Yes, AI image detectors can be fooled, in both directions. AI images can be pushed past a detector by stripping their metadata, compressing or re-capturing them, or applying small deliberate changes designed to confuse the model. Real photos can also be made to look AI-generated, which is a way to discredit genuine evidence. Researchers have demonstrated these attacks against watermarks and classifiers alike. That doesn’t make detectors useless, but it does mean you should never rely on one alone, especially when someone has a motive to deceive you.
How AI images slip past detectors #
Stripping or faking metadata #
Metadata is the easiest layer to defeat. Content Credentials and generator tags can be removed with a screenshot or a re-save, and plain EXIF or IPTC fields can be edited to claim a camera took the picture. Signed C2PA credentials are harder to forge, but they’re easy to delete (C2PA FAQ). A detector that relies only on metadata is beaten by anyone who knows this.
Degrading the image #
Classifiers read fine texture. Anything that destroys it (heavy compression, resizing, blurring, adding noise, filters, repeated reposting) weakens the signal. Most of this happens innocently, as images travel across platforms. Someone trying to evade detection can do it on purpose.
Adversarial perturbations #
Machine learning models can be pushed toward a wrong answer by carefully calculated changes that people can’t see. In a 2024 University of Chicago study of human art versus AI art, Hive’s detector performed very well on clean images but was weaker against adversarial perturbations, while the expert human artists in the study produced more false positives (Ha et al.).
Removing watermarks #
Watermarks like Google’s SynthID are designed to survive cropping, filters and compression (Google DeepMind). But research on AI image detection has shown that watermarks which change the image only slightly can be removed with a technique called diffusion purification, and that stronger watermarks can also be attacked (Saberi et al.).
New generators #
The simplest route requires no effort at all: use a generator the detector hasn’t been trained on. Classifiers tend to treat unfamiliar images as real by default (Ojha et al.).
How real photos can be made to look fake #
This direction gets less attention but matters just as much. The same watermark research showed that a watermarked noise pattern can be added to a real image so that it’s wrongly classified as watermarked, and that there’s a fundamental trade-off between how often a detector misses AI images and how often it wrongly flags real ones (Saberi et al.).
In practice, this enables what’s sometimes called the “liar’s dividend”: once people know AI fakes exist, anyone caught on camera can claim a genuine photo is AI. A detector result that says “AI” about a real photo, whether from an attack or an honest false positive, gives that claim cover. That’s one reason we cover why real photos get flagged as AI in detail.
Which checks are hardest to fool? #
| Check | How easily it’s fooled | Notes |
|---|---|---|
| Plain metadata (EXIF, IPTC, XMP) | Very easily | Can be deleted or typed in |
| Signed Content Credentials | Hard to forge, easy to delete | A valid signature is strong; absence is meaningless |
| Invisible watermarks | Moderately | Built to survive edits, but research shows removal and spoofing are possible |
| Pixel classifiers | Moderately | Weakened by compression, new generators and adversarial changes |
| Source and context checks | Hard | Faking a years-long account history and matching real-world details takes real work |
| Other photos of the same event | Hard | Real events leave many independent images |
The pattern is clear. Technical checks are fast but individually beatable. Checks that depend on the world outside the image are slower but much harder to fake.
What this means when you’re checking an image #
- Stack independent checks. A detector, a reverse search, a source check and a context check fail in different ways. Fooling all of them at once is much harder than fooling one.
- Weigh the motive. A meme from a stranger isn’t an adversarial attack. A photo in a scam, a political fight or a legal dispute might be. Raise the bar when someone gains from deceiving you.
- Respect “Uncertain.” A good detector says so when the signal is weak, rather than forcing a verdict that an attacker could exploit.
- Prefer provenance when it exists. A valid Content Credential from a known signer is stronger than any pixel score.
Expose AI is built with these limits in mind. It runs a metadata pass and an on-device model side by side, and because Content Credentials can be removed or faked, the metadata pass is never the only pass. When the metadata has nothing credible to say, the model decides, and the “How we decided” card shows which pass made the call. The app lists heavy compression, screenshots of screenshots, brand-new generators and stripped or spoofed metadata as the cases where it’s least sure, and it answers Uncertain rather than guessing. That honesty is more useful to you than a tool that always sounds confident.
For the full routine that combines these checks, see how to tell if an image is AI-generated, and for what accuracy figures really mean, how accurate AI image detectors are.
Frequently asked questions #
Does screenshotting an AI image fool detectors? #
It removes all metadata, so any Content Credentials or generator tags are lost. It also lowers resolution, which weakens the pixel signal. Many AI screenshots are still detected, but confidence drops and “Uncertain” results become more common.
Can you remove a SynthID watermark? #
SynthID is designed to survive common edits like cropping, filters and compression. Academic research has shown that watermarks in general can be weakened or removed with more deliberate techniques, so a missing watermark isn’t proof an image didn’t come from a watermarking tool.
Can a real photo be made to look AI-generated? #
Yes. Heavy filters and edits can do it accidentally, and researchers have shown deliberate methods that make real images trigger watermark detectors. That’s why a detector result alone shouldn’t be used to dismiss a genuine photo.
Is it pointless to use an AI detector, then? #
No. Most images you check haven’t been attacked, and a detector catches many generated images that people can’t spot by eye. Use it as one layer: fast, often right, and most useful combined with source and context checks.