Can AI Image Detectors Be Fooled? Understanding the Limits of Detection

Short answer: yes. Any AI image detector, including ours, can be wrong — and it's worth understanding exactly how and why before you rely on one for something that matters.

This isn't a reason to distrust detection tools. It's the reason to use them correctly: as one strong signal among several, not as a final, unappealable verdict. Here's what the research actually shows about where detection breaks down, and what that means in practice.

Detectors can be deliberately evaded

Researchers have shown that image classifiers, including deepfake and AI-generation detectors, can be fooled by adding small, carefully calculated changes to an image — changes that are invisible or nearly invisible to a human but specifically designed to confuse the detection model. This is called an adversarial attack, and it's a well-documented weakness across machine learning systems, not just image detection.

A 2020 study by researchers Nicholas Carlini and Hany Farid found that these kinds of small perturbations could reduce a deepfake detector's performance to worse than random chance, while remaining essentially invisible to the human eye. More recent research testing detectors built in 2024 and 2025 found similar results: one detector's accuracy dropped from 100% to 50% under adversarial attack, and another fell from 95.2% to 54.8% on a standard benchmark.

In practical terms, this means a motivated bad actor with the right tools can, in some cases, deliberately craft an AI-generated image specifically designed to slip past a specific detector. This is an active area of security research — detectors are regularly updated to close known gaps, similar to how spam filters and antivirus software evolve against new evasion techniques — but it means no detector can claim to be permanently unbeatable.

Ordinary re-uploading and compression degrade accuracy too

Deliberate evasion is one problem. A much more common one is completely accidental: normal image handling on the way to your screen.

Research comparing human detection accuracy on original images versus the same images after being compressed, resized, or re-uploaded (the kind of processing that happens automatically when an image is shared on social media or messaging apps) found significant accuracy drops purely from that processing — independent of any deliberate manipulation. The same kinds of degradation affect automated detectors: heavy compression and repeated re-saving strip away exactly the pixel-level signals that many detection methods rely on.

This is why an image downloaded from a messaging app or scraped from a low-resolution social media post is often harder to classify accurately than the original file straight from the source.

Detection accuracy varies by generator and image type

Not all AI generators leave the same kind of trace. A detector trained heavily on one generator's typical patterns may perform worse on images from a newer or less common tool, especially one released after the detector was last updated. This is part of why detector providers, including us, continuously update detection models as new generators are released — a detector that isn't updated will quietly lose accuracy on newer tools over time, even if it stays perfectly accurate on the tools it was originally trained against.

Image content matters too. Portraits and faces tend to be easier to classify than complex scenes, landscapes, or images with unusual lighting — there's simply more research and training data focused on faces than on, say, AI-generated architecture or nature photography.

What this means for how you should use a detector

None of this means detection is pointless — it means detection results should be read as a confidence signal, not a verdict. A few practical guidelines:

1. 1Treat a high-confidence "AI-generated" result as a strong signal, not automatic proof. Cross-check with other context when the stakes are high — where the image came from, whether the source has a track record, whether other evidence supports or contradicts it.
2. 2Treat a "likely authentic" result the same way. It means no strong AI-generation signals were found — not that the image is guaranteed real. A well-evaded fake or a heavily compressed image can both come back as low-confidence.
3. 3Use metadata and provenance as a separate, additional signal, like C2PA Content Credentials, rather than relying on visual/pixel analysis alone. The two methods fail in different ways, so combining them is more robust than either on its own.
4. 4For high-stakes decisions — publishing a news story, approving an insurance claim, verifying legal evidence — treat detection as one input into a broader verification process, not the entire process.

This is also why we show a confidence score rather than a flat yes/no on every scan: the honest answer is almost always a probability, not a certainty.

The bigger picture

Detection and generation are in a genuine back-and-forth — as generators get better at producing convincing images, detectors adapt to catch new patterns, and as detectors improve, evasion techniques adapt in response. Neither side "wins" permanently. That's not a flaw specific to any one tool; it's the nature of the problem.

What that means practically: a good detector isn't one that claims perfect accuracy. It's one that's transparent about its confidence, gets updated as the landscape changes, and is used as part of a broader judgment process rather than as a substitute for one.

If you haven't already, it's worth pairing detection with the visual checks in how to tell if a photo is AI-generated — neither approach is reliable alone, but together they get you meaningfully closer to a real answer.