How to detect an AI-generated image

1. The three families, side by side

The column that decides everything is the last one: whether a third party (you, your vendor, anyone who is not the model's owner) can actually run the check.

2. Content Credentials (C2PA): the deterministic one

Checking a manifest is not an estimate. It is a signed statement embedded in the file (a JPEG's APP11 JUMBF segment, a PNG's caBX chunk), naming who produced the image and what was applied. Resolve the certificate chain against a trust list and the signature either covers the bytes you hold or it does not. Verify one at contentcredentials.org/verify or with c2patool.

What a valid manifest proves

Exactly one thing: a named signer, whose certificate chains to a trusted authority, asserted this production history over these bytes. A strong fact, and a narrow one.

What a valid manifest never proves

• Not authorship. The signer is whoever ran the signing software. Neither a generator's credential nor an editor's identifies the human being who chose what the image would say.
• Not truth. A signed photograph of a forged document is a valid credential wrapped around a lie.
• Not the whole file. A manifest protects the ranges it says it protects. Fields left outside (some metadata, sometimes location) are carried along unattested.

And absence proves nothing at all

This is the single most misused finding in the field. Removing a credential is not an attack requiring skill; it is one command:

The entire cooperative layer, removed

exiftool -all= -jumbf:all= image.jpg

And most credentials are lost without anyone intending it.

A measured study of GPT-Image-2 images collected from X found that the platform's CDN systematically strips credentials on upload. A missing credential is the normal condition of nearly every image on the internet, including the honest ones.

Why this is worth checking now rather than in 2028

The supply of signed images inflected in 2026, and the reading side did not keep up. The C2PA conformance programme's own machine-readable product list, read on 14 August 2026, gives 167 conforming products:

• 147conforming generators
• 20conforming validators, none a household name
• 58of the 167 certified in July 2026 alone

OpenAI's image output carries C2PA alongside a SynthID watermark; Anthropic began signing generated .svg, .png and .jpg on 11 August 2026 (how Claude marks AI-generated content).

Regulation pushes the same way. China has required a machine-readable label in the file's own metadata since 1 September 2025. California's AB 853 goes further: from 1 January 2027, large online platforms must detect provenance data, surface it, and may not strip it. The strongest argument against building on C2PA, “it never survives an upload”, now has a legislated expiry date.

3. Unsigned first-person statements

Below the cryptographic layer sits a cheaper one: metadata in which the producing tool simply says what it did. Deterministic to read, unsigned, forgeable in both directions. A lead, never a verdict, and when present, unusually specific.

• XMP DigitalSourceType (IPTC). trainedAlgorithmicMedia is the standard way to say “created by a generative model”; compositeWithTrainedAlgorithmicMedia says the more fraud-shaped thing: a real image augmented by a model, which is what inpainting a number onto a document looks like. The sibling screenCapture is a legitimate declaration worth surfacing rather than penalising.
• PNG text chunks. AUTOMATIC1111 writes a parameters chunk holding prompt, negative prompt, sampler, steps, CFG, seed and model hash. ComfyUI writes prompt (the execution graph) and workflow (the full UI graph). InvokeAI, Fooocus and SwarmUI each have their own keys.
• EXIF UserComment and Software. The same payloads for JPEG and WebP output; generators name themselves the way an editor would.

The evasion cost is zero: ComfyUI suppresses all of it with --disable-metadata. These checks find images that announced themselves, and nothing else.

4. Invisible watermarks: real technology, key-gated detection

Invisible watermarking is the strongest idea in this space, and you cannot run the detector. The signal lives in the pixels, so unlike metadata it survives screenshots, resizing and re-compression. SynthID-Image is the largest deployment; since May 2026 OpenAI embeds it too. Stable Signature, TrustMark and InvisMark are the other named schemes.

• The SynthID Detector portal is still waitlisted. There is no public API and no SDK, and the image detector was never open-sourced. Only SynthID for text was.
• Google's own consumer surface is scoped: its documentation states Gemini can currently only recognise content made by Google AI tools, so even after OpenAI adopted SynthID, Google's checker does not verify OpenAI's images.
• The restriction is deliberate. DeepMind's own technical paper names query-rate limiting as a first-class defence: access control is the security model, which is why a public detection API may never arrive.
• Neither Google nor OpenAI appears in the C2PA soft-binding registry, the one interoperable place a scheme can be implemented against. Adobe, Microsoft, Digimarc, Imatag and Steg.AI are there; the largest schemes are not.

Watermarks work, for the vendor that planted them. If a service claims to check “AI watermarks” for you, ask which scheme and with whose key. Even for the key holder the guarantee is one-directional: removal is cheap, and forgery, making an authentic photograph test positive, is the live 2026 problem.

5. "Is this AI?" classifiers: probabilistic, with published error rates

Nothing is being verified; a likelihood is being estimated. These are the models behind almost every consumer “AI image detector”. The 2026 numbers, from primary sources, are the argument.

• 18, 31%best detector's accuracy on 2026 generators
• 51.9%after one JPEG re-save, from 99.9% clean
• 13.33%of authentic images called AI by five leading tools
• 5.04%of fakes caught, at 92.77% headline “accuracy”

The four 2026 results, one at a time

• One re-save takes them to a coin flip. On GenImage (arXiv:2306.08571, 2.68M images), a ResNet-50 detector scoring 99.9% clean falls to 51.9% after a single JPEG re-save at quality 65. Every document photo that went through WhatsApp or a scanner app has been re-compressed at least once, which makes the degraded case the normal case.
• They call real photographs fake. A NewsGuard test of five leading tools (8 May 2026, 45 images) found they declared authentic images AI-generated 13.33% of the time, individual rates up to 40%. On lightly edited real photographs, three of the five flagged 80, 93% as AI. In 35 of the 45, at least one tool disagreed with the rest.
• Headline “accuracy” hides the split that matters. On Chameleon (arXiv:2406.19435), the paper's own state-of-the-art method reports 92.77% overall accuracy while catching 5.04% of the fakes; others in the same table catch 0.01%, 3.25%. The aggregate is class imbalance plus a near-perfect score on the real class.
• There is one narrow case where they do well. When the generator is already in the training set, in-distribution detection reaches around 0.97 ROC-AUC even under dozens of degradations.

A 2026 study of synthetic legal evidence (arXiv:2606.07613) reached the same place from the courtroom side: human accuracy 64.8% and at chance against the strongest generators, multimodal models at 5.9% sensitivity, and a recommendation to combine human review, screening and Content Credentials. Usable as triage. Never as evidence.

6. What none of this can tell you

• No credential does not mean camera-made. Absence is the default state of the internet, produced by ordinary tooling far more often than by anyone hiding anything.
• A valid mark does not make the content true. Cryptography attests to the file's history. It says nothing about whether the salary on the payslip is real or whether the scene was staged.
• AI-generated does not mean fraudulent. Upscaling, background replacement, generative fill, portrait-mode blur. All ordinary. What a fraud process needs answered is whether a specific claim is false, and “a model touched these pixels” is not that question.
• “Likely AI” is a probability with a published error rate, not a fact. When a detector says 87%, the honest reading is “87% under this model's calibration, on generators it has seen, before any re-compression.” There are published cases of 94.9 AUC and 51.9% accuracy on the same data.

One more limit, and the one that matters most for documents. Whole-image classifiers rely on image-wide statistical fingerprints rather than local forgery traces (arXiv:2602.00192), so they generalise poorly to partially edited images. Nobody generates a fake payslip from scratch; they inpaint the amount. Precisely the case an “is this AI?” score is structurally worst at.

7. A workable order of operations

1. Ask for the original file, not a screenshot and not a forward. Everything below only exists in bytes nobody re-encoded on the way to you.
2. Look for a Content Credential and verify it if one is there. Present and valid is the strongest single fact available.
3. Read the unsigned statements: DigitalSourceType, PNG parameter chunks, UserComment, Software.
4. Check the file's history against its story. Timestamps, editor fingerprints, encoding. This is the edited-image lane, usually the productive one for document fraud.
5. Verify the underlying claim out of band. The bank confirms the transfer; the registry confirms the invoice. No image analysis outranks the authoritative source.
6. Treat any classifier score as queue ordering, if you use one at all. Never as a reason on its own.

What the Tamperlens checker reads

Exactly what the engine does with the layers above, and exactly what it does not.

• Content Credentials: presence, reported as presence. The engine finds the C2PA container in a standalone image and reports that it is there. It does not parse the manifest and does not verify the signature chain, so it claims nothing about what the credential says or whether it is valid. Reporting “signed provenance” without checking the signature would be the exact failure this product exists to criticise.
• Generator metadata: read as first-person statements. Named generators in Software, XMP and PNG text; AUTOMATIC1111 parameters; ComfyUI prompt and workflow; InvokeAI keys; the IPTC values above. A generation parameter block is a declaration of synthetic origin, not an inference, which is why it is the one image family that reaches high severity.
• No AI classifier, and no watermark detection. No “is this AI?” model, no probability, for the reasons in section 5, and no SynthID check, because nobody outside the vendor can run one.

The engine reads structures the encoder wrote; it decodes no pixels and calls no third-party service. Files are parsed in memory, never written to disk.

Related reading

• How to tell if an image was edited The other question: EXIF, editor fingerprints, the four timestamps, encoding and container structure.
• Does a C2PA signature survive a PDF? A measurement: a signed JPEG through nine PDF generators, and what the official reader says afterwards.
• See a file's metadata Read the EXIF, XMP and PNG text chunks of any file in the browser, without an account.
• PDF fraud signals field guide All eighteen PDF signal families, what each detects, its benign causes and how severity is decided.