How AI image detectors actually work

An AI image detector does not look at a picture and recognize that it is fake the way a person might notice a wrong shadow or a sixth finger. It measures a faint statistical trace the generator left in the pixels, then compares that trace to the patterns it learned during training. Several different traces are readable, each detector is built to read one of them, and that is why no two detectors behave quite the same way.

What a detector is actually reading

A photograph carries the physical record of how it was made: the sensor’s pattern noise, the color-filter interpolation, the lens, the compression the camera applied. A generated image never passed through a camera, so it carries none of that. What it carries instead is the fingerprint of the model that made it. Any synthesis method “embeds some peculiar traces in their output images, that are related to the actions taken in the generation process,” as Corvi, Cozzolino, Zingarini et al. (ICASSP 2023) put it, and detection is the act of reading those traces. This is the same divide that makes text so hard to check, described in can AI-generated text even be detected: a detector reads a fingerprint when one exists, and guesses when it does not.

Frequency detectors: the upsampling fingerprint

The oldest working family reads the image in frequency space rather than as pixels. Frank, Eisenhofer, Schönherr et al. (ICML 2020) showed that generated images exhibit severe artifacts in the frequency domain, periodic grid-like peaks a simple classifier can separate from real images, reaching 100% test accuracy separating real faces from StyleGAN faces in their core experiment. The cause is structural: “these artifacts are caused by upsampling operations found in all current GAN architectures,” the step where a model scales a small feature map up to a full image. Because the artifact comes from how generators are built rather than from any one model, a frequency detector can flag images from models it never trained on. Its weakness is equally structural, and we return to it below.

Pixel and CNN detectors: learning the look of fake

A second family hands the raw image to a convolutional network and lets it learn the difference. The reference result is Wang, Wang, Zhang et al. (CVPR 2020), whose title, “CNN-generated images are surprisingly easy to spot… for now,” captures both the promise and the caveat. A classifier trained on a single generator (ProGAN) generalized “surprisingly well to unseen architectures, datasets, and training methods,” provided the training used careful blur and JPEG augmentation. Newer variants read a sharper cut of the same signal: NPR (Tan, Liu, Zhao et al., CVPR 2024) looks only at the relationship between neighboring pixels that upsampling disturbs, and reports gains across 28 different generators.

Feature-space detectors: asking a model what it already knows

The family that generalizes best does not train on fake images in the usual way. Ojha, Li, Lee (CVPR 2023) take a frozen vision-language model (CLIP), trained on 400 million image-text pairs for general recognition, and simply ask whether a picture sits in the “real” or the “fake” region of that model’s feature space. Their detector reaches 94.19 mean average precision across 17 generators, far above the pixel-CNN baseline, and the authors observed that “the real class becomes a ‘sink’ class,” holding anything that is not recognizably fake. Their conclusion is worth keeping: what matters is the breadth of the pretraining, not the exact network, because a broadly trained model has already seen enough of the world to notice when something is off.

Reconstruction and texture: two newer angles

Two more approaches round out the picture. Reconstruction detectors feed the image back through a diffusion model and measure how well it rebuilds: a diffusion-generated image reconstructs almost perfectly, a real photo does not, and that gap is the signal. DIRE (Wang, Bao, Zhou et al., 2023) reads that reconstruction error directly, and AEROBLADE (Ricker, Lukovnikov, Fischer, CVPR 2024) does it without training at all, measuring the autoencoder reconstruction error of latent-diffusion models to reach an average precision of 0.992 on Stable Diffusion, Kandinsky and Midjourney. Texture detectors like PatchCraft (Zhong, Xu, Li et al., 2023) instead compare an image’s rich-texture and poor-texture regions, on the finding that generators leave inconsistent traces between the two.

Every family above reads a trace of the generator, not a property of reality, and that is the catch. A detector knows the fingerprints of the generators in its training set, and it is close to blind to a generator it has never seen. Ojha’s own numbers show the fall: the same detector that scores 100 on ProGAN drops to 61.32 on an autoregressive model it did not train on. Corvi, Cozzolino, Zingarini et al. (ICASSP 2023) show the other half, that ordinary compression and resizing push a frequency detector’s accuracy from 70.5% down to 52.7% AUC, close to a coin toss. Dataset artifacts make it worse: Grommelt, Weiss, Pfreundt et al. (2024) found that many detection datasets carry “biases related to JPEG compression and image size,” so a detector can learn to spot compression rather than generation. Little wonder that Yan, Li, Cai et al. (ICLR 2025) call the whole problem “far from being solved.”

What this means when you read a score

Knowing what a detector reads changes what its score means. A high “AI” score is evidence that the image carries a trace this particular detector was trained to recognize, not proof that a machine made it, and a low score means this detector did not find its trace, not that the image is real. That is why the same picture can get opposite verdicts from two tools, covered in why do AI detectors give different results, and why the right use of any one detector is as a prompt to look closer rather than a verdict. For how far these tools can be trusted overall, see are AI detectors accurate.

Sources

Corvi, Cozzolino, Zingarini et al. (2023). On the Detection of Synthetic Images Generated by Diffusion Models. ICASSP 2023.
Frank, Eisenhofer, Schönherr et al. (2020). Leveraging Frequency Analysis for Deep Fake Image Recognition. ICML 2020.
Wang, Wang, Zhang et al. (2020). CNN-generated images are surprisingly easy to spot… for now. CVPR 2020.
Tan, Liu, Zhao et al. (2024). Rethinking the Up-Sampling Operations in CNN-based Generative Network for Generalizable Deepfake Detection. CVPR 2024.
Ojha, Li, Lee (2023). Towards Universal Fake Image Detectors that Generalize Across Generative Models. CVPR 2023.
Wang, Bao, Zhou et al. (2023). DIRE for Diffusion-Generated Image Detection.
Ricker, Lukovnikov, Fischer (2024). AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error. CVPR 2024.
Zhong, Xu, Li et al. (2023). PatchCraft: Exploring Texture Patch for Efficient AI-generated Image Detection.
Grommelt, Weiss, Pfreundt et al. (2024). Fake or JPEG? Revealing Common Biases in Generated Image Detection Datasets.
Yan, Li, Cai et al. (2025). A Sanity Check for AI-Generated Image Detection. ICLR 2025.