PURE: Purging Unrelated Representations for Content-Agnostic Forgery Detection

1 Introduction

The democratization of generative models, spanning from GANs to diffusion models [Karras et al., 2019; Ho et al., 2020; Rombach et al., 2022; Nichol et al., 2021], enables unprecedented high-quality image synthesis. This newfound freedom in image generation, however, raises urgent concerns about misinformation and trust in visual media. While AIgenerated image (AIGI) detectors achieve impressive performance on in-domain benchmarks, real-world deployments reveal a critical vulnerability: spurious correlations in training data systematically undermine generalization under distribution shift.

Recent efforts to improve AIGI detector generalization can be broadly organized by the types of features they exploit [Wu et al., 2025a], ranging from RGB and frequency cues to noise residuals and high-level semantic representations. RGB-based methods [Yan et al., 2025; Liu et al.,

2024b; Miao et al., 2025] directly leverage spatial and color information from raw pixel channels, excelling at detecting boundary inconsistencies and occlusion mismatches through shallow convolutional networks. However, they struggle to capture subtle manipulation signals when forgery artifacts are imperceptible in the spatial domain. Frequencybased approaches [Guo et al., 2023; Liu et al., 2024c; Wu et al., 2025b] transform images into spectral representations via DCT or Fourier transforms to identify periodic structures and compression artifacts. While effective at detecting high-frequency anomalies invisible to RGB analysis, these methods remain sensitive to preprocessing operations and may not generalize when frequency signatures vary across generators. Noiseprint-driven methods [Guillaro et al., 2023; Guo et al., 2024a] extract residual patterns through high-pass filtering to reveal device-specific traces and manipulationrelated statistical inconsistencies. Despite their sensitivity to subtle perturbations, noiseprint features can be disrupted by post-processing operations that alter the underlying noise characteristics. Representation learning methods [Ojha et al., 2023; Liu et al., 2024a; Wu et al., 2025b] employ visionlanguage models or deep networks to learn semantic abstractions, particularly valuable for cross-domain robustness. However, when semantic content correlates spuriously with authenticity labels during training, such approaches may inadvertently amplify content bias rather than mitigate it.

Despite progress across these feature paradigms, existing detectors exhibit substantial accuracy drops when distributions shift between training and testing [Lin et al., 2024; Kashiani et al., 2025]. This suggests a fundamental challenge remains unresolved: spurious correlations between semantic content and authenticity labels [Trinh and Liu, 2021; Fu et al., 2025; Bai et al., 2025]. We observe that this generalization failure stems from content bias. Detectors erroneously couple forgery artifacts with semantic attributes (e.g., object categories, demographic features) during training, learning spurious content-label associations instead of generalizable forgery patterns. Consider a scenario where 80% of dogs are AI-generated while 80% of cats are real. The detector learns to associate "dog" with "fake" rather than genuine artifacts. When the spurious content-label association learned during training is reversed in the test distribution, performance collapses dramatically.

Figure 1 provides empirical evidence. We train state-ofthe-art detectors on CIFAKE and GenImage with deliberately constructed spurious correlations. Although both baseline (Effort [Yan et al., 2025]) and our method achieve high validation accuracy (97 to 99%), the baseline's test accuracy falls to 87% on CIFAKE and 65% on GenImage when spurious correlations reverse, resulting in a 12 to 34% drop. This validation-test gap reveals that models memorize contentlabel associations rather than learning forgery patterns. Our method maintains stable performance, demonstrating genuine content-agnostic detection.

To address this issue, we propose PURE (Purging Unrelated Representations for Content-Agnostic Forgery Detection), which achieves content-agnostic detection through two synergistic components: a Causal Semantic Generative (CSG) mechanism that disentangles semantic representations from forgery-irrelevant nuisance factors, and a Gaussian Mixture Model (GMM)-based prototype alignment module that normalizes category-specific feature distributions to suppress content priors. PURE explicitly models causal relationships between content and forgery cues, introducing fairness-aware prototype balancing and gradient bridging to enable end-toend joint optimization.

Specifically, CSG disentangles CLIP features into semantic factors (encoding content and forgery cues) and nuisance factors (capturing forgery-irrelevant style variations) via variational inference. GMM alignment then projects semantic factors onto content-normalized representations by modeling each category with Gaussian prototypes, forcing classifiers to focus on prototype-level forgery artifacts rather than content shortcuts.

Our contributions are summarized as follows:

• We propose PURE, a novel content-agnostic AIGI detection framework designed to acquire forgery-invariant knowledge under distribution shift, where target content distributions are inaccessible during training. It explicitly eliminates content bias through causal disentanglement and prototype-based normalization.
• The framework comprises two synergistic components: a CSG mechanism that isolates semantic from nuisance
• factors via variational inference, and a GMM alignment module with fairness-aware prototype balancing.
• Empirically, we conduct rigorous spurious correlation reversal experiments on CIFAKE, GenImage, and AlFace to assess generalization under deliberately constructed distribution shifts. PURE consistently outperforms state-of-the-art baseline approaches.

2 RelatedWork

ForgeryDetection. Existing image forgery detectionmethods can be primarily categorized based on feature-driven strategies [Wu et al., 2025a], including RGB-based methods [Miao et al., 2025; Liu et al., 2024b], frequency-based methods [Zhu et al., 2025; Guo et al., 2023], noise-texture methods [Guillaro et al., 2023; Guo et al., 2024b], and representation learning methods [Yu et al., 2024; He et al., 2026]. These methods leverage various feature extraction strategies ranging from low-level pixel statistics to high-level semantic abstractions to capture diverse manipulation cues. While these methods achieve strong performance in in-domain or same-distribution evaluation settings [Lin et al., 2024; Yan et al., 2025], they still suffer from significant performance degradation in cross-domain scenarios involving different manipulation types, generative models, or data distributions.

Generalization in Forgery Detection. Studies [Lin et al., 2024] indicate that the above generalization degradation largely stems from spurious correlations, which refer to statistical biases between authenticity labels and semantic content (e.g., demographic attributes such as race and gender) in the training distribution, causing detectors to rely on content priors rather than genuine forgery artifacts at test time. To address this generalization challenge, D3 [Yang et al., 2025] uncovers universal forgery artifacts through multi-generator joint training and discrepancy signal learning. Furthermore, Effort [Yan et al., 2025] employs SVD to orthogonally disentangle semantic and forgery features, while UCF [Yan et al., 2023] proposes a three-level disentanglement framework to extract universal forgery features. Meanwhile, vision foundation model approaches attempt to improve generalization by leveraging large-scale pre-trained knowledge, such as UniFD's [Ojha et al., 2023] zero-shot detection strategy and FatFormer's [Liu et al., 2024a] adaptive feature fusion mechanism. However, most of these methods fail to explicitly model and eliminate the spurious correlations introduced by content bias, leading to significant performance drops when content distributions shift at test time. Systematically eliminating content bias and achieving content-agnostic robust detection is the central focus of this paper.

3 Preliminary

Notations. Let X ⊆ Rd denote a feature space, Y = {0, 1} the binary label space, and C = {1, . . . ,C} the content attribute space. We use random variables X, Y , and C to denote features, labels, and content attributes taking values in X, Y, and C, respectively, and use x, y, and c to denote their realizations. Given a dataset D = {(xi, yi, ci)}Ni=1 sampled i.i.d. from a joint distribution P(X, Y, C), the goal is to learn a classifier fθ : X → Y parameterized by θ that accurately predicts authenticity labels.

Given training data Dtr = {(xi, yi, ci)}Ntr i=1 sampled from distribution Ptr(X, Y,C), standard empirical risk minimization (ERM) solves

where L : Y × Y → R+ denotes a classification loss. Under the i.i.d. assumption Ptr = Pte, the learned classifier generalizes to test data.

Spurious Correlation Shift. We consider a challenging scenario where training and test distributions exhibit different correlations between content and labels:

This correlation shift preserves the underlying data generation mechanism but alters the statistical association between content attributes and labels. Classifiers trained via Eq. (1) exploit spurious shortcuts X → C → Y , learning to associate content with labels rather than genuine discriminative patterns, leading to severe degradation under distribution shift.

4 Method

To address the challenge of spurious correlations, we propose PURE (Purging Unrelated Representations), which achieves content-agnostic detection through three complementary components: (1) CLIP-based feature extraction that encodes both semantic content and forgery patterns, (2) Causal Semantic Generative (CSG) disentanglement that separates semantic factors from nuisance variations, and (3) GMM-based prototype alignment that normalizes categoryspecific distributions to suppress content priors.

4.1 CLIP Feature Extraction

We employ a pre-trained CLIP as the feature extraction backbone, leveraging its rich semantic priors from largescale vision-language pretraining. Given an image X, CLIP

produces a 768-dimensional feature embedding x that encodes both content semantics and visual patterns potentially associated with generative artifacts. To adapt CLIP features for forgery detection, we introduce contrastive finetuning with authenticity-aware descriptions. Specifically, we use BLIP [Li et al., 2022] to generate a content description for each image, then construct prompts in the form "a {real/fake} photo of {caption}" (e.g., "A fake photo of a blue bird perched on a branch with a blurred background"). The CLIP text encoder maps each prompt to a text embedding ti. We then optimize a symmetric bidirectional contrastive loss:

where Li2t and Lt2i denote InfoNCE losses [Radford et al., 2021] for image-to-text and text-to-image alignment, respectively. This mechanism encourages CLIP to not only preserve its semantic understanding but also to learn to associate visual patterns with authenticity labels, providing a foundation for subsequent disentanglement, where forgery-related patterns in x will be isolated from content biases.

4.2 Disentanglement Learning

Causal ForgeryGenerationModel. Following causal reasoning principles [Liu et al., 2021], we posit that CLIP features x arise from two independent generative factors. Let s ∈ Rds denote the semantic factor encoding both content semantics and forgery artifacts, and v ∈ Rdv denote the nuisance factor capturing forgery-irrelevant style variations (e.g., lighting, background, artistic style). The generative process factorizes as:

This causal structure enforces that: (1) authenticity y is determined solely by the semantic factor s, implying v ⊥ y; and (2) nuisance variations v influence the observed representation only through p(x | s, v), without directly affecting authenticity judgments. Crucially, while CSG assumes that s directly causes y, in our setting s may still entangle content semantics with forgery cues. The subsequent prototype alignment module is designed to resolve this residual entanglement.

Variational Inference. To learn this disentangled representation, we employ variational inference with two encoders Es and Ev, which predict the parameters of Gaussian distributions for the variational posteriors q(s | x) and q(v | x), respectively. The training objective maximizes the Evidence Lower Bound (ELBO):

where the first term enforces reconstruction fidelity through a decoder D, yielding ˆx = D(s, v), and the KL terms regularize the variational posteriors toward standard Gaussian priors, with β = 0.1 controlling the strength of regularization.

4.3 GMM-based Prototype Alignment

Prototype Modeling. For each content category c ∈ {1, . . . ,C}, we model the distribution of semantic features using a Gaussian Mixture Model (GMM) with K prototypes {µkc ,Σkc }Kk=1 and mixture weights {πk c }Kk=1 . Given the semantic representation sci of the i-th sample from category c, its soft assignment to the k-th prototype is computed via the E-step:

The aligned representation is obtained by projecting sci onto prototype centers weighted by responsibilities:

This projection removes instance-specific variations within each category, forcing the downstream classifier to rely on prototype-level, category-normalized forgery cues.

Fairness-aware Prototype Balancing. Standard EM updates for mixture weights use πk c ∝ N k c , where N k c = ∑i γ c i,k counts the effective samples assigned to prototype k in category c. However, this can result in an imbalanced prototype usage across categories: certain prototypes may become preferentially associated with specific content categories, allowing prototype identities to encode content priors.

To prevent this, we apply a fairness-aware M-step that encourages balanced prototype usage [Li et al., 2024; Zhao et al., 2024]. Let ¯ γ k c = 1 Nc ∑i∈Dc γ c i,k denote the average responsibility of prototype k in category c, and ¯ γ k = 1C ∑Cc=1 ¯ γ k c the global average. We modify the mixture weight update as:

and Nc = |Dc|. This adaptive regularization penalizes prototypes that are over-represented in a category (¯ γ k c > ¯ γ k ) by effectively reducing their mixture weight, while encouraging under-represented prototypes. The strength λfair > 0 controls the degree of balancing. Weights are renormalized to ensure ∑Kk=1 πk c = 1.

Joint Training via Gradient Bridging. GMM parameters are estimated via the non-differentiable EM algorithm, which prevents direct backpropagation. Prior work addresses this through staged training, decoupling feature learning from debiasing. We instead enable joint optimization via gradient bridging.

Let ¯sci denote sci with gradients detached. The classifier input is:

During forward pass, sci - ¯sci = 0, so the classifier operates on aligned features ˜sci . During backpropagation, gradients bypass the non-differentiable GMM: ∂Lcls ∂sci = ∂Lcls ∂sccls , allowing the encoder to adapt to the debiasing objective.

Classification Objective. Aligned features are classified via a two-layer MLP:

Stable Estimation via Memory Bank. To stabilize GMM fitting under mini-batch training, we maintain a memory bank storing recent features per category. Current batch features are merged with historical samples before EM, ensuring reliable parameter estimation.

4.4 Overall Training Objective

The complete training objective integrates contrastive feature learning, variational disentanglement, and classification:

where LCLIP (Eq. 3) is the image-text contrastive loss, Ldis (Eq. 5) is the disentanglement loss, and Lcls (Eq. 10) is the classification loss on aligned representations. We set w1 = 0.01, w2 = 1.0. Training alternates between updating GMM parameters via fairness-aware EM (Eq. 6) and backpropagating through Ltotal to optimize neural networks. The gradient bridging mechanism (Eq. 9) enables joint optimization despite the non-differentiable GMM module.

5 Theoretical Analysis

We study generalization under spurious correlation reversal, where the association between content categories and authenticity labels change from training to testing, while forgery patterns remain invariant.

Setup. Let Ptr and Pte be the training and test distributions over (X, Y, C).

Assumption 1 (Spurious Correlation Shift). The following conditions hold:

Assumption 1 captures spurious correlation reversal: the conditional association P(y | c) shifts across domains, while within-category forgery patterns and marginal distributions remain unchanged. Under (iii) and (iv), this is equivalent to a reversal of the category distribution within each label, i.e., Ptr(c | y) ̸= Pte(c | y).

Disentanglement quality. We require the learned semantic representation s to be approximately independent of the content category given the label:

where TV(·, ·) denotes the total variation distance between two distributions, defined as TV(P,Q) = 12 ∫ |p(z) - q(z)| dz. This condition ensures that, conditioned on y, the content category c provides negligible additional information about s.

Theorem 1 (Generalization under Correlation Reversal). Let ℓ(g, Y ) = |g - Y | and define ∆y(c) = Pte(y = 1 | c) - Ptr(y = 1 | c). For any classifier f : Rds → [0, 1] and predictor g(X) = f(s(X)), under Assumption 1 and (12),

Proof sketch. By the law of total expectation and Assumption 1(iii), the train-test error difference can be decomposed as a weighted sum over content categories. Under Assumption 1(ii), the conditional expectations of the predictor given (y, c) are identical across training and test domains, so the difference arises solely from the shift in P(y | c). Moreover, Assumption 1(iv) ensures that the label marginals cancel out globally. The remaining term depends on how much the predictor varies with c within each label. Condition (12) bounds this variation uniformly by ε for any bounded predictor, which yields the bound in (13).

Interpretation. The generalization gap is controlled by two factors: (i) the disentanglement quality ε, measuring deviation from s ⊥ c | y; and (ii) the magnitude of spurious correlation shift maxc |∆y(c)|. Even under complete category reversal within each label, the error gap remains small provided ε is small.

Connection to PURE. Theorem1 indicates that robustness follows from minimizing ε. Our method achieves this via CSG disentanglement, which separates forgery-relevant semantics from nuisance factors, and GMM prototype alignment, which further suppresses category-specific variations. If the aligned representation ˜s satisfies TV(P(˜s | y, c), P(˜s | y)) ≤ ˜ ε, the bound tightens to 2˜ ε · maxc |∆y(c)|.

6 Experiments

6.1 Settings

Datasets. We utilize four real-world benchmarks to verify the effectiveness of PURE. (1) CIFAKE [Bird and Lotfi, 2024] is a CIFAR-10-style dataset containing 5,000 real and 5,000 GAN-generated images across 10 semantic categories. The fake images are generated using a single GAN model to create controlled artifacts. (2) GenImage [Zhu et al., 2023] consists of 8,000 GLIDE-generated images spanning 29 object categories. This dataset evaluates detection performance on state-of-the-art diffusion models. (3) DFD and (4) DFDC are facial image subsets from the AIFace benchmark [Lin et al., 2025], totaling 6,200 images annotated with the Monk Skin Tone Scale (10 levels). These datasets enable evaluation of demographic fairness under spurious correlations between skin tone and authenticity labels. To rigorously evaluate robustness against spurious correlations, we design train-test splits where class labels (real/fake) are intentionally correlated with content or demographic attributes during training, but this correlation is fully reversed at test time. This challenging protocol examines whether models rely on spurious shortcuts or genuinely learn forgery-discriminative patterns. Due to space limitations, we defer detailed dataset descriptions and split configurations to Appendix.

Baselines. We compare PURE with ten representative methods that address generalizable forgery detection from four perspectives: (1) frequency and noise-based methods attempt to capture generation artifacts in the frequency domain, including SRM [Luo et al., 2021] that leverages highfrequency features via spatial rich model filters, LGrad [Tan et al., 2023] that learns on gradient representations, and NPR [Tan et al., 2024] that exploits up-sampling artifacts; (2) representation learning methods leverage pre-trained features for better generalization, including UniFD [Ojha et al., 2023] that employs CLIP features for zero-shot detection, RINE [Koutlis and Papadopoulos, 2024] that utilizes intermediate encoder-block representations, and FatFormer [Liu et al., 2024a] that proposes forgery-aware adaptive transformers; (3) disentanglement-based methods aim to separate forgery-relevant features from content, including UCF [Yan et al., 2023] that extracts universal forgery features via threelevel disentanglement and Effort [Yan et al., 2025] that employs SVD to orthogonally separate semantic and forgery features; and (4) fairness and generalization methods explicitly address distribution shift and bias, including PFG [Lin et al., 2024] that preserves fairness under domain shift and D3 [Yang et al., 2025] that learns from cross-generator discrepancy. For all baselines, we use official implementations and evaluate under our spurious correlation protocol with identical train-test splits.

Implementation. We use CLIP (ViT-Large/14) [Radford et al., 2021] as the feature extraction backbone in PURE, leveraging its rich semantic priors from large-scale visionlanguage pretraining. Image descriptions are generated using BLIP (Salesforce/blip-image-captioning-base) [Li et al., 2022] for contrastive fine-tuning. The CSG encoder disentangles CLIP features into semantic representation s ∈ R128 and nuisance representation v ∈ R32 , and a transposedconvolutional decoder reconstructs the original image from concatenated (s, v). To ensure fair comparison across different datasets, images are resized to 224 × 224 with standard data augmentations. The results represent the average values obtained from 5 runs for all compared methods.

6.2 Results

Performance Comparison. Table 1 shows the overall performance of our method, PURE, compared with baselines across four real-world datasets. PURE consistently outperforms all baselines, achieving 94.53% accuracy and 0.947 F1 score on average and surpassing the runner-up FatFormer by 3.55% and 3.9, respectively. On CIFAKE and GenImage, PURE achieves gains over the runner-up FatFormer by 2.6% and 2.0% in accuracy, and 0.04 and 0.01 in F1 score, respectively.

CIFAKE's challenging dog-to-cat content shift validates that prototype alignment effectively decouples forgery features from category-specific patterns. The near-perfect GenImage performance demonstrates robust generalization on diffusiongenerated content. On DFD and DFDC, PURE outperforms the runner-up D3 by 2.0% and 3.4% in accuracy, and 0.02 and 0.04 in F1 score. These benchmarks evaluate robustness to demographic bias under reversed skin-tone correlations. The substantial improvement on DFDC underscores the effectiveness of fairness-aware prototype balancing on challenging facial datasets with complex human-attribute biases.

Effectiveness of PURE for Content-Agnostic Detection. To understand how PURE achieves content-agnostic detection, we apply occlusion sensitivity analysis (OSA) [Zeiler and Fergus, 2014] to visualize what regions the model relies on for forgery detection. OSA systematically occludes each image patch and measures the resulting change in prediction confidence. Patches whose occlusion causes large confidence drops indicate high model sensitivity (the model relies heavily on these regions), while patches causing minimal changes indicate low sensitivity. These sensitivity scores are then mapped to a color spectrum: red for high sensitivity and blue for low sensitivity. In the context of forgery detection, red regions concentrated on semantic content (e.g., faces, objects) indicate that the model is making decisions based on content cues rather than forgery artifacts, which leads to poor generalization under spurious correlation shifts. Figure 3 compares our method against runner-up baselines (D3 and FatFormer) and ablation variants of PURE (w/o GMM, w/o CSG, w/o CLIP). We observe that the baselines exhibit dense red regions concentrated on semantic areas (faces and objects), indicating strong reliance on content cues rather than forgery artifacts. In contrast, our full model presents uniformly light blue heatmaps with no red regions, demonstrating that it does not rely on any specific semantic content for prediction and instead captures forgery-relevant features distributed across the entire image. Critically, all ablation variants (w/o GMM, w/o CSG, w/o CLIP) revert to content-biased patterns with concentrated red regions similar to baselines, demonstrating that only the joint use of CSG-based semantic disentanglement and GMM prototype alignment on top of the CLIP backbone can effectively suppress content-related cues and enable content-agnostic forgery detection.

Ablation Studies. We conduct systematic ablations to quantify the contribution of each component in PURE. As shown in Figure 4, removing the GMM module (w/o GMM) leads to clear performance drops across all datasets, indicating that even after CSG-based disentanglement, forgeryrelated features still retain some entanglement with spurious content patterns. Without GMM's prototype-based alignment to normalize these residual category-specific variations, classifiers can still exploit spurious content-label correlations. Removing CSG (w/o CSG) also causes substantial performance degradation, highlighting that disentanglement is a critical prerequisite for effective alignment. When CLIP

features remain entangled with semantic and style factors, GMM alignment becomes less effective because prototypes are constructed from contaminated representations that conflate content and forgery information. The complementary nature of both components is evident: removing either CSG or GMM causes substantial performance degradation, confirming their synergistic roles where CSG isolates forgeryrelevant factors from semantic content and GMM normalizes residual category-specific patterns across different forgery types. Removing the CLIP encoder (w/o CLIP) results in catastrophic performance drops across all datasets, far exceeding the degradation caused by removing any individual component. This underscores that CLIP's vision-language pretraining serves as the foundational backbone of our framework, providing the semantic understanding necessary for both CSG disentanglement and GMM alignment to function effectively.

Quality of Generated Image Descriptions. We further analyze the impact of image description quality on model performance by replacing BLIP-generated detailed descriptions with simplified ones. Figure 5 compares the full model (PURE) using detailed descriptions against two variants using simplified descriptions: one that retains CSG (w/o detailed description) and one that removes CSG (w/o detailed description + CSG). Overall, using simplified descriptions consistently degrades performance across all datasets compared to the full model with detailed descriptions. This degradation occurs because simplified descriptions lack the semantic richness necessary to guide CLIP in extracting comprehensive content representations-without detailed contextual information about environment, lighting, and fine-grained object attributes, CLIP produces semantically impoverished feature representations that fail to provide a sufficient basis for effective content-forgery disentanglement. This impact is particularly pronounced on complex datasets: on DFDC, the full model achieves 90.81% F1 score, whereas using simplified descriptions reduces performance to 83.98%. Beyond this overall trend, we observe that under detailed descriptions, CSG consistently improves performance across all datasets, demonstrating its robust effectiveness when provided with sufficient semantic information. In contrast, under simplified descriptions, CSG exhibits clear dataset-dependent behavior. On GenImage and DFD, retaining CSG maintains competitive performance (e.g., 93.70% F1 on DFD), while removing it causes further degradation (e.g., to 92.43%), indicating that CSG can still extract meaningful disentanglement even with limited semantic signals. However, on datasets where forgery traces are highly entangled with semantic factors, such as CIFAKE and DFDC, retaining CSG under simplified descriptions actually degrades performance (e.g., 83.98% F1 on DFDC versus 88.75% without CSG). This suggests that when CSG actively disentangles semantic factors but the semantic representations themselves are incomplete, the disentanglement process may inadvertently affect forgery-relevant features that are entangled with the incomplete semantic information.

Effectiveness of the GMMComponent (K). We evaluate the sensitivity of PURE to the number of GMM prototypes K ∈ {2, 3, 4, 5, 6} across four datasets, with results shown in Figure 6. Consistent trends are observed over two metrics. Performance peaks at K = 3 or K = 5: smaller K lacks the capacity to model intra-category content diversity, while larger K risks overfitting and capturing instance-level variations.

7 Conclusion

In this paper, we introduce a novel framework, PURE, for content-agnostic AI-generated image detection under distribution shift. The framework is designed to explicitly mitigate spurious correlations, particularly content bias, which arises when detectors couple forgery artifacts with semantic content instead of learning generalizable forgery patterns. PURE integrates a Causal Semantic Generative (CSG) mechanism and a Gaussian Mixture Model (GMM)-based prototype alignment module to achieve robust detection across content distribution shifts. The CSG mechanism disentangles semantic representations encoding forgery-relevant information from nuisance variations capturing forgery-irrelevant style. The GMM-based prototype alignment further normalizes category-specific feature distributions, suppressing content priors and enabling invariant forgery representation learning. Extensive experiments demonstrate that PURE consistently outperforms baseline methods under spurious correlation reversal settings.

Acknowledgments

This work is supported by the National Science Foundation (NSF) # 2515265. Minglai Shao did not receive any financial support for this work and contributed only by developing the research ideas, participating in discussions, and providing feedback on the manuscript.