Adversarial AI-Generated Image Detection

# Illustrative sketch (not from the paper)
import torch
from torch import nn

# Placeholder for the reasoning defender (Qwen3.5-9B) and attacker (Qwen-Image-Edit-2511)
class Defender(nn.Module):
    def forward(self, img):
        # returns verdict (0/1) and explanation embedding
        return torch.sigmoid(torch.randn(1)), torch.randn(512)

class Attacker(nn.Module):
    def forward(self, img, instruction):
        # returns edited image
        return img + 0.01 * torch.randn_like(img)

def lora_tune(model):
    # stub for LoRA‑tuning step
    pass

def reward(verdict, target):
    # 0/1 fooling reward used for attacker
    return (verdict != target).float()

# Initialize models
D = Defender()
A = Attacker()
lora_tune(D)
lora_tune(A)

# Simple adversarial training loop (illustrative)
for step in range(5):
    real_img = torch.randn(3, 224, 224)               # real source image
    instr = "make the image look AI‑generated"
    edited = A(real_img, instr)                       # attacker edits image
    verdict, _ = D(edited)                            # defender predicts
    # Attacker is gated by instruction scorer (PaCo) – omitted for brevity
    r = reward(verdict, torch.tensor(0.0))            # target: should be classified as real
    # Update attacker to maximize reward (gradient ascent)
    r.backward()
    # Update defender with verdict‑only loss (cross‑entropy)
    loss = nn.BCELoss()(verdict, torch.tensor(1.0))   # target: detect edited as fake
    loss.backward()
    # Optimizer steps would go here (omitted)

// Illustrative sketch (not from the paper)
const torch = require('torch-js'); // placeholder import

// Stub classes for defender and attacker
class Defender {
  forward(img) {
    // returns verdict (0/1) and explanation embedding
    return { verdict: torch.sigmoid(torch.randn([1])), explanation: torch.randn([512]) };
  }
}

class Attacker {
  forward(img, instruction) {
    // returns edited image
    return img.add(torch.randnLike(img).mul(0.01));
  }
}

function loraTune(model) {
  // placeholder for LoRA‑tuning
}

function reward(verdict, target) {
  // 0/1 fooling reward
  return verdict.notEqual(target).toFloat();
}

// Initialize models
const D = new Defender();
const A = new Attacker();
loraTune(D);
loraTune(A);

// Simple adversarial training loop (illustrative)
for (let step = 0; step < 5; step++) {
  const realImg = torch.randn([3, 224, 224]); // real source image
  const instr = "make the image look AI-generated";
  const edited = A.forward(realImg, instr); // attacker edits image
  const { verdict } = D.forward(edited);    // defender predicts
  // Attacker gated by instruction scorer (PaCo) – omitted
  const r = reward(verdict, torch.tensor(0)); // target: should be classified as real
  // Update attacker to maximize reward (gradient ascent) – placeholder
  // Update defender with verdict‑only loss (binary cross‑entropy) – placeholder
}