---
pipeline_tag: image-classification
library_name: repostguard-lite
license: cc-by-nc-sa-4.0
base_model:
  - laion/CLIP-ViT-B-32-laion2B-s34B-b79K
datasets:
  - OwensLab/CommunityForensics-Small
tags:
  - aigc-detection
  - ai-generated-image-detection
  - image-forensics
  - quality-aware-gating
  - robustness
  - pytorch
  - openclip
---

# RepostGuard-Lite M3 — Community Forensics train-v3

M3 is a binary AI-generated image (AIGI) detector trained for robustness to common reposting and editing transformations. It extends M2 with a six-dimensional quality-conditioned two-branch gate over the frozen OpenCLIP semantic branch and the DCT/SRM/NPR-inspired forensic branch.

This repository provides a self-contained inference release. The full frozen OpenCLIP visual state is included, so inference does not download the base model and does not require retraining.

## Release artifacts

| File | Purpose |
|---|---|
| `model.safetensors` | Preferred full FP32 inference state dict |
| `resolved_config.yaml` | Frozen model, preprocessing, training, and evaluation configuration |
| `thresholds.json` | Frozen internal-validation operating threshold and score semantics |
| `preprocessor_config.json` | Portable input/preprocessing contract |
| `inference_example.py` | Minimal single-image safetensors inference example |
| `requirements.txt` | Additional Hub-side inference dependencies |
| `SHA256SUMS.txt` | SHA-256 for every published artifact except itself |

The trusted source checkpoint used for the lossless safetensors conversion had SHA-256 `c83f70641a9c8d7f6808e794cfc8c28c0e478feeca7506e489c772a512115b2f`. Optimizer and recovery state are intentionally not published because they are unnecessary for frozen-weight inference.

## Architecture and parameters

- Frozen semantic branch: OpenCLIP `ViT-B-32`, pretrained tag `laion2b_s34b_b79k`.
- Forensic inputs: RGB patches, DCT bands, 30-channel SRM responses, and 3-channel NPR residuals.
- Forensic encoder: trainable ResNet-18-style encoder with attention pooling.
- Fusion: projected 256-dimensional semantic and forensic representations.
- Quality gate: `LayerNorm(6) → Linear(6,32) → GELU → Linear(32,2) → Softmax`.
- Total parameters: **99,423,744**.
- Trainable parameters: **11,574,528**.
- Frozen parameters: **87,849,216**.
- Input: 224×224 RGB.
- Output: one AIGI logit; sigmoid converts it to a ranking score.

M3 adds only 302 parameters over M2. On train-v3, same-checkpoint fixed/shuffled-gate ablations show that the per-sample gate has little aggregate advantage; this does not establish that gating is universally ineffective under all data scales.

## Evaluation

The principal external result uses a frozen 4,000-image expanded strict-unseen-generator set and 21 conditions (clean plus 20 transformed conditions). The test manifest and robustness matrix are identical to those used for the M2 release.

| Metric | Value |
|---|---:|
| Clean AUROC | 0.9305328 |
| Clean balanced accuracy | 0.85350 |
| Non-clean mean AUROC | 0.9153811 |
| Non-clean mean balanced accuracy | 0.83810 |
| Worst AUROC | 0.8489407 |
| Worst condition | six-stage random reposting profile |

The frozen decision threshold is `0.9970703125`, selected only on the internal validation split. The sigmoid score is not a calibrated deployment-domain probability. Recalibrate on a target deployment domain rather than defaulting to 0.5.

## Installation and loading

Use the repository code revision verified against this release:

```bash
python -m pip install "git+https://github.com/lsy640/TikTok_project_5.git@869b0a950fbd54defc5ab389be322b79556f2975"
python -m pip install "safetensors>=0.4,<1" "huggingface-hub>=1,<2"
```

Download the immutable `v1.0.0` release and load the preferred safetensors file:

```python
from pathlib import Path
import torch
from huggingface_hub import snapshot_download
from safetensors.torch import load_file
from repostguard.config import load_config
from repostguard.models import build_model

root = Path(snapshot_download(
    repo_id="LLL640/RepostGuard-Lite-M3-train-v3",
    revision="v1.0.0",
))
config = load_config(root / "resolved_config.yaml")
model = build_model(config, load_pretrained=False)
model.load_state_dict(load_file(root / "model.safetensors"), strict=True)
model.eval()
```

For single-image inference with the safe tensor release, run:

```bash
python inference_example.py /path/to/image.jpg --device cpu
```

`model.safetensors` is non-pickle tensor storage and is the only model-weight artifact published in this repository.

## Reproducibility boundary

- `inference_code_revision`: `869b0a950fbd54defc5ab389be322b79556f2975` (strict loading and finite forward pass verified).
- `training_code_revision`: not recorded in the original run card. Do not treat the inference revision as proven byte-identical training code.
- Training manifest SHA-256: `fc0a7ab732faeb604ed1e77281fada715d7cffb353974a4985820548d871d9d6`.
- Internal validation manifest SHA-256: `11bfa4b6d7c538ce0a3d774c3f2902ac11ffc7dbe513de354f87fbaad1d6b6ba`.
- Expanded strict-unseen 4k manifest SHA-256: `59ca2e4ca966dac9fa4fb55281153f93e5becdd3e25da83bc2dff3fad36126cd`.
- Robustness matrix SHA-256: `69531f3f7111651808c99f14f89723bf631345878b1cbd0cbe0eee8531dde83c`.

The release enables frozen-weight inference without retraining. Exact from-scratch training reproducibility additionally requires the original data revisions and the unrecorded training-time source state.

## Limitations and intended use

- Intended for research and evaluation of AIGI detection under reposting transformations.
- Not a calibrated authenticity probability, legal determination, copyright judgment, or sole moderation signal.
- The principal strict-unseen test contains a limited set of generator and real-image sources and cannot represent all future models or domains.
- M2/M3 have known blind spots on Hourglass, DFGAN, and GALIP diagnostic slices.
- Current core results are from a single training seed.
- Low-FPR deployment performance and target-platform calibration require further work.
- Evaluate distribution shift, false-positive cost, and subgroup behavior before deployment.

## License and attribution

Model weights are released under CC BY-NC-SA 4.0 to preserve the recorded upstream Community Forensics non-commercial ShareAlike constraints. Source code is MIT. OpenCLIP base weights and all datasets remain subject to their own licenses and terms; see `LICENSE.md`.

Project repository: https://github.com/lsy640/TikTok_project_5