Frozen encoders plus a Gaussian rule rival trained AI-image detectors

An AI-image detector usually has two parts: an image encoder, which turns a picture into a long list of numbers describing it, and a decision layer trained to read those numbers as real or generated. Such detectors often break when the generator, prompt style or image source changes. In a paper accepted at ECCV 2026, Sakana AI researchers ask which part is responsible: the encoder, the trained decision layer, or the images it was trained on.

Their test replaces the trained decision layer with a formula. They keep the encoder frozen, pass labeled real and generated images through it, and record each group's average and how its features vary together. A new image is assigned to whichever group it sits closer to, with distance measured in a way that accounts for that spread. Nothing is trained iteratively. The paper tries four versions of the rule, from one that ignores how features vary together to one that models each group separately. The version that assumes both groups vary in the same way won most often.

The test suite, called Percept-Lens, combines 39 public datasets with 7.1 million images in which generator, prompt style and image source shift at once. Accuracy is balanced between real and generated images and averaged across datasets. When the rule used each released detector's own encoder and training data, it beat the trained decision layer for most of them, but not for the strongest, CF-384, which stayed ahead 87.54% to 84.55%. The figure behind Sakana's announcement, 94.46%, comes from fitting the rule on a different general-purpose encoder, PE-Core-bigG, that was never trained for detection, using the same CommunityForensics training data as CF-384. So the headline win mixes a better encoder with the simpler rule.

The paper's own conclusion is narrower than "simple beats trained." It calls the rule a diagnostic baseline that detector papers should beat on the same encoder and data before crediting their trained layer, and says trained layers can legitimately win on heavily post-processed images or generator-specific artifacts. Training data mattered more than the rule: with the same encoder, accuracy ranged from 77.92% to 94.46% depending on which dataset supplied the labeled examples. The rule also needed little data, reaching 90.89% from 219 labeled images.