AI Image Detection in 2026: How Detectors, Watermarks and Metadata Really Work

You uploaded a photograph you took yourself. The platform stamped it "AI info". Or you generated an image legitimately for your own project, licensed and paid for, and now every crawler, marketplace and social feed treats it like a forgery.

Both situations feel the same from the outside — an invisible verdict you did not get to see, with no explanation of what triggered it. And almost every article you can find on the subject is either a vague listicle of "AI detector" links or a scammy landing page promising to make anything undetectable.

This guide is the honest version. It explains exactly what the three layers of AI image detection are, which one is actually flagging your files today, what you can verify yourself, and what nobody can truthfully promise you. Everything described here you can inspect in your own browser, on your own images, without uploading a single file to anyone.

The three layers of AI image detection

The single biggest misconception about this topic is that "AI detection" is one thing. It is three independent systems that happen to answer the same question. They fail in completely different ways, and they respond to completely different remedies.

Read that table again, because it contains the whole strategy. Layer one is a confession. Layer two is a fingerprint. Layer three is a guess.

Layer 1: metadata is the confession in the file

Every image file is a container, and the picture is only part of what is inside it. Around the pixels sit blocks of structured data: EXIF from cameras, XMP from editors, IPTC from newsrooms, ICC colour profiles, PNG text chunks, and increasingly a C2PA manifest — a cryptographically signed record of what created the image and what happened to it afterwards.

When an AI model generates an image, that record can include the model name, the generating software, a creation timestamp, an action list describing the generation event, and a signature from the issuing organisation. When an AI-assisted editing step touches a real photograph, it can append its own entry to the same chain.

This is the layer that gets you labelled, and it works whether the picture shows a mountain, a face or a spreadsheet. It requires no cleverness at all — just a parser.

What actually lives in your files

• C2PA / Content Credentials — the signed provenance manifest. The strongest possible declaration, and the one social platforms read first.
• EXIF `Software`, `ProcessingSoftware` and maker notes — often carry a generator or model string verbatim.
• XMP packets — xmp:CreatorTool, digital-source-type fields and vendor namespaces, frequently naming the model outright.
• PNG `tEXt` / `iTXt` chunks — a favourite for prompt text, seeds and workflow JSON from local generation tools.
• IPTC digital source type — a standardised field whose value can literally say the content was synthetically generated.

The unnerving part is how much of that you never asked to include. A prompt you typed privately can ride along inside a PNG chunk to anyone who downloads the file.

Read the deep dive: AI image metadata explained — EXIF, XMP, C2PA and generator tags →

Why re-encoding removes it

Metadata is not part of the picture. It sits alongside the compressed pixel data in the container. When an image is decoded to raw pixels and re-encoded from scratch, everything outside those pixels is simply not carried over — there is no mechanism by which it could be.

That is why our Remove AI Metadata tool works the way it does: it decodes your image in the browser, throws away the container entirely, and writes a brand-new file from the pixel buffer. Nothing to parse, nothing to strip selectively, nothing left behind by accident.

Layer 2: invisible watermarks are a fingerprint in the pixels

An invisible watermark is a deliberate, imperceptible pattern woven into the pixel values themselves at generation time. Google's SynthID is the best-known example. Because it lives in the pixels rather than the container, it does not care about your file format, your metadata, or how many times you have re-saved the image.

Robust watermarking schemes are explicitly designed to survive the things people do to images: JPEG compression, resizing, cropping, colour adjustment, screenshots. That is the entire engineering goal. Fragile schemes — and plenty of watermarking is fragile — degrade quickly under the same treatment.

Honest framing: no browser-based tool, ours included, can guarantee removal of a watermark that was designed to survive re-compression and resampling. Anything that claims otherwise is either mistaken or lying to you.

What pixel-domain processing *can* do is disrupt fragile embeddings, at a real cost in image fidelity. Aggressive resampling, requantisation and dithering all perturb exactly the low-level statistics a watermark hides in. Sometimes that is enough. Sometimes it is not, and you cannot tell from the outside which case you are in.

Read the deep dive: what SynthID is and whether it can be removed →

Layer 3: statistical classifiers are guessing, confidently

This is the layer people mean when they type "ai image detector" into Google. You paste an image, a website prints "94% likely AI" and you are expected to treat that as a fact.

It is not a fact. It is a model's opinion, formed from patterns like these:

• Frequency-domain signatures — generative upsampling leaves characteristic periodic structure that photographic optics do not produce.
• Noise floor coherence — real sensors produce spatially varying noise; synthetic images are often unnaturally clean or uniformly noisy.
• Local texture regularity — hair, foliage, fabric weave and skin pores are hard for models to keep statistically consistent at every scale.
• Edge and gradient smoothness — a suspiciously perfect absence of chromatic aberration, sensor imperfection and lens falloff.
• Compression history — genuine camera output usually carries a plausible JPEG history; freshly generated PNGs do not.

Every one of those is a correlation, not a proof, and every one of them is destroyed or introduced by ordinary editing. Heavily post-processed real photographs — beauty retouching, denoise, upscaling, aggressive compression for the web — can trip the same wires. That is why responsible platforms treat classifier output as one weak signal among many, and why you should be deeply sceptical of any single-number verdict.

Read the deep dive: how AI image detectors work and how accurate they really are →

Why this hits legitimate creators hardest

The people most damaged by AI detection are rarely the bad actors it was designed to catch.

• Photographers whose editing suite ran an AI denoise or generative-fill step, so their genuine shot arrives pre-labelled as AI.
• Designers and agencies using properly licensed generative assets in client work, where a stray "AI info" badge derails an approval.
• Small e-commerce sellers whose product visuals get demoted by marketplace ranking rules that penalise flagged media.
• Marketers whose paid creative underperforms because platform distribution quietly discounts labelled images.
• Anyone with privacy needs, since the same metadata block that names a model also carries GPS coordinates, device serials and timestamps.

None of that is fraud. It is the collateral damage of a signalling system that was bolted onto image files faster than anyone built tools for ordinary people to see it.

How to inspect an image yourself, in four steps

You do not need to trust a black-box verdict about your own files. You can read the provenance layer directly and see exactly what a platform would see.

1. 1Open the image in a tool that reads the container, not just the picture. Our Remove AI Metadata tool enumerates C2PA manifests, EXIF, XMP, IPTC, ICC profiles and PNG text chunks locally in your browser.
2. 2Read the findings list before you change anything. This is the important step people skip. It tells you whether you have a signed C2PA manifest, a bare generator string, or nothing at all.
3. 3Strip the container by re-encoding from raw pixels. Everything outside the pixel data is discarded — deterministically, not heuristically.
4. 4Compare the before/after report. The tool scores detection likelihood on both versions using local heuristics, so you can see which signals disappeared and which pixel-level characteristics are unchanged.

Read the deep dive: how to read your before-and-after AI detection report →

What each remedy can and cannot do

Setting expectations properly is the most useful thing this article can give you.

Notice the pattern: the metadata column is honest and absolute. The other two are qualified. Any tool that presents all three columns as solved has stopped describing reality.

Removing a visible AI badge is a separate job

Provenance metadata is invisible. The little coloured strip or logo that Gemini, DALL·E and other models stamp onto the bottom edge of an image is not — it is pixels in the picture, and no metadata operation touches it.

That is a cropping and patching problem, handled by our Remove AI Watermark tool, which trims or blends the badge region with preset strip heights per model. For a clean result you usually want both operations: remove the visible badge, then strip the container.

Read the guide: remove AI watermarks from Gemini and DALL·E images →

The ethical line, stated plainly

We build these tools because ordinary people deserve to see and control what their own files say about them. That belief comes with a boundary.

Cleaning provenance data from images you own — for privacy, for file size, for a client deliverable, for a platform that mislabels your photograph — is legitimate, and it is what every social network already does to your uploads automatically. Using the same operation to pass synthetic media off as documentary evidence, authentic journalism, or proof of a real event is not, and in a growing number of jurisdictions and platform policies it is explicitly prohibited.

Disclose AI use when it matters. Clean your files when it does not. The tooling is the same; the honesty is on you.

Where to go next

Each spoke below goes deep on one layer of the stack. If you only have time for one, pick by what you actually need: understanding a verdict, understanding a watermark, or cleaning a file.

• How AI image detectors work — and how accurate they are
• What SynthID is, and whether it can be removed
• C2PA Content Credentials explained
• AI image metadata: EXIF, XMP, C2PA and generator tags
• How to check if your image looks AI-generated
• Why Instagram and Facebook label your photo as AI