How AI image detection works, and where it fails

Four ways to check an image

• Pixel forensics looks for statistical traces left in the image's pixels.
• Learned classifiers are models trained on real and generated images to tell them apart.
• Provenance data is a signed record of how a file was made, such as C2PA content credentials.
• Watermarks are signals a generator embeds in an image as it creates it.

Each answers a different question, and each fails in different ways, which is why serious checking uses more than one.

Pixel forensics: what generators leave behind

A real photograph carries traces of the camera that took it, including sensor noise with a pattern specific to the device and its processing. An image generator has no sensor, so it leaves different traces. Research on images from generative adversarial networks (GANs) found irregularities in the frequency spectrum that come from the upsampling steps built into the generator's architecture. Other kinds of generators leave other traces, often tied to the decoder that turns an internal representation into pixels.

Edited images add a further clue. When part of an image is regenerated (inpainting) or pasted in, that region's noise, texture and compression history can differ from everything around it, which leaves a seam.

Learned classifiers and the generalization problem

Most modern detectors are classifiers trained on large collections of real and generated images. They can be very accurate on generators they were trained on, and much less accurate on new ones, because each generator leaves its own traces. A detector therefore needs regular updating, and it should be tested on images from generators it has never seen before you trust it.

Provenance and watermarks: checking the paperwork

Instead of inspecting pixels, you can check whether a file arrives with a signed history. C2PA content credentials do this, and our guide explains how.

Watermarks work differently. A generator embeds a signal in the image as it is created, and a matching detector looks for it. Google's SynthID is one example. Its invisible watermark for images and video is designed to survive common changes such as cropping, filters and lossy compression. But its detector only recognizes content that carries a SynthID watermark, so an image without one is simply “not found”, which is not the same as “real”.

Where detection fails

• Compression, resizing and screenshots. Platforms re-encode images, and each step erases some of the traces detectors depend on.
• New generators. A detector trained on last year's generators may miss this year's.
• Deliberate evasion. Adding noise, photographing a screen or running an image through another model can hide traces.
• Heavily edited real photos. Aggressive denoising, upscaling and retouching change the same statistics detectors read, so a real photo can look synthetic.
• Small or low-quality images. Less data means less signal.
• Missing metadata. Most platforms strip metadata, so the absence of credentials is not evidence of anything.

Calibrated scores and the base-rate trap

A detector's output is more useful as a probability than as a label. But a probability only means something if it is calibrated: when it says 0.8, about 80 out of 100 such images should really be AI-generated, on images like the ones you will check.

Even a calibrated, accurate detector can mislead when AI images are rare. Suppose 1 in 100 images in your queue is AI-generated, and the detector catches 95% of those while wrongly flagging 5% of real images. In 10,000 images, 100 are AI-generated and 95 of them are flagged. Of the 9,900 real images, 495 are flagged too. So only 95 of the 590 flagged images, about 16%, are actually AI-generated.

How to use detection responsibly

• Combine signals: provenance data, watermark checks, pixel analysis and the context around the image.
• Find where the image first appeared, and whether earlier or higher-quality copies exist.
• Keep the confidence with the score instead of reducing it to a label.
• Have a person review any decision that affects someone.
• Record what was checked, with what, and when.

Where Synas Detect 001 fits

Synas Detect 001 is built around these ideas. It looks for diffusion fingerprints, inpainting seams and metadata mismatches, and reports a calibrated score together with its confidence. It is open-weight, so teams can test it on their own images before relying on it. Like every detector, it produces evidence, not proof.

Sources

• Frank et al.: Leveraging Frequency Analysis for Deep Fake Image Recognition (arXiv). GAN-generated images show frequency-domain irregularities from upsampling
• Google DeepMind: SynthID. Watermarking and a detector that recognizes SynthID content
• C2PA: Coalition for Content Provenance and Authenticity