AI image detectors work in up to three ways. They read what the file says about itself (Content Credentials and generator tags in the metadata), they look for invisible watermarks that some AI companies embed in their images, and they run a machine learning classifier trained on large sets of real and AI-generated images to spot the statistical fingerprints generators leave behind. Most consumer tools rely on the classifier, and the best ones combine it with a metadata check.
Method 1: Reading provenance metadata #
The simplest method is to check whether the image declares its own origin. Some generators and editing tools write that information into the file:
- Content Credentials (C2PA): a signed manifest recording which tool created or edited the image and whether AI was involved.
- IPTC digital source type: a standard field whose value
trainedAlgorithmicMediamarks an image as AI-generated (IPTC). - Generator tags: software names, or prompts and settings written into PNG text fields.
When this information is present and credible, it’s the strongest evidence a detector can have. It’s also often missing, because platforms strip metadata and screenshots don’t carry it. See what C2PA and Content Credentials are.
Method 2: Detecting watermarks #
Some AI companies hide a watermark in the pixels themselves. Google’s SynthID embeds imperceptible signals in images from Google’s AI tools, designed to survive cropping, filters and lossy compression (Google DeepMind). Detecting it requires Google’s own tools; since November 2025 you can upload an image to the Gemini app and ask whether it was made with Google AI.
Watermark detection is very reliable for the images it covers, but it only covers images from the company that added the watermark. A SynthID check tells you nothing about an image from a different generator. We compare the two provenance approaches in SynthID vs C2PA.
Method 3: Classifying the pixels #
This is what most people mean by an AI image detector. It works like other image classifiers:
- Collect training data. Hundreds of thousands to millions of real photos, plus images from many generators.
- Preprocess. Resize or crop images to the size the model expects, the same way every time.
- Train a model to output a score between “real” and “AI” for each image.
- Set thresholds. Decide which scores count as AI, which as real, and whether there’s a middle band for uncertain cases.
What the model learns to see #
Generators leave traces that people can’t see. They show up in the fine structure of noise, in how neighboring pixels relate, in color statistics, and in regular patterns left by the way a model builds up an image at increasing resolution. Real camera photos have their own traces: sensor noise, lens effects, and the processing each phone applies. A classifier learns to tell these apart.
It can also learn higher-level cues, like the polished lighting and textures typical of generated images. That helps with clean images but can cause false positives on polished real photos.
Old and new architectures #
Early detectors used convolutional networks trained from scratch. A 2020 study showed a classifier trained on images from one GAN, with careful preprocessing and augmentation, could generalize surprisingly well to other GANs (Wang et al.).
Newer detectors often start from a large pretrained vision model, one that has already learned general features from huge image collections, and train a small classification head on top. Researchers found that features from the vision model CLIP generalized much better to unseen diffusion and autoregressive generators than classifiers trained from scratch (Ojha et al., 2023).
How Expose AI puts the methods together #
Expose AI runs two of these methods side by side on your phone:
- A metadata pass that reads Content Credentials, XMP and generator tags. An image that declares Firefly, FLUX, Midjourney or Stable Diffusion, for example, is flagged on the spot.
- An on-device neural network trained on the visual fingerprints of AI image generators. The standard model is about 1 MB. Pro swaps in a larger model of about 95 MB, based on a SigLIP2 image tower (a pretrained vision model in the same family of approaches as CLIP) with a head trained on the app’s exact preprocessing. On the developer’s evaluation set, it returns roughly half as many Uncertain verdicts.
A credible AI claim in the metadata decides on its own. Otherwise the model decides. The result shows Likely real, Uncertain or Likely AI-generated with a confidence meter, and a “How we decided” card naming the pass that made the call. It doesn’t check for proprietary watermarks like SynthID. Because both models ship inside the app, the image is never uploaded and scans work offline.
Why detectors make mistakes #
| Failure | Cause |
|---|---|
| Missing a new generator’s images | The model hasn’t seen its fingerprints; unseen images default toward “real” |
| Flagging filtered real photos | Beauty filters and heavy processing remove camera texture |
| Unsure about screenshots | Resampling, compression and interface clutter weaken the signal |
| Missing small AI edits | Most of the image’s pixels are real |
| Being fooled on purpose | Deliberate perturbations and post-processing push scores the wrong way |
The last point is covered in can AI image detectors be fooled.
Online vs on-device detection #
Server-based detectors can run very large models and update them quickly, but you have to upload your image. On-device detectors keep the image on your phone and work offline, but they’re limited by the model size a phone can run. We weigh the trade-off in online vs on-device AI image detectors.
Frequently asked questions #
Do AI image detectors use AI? #
Yes. The pixel-based part of a detector is itself a machine learning model, trained to tell real photos from generated ones. The metadata and watermark checks are more like reading a label, but the classifier is AI judging AI.
Can a detector tell which AI made an image? #
Metadata can name the tool when it’s present. Some online detectors also estimate the likely generator from the pixels, which is less reliable. A watermark check like SynthID confirms only its own company’s images.
Why do detectors need to be updated? #
New generators appear regularly, and each leaves slightly different fingerprints. A detector trained before a generator existed may not recognize its images, so developers retrain on newer data.
How long does an AI image check take? #
Metadata checks are nearly instant. A classifier takes a second or two on a modern phone, or a few seconds on a server plus upload time. Expose AI finishes on the device in a second or two.