Image Forensics Methodology: How We Examine a File
This page describes exactly what happens to a file after you upload it: what we read, in what order, how the result is scored, and — the part most tools leave out — where the method fails. If a result on this site ever contradicts what is written here, the writing is what you should hold us to.
The short version: we work in three layers, from the most reliable evidence to the least. Provenance first, because when it is present and intact it is close to proof. Statistical detection second, because it is useful but conditional. Explanation last, because a score without its reasoning is not evidence.
The three layers, in order
| Layer | What we read | Strength of evidence | Fails when |
|---|---|---|---|
| 1. Provenance | C2PA manifest, signature chain, EXIF and XMP, IPTC DigitalSourceType |
Strong when the signature verifies against a trusted signer | Metadata is stripped, the file is screenshotted, or the signer is self-signed |
| 2. Statistical detection | Model-specific artifacts, frequency-domain traces, upsampling and blending residue | Conditional — good within its training distribution, degrades outside it | The file was compressed or resized, or came from a newer model |
| 3. Explanation | Which indicators fired, which did not, and what each one actually proves | The part you can actually defend in a conversation | Never — but it is only as good as the two layers above it |
Layer 1: provenance and the file's own record
The first thing we do is not analysis, it is reading. Most files carry more of a paper trail than people expect: an EXIF block from the capturing device, an XMP packet from the editor, and increasingly a C2PA manifest with a signed record of the actions taken. The full manifest reader lives on the C2PA viewer page, and the fields it reports are the ones that matter here.
Two specific values carry most of the weight. The claim generator names the software and version that produced the manifest, which is often a direct statement of origin. The IPTC digital source type distinguishes a camera capture from trained algorithmic media, which is the closest thing the format has to a machine-readable "this was generated" flag. Everything else — action history, ingredients, hard binding — tells you whether that statement is internally consistent and whether the bytes changed after it was made.
One rule from this layer carries into everything else: a valid signature is not a trustworthy signer. The cryptography only proves the file has not changed since whoever signed it signed it. Whether that entity is on a trust list is a separate question, and we report the two separately.
Layer 2: statistical detection
When provenance is absent — which is the common case — we fall back to evidence in the pixels. The detector looks for traces that generators and editing pipelines leave behind: spectral artifacts from upsampling, inconsistencies in noise residuals, blending boundaries that do not match the surrounding grain, and model-specific fingerprints learned from a reference set.
The honest framing of this layer is that it is a classifier, and a classifier is a statement about the data it was trained on. It performs well on clean files from model families in its training set. It loses accuracy as JPEG compression, resizing, cropping, screenshotting and re-encoding destroy the artifacts it depends on, and it has little to say about a model released after it was trained. Model release cycles are now measured in weeks, so this is not a theoretical caveat. The detector used for video and face-swap work is described on the deepfake detector page.
Layer 3: what the score means and what the bands are
We report a risk indicator between 0 and 100. It is a weighted summary of how many independent indicators fired, not a probability. A score of 40 does not mean a 40% chance the file is synthetic; it means a moderate number of moderate-strength indicators fired. Read the indicator list, not the number.
| Band | Range | What it means | What to do |
|---|---|---|---|
| No indicators | 0–24 | No provenance, no statistical trace. Nothing was found. | Treat as unverified, not as clean. Absence of evidence is not evidence of absence. |
| Indeterminate | 25–59 | Mixed signals: some traces present, some contradicted, or weak evidence only. | Do not publish a claim on this alone. Request the original file. |
| Elevated | 60–84 | Multiple independent indicators agree, but provenance is missing or unverifiable. | Treat as likely synthetic or edited. Get a second opinion and the original. |
| High | 85–100 | Strong agreement across indicators, or a provenance record that directly names a generator. | Strong enough to act on internally; still not a legal determination. |
A provenance hit can override the statistical score in either direction. A file whose manifest names a generative model is high-confidence regardless of what the pixels say, and a verified camera capture with an intact chain is strong evidence of capture — though not of what happened to the scene in front of the lens.
What we deliberately do not claim
- We do not determine intent. Synthesized media is not the same as deceptive media.
- We do not call anything authentic. Verified provenance means the record is intact, not that the record is true.
- We do not turn a score into a legal conclusion. A forensic report packages evidence; admissibility is for someone else to decide.
- We do not treat a missing credential as a red flag. Most real photos in circulation have no manifest, because the camera never wrote one or the platform stripped it.
Known failure modes
These are the cases where our own method is weakest, stated in advance so you can weigh a result correctly:
- Screenshots. A screenshot destroys the manifest and normalizes pixel statistics. Expect no indicators. This is the single most common way a synthetic file comes back clean.
- Heavy re-compression. Social platforms re-encode on upload, which removes both the manifest and the high-frequency artifacts. The result is uninformative, not exculpatory.
- Newer models. A generator released after the reference set was collected may leave no detectable trace, or may produce a false positive against an older fingerprint.
- Partly edited genuine photos. A real capture with one inserted region can read as authentic at the whole-image level. Region-level scrutiny and ingredient hashes are the only defenses, and both require the original file.
- Self-signed manifests. A valid signature from an unknown signer is technically impressive and evidentially near-worthless. We flag it as unverified rather than as a pass.
Versioning
Methods change, and a claim about a file should be reproducible. This page is versioned
alongside the pipeline: the dateModified on the article record reflects the last
substantive change to the method, not a cosmetic edit. When a detector's reference set is
replaced or a threshold band moves, the date changes and the result of any earlier analysis
should be read against the version in force at the time.
Using a result responsibly
If you are publishing something based on our output, three habits make the difference between evidence and an accusation. Report the layer that fired and quote what it said, rather than the score. State the uncertainty in the same sentence as the finding. And give the other side the chance to produce the original file — a verifiable original settles in minutes what no detector can settle by inference. Where a formal record is needed, the forensic report captures the file hash, the manifest contents, and the indicator set with a timestamp, so a third party can reproduce the work.
Frequently asked
What is image forensics?
Image forensics is the practice of reconstructing how an image or video was produced, using evidence that travels with the file. In practice that means three things: the provenance record a tool attached to the file, statistical traces left by the generator or the editing process, and a written account of what the evidence does and does not support. It is not a single score, and it is not a yes-or-no answer.
How accurate is AI-generated image detection?
Accuracy depends almost entirely on the conditions of the test. On clean, recently generated files from a model the detector was trained on, well-built detectors reach high accuracy. On compressed, resized, screenshotted, or re-encoded files, and on models released after the detector was trained, accuracy drops sharply. Any vendor quoting a single accuracy number without stating the file conditions and the model set is telling you nothing useful.
Can a file pass every check and still be manipulated?
Yes. A valid signature proves the file has not changed since it was signed; it does not prove the signer was honest. Statistical detection catches what it was trained on and misses what it was not. A careful operator who re-encodes, resizes, and strips metadata can defeat both layers. That is why we report the layers separately and never present a single pass or fail.
What does the risk score mean?
The score is a summary of how many independent indicators point toward synthetic or manipulated origin, weighted by how reliable each indicator is. It is not a probability, and it is not calibrated across model generations. A low score means no indicator fired, which is not the same as a clean file. Read the indicator list, not the number.
Why do different detection tools give different answers on the same file?
Because they are looking at different things and were trained on different data. One may rely on frequency-domain artifacts, another on a classifier trained on a specific model family, another only on metadata. When two tools disagree, the disagreement itself is information: it usually means the file sits in a region where the evidence is weak, and the honest report says so.
Can I use these results in a published report?
You can cite the method and the individual findings. Do not cite a score alone as proof of authenticity or manipulation. For anything with legal, editorial, or contractual consequences, request the forensic report, which records the file hash, the manifest contents, the indicators that fired, and the timestamp, so the analysis can be reproduced by a third party.