AI Images Are Winning the Visibility War. Here’s the Framework We’re Building to Fight Back.

Fully synthetic images have crossed a threshold we can no longer ignore. This post lays out the technical architecture we’re developing to detect them — honestly, and without overstating what’s solved.

We’ve crossed a line this year. AI-generated images aren’t just good enough to fool casual viewers; they’re good enough to fool trained investigators, KYC analysts, and insurance adjusters. A fraudulent car damage photo. A synthetic identity document. A fabricated invoice scan. Each one visually indistinguishable from the real thing.

The implications are concrete. Fraudulent insurance claims, synthetic identities entering financial systems, and fabricated evidence in legal proceedings aren’t theoretical failure modes anymore. They’re happening. And the tools that were supposed to catch them weren’t built for this.

The old detection playbook was designed for a different problem and fully synthetic images have broken it entirely.

Classical forensic tools were built to detect manipulation: edits, splices, and composites of real photographs. Fully synthetic images sidestep that model. There’s no original being altered. The entire pixel grid is generated from scratch; they are internally consistent, visually plausible, and free of the artifacts our existing tools were designed to detect.

Here’s how we’re approaching it differently.

OUR APPROACH

Start With What the Industry Is Converging On and Then Go Further

The most reliable long-term answer to image authenticity is provenance. The C2PA Content Credentials standard lets a camera or image generator cryptographically sign an image at the moment of creation. That signature, encoding who created it, how, and when, travels with the file.

The backing is significant: Google, Adobe, OpenAI, Microsoft, Samsung, Nikon, and Leica are all participating. Regulatory momentum is building behind it, too. The EU AI Act mandates machine-readable AI disclosure from August 2026, and California’s SB 942 is already in force.

We’re building C2PA verification into our pipeline because any serious framework has to start there. But provenance alone doesn’t get us far enough.

Most distribution platforms strip Content Credentials during re-encoding. A screenshot kills the signal. A JPEG conversion kills the signal. And the vast majority of images we’re actually asked to verify, such as fraud claims, KYC documents, insurance photos, were never credentialed in the first place. Provenance handles the signed case well. For everything else, we need active detection. That’s where the engineering gets interesting.

PILLAR ONE

Forensic Signals Grounded in Camera Physics

We’re not relying on classical tampering detectors. Those were built for a different problem. The signals that actually distinguish synthetic from real images are the ones that measure statistical properties that real camera hardware produces — properties that diffusion models consistently fail to replicate.

DCT Coefficient Distributions and Benford’s Law Conformance. Real JPEGs, compressed from sensor data, produce Discrete Cosine Transform coefficients with predictable statistical distributions that follow Benford’s Law. Synthetic images compressed after generation frequently don’t follow this pattern and this deviation is detectable even against modern diffusion outputs.

CFA Correlation Analysis. Real cameras capture images through a Bayer pattern sensor, which assigns a single color to each pixel. The firmware interpolates the missing color information, leaving a measurable correlation structure between color channels at the pixel level. Diffusion models don’t produce this structure natively. Even when generators attempt to replicate it, the correlations are typically wrong in ways that are statistically identifiable.

Absence of a PRNU Fingerprint. Every real camera sensor introduces a unique, repeatable noise pattern, a Photo Response Non-Uniformity (PRNU) fingerprint, caused by microscopic manufacturing variation. We can’t trace a synthetic image to a specific device, but we can verify whether it carries the noise structure any real sensor would produce. The absence of that structure is itself the signal.

SRM Residual Mapping. The Steganalysis Rich Model was originally developed to detect hidden data within images. Its residual maps turn out to be sensitive to the textural inconsistencies that generative models leave at object boundaries, a useful side effect of a tool built for a different purpose.

Frequency-Domain Spectral Analysis. Diffusion models often introduce periodic artifacts in the mid-to-high spatial frequency bands of generated images. They’re not always visible to the human eye, but they’re consistently measurable through frequency analysis.

Each of these signals catches failure modes that the others miss. None is sufficient alone. Together, they triangulate against the underlying physics of image formation; constraints that synthetic pipelines violate reliably in at least one dimension.

The Physics vs. Pixel Conflict

PILLAR TWO

Learned Representations of Authenticity

Physics-based signals tell us what’s statistically anomalous. Deep learning models tell us what’s semantically anomalous, inconsistencies that resist hand-engineering but that learned representations can surface. We’re running four architectures in this layer.

CLIP ViT-L/14 with a Linear Probe (UniversalFakeDetect). A frozen vision-language backbone whose feature space has shown genuine generalization to generators it wasn’t trained on. A simple linear classifier on top picks up cross-generator signals that transfer well to architectures we haven’t seen before.

DINOv2 as a Feature-Space Anomaly Detector. Trained on 142 million real photographs, DINOv2’s embeddings capture the statistical structure of authentic imagery. We use these embeddings to measure how far a given image sits from that manifold, producing an anomaly score that doesn’t require labeled synthetic training data.

TruFor. DARPA-funded, presented at CVPR 2023. TruFor combines Noiseprint++ camera fingerprinting with RGB features to produce pixel-level localization of manipulated regions. It answers a different and important question: not just whether an image is synthetic, but where and what was altered.

DualBranchModel. An EfficientNet-B0 architecture that processes the RGB image in one branch and a DCT frequency representation in a parallel branch, fusing them through gated attention. It bridges the physics-based and semantic views within a single model.

Generators optimized to defeat one signal will still fail others. That asymmetry is the architecture’s core strength.

WHERE WE’RE HEADING

A Unified Meta-Classifier

The components above each capture a partial view. The framework we’re building integrates them.

Every forensic signal and every model output is computed for each image, producing a combined feature vector. A meta-classifier trained on that vector produces a single confidence score. The wager is straightforward: generators optimized to defeat one signal will still fail others. A model that mimics PRNU noise may still produce incorrect CFA correlations. One that passes pixel-space detectors may still leave spectral artifacts. One that appears semantically coherent to CLIP may still sit far from the DINOv2 manifold of authentic imagery.

Physics-grounded signals and learned semantic features, trained jointly, should be materially more robust than either half alone. The goal isn’t a perfect detector as it doesn’t exist. It’s a system that raises the cost and complexity of defeating all signals simultaneously.

BEING HONEST

What We’re Tracking and What We’re Not Claiming

This is an arms race, not a solved problem, and we think it’s important to say so directly.

Tools like Imagera are already being built to defeat detectors by adding real camera noise and authentic compression artifacts to synthetic images. Published detection accuracies of 94% against vanilla Midjourney outputs can drop below 50% against these adversarial pipelines. That gap is real, and we’re not minimizing it.

We’re tracking three things above everything else:

False Positive Rate. Flagging a genuine photograph as synthetic is a more damaging error than missing a fake in most of our deployment contexts. This is more concerning in industries like insurance, where a false accusation carries legal and reputational consequences. We calibrate detection thresholds accordingly.

Robustness to Re-encoding. Images don’t arrive in pristine form. They’re screenshotted, resized, cropped, and processed by platform compression pipelines. Detection that fails against JPEG re-encoding or resolution changes isn’t operationally useful.

Cross-Generator Generalization. A new foundation model releases roughly every three weeks. A system trained exclusively on known generators provides diminishing returns with every new release. Generalization to unseen architectures is a primary design constraint, not an afterthought.

OPEN QUESTION

We’d Rather Compare Notes than Rediscover Dead Ends

If you’re working on this problem, be it in fraud, insurance, digital forensics, or platform trust, we want to hear from you. Which signal families have you found most generalizable across generation architectures? Where does detection break first against the latest diffusion outputs?

The marginal value of independent discovery is low. The value of shared methodology is high. We’re sharing our framework openly because we think that’s how the field makes faster progress and because the problem is serious enough that it warrants it.

Reach out. We’re comparing notes.

QUICK REFERENCE GLOSSARY

For readers who want the technical terms unpacked.

C2PA Content Credentials: An open standard that lets cameras and software cryptographically sign images at creation, embedding verifiable provenance that travels with the file.

DCT (Discrete Cosine Transform): The mathematical operation behind JPEG compression. The statistical distribution of DCT coefficients differs between sensor-captured and synthetically generated images.

CFA / Bayer Pattern: The color filter array in digital camera sensors. The interpolation process leaves statistical traces in real images that synthetic images lack.

PRNU: Photo Response Non-Uniformity — the unique noise fingerprint of a camera sensor. Present in real photographs; absent in synthetic ones.

SRM: Steganalysis Rich Model — a noise residual method originally designed to detect hidden data, now useful for spotting generative artifacts at image boundaries.

CLIP / DINOv2: Large vision models whose internal representations are sensitive to distributional anomalies in synthetic content.

TruFor: A DARPA-funded detection model combining camera noise fingerprinting with pixel-level localization of manipulated regions.

Diffusion Model: The generative AI architecture behind most current image synthesis systems, including Midjourney, Stable Diffusion, and DALL·E.