How to tell if an image is AI generated

The result exposes the central problem with AI-generated image detection: a system can perform well on clean exports and still fail after the image passes through an ordinary social media workflow.

That workflow usually includes resizing, cropping, JPEG or WebP recompression, metadata removal, color adjustment, or a screenshot. None of these changes needs to look suspicious. They are routine operations performed by messaging apps, content delivery networks, publishing systems, and human editors.

The practical answer is to combine provenance, embedded watermarks, learned classifiers, and forensic analysis. Each detects a different signal, and each fails differently. This guide focuses on recompression and editing resilience rather than ideal laboratory accuracy.

Why Ordinary Image Transforms Break Detection

An image downloaded directly from a generator is the easiest case. It can retain signed metadata, the original dimensions, the generator’s compression settings, and any watermark inserted during creation. The same image posted to a social network becomes a different forensic object.

C2PA: Strong Provenance, Weak Persistence

C2PA Content Credentials attach signed assertions about media creation and editing to the asset. A verifier can inspect the signature, issuer, declared actions, and relationship between the file and its manifest. This makes C2PA useful for answering questions such as who signed the asset, which tool recorded an edit, and whether the signed representation has changed.

The signature prevents an attacker from silently rewriting a credential while keeping it valid. It does not force every platform to preserve the credential. Metadata can be removed manually, discarded by an editor, or lost when a service creates a derivative file.

Google DeepMind’s SynthID introduction explicitly distinguishes metadata from pixel-embedded signals: metadata can be manually removed or lost during editing, while an embedded mark can remain after the metadata disappears. In May 2026, OpenAI described C2PA and SynthID as complementary for the same reason. The Verge’s report on OpenAI’s verification changes notes that platforms can remove metadata during upload and that OpenAI’s verifier does not treat an absent credential as proof that an image is genuine.

This distinction should shape incident reports. A valid C2PA record is affirmative evidence about the signed asset. A missing record is an inconclusive result. An unsigned screenshot of a signed original has lost its machine-verifiable chain, even if the screenshot looks identical to a human reviewer.

C2PA works best in controlled media pipelines where capture devices, editors, storage systems, and publishing tools preserve manifests. It works poorly as the sole detector for arbitrary images scraped from the public web. For a broader treatment of provenance standards, watermarking, and disclosure obligations, see our earlier 2026 analysis of C2PA and SynthID. The added focus here is what remains after the file has been transformed.

Camera and memory card used in an authenticated media capture workflow — Signed capture has the most value when every system in the publishing chain preserves the credential.

Embedded Watermarks: The Best Signal After Recompression

Invisible watermarking places a machine-readable pattern in the media content rather than relying only on the file container. This gives it a direct advantage over metadata when an image is re-uploaded, converted, or captured through a screenshot.

Google says SynthID embeds its mark directly in image pixels using jointly trained watermarking and identification models. According to the company’s launch description, the detector can retain a signal after filters, color changes, brightness adjustments, and lossy JPEG saves. Google also states that SynthID is not foolproof against extreme manipulations, so these are vendor claims about common edits rather than a guarantee against a motivated attacker.

The underlying engineering trade-off is signal strength. A stronger mark is easier to recover after compression but more likely to affect image quality. A weaker mark is less visible but has a smaller detection margin after resizing, cropping, noise, or repeated encoding. Detector thresholds add another trade-off between false negatives and false accusations.

Cropping is particularly difficult because it removes marked pixels instead of merely adding noise. The July 2026 Reuters analysis of Meta’s image detector found that it failed to identify 55% of the cropped Muse Image samples in the test. That result should discourage teams from treating “watermark not detected” as an authenticity certificate.

Screenshots are less predictable than a single JPEG conversion. A screenshot can preserve enough of a distributed mark for detection, but the result depends on display scaling, crop area, capture resolution, subsequent compression, and the detector’s threshold. OpenAI’s 2026 description says watermarking can be more durable through screenshots, not that every screenshot remains detectable.

Meta’s Video Seal addresses watermarking in video workflows, where temporal frames and encoding introduce another set of transformations. It should not be treated as a standalone detector for still images merely because a frame can be extracted from a clip. Still-image verification should use a detector evaluated on the exact image watermark and transform sequence involved.

The best use of an embedded mark is source attribution. A positive SynthID result can indicate that supported Google or partner tooling created or edited the content. It cannot identify every synthetic image on the internet because unmarked generators, older outputs, local models, and deliberately altered files fall outside that claim.

Classifier-Based Detection and Model Drift

Classifier-based systems learn to distinguish real and generated images from labeled examples. A CNN or transformer can inspect spatial textures, edge statistics, frequency features, local patches, or combinations of these signals. The operational advantage is broad coverage: the image does not need to contain a cooperating vendor’s watermark.

The weakness is distribution shift. A classifier can learn shortcuts tied to a particular generator, dataset, resizing method, or compression pipeline. When a new model produces different artifacts, the detector’s confidence can collapse even though its benchmark score looked strong.

A 2026 zero-shot benchmark evaluated 23 pretrained detector variants across 12 datasets containing 2.6 million samples from 291 generators. The benchmark study reported a mean accuracy of 75.0% for the best detector and 37.5% for the worst.

The study’s most useful operational finding concerns training data. This means model selection cannot be separated from data collection. A modest detector retrained on recent samples from the production stream can be more useful than a highly ranked model trained on yesterday’s generators.

Retraining is relatively fast compared with redesigning a watermark standard or replacing a capture chain. Teams can collect confirmed outputs from a new generator, add the actual compression path used by their platform, fine-tune the detector, and recalibrate its threshold. The drawback is continual maintenance and the need for trustworthy labels.

Close-up of photo editing software used to resize and recompress images — A production benchmark should reproduce the same crop, resize, filter, and encoding steps used by the application.

Forensic Artifacts From Diffusion Models and GANs

Forensic detectors search for traces left by the generation process. GAN detectors have used co-occurrence statistics, spectral patterns, and model-specific fingerprints. Diffusion-oriented approaches can inspect reconstruction error, latent-space behavior, or estimated noise created while processing the image through a diffusion model.

These methods can be highly accurate when the test data resembles the generators used during development. A review of synthetic-image detection methods describes how earlier CNN classifiers generalized across several GAN families because those generators shared systematic artifacts. The same review notes that diffusion systems changed the problem by producing different and often weaker traces. See the survey of spatial, frequency, fingerprint, patch, and reconstruction methods for the underlying detector categories.

Diffusion Noise Feature, or DNF, takes a more recent approach. It processes the image through an inverse diffusion procedure and builds a representation from the resulting estimated noise. Those figures come from the method’s own published experiments and should be tested independently against the organization’s image sources before deployment.

The much lower figures in the broad 2026 zero-shot benchmark explain why a strong paper result should not become a universal production claim. A detector can excel across its selected datasets and still struggle with newly released commercial generators, aggressive crops, screenshots, or data from a different publishing pipeline.

Forensic artifacts are therefore best treated as supporting evidence. They are especially useful when C2PA is absent and no compatible watermark detector exists. They become weaker evidence when the generator family is unknown or the image has passed through several transformations.

Published Results and What They Mean

Evaluation	Test scope	Published result	Operational reading	Source
Diffusion Noise Feature	Five test datasets	99.8% accuracy	Strong controlled evaluation for an inverse-diffusion forensic representation	DNF paper
Diffusion Noise Feature under perturbation	Gaussian blur or JPEG compression	99.2% accuracy	Evidence that the tested feature survived the paper’s selected blur and compression conditions	DNF paper
Community-Forensics in a zero-shot benchmark	12 datasets within a 2.6 million-image benchmark	75.0% mean accuracy	The strongest tested detector still left a material error rate across diverse data	2026 benchmark
AIGCDetectBenchmark_CNNSpot in the same benchmark	12 datasets within the same zero-shot evaluation	37.5% mean accuracy	Out-of-box results vary sharply between pretrained detectors	2026 benchmark
Few-Shot Detector on GenImage	10 additional samples from tested classes	11.6 percentage-point average accuracy improvement	A small labeled support set can help adapt detection to an unseen source	Few-Shot Detector paper

The experiments measure different things. The first tests a specific method against selected perturbations and datasets. The second asks how pretrained systems behave across a much wider collection without target-specific tuning.

Production teams should require both forms of evidence. Controlled perturbation testing reveals which transforms damage a signal. Cross-generator and cross-dataset testing reveals whether the detector has learned a reusable feature or a shortcut tied to its training corpus.

A Production Verification Workflow

A defensible verification pipeline should preserve the original file and report each signal separately. Collapsing every check into a single “real” or “fake” label hides the distinction between missing evidence, contradictory evidence, and a positive match.

Hash and retain the submitted asset. Keep the original bytes before normalization, thumbnail generation, or transcoding.
Inspect C2PA credentials first. Validate the signature and declared actions. Record a missing manifest as absent provenance, not failed authenticity.
Run compatible watermark detectors. Record the detector, supported source family, confidence band, and image region examined.
Apply at least two independent classifiers. Prefer models trained on different feature families or data sources. Agreement is useful, but correlated training data can still produce correlated errors.
Run forensic analysis where risk justifies the cost. Diffusion-noise, reconstruction, frequency, and fingerprint methods can add evidence when active provenance is missing.
Review contextual evidence. Search for an earlier version, obtain the uploader’s source file, and compare publication history. Pixel analysis cannot prove the truth of the event depicted.
Return a graded result. Useful outcomes include verified provenance, supported watermark detected, synthetic indicators found, conflicting signals, and inconclusive.

This design also fits the EU AI Act’s 2026 disclosure context better than a binary detector. Disclosure systems need traceable evidence about how a label was assigned. A stored C2PA validation result or supported watermark match is easier to audit than an unexplained classifier score.

How to Test a Detector Before Deployment

Build the evaluation set from the same paths your users follow. Include direct generator exports, images copied through browsers, mobile screenshots, social platform downloads, and files processed by your own CDN. Keep real camera images from the same subject categories so the classifier cannot rely on content alone.

For every source image, create a transform matrix:

One and multiple JPEG recompression passes.
WebP conversion through the production encoder.
Common thumbnail dimensions from the application.
Center crops and off-center crops that remove substantial image area.
Desktop and mobile screenshots at realistic scaling settings.
Brightness, contrast, color, blur, and filter changes used by the target audience.
Combinations such as crop, screenshot, resize, and JPEG export.

Report false-positive and false-negative rates separately for every transform and generator. A single average can conceal a detector that handles JPEG well but fails on crops, or one that catches a known diffusion model while misclassifying compressed camera photographs.

Thresholds should reflect the decision being made. Automated removal requires a much lower false-positive rate than queue prioritization. A newsroom investigation can tolerate a sensitive screening score because a human will inspect the evidence. A public accusation cannot.

Schedule retesting whenever a major generator changes or the media pipeline introduces a new encoder, CDN transformation, or upload client. The 2026 benchmark’s 20% to 60% variation within identical detector architectures shows how strongly data alignment affects results. Detection maintenance is a continuing data task, not a one-time model installation.

Final Assessment

Embedded watermarks provide the best chance of surviving ordinary recompression and editing because the signal travels with the pixels. They still depend on source participation and can fail after cropping, aggressive transformation, or adversarial removal.

C2PA provides richer provenance than a watermark, including signed information about origin and edits. Its weakness is persistence. A re-uploaded derivative can lose the manifest without leaving visible evidence that anything was removed.

Classifiers provide broad coverage and can be retrained quickly, making them useful for screening large queues. Their accuracy follows the training distribution, and new generator releases can turn a good detector into an unreliable one. Forensic artifact methods add another independent signal, but their strongest results are usually tied to specific generator families and evaluation conditions.

The production standard for 2026 should be layered evidence: validate provenance, check embedded marks, run recently tested classifiers, inspect forensic traces, and retain an inconclusive category. Recompression-resistant detection is possible, but no negative result can prove that an image came from a camera. The system should explain which signals survived, which were absent, and which transformations may have destroyed them.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: