How AI detection actually works

Someone sends you an image and you want to know if it's real. You paste it into an "AI detector," it says 87% human, and you believe it. That number is close to meaningless — but there is a real system underneath, run by Google, OpenAI, Adobe, the BBC and Sony, and it works completely differently from what most people think.

1. Content Credentials — the receipt

The standard is called C2PA, run by the Coalition for Content Provenance and Authenticity, a Linux Foundation project. Its consumer-facing name is Content Credentials. C2PA's own description is the clearest one out there — it works like "a nutrition label for digital content."

Technically, it's a cryptographically signed manifest attached to a file. It can record what made the content, when, and what edits happened along the way. Because it's signed with public-key cryptography, you can verify it hasn't been tampered with.

Who's actually behind it. The steering committee, listed publicly on c2pa.org: Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. That's the camera makers, the model builders, the social platforms and a major broadcaster in one room. This is not a fringe standard.

2. SynthID — the invisible layer

Because metadata falls off so easily, Google DeepMind built something that lives inside the content: SynthID. Instead of attaching data to the file, it makes imperceptible adjustments to the pixels themselves — or, for audio, the waveform, and for text, the word choices.

Two neural networks are trained together: one embeds the pattern, one detects it. Detection is a matched-filter approach — the detector already knows what signature to look for and checks whether it's present.

The practical difference: a screenshot destroys C2PA metadata but SynthID generally survives screenshots, resizing, compression and format changes. That's the entire reason it exists.

OpenAI's framing is worth borrowing because it's accurate: the two layers do different jobs. C2PA carries rich detail when it survives. SynthID provides a survivability floor when it doesn't.

3. Why text is the hardest case

Images and audio have somewhere to hide a signal. Text doesn't. You can't nudge a pixel — you only have word choices.

So statistical text watermarking works differently. At each step, the model secretly splits its vocabulary into two lists, then biases itself toward one of them. Across a long enough passage, the proportion of words from the favoured list is statistically improbable in human writing. Someone with the key can measure it.

Why this is weak in practice:

• It needs length. A short paragraph doesn't carry enough signal to be measurable.
• Paraphrasing degrades it badly. Rewriting the text — by hand or with another model — disrupts the word distribution the mark depends on.
• It's opt-in per vendor. There's no shared standard for text the way C2PA covers images.

Which is why the tools claiming to detect AI text are almost never reading a watermark. They're guessing.

4. Why AI detectors get people fired

The detectors used in schools and hiring don't check for watermarks. They measure statistical properties of the writing — chiefly perplexity, roughly "how predictable is each next word." AI writing tends to be smoother and more predictable. So does a lot of human writing.

Be suspicious of accuracy claims, including the good ones. Most published figures come from the vendors selling the detector, tested on datasets they chose. Independent testing consistently produces worse numbers than marketing does.

The asymmetry matters most: a false positive accuses a real person of cheating. And the people most likely to be wrongly accused are the ones least equipped to argue back.

5. How fragile all of this is

Provenance is far better than detection. It is not bulletproof, and being honest about that is the point of this section.

Removal tooling exists, it's public, and it's mature. The clearest example is a GitHub project called watermarks-remover, which at the time of writing has around 10,000 stars and describes itself as stripping "multi-vendor AI provenance marks" — C2PA and metadata across PNG, JPEG, SVG, PDF, DOCX, HTML and Markdown, plus harnesses aimed at statistical text watermarks and pixel-level marks.

github.com/guillaumemeyer/watermarks-remover →

Note that even that project's own maintainer treats part of it carefully: its SynthID-scoring component is under a non-commercial research licence and deliberately not published as a prebuilt image.

6. The one rule that matters

OpenAI builds this asymmetry into their own tool. In their words, "no detection method is foolproof" — so when no signal is found, the tool refuses to conclude the image wasn't AI-generated. That's the correct behaviour, and it's the mental model to copy.

Anyone selling you a single percentage for "how AI is this" is selling confidence they don't have.

7. How to actually check something

In rough order of how much the answer is worth:

• OpenAI's verification tool — upload an image or supported audio, and it reports whether Content Credentials and/or SynthID are present. Limited to OpenAI-generated content at launch, so a negative tells you little.
• Gemini / SynthID Detector — Google's route for checking whether content carries a SynthID mark from Google's models.
• A Content Credentials viewer — reads the C2PA manifest if it's still attached and shows the signing chain and edit history.
• Reverse image search — unglamorous and often decisive. If the "photo" existed in 2019, it isn't AI.
• Context — who posted it, do they have the original file, does anything in the image contradict known facts. This still outperforms every automated tool.

And if you're the one being accused: version history is the strongest defence there is. Google Docs revision history, a git log, drafts with timestamps. Provenance runs in both directions — you can prove you made something, and that's a better position than arguing with a percentage.

Method note: The C2PA steering committee list was read off c2pa.org, and the OpenAI provenance dates and quotes from OpenAI's own announcement, not from secondary coverage. Detector accuracy figures come from published academic work (Stanford 2023; Weber-Wulff et al. 2023), not vendor marketing. This area moves fast — verify before relying on any of it.