AI Image Forensics: Detect AI-Generated and Altered Photos

What AI image forensics can and cannot establish

AI image forensics is the structured examination of a questioned image file to determine whether its content was generated or altered by artificial intelligence, and whether it is a faithful record of the scene it claims to show. The examination looks at two different things: the content inside the picture, and the structure of the file that carries it. A defensible opinion uses both, and states which observations support it.

The discipline has a known ceiling, and it is documented by the bodies that govern it. The Scientific Working Group on Digital Evidence, in its published best practices for image authentication, states that the state of the art is such that in a single image, manipulations can be performed which a trained forensic practitioner may not adequately detect, and that image authentication should therefore be performed on a series of images depicting the same or similar subjects, or on video. Any examiner who tells you a single JPEG can be certified as authentic has told you something about their standards before they have looked at a single pixel.

Equally, the discipline has a floor. A careful examination can establish, with reasons, that no evidence of alteration was observed. It can establish that alteration was observed. It can also establish that the evidence does not support a determination either way. Those three outcomes are the honest range. What an examination never produces is a certainty claim untethered from a method.

Our examiners take matters from law firms, insurers, corporate counsel, HR and compliance teams. The wider forensic practice is described on the digital forensics and incident response page. That practice covers breach response and network forensics. It also covers expert testimony. For the AI services side of the practice, see the AI hub.

Provenance records: C2PA Content Credentials and IPTC DigitalSourceType

Provenance is the newest line of evidence available. When present and intact, it is also the strongest. It does not ask what the image looks like. It asks what the file says about itself, and whether that statement has been tampered with.

How Content Credentials work

Content Credentials, defined by the Coalition for Content Provenance and Authenticity, are a cryptographically signed record of an asset's history: who or what created it, when, in which application, and what edits followed. The C2PA explainer describes a Content Credential as a structure containing one or more assertions about the asset, digitally signed to protect their authenticity and integrity. Assertions can record origin and modifications. They can also record the use of AI, and implementers can add their own, including assertions about whether the content may be used for AI training.

At the file level the manifest is bound to the content by a hard binding, a cryptographic hash relationship covered by the claim signature. Removal of data from inside a manifest is therefore detectable. The claim itself is hashed and signed, and so is the assertion store. A validator checks the signature against a trust list of certificate authorities that the C2PA maintains. It reports whether the manifest is well formed. It reports whether it is intact and valid, and whether the signer is trusted.

Adoption is real but uneven. Leica states that its M11-P is the first camera to integrate content authentication under the Content Authenticity Initiative and the C2PA standard. Google Search surfaces C2PA metadata through its "About this image" feature in Images, Lens and Circle to Search. The Content Authenticity Initiative described itself in January 2026 as a community of more than 6,000 members.

Where Content Credentials fail, and why that matters in a case

The specification is candid about its limits, and a forensic examiner must be equally candid. Five failure modes matter in practice:

• Complete removal. The C2PA security considerations state that "C2PA does not offer any protection against the complete removal of C2PA manifests from assets". Download the file, strip the manifest, repost it, and a viewer shows no provenance at all.
• Everyday actions destroy it. Taking a screenshot or converting a file removes the credential. The vendor documentation for OpenAI's provenance signals says exactly this, which is why the same images also carry an invisible watermark.
• A valid signature can cover false data. Nikon added C2PA signing to its Z6III in firmware 2.00, released 27 August 2025. A researcher then used the camera's Multiple Exposure mode to make the camera sign an image it had not captured, and the forged file passed standard verification. Nikon suspended its Authenticity Service on 5 September 2025, stating that an issue had been identified with the service. The signature was valid; the input to the signer was not.
• Trust depends on the validator. An outdated trust list can cause a validator to display manifests signed with revoked or compromised credentials as valid. An independent security analysis published in April 2026, by Golaszewski and co-authors, reported the same image being labeled valid by one validator and invalid by another, and revoked credentials still being accepted. Its abstract concludes that C2PA should not yet be relied upon for high-stakes uses including legal evidence.
• Soft bindings are not proof either. A durable credential survives stripping by pairing the manifest with a watermark identifier or a perceptual fingerprint kept in a repository, but the security considerations describe a collision risk where an attacker generates a malicious asset whose soft binding matches a legitimate one.

The practical consequence for a case is simple. A valid, trusted, intact Content Credential recording AI generation is strong evidence that the tool that produced the file declared it. A missing credential proves nothing at all, and most files carry none, because the standard is designed for global, opt-in adoption.

IPTC DigitalSourceType: the label written into the metadata

The IPTC Digital Source Type vocabulary is a controlled list that states from which source a digital image was created. In XMP it is carried as Iptc4xmpExt:DigitalSourceType, and tools such as ExifTool expose it as XMP-iptcExt:DigitalSourceType. The current vocabulary separates degrees of synthesis that a lay description usually collapses into one word:

• digitalCapture: the media was captured from a real-life source using a digital camera or digital recording device.
• computationalCapture: multiple frames captured from real life and automatically merged into one frame using digital signal processing or non-generative AI, including the HDR processing common in smartphone camera apps.
• humanEdits: augmentation, correction or enhancement by one or more humans using non-generative tools.
• algorithmicallyEnhanced: modification or correction by an algorithm without changing the main content of the media, such as sharpening or applying noise reduction.
• compositeWithTrainedAlgorithmicMedia, described as "Edited using Generative AI": augmentation or enhancement using a generative model, such as inpainting or outpainting.
• compositeSynthetic: a composite of several elements, at least one of which is generative AI.
• trainedAlgorithmicMedia, described as "Created using Generative AI": digital media created algorithmically using an AI model trained on captured content.
• algorithmicMedia: media created purely by an algorithm not based on any sampled training data, such as an image produced from a mathematical formula.

The distinction between a capture that was retouched and a capture that had a person inserted into it is not academic. It is the difference between an image that is misleading and an image that is fabricated. C2PA's own guidance for AI and ML tells implementers to use the appropriate digital source type, and names trainedAlgorithmicMedia for generative model output. Google Merchant Center now requires merchants to carry the trained-algorithmic tag on generative AI product imagery and tells them not to remove it. Whether a client is under that obligation is a question for their counsel rather than for an examiner. The presence or absence of the tag, however, is something an examiner can document.

Invisible watermarks, SynthID and the limits of marking

A watermark is not metadata. It is a signal embedded in the pixels themselves, which is why it can outlive the removal of the manifest that accompanied it. Google's SynthID embeds an imperceptible watermark into AI-generated images, and Google applies SynthID watermarking to audio and text, as well as video. Google states that for images and video the watermark is added the moment the content is created and designed to stand up to cropping and filters, to frame rate changes and to lossy compression.

Two developments changed what this means for investigations. First, coverage widened. Google announced the SynthID Detector as available globally in English from 7 October 2026, saying it detects media from Google itself and from partners including OpenAI, NVIDIA, Kakao and Apple, and that more than 180 billion images and videos and 240,000 years of audio had been watermarked. Second, the watermark stopped being a Google-only signal. OpenAI states that images generated with ChatGPT, Codex or the OpenAI API include both Content Credentials and SynthID watermarks, and offers verification at openai.com/verify plus a Content Provenance API for supported image and audio files.

The SynthID-Image technical paper, published in October 2025, documents the engineering behind this at internet scale, reporting that the system has been used to watermark over ten billion images and video frames. It also sets out the threat models and constraints that come with deploying a provenance system across a large product surface. It is worth reading for the same reason the C2PA security considerations are worth reading: the people who built it describe the attacks.

What a watermark can and cannot prove

A positive watermark detection is meaningful evidence that the content was produced or exported by a supporting tool. A negative result is not evidence of authenticity, and the vendor documentation says so in plain language. OpenAI states that more extensive changes can make a watermark undetectable, and names the kinds of change that do it:

• heavy cropping
• file compression
• substantial paraphrasing or translation

Cropping is not exotic. It is what happens when a photo is reframed for a post.

The published attack research goes further and matters to anyone relying on a watermark in litigation. Saberi and co-authors, in "Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks", show a fundamental trade-off between the evasion error rate and the spoofing error rate of watermarks under a diffusion purification attack, show that low-perturbation watermarks are effectively removed by diffusion purification, show a model-substitution adversarial attack that removes watermarks from higher-perturbation methods, and show that with black-box access to a watermarking method an attacker can make genuine images be classified as watermarked. That last result cuts both ways. It means a watermark hit can be manufactured, which is exactly the kind of question a careful examiner raises before anyone celebrates an automated result.

Metadata, EXIF and file-structure forensics

File structure is what most people mean by "the metadata", and it is broader than that. SWGDE's best practices for image authentication divide image-structure examination into three areas. One is the file format and container. The next is the metadata. The last is the noise characteristics of the image.

On metadata, the standard lists what an examiner may look for. The list begins with camera make and model, and the serial number. It continues with the date and time of creation or of alteration; camera settings; resolution and image size; GPS coordinates and elevation; processing or image history; original file name; lens or flash information; frame rate; and thumbnail information. Container analysis looks at hex-level header bytes and footer bytes. It also looks at the EXIF block itself, and at bit-level file structure. In a generative image, the absence of a coherent camera block, the presence of an encoder signature that does not match the claimed device, a thumbnail that does not match the main image, or an edit-history segment that contradicts the story, are all reportable observations.

The limitation is stated just as plainly: metadata "may be useful in identifying the source and processing history of the file, but can be limited, absent, or altered". Two consequences follow. First, metadata is evidence about a file, not about a scene. Second, the path a file traveled determines what remains. A published study of EXIF integrity across transfer methods found that direct transfers by USB and email, and document-based modes, preserved all EXIF fields and file hashes, while chat and image modes and the major social platforms re-compressed the file, removed metadata and changed the hash. That is why our intake process asks where the image came from and which platform it passed through, before anyone opens it.

What hashing proves, and what it does not

Hashing is the backbone of evidence integrity, and it is routinely misunderstood. SWGDE puts it precisely: the use of a hash function can verify that a copy of a digital image file is identical to the file from which it was copied, but it cannot demonstrate the veracity of the scene depicted in the image. A hash answers "is this the same file". It never answers "is this image true". Both answers are needed, and they are different answers.

Our forensic practice applies dual hash verification. It computes MD5 and SHA-256 at collection, then verifies them before every subsequent analysis session. Work happens only on forensic copies, and never on original media. The same discipline applies to a single questioned photograph as to a server image, because the objection you will face is the same in both cases.

Error level, noise and frequency analysis

Below the metadata layer, the pixels carry traces of the processes that made them. Four families of technique are used in practice, and each has a clearly bounded meaning.

Error level analysis and JPEG compression history

Error level analysis works by deliberately resaving the image at a known compression quality and displaying the difference between the re-saved version and the original. Regions at a different error level from the surrounding image may have a different compression history, which is consistent with local editing. The technique is described by Neal Krawetz in a 2008 Black Hat whitepaper, and it has been evaluated in the peer-reviewed literature since: Warif, Idris, Wahab and Salleh, in a 2015 IEEE ICSET paper, evaluated error level analysis against different tampering types and reported reliability against JPEG compression and image splicing, along with image retouching forgery.

Reliability against splicing is not the same as a verdict. Error level analysis is sensitive to the compression history of the whole file: resave a genuine photograph twice at different qualities and the map will show structure that has nothing to do with editing. It is also defeated by the ordinary life of a shared image, because a file that has been recompressed by a platform no longer carries the quantization pattern the technique depends on. A study of JPEG block signatures makes the mechanism explicit: the error level is computed against a controlled re-save, so what the map shows is the residual after that re-save, and interpreting it requires knowing what the original encoder did.

Our examiners use error level and compression analysis as one input to a structured examination, never as a standalone conclusion, and we state the compression history we were able to reconstruct in the report.

Sensor noise and PRNU

Every camera sensor leaves a photo-response non-uniformity pattern, a fixed noise signature that SWGDE lists as a way to correlate images from the same source. Stochastic noise evaluation can show consistency between images from the same sensor manufacturer. In principle this links an image to a device, which is often the more useful question than whether AI was involved at all.

In practice the signature is fragile. Compression suppresses the PRNU fingerprint in the high-frequency band, and research on PRNU-based attribution for YouTube videos documents how much performance degrades once frames have been recompressed or delivered at a low bit rate. A modern variant is the CNN-derived camera model fingerprint known as noiseprint. It suppresses scene content and enhances model-related artifacts to localize forgeries. It performs well in the literature, but it too is a probabilistic signal that must be reported as such.

Frequency and generative artifacts

Generative models leave regularities that a trained examiner can look for. These include periodic patterns in the frequency domain and upsampling artifacts around synthesized edges, plus inconsistencies in the noise floor between regions. Lighting or shadow geometry that does not obey the physics of the scene is another. Some of these are visible to a careful eye, and all of them are strengthened by comparison against other images of the same subject or the same location. That is the reason the standards insist on series and on video where possible, and it is why we ask for everything the client has, not just the one frame in dispute.

AI classifier detectors and their measured error rates

Classifier detectors are the tools most people meet first. They are free on a web page, and they return a number. The number is the problem. A percentage attached to a single image, with no published operating point and no stated test set, is not a measurement. It is a score.

The best public evidence of how these tools behave comes from an audit published by NewsGuard in May 2026. Its authors tested 15 authentic photographs of the 2026 Iran war published by credible outlets, plus sets of lightly touched-up images and heavily altered images, through five leading detectors: Hive, AI or Not, ZeroGPT, Sightengine and ScamAI. The results should be required reading for anyone who plans to cite a detector in a dispute.

• On authentic photographs, the tools collectively declared authentic images to be AI-generated 13.33 percent of the time. ScamAI misidentified 6 of 15, or 40 percent. ZeroGPT misidentified 3 of 15, or 20 percent. AI or Not misidentified 1 of 15. Hive and Sightengine identified all 15 as real.
• On images that had been heavily altered to change their meaning, the ranking inverted. Sightengine identified 5 of 15 as fake, or 33 percent. Hive identified 9 of 15, or 73.33 percent. ScamAI identified 12 of 15. ZeroGPT identified 14 of 15. AI or Not identified all 15.
• On images that had merely been lightly touched up, the tools disagreed about what counts as manipulation: ScamAI labeled 93 percent as AI-generated, AI or Not 87 percent, ZeroGPT 80 percent, and Hive and Sightengine 27 percent.

Those two columns together describe the trap. The tools that were most careful about authentic images were the worst at catching significant alteration, and the tools that caught alteration were the most willing to call a real photograph fake. A single detector score tells you which way that particular tool leans. It does not tell you what happened to the file.

The audit also documented the consequence in the wild. An authentic proof-of-life video of Israeli Prime Minister Benjamin Netanyahu was uploaded to social media alongside a detector output calling it likely AI-generated with 96.9 percent probability, and that output was used to argue the video was fabricated. Comparisons with other images and video of the same cafe confirmed the clip was authentic; it appears a filter or light edit had blurred the background. A false positive from a detector became a disinformation tool in its own right.

Vendor accuracy claims should be read with the same care. ScamAI's site states 95.3 percent detection accuracy and AI or Not's states 98.9 percent, and both are the vendors' own evaluations of data sets they selected. Academic work points the same direction: Saberi and co-authors characterize a fundamental trade-off between robustness and reliability for classifier-based deepfake detectors, which is a theoretical statement of what the NewsGuard audit measured empirically. On this page we therefore report classifier output as triage, never as a finding, and we never present a percentage as a probability that the image is fake.

Chain of custody and evidentiary use

An examination that cannot be reproduced is not an examination. The evidentiary scaffolding around the technical work is what makes a finding usable, and it is where most improvised investigations fail.

At intake we preserve the original as received. We compute and record hashes, and open a contemporaneous chain-of-custody log. That log records every person who handled the evidence, with the time and the purpose of each handling. All examination happens on working copies. Original media is stored in tamper-evident packaging in an access-controlled facility with logged entry. Where a file was obtained from a platform, we record the retrieval method and the account. We record the timestamp and the exact URL, because a downloaded copy is a different artifact from an uploaded original and the report must not blur the difference.

The methodology is documented to the standards that courts apply. Under Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993), the factors a court weighs include:

• whether a technique can be and has been tested;
• whether it has been subjected to peer review and publication;
• its known or potential error rate;
• the existence and maintenance of standards controlling its operation;
• its general acceptance in the relevant scientific community.

Every technique named on this page has published research behind it and a stated limitation, which is what that framework rewards, and it is why we do not lead with a proprietary score.

Two Federal Rules of Evidence matter at the procedural level. Rule 902(13) permits authentication of records generated by an electronic process or system through a certification by a qualified person, and Rule 902(14) permits authentication of data copied from an electronic device, storage medium or file if authenticated by a process of digital identification, again by certification, with prior written notice to the adverse party. Those certifications are only as strong as the documentation behind them.

Our handling practices follow ISO/IEC 27037:2012, which gives guidelines for the identification and collection of digital evidence. It also covers acquisition and preservation. We also follow NIST SP 800-86, the Guide to Integrating Forensic Techniques into Incident Response, published in August 2006, which presents forensic process from an IT perspective and is explicit that it is not legal advice. NIST's Computer Forensics Tool Testing program provides an independent methodology for testing forensic software and publishes the results, which is the basis on which we select and document tooling rather than accepting a vendor's own claims.

Reports are structured for challenge, not for comfort. SWGDE states that results should not be reported in terms of numerical probability without a proper scientific foundation and related research, and that results must undergo independent review by a comparably trained individual. Both rules are in our process: no invented probabilities, and a second examiner reads the work before it leaves the lab. SWGDE also names the bias risks that matter here. Those include confirmation bias and contextual bias, and the controls that reduce them, which is why the examination request is framed around propositions rather than around a suspect conclusion.

For matters that move into litigation, our attorney engagement packet sets out the intake documents. It also sets out the deliverables and the custody artifacts in advance, and our expert witness services for law firms page covers deposition and trial support.

What an examiner can and cannot conclude

This section exists because the gap between what a client wants and what evidence supports is where reputations are lost. Here is the honest division.

The distinction between "no evidence of alteration was observed" and "the image is authentic" is not a lawyer's quibble. It is the difference between an opinion that holds under cross-examination and one that collapses the first time opposing counsel asks what the examiner would have expected to see if the image had been altered, and why.

How Petronella Technology Group, Inc. runs an AI image forensics matter

Petronella Technology Group, Inc. has run digital forensic engagements from the same Raleigh office since 2002, led by Craig Petronella, a North Carolina licensed Digital Forensic Examiner holding license 604180-DFE. Image authentication matters follow the same three-phase arc as the rest of the practice, because the failure modes are the same.

Phase 1: Intake, preservation and scoping

We establish what file we actually have before anyone analyzes it. That means the original as received and the retrieval path. It means the platform history if any, and the questions the matter turns on. Propositions are framed with counsel or with the instructing party: what would the evidence look like if the image were authentic, and what would it look like if it were not. The file is hashed. It is also preserved and logged. Where the client still has access to the source device or the original export, we document that transfer before anything is opened, because a file that passes through a messaging app loses the metadata that would have answered most of the questions.

Phase 2: Examination

The examination proceeds from the least destructive and most probative signals outward. Provenance first: does a manifest exist, does it validate against a current trust list, and what does it assert. Watermark testing next, using the highest-quality copy obtainable. Then structure: container, EXIF, thumbnails and encoder signatures, and edit history. Then the pixel-level work. That work includes error level and compression analysis. It covers noise and PRNU comparison where a reference set exists. It ends with frequency and geometry review. Classifier tools, where used, are run as triage. We report them with their version and their operating characteristics, and with the caveat that their published error rates are substantial in both directions. Every step is recorded so that a second examiner, or opposing counsel's examiner, can repeat it.

Phase 3: Reporting and testimony

Every examination produces a technical report and a plain-language summary. The technical report states the file examined and its hash. It states the tools and versions used, the observations made, the weight each observation carries and the limits of the method. The summary states what the findings do and do not support in the language of the matter. Where testimony is required, Craig Petronella provides it on matters our team personally examined. We do not testify to work we did not do, and we do not stretch a credential to cover an examination our tooling was not built for.

The surrounding forensic capabilities are described on our digital forensics services overview and in the step-by-step guide to how a forensic engagement works. Where the questioned material is video or audio rather than a still image, see our deepfake detection services.

Matters we are asked to examine

If your matter is not on this list, call us. Describe it, and we will tell you within one conversation whether it fits our scope, and if it does not, we will say so and point you to someone whose tooling does.

Engagement model and what shapes the price

Image authentication is scoped, not packaged, because the work depends on what survives in the file. A single screenshot submitted as a social media post supports far less examination than a phone's original file with a reference set of other images from the same device. We confirm scope and deliverables, and the price, in a written proposal before any work begins, and we do not quote a figure that assumes findings we have not yet made.

Four variables drive the effort:

• the number of files and whether a comparison set exists;
• the chain of custody we must document, including device handling and platform retrieval;
• the depth of pixel-level analysis the questions require;
• whether the engagement extends to a written expert report, a declaration or testimony.

Active incidents are handled on an urgent basis through our incident response practice.

The examiner

Craig Petronella founded Petronella Technology Group, Inc. in 2002 and leads its digital forensics practice. He holds a North Carolina Digital Forensic Examiner license, number 604180-DFE, along with the CMMC Registered Practitioner credential, Cisco CCNA and CWNE. Petronella Technology Group, Inc. is a Cyber AB Registered Provider Organization, RPO #1449, holds a BBB A+ rating, and has served clients from the same Raleigh office since 2002. His full biography is on the team page.

Compliance and assessment work sits alongside the forensic practice. Where a matter involves CMMC or regulated CUI handling, the relevant program material is on our CMMC compliance pages; the two practices share methodology and evidence discipline, and they are kept separate in the report so that a compliance finding is never mistaken for a forensic one.

Call before you send the file

Preservation decisions made in the first hour determine what is still examinable a week later. If a questioned image is about to matter to a dispute, a claim or a publication, call 919-348-4912. Tell us where the file came from. We will tell you what to preserve. We will tell you what to stop doing, and what an examination can realistically establish.

Call Penny at 919-348-4912   Contact Petronella Technology Group, Inc.