How Do AI Image Detectors Work? Pixels, Noise, Metadata and C2PA, Explained
You upload a photo and two seconds later a tool says "AI". This guide explains what happened in those two seconds, which signals a detector reads, why it can name Midjourney or DALL-E on one file and go blind on a copy of the same file, and where every method fails.
An AI image detector is software that decides whether a picture was made by a model such as Midjourney, DALL-E or Stable Diffusion. It works in two layers. A trained classifier reads statistical traces in the pixels, such as frequency artifacts and noise. A metadata layer reads EXIF, XMP and C2PA records and can name the generator when they survive.
- What is an AI image detector?
- What signals do AI image detectors look for?
- How does metadata forensics name the generator?
- What does a C2PA manifest actually contain?
- What happens between upload and verdict?
- How accurate are AI image detectors?
- When do AI image detectors fail?
- FAQ
- Conclusion
I build detection systems for a living. This is the version I would want if I were evaluating one: the signal families, what a score means, what metadata can and cannot prove, and the failure modes vendors tend to leave out.
What is an AI image detector?
An AI image detector is a classifier. It takes an image as input and returns a probability that the image was generated or altered by a model, plus a verdict band. It does not look for a sixth finger. It measures properties of the file that a camera produces one way and a generator produces another.
Two kinds of evidence feed that decision. Pixel evidence lives inside the picture and survives screenshots and resizing in degraded form. Provenance evidence lives in the file container, in EXIF, XMP, PNG text chunks and C2PA manifests. Provenance evidence can be specific enough to name the software that made the image. It is also the first thing lost when a file is re-saved.
A good detector tells you which kind of evidence it found. A score alone is not an explanation.
What signals do AI image detectors look for?
Four families of signal cover almost everything in production use. Real systems combine them. Here is what each one reads and where it breaks.
| Signal family | What it reads | Can it name the generator? | Survives a screenshot or resize? | Main weakness |
|---|---|---|---|---|
| Frequency analysis | Grid and checkerboard patterns in the Fourier spectrum left by upsampling layers | No. Family-level at best | Partly. Recompression blurs the spectrum | Newer generators suppress the pattern |
| Noise residuals | Sensor noise a real camera leaves versus the too-clean or correlated noise of a model | No | Weakly | Heavy filters on real photos mimic model noise |
| Learned classifiers | A CNN or vision transformer trained on labelled real and generated images | Sometimes, by family (GAN versus diffusion) | Yes, with reduced confidence | Unseen generators shift the decision boundary |
| Metadata and provenance | EXIF Software, XMP CreatorTool, PNG text chunks, IPTC, C2PA manifest | Yes, by name, with an evidence level | No. Any re-encode strips it | Coverage. Most images in the wild carry none |
Frequency analysis: patterns hidden in the spectrum
Every image can be decomposed into spatial frequencies, the way a chord decomposes into notes. Generators build images by upsampling a small internal representation to full size. That upsampling leaves periodic structure in the high frequencies. Frank and colleagues documented these spectral artifacts across GAN architectures in 2020 (Frank et al. ICML 2020). Camera photos rarely show the same regular grid. Diffusion models leave weaker but still measurable spectral traces (Corvi et al. ICASSP 2023).
Noise residuals: cameras are messy, models are not
Subtract the visible content of a photo and you are left with noise from the sensor and its processing chain. That residual is a fingerprint of the capture device. Generated images carry noise too, but it is wrong in telling ways: too uniform, or correlated across the frame in patterns no physical sensor produces. A model of what natural sensor noise should look like can flag an image whose noise floor does not add up.
Learned classifiers: networks trained on millions of examples
The workhorse of modern detection is a convolutional neural network or vision transformer trained on labelled real and synthetic images. Wang and colleagues showed in 2020 that a classifier trained on one GAN's output generalised to other, unseen GANs (Wang et al. CVPR 2020). Corvi and colleagues then showed in 2023 that the same GAN-trained classifiers largely failed on diffusion models (Corvi et al. 2023). Coverage of new generator families is therefore an operational requirement, not a nice-to-have.
Our image model outputs separate probabilities for a fully generated image and for inpainting, which is AI-edited regions inside a real photo. We add the two to form the AI score, clamped to a 0 to 1 range. We deliberately do not use the model's confidence in its winning class as the score, because a real photo the model is 99% sure about would otherwise read as 99% AI.
Metadata and provenance: reading the file's paper trail
The fourth family does not analyse pixels at all. It reads what the producing software wrote into the file. This is the only family that can name a specific generator, and it is the one most detectors skip. The next two sections cover it in detail because it is where the useful answers live.
How does metadata forensics name the generator?
Image software writes its name into predictable places. A camera writes its make and model into EXIF. Photoshop writes "Adobe Photoshop" into XMP CreatorTool. Stable Diffusion WebUI writes the full generation prompt into a PNG text chunk called parameters. ComfyUI writes workflow and prompt chunks. NovelAI writes Software: NovelAI. Firefly, DALL-E 3 and a growing list of tools sign a C2PA manifest.
Our source check reads EXIF Software, XMP CreatorTool and full XMP text, PNG tEXt and iTXt keys, the JPEG comment segment, IPTC keywords and the C2PA manifest. It matches what it finds against a signature table of 29 AI generators, 5 editing tools and a screenshot class. Generators covered include Midjourney, DALL-E, OpenAI and Sora, Anthropic Claude, Google Gemini, Imagen and Veo, Stable Diffusion, SD WebUI, ComfyUI, InvokeAI, NovelAI, Adobe Firefly, Flux, Leonardo, Ideogram, Runway, Kling, Grok, Luma, Pika, Recraft, Microsoft Designer and Meta AI.
Every match carries an evidence level. Strong means a signed C2PA manifest or an unambiguous software tag names the generator. Moderate means a generator-specific field is present but unsigned. Light means a weak hint, such as a keyword. None means the file carries no attributable metadata. Editing tools and screenshots are classified separately from generators, so a Photoshop tag does not read as "AI".
The honest limit: a resized, screenshotted or re-saved copy carries no metadata, and the source check reports none. That is not a failure of the image being real. It means the paper trail was destroyed. The pixel classifier still scores the file. No competitor we have evaluated states this limit on its results page. We state it on every result.
What does a C2PA manifest actually contain?
C2PA, the Coalition for Content Provenance and Authenticity, defines a signed record that travels inside the file. Adobe, Microsoft, OpenAI, Google, Intel, Sony and the BBC are among its members (c2pa.org). Adobe exposes it to users as Content Credentials (contentcredentials.org). OpenAI attaches both a C2PA manifest and a SynthID watermark to images generated with ChatGPT and its API (OpenAI Help Center, checked 20 October 2026). Meta labels AI images on Facebook, Instagram and Threads with IPTC metadata and invisible markers (Meta Newsroom, 6 February 2024).
To show what the record looks like, I inspected the public reference images published by the C2PA open-source project on 20 October 2026 (contentauth/c2pa-rs test fixtures, files C.jpg and CA.jpg). The table shows the fields that matter for attribution.
| Field in the manifest | C.jpg (generated reference) | CA.jpg (edited reference) | What a detector reads from it |
|---|---|---|---|
claim_generator | make_test_images 0.33.1, c2pa-rs 0.33.1 | Same | The software that wrote the claim |
c2pa.actions | c2pa.created | c2pa.opened, c2pa.color_adjustments | Whether the file was created from nothing or edited from an ingredient |
digitalSourceType | algorithmicMedia (IPTC vocabulary) | Not asserted on the edit | An explicit "made by an algorithm" declaration |
c2pa.ingredient | Absent | Present, with a thumbnail of the parent image | The chain back to the original asset |
c2pa.signature | Present | Present | Whether the record is tamper-evident |
Then I did what a social network does to an upload. Re-saving C.jpg as a JPEG at the same resolution removed the manifest entirely. Resizing it to 50% removed it. Re-encoding it as a PNG, the equivalent of a screenshot, removed it. Zero of three copies retained a single byte of C2PA data (test run 20 October 2026, Python Pillow 12.3). This is why metadata is strong evidence when present and no evidence when absent.
What happens between upload and verdict?
Here is our pipeline as a worked example. You upload a JPG, PNG, WEBP, BMP, TIFF, HEIC or HEIF file up to 12 MB. The file is validated by its actual bytes, not its extension. Images below 8 pixels on a side or above 48 megapixels are rejected with a clear error.
Decode and probe
The image is decoded, its dimensions are read, and the container is checked against the declared format.
Pixel classification
The in-house image model returns probabilities for generated and inpainted content. The AI score is the sum, clamped to 0 to 1.
Source check
EXIF, XMP, PNG text, JPEG comment, IPTC and C2PA are parsed with a short time budget and matched against the signature table. The result is a tool name and an evidence level, or none.
Verdict
You receive a whole-image verdict band, the AI score as a 0 to 100 percentage, and the source check result with its evidence level and a one-line note on what was found.
Two design choices matter. The output is a whole-image verdict, not a heat map, because region maps on a single image are far less reliable than a calibrated whole-file score. And the generator name comes only from metadata, never from the pixel model. We would rather tell you "no attributable metadata" than guess.
How accurate are AI image detectors?
Accuracy is an average over a test set. It is not a guarantee about your image. We publish no single accuracy percentage, because a percentage without the test set, the generator mix and the compression settings behind it is marketing, not measurement.
Base rates matter more than the headline number. If nearly everything you scan is genuine, even a small false-positive rate produces some wrong "AI" calls, because real images vastly outnumber fakes in a normal queue. Treat the score as evidence to weigh, not a courtroom verdict.
False positives, where a real photo is called AI, cluster around heavy processing: aggressive upscaling, beauty filters and repeated recompression all leave residue that resembles generator noise. False negatives, where a fake is missed, cluster around brand-new generators and around degraded copies where the pixel signal has been smeared. Humans are not a reliable backstop. In a controlled study, participants identified synthetic faces with 48.2% accuracy, below chance (Nightingale and Farid, PNAS, 2022).
When do AI image detectors fail?
Detection is an arms race. There are three main ways a detector is beaten, described here conceptually and not as a recipe.
New model releases. Each generator architecture shifts the statistical fingerprint. The GAN-to-diffusion transition broke a generation of detectors (Corvi et al. 2023). Coverage has to keep pace with the tools people actually use.
Adversarial perturbation. Small, deliberately crafted pixel changes can push a single classifier toward the wrong answer while leaving the image visually unchanged.
Laundering. Passing a fake through filters, screenshots and recompression smears its traces. Laundering also destroys metadata, which is why a stripped file with a confident pixel score and a source check of none is a common and informative pattern.
The field responds with layered defence. Ensembles of independent signals are harder to fool than any one classifier. Models are updated as new generators appear. Provenance standards like C2PA and Google's SynthID watermark (Google DeepMind) add a layer that does not depend on artifacts at all, when the producing tool participates. No single defence is complete. That is the reason serious systems report both the pixel verdict and the provenance evidence, separately.
FAQ
How do AI image detectors work in simple terms?
They pattern-match in two places. A trained model reads traces in the pixels that generators leave and cameras do not, such as frequency grids and unnatural noise. A metadata reader checks EXIF, XMP and C2PA records for the name of the software that made the file. The result is a score plus any provenance evidence found.
Can an AI image detector tell which AI made an image?
Only from metadata. If the file still carries its EXIF, XMP, PNG text or C2PA record, a detector can name Midjourney, DALL-E, Stable Diffusion, Firefly and others with an evidence level. Pixel analysis alone can suggest a family, such as GAN versus diffusion, but it cannot reliably name a product.
Can AI image detectors be wrong?
Yes, in both directions. A false positive flags a real but heavily filtered or upscaled photo as AI. A false negative misses a fake from a new generator or a degraded screenshot. That is why a good result shows a score and a verdict band rather than a flat yes or no, and shows the provenance evidence separately.
Do detectors work on screenshots of AI images?
Partly. Screenshotting re-encodes the image, which smears pixel artifacts and deletes all metadata, so the generator cannot be named. The pixel model can still score the file, usually with lower confidence. A borderline score on a screenshot deserves extra caution and a search for the original file.
What is C2PA and does every AI image have it?
C2PA is an open standard for a signed provenance record embedded in a file, shown to users as Content Credentials. Firefly, DALL-E 3 and other participating tools attach one. Most images online do not have it, and any re-save removes it, so its absence proves nothing. Its presence is strong evidence.
Can you fool an AI image detector?
It is possible, through adversarial pixel changes or by laundering an image through filters and recompression. Detectors that combine several independent signals resist this better than a single classifier, because defeating all of them at once is much harder. Laundering also strips metadata, which is itself a visible signal.
Conclusion: two layers, reported separately
So how do AI image detectors work? They read the statistical residue generators leave in pixels, and they read the paper trail software leaves in metadata and C2PA manifests. The first layer gives a score. The second layer can give a name. Both have limits, and the useful detectors show you which layer produced each piece of evidence rather than collapsing it into one number.
See both layers on your own file. Scan an image with the AI image detector. Free accounts include 50 detections per month. For a hands-on checklist, read how to tell if an image is AI generated, and for the edited-versus-generated distinction see edited vs AI generated images.