There are three ways to tell whether an image was generated, and they are not equally strong. A pixel detector produces a statistical guess. A watermark produces a signal that only its owner's tool can read. Metadata produces a document you can inspect yourself. Most confusion about AI detection comes from treating all three as the same claim.
Key takeaways
- A detector score is a probability from a classifier, not a finding of fact.
- Watermarks are strong evidence when present, and only the issuer can usually read them.
- Metadata is the only evidence you can inspect and judge yourself, and also the easiest to remove.
- No signal is not evidence of a human. It is the normal state of almost every image online.
Three kinds of evidence
Kind | What it is | Proves when present | Proves when absent | Can you check it yourself? |
|---|---|---|---|---|
Pixel classifier | A model trained to separate generated images from photographs | A probability, not a fact | Nothing | No, you get a score |
Invisible watermark | A signal embedded in the pixels by the generator | Strong evidence of that generator | Nothing | Usually not, you need the issuer's tool |
Metadata | Fields written into the file: C2PA, source type, generation settings | Strong and specific evidence | Nothing | Yes, field by field |
Read the fourth column before the others. Every one of these says nothing useful when the signal is absent. That single row causes more bad conclusions than the rest of the subject combined.
What does a detector score actually mean?
A pixel detector is a classifier. It was trained on a set of generated images and a set of photographs, and it learned to separate them. When you give it a new image it returns a number: how much this image resembles the generated side of its training data.
That number is a similarity judgement, not a measurement. Three things move it, and none of them is whether a model made the picture.
Whether the generator is one it has seen. Classifiers do well on the families they were trained on and worse on ones released afterwards. The field moves faster than training sets.
How much the image has been through. Compression, resizing, cropping and screenshots all degrade the statistical traces the classifier keys on. An image that has been through a social platform twice is a harder case than the same image straight from the generator.
What kind of image it is. Heavily retouched photographs, digital illustration, upscaled old photos and product renders all sit near the boundary. A confident score on any of them deserves suspicion.
None of this makes detectors useless. It makes their output a piece of evidence with a known error rate rather than a verdict. Treat a high score as a reason to look further, and a low score as almost no information at all.
Watermarks: strong, and mostly not yours to read
Some generators embed an imperceptible pattern into the pixels as they produce the image. Google's SynthID is the best known. The pattern is designed to survive ordinary handling like resizing and compression, which makes it far more durable than anything in the metadata.
When such a watermark is present and readable, it is strong evidence: it says a particular system produced this image, and it survived the journey.
Honest limit
Two practical limits. First, reading a watermark generally requires the issuer's own detector, so this is not evidence you can check yourself the way you can read a metadata field. Second, our tools do not detect or remove pixel watermarks at all. We work on the metadata layer. Cleaning metadata leaves a watermark exactly where it was, and we would rather say so than let you assume otherwise.
Metadata: the evidence you can actually read
This is the layer we work on, so treat what follows as a description of our own trade rather than a neutral survey.
Generators leave three kinds of trace in the metadata, and each is a document rather than a score.
Content Credentials. A signed manifest describing what made the file. When a generative model is declared in it, that is an explicit statement, cryptographically bound to this state of the file. What it does and does not establish is the whole subject of what C2PA is.
A declared source type. IPTC and XMP define digitalSourceType. The value trainedAlgorithmicMedia is a file saying outright that a model made it.
Generation settings left in place. Stable Diffusion writes its whole block into a PNG text chunk called parameters: the prompt, the negative prompt, the sampler, the seed, the model hash. ComfyUI writes prompt and workflow. These are not watermarks and were never meant as evidence. They are working data nobody cleaned up, and they are often the most detailed thing in the file.
The strength of metadata evidence is that you can read it. Our AI image checker shows you the raw field it found and where it found it, so you can judge the document instead of trusting a number. The weakness is the mirror image: anyone can remove all of it in a few seconds, which is what our own metadata remover does when you ask it to.
The mistake almost everyone makes
Here it is plainly: the absence of a signal is not evidence that a human made the image.
Almost every image on the internet has no Content Credentials, no readable watermark and no generation metadata. That is the baseline, not a red flag. Metadata is stripped by messaging apps, by social platforms, by format conversion and by screenshots, all as routine behaviour that has nothing to do with anyone hiding anything.
So a clean file tells you that the file is clean. It does not tell you what made the picture. Anyone reasoning from "the checker found nothing, so it is real" has inverted the logic, and they will be wrong in both directions: fooled by generated images that have been through a screenshot, and suspicious of photographs that went through a messaging app.
The reverse error is rarer but worth naming. A single positive signal is not proof either. A digitalSourceType field can be written by hand. A manifest can be valid and still describe a misleading image.
How to actually judge an image
There is no single test. There is a sequence, and it is worth doing in this order because each step is cheaper than the next.
- Read the metadata first. It is free, it is fast, and when there is something there it is the most specific evidence you will get. Start with the AI image checker or, if you only care about provenance, the C2PA checker.
- Check the file's history, not just its origin. Which software wrote it last, whether the capture and modify dates agree, whether anything is inconsistent. The vocabulary for this is in what EXIF data is.
- Run a pixel detector if you want a second opinion, and read the result as a probability from a model with a real error rate.
- Look at the picture. Hands, text, reflections, the geometry of repeated objects, the way light falls. Human judgement is still evidence, and it does not degrade when the file is re-encoded.
- Weigh the source. Where the image came from and who is circulating it usually matters more than any of the above.
If every step comes back empty, the honest conclusion is that you do not know. That is an acceptable answer, and it is more useful than a confident one built on a missing signal.
What if you need to prove your own photo is real?
The inverse problem gets less attention and is becoming the more practical one. You took the photograph, and you need someone else to believe it.
Detection cannot help you here. No classifier returns "definitely a camera", because that is not what a classifier does, and the absence of AI signals proves nothing about your file any more than it does about anyone else's. Proving origin is a different job from detecting generation, and it needs different machinery.
What does help is provenance, built in from the start. A camera that writes Content Credentials signs the file at capture. Editing software that supports the standard adds its own entry rather than breaking the chain. The result is a record that someone downstream can check.
Two habits make that record worth something, and both are unglamorous. Keep the original. An untouched file with intact metadata is the strongest thing you own, and it is worth more than any certificate you can add later. Do not let the chain break silently. Exporting through a tool that discards the manifest leaves you with a picture and no history, and there is no way to reattach one honestly after the fact.
If you publish photography and none of your equipment writes Content Credentials yet, the fallback is ordinary and still useful: fill in the creator and copyright fields, keep the originals, and be able to produce them. Our metadata editor writes those fields into EXIF, IPTC and XMP together so they survive the next program that touches the file.
Questions answered
How accurate are AI image detectors?
Accuracy depends on which generator made the image, how much processing the file has been
Can an AI image detector be wrong about a real photograph?
Yes. Heavily edited photos, AI-upscaled scans and digital illustration all sit close to the
Does removing metadata make an image undetectable?
No, and we would not build that if it were possible. Removing metadata removes the metadata
Is there a single tool that tells me for certain?
No. Every method covers one layer, and every layer can be absent. Anyone claiming certainty is
What is the strongest evidence available today?
A valid Content Credentials manifest that declares a generative model, or a readable watermark