RAID image 2025: adversarial images cut Hive to 0.44 and Sightengine to 0.00 (accuracy)

The record enters the studies index as the first image record built on adversarial perturbations rather than natural edits. The version read is v4 of 29 October 2026, an arXiv preprint without a stated venue (arXiv 2506.03988, read 9 November 2026).

Seven open research detectors form the attack ensemble, nine more are evaluated on the finished dataset, and two commercial APIs are tested in Appendix D (arXiv 2506.03988, Sections 3.2 and 4.1, read 9 November 2026). Only the two commercial detectors have a card; Hive's card already carries an image result from Ha and Passananti 2024.

Detectors as named in v4; the commercial APIs are identified by URL only (arXiv 2506.03988, read 9 November 2026).

The source images are 4,800 real photographs from LAION-400M and 19,200 AI images, one per real image from each of Stable Diffusion 1.4, Stable Diffusion 2.1, Stable Diffusion XL and DeepFloyd IF, each re-encoded to match the format and compression of its real counterpart (arXiv 2506.03988, Sections 3.1 and 3.3, read 9 November 2026). All images are centre-cropped to 256 by 256 pixels.

Counts as printed (arXiv 2506.03988, Sections 3.3 and 4.1, Appendix D, read 9 November 2026).

The attack is untargeted projected gradient descent for 10 iterations against the ensemble's average loss, at budgets of 8/255, 16/255 and 32/255, with the detector under test left out of the ensemble so every result is a black-box transfer (Sections 2 and 4.1). The metrics are AUROC and attack success rate, the relative AUROC drop from clean images; accuracy is reported only for clean images, because thresholds "are not calibrated for our data", and for the commercial APIs at a 0.5 score threshold (Section 4.1 and Appendix D).

Every figure below is printed in Tables 2, 4, 5, 7, 8, C.10 and D.13 of v4 (arXiv 2506.03988, read 9 November 2026).

Values as printed; Table D.13 prints "Score (Real)" as 0.99 for both APIs beside an accuracy of 1.00 on real images, which this record carries as printed (arXiv 2506.03988, Table D.13, read 9 November 2026).

The commercial result is small but direct: on 50 AI images, Sightengine's mean AI score fell from 0.65 to 0.01 after the RAID perturbation and Hive's from 0.59 to 0.45, while both scored all 50 real images correctly (Table D.13). The paper's Figure 1 shows a Sightengine verdict moving from "Fake with 70% confidence" to "Real with 91% confidence" after noise computed on the Corvi detector (arXiv 2506.03988, Figure 1, read 9 November 2026).

The research detectors fare no better. The seven-model ensemble dropped the CNN-based Co23 and W20 from AUROC 0.99 to 0.13 and 0.26 at 16/255, the patch-based Cavia detector was the most resistant held-out model at ASR 54.7%, and of five released detectors never seen by the attack, OmniAID and DDA lost most, from AUROC 0.78 and 0.93 to 0.15 and 0.34 (Tables 4 and 8). A Gaussian-noise control of the same size reached an ASR of at most 15.9% (Section 6).

The text and image question, added 9 November 2026, counts this record as an image record for Hive, and the free checks per day ranking, added the same day, places Sightengine first on its Free Tier of 500 operations a day with this record as its one study.

The authors list four: the benchmark "requires frequent updates to remain relevant as new generative models emerge"; PGD requires every ensemble detector to be differentiable; the perturbations "are not designed to be robust to post-processing operations" and cover a 256 by 256 centre crop; and RAID is "a one-directional (necessary, not sufficient) screen", so passing it does not prove robustness (Sections 3.3 and 6). Appendix D calls the commercial figures preliminary because of the 50-image size (arXiv 2506.03988, read 9 November 2026).

Evident from the sources: the commercial APIs carry no version or scoring date; the clean 0.60 for Hive and 0.66 for Sightengine on AI images is itself low, so the drop starts from a weak base; the images are 256-pixel crops from four 2022 and 2023 open-source diffusion models; and the paper has no stated venue.

Two cards take a result line, each with the 50-image base and the "preliminary" label the authors attach (arXiv 2506.03988, Table D.13, read 9 November 2026).

Both drops are evasion results for the adversarial robustness ranking, with the caveat that the base is 50 images and the attack is pixel noise. Neither card gains a false positive or false negative rate: the 1.00 on 50 real images is printed as accuracy, not as a count of false positives. The record counts as an image-modality study with two indexed detectors in the ranking of independent studies by modality, and the modalities feature lists it under image. The home page shows which AI detectors exist and who has tested them.

Related records: Ha and Passananti 2024 scored Hive at 98.03% (accuracy) on 630 clean images and 67.56% under Glaze; DFDC 2020 is the video challenge whose winners also fell on unseen material; RAID 2024 is the unrelated text benchmark that shares the name.