Meta’s AI Image Detector Missed 55 Percent of Its Own Pictures

The AI verified every original image but missed half once they were cropped.

Reuters journalists put Meta’s new AI-image detector through a straightforward test. They generated 40 pictures with Muse Image, Meta’s own generative model, and submitted them to the company’s detector.

The tool verified every original image. But after Reuters cropped the pictures to roughly one-third to one-half of their original size, it failed to verify 22 of them. That is a miss rate of 55%, and for cropping.

Cropping is hardly an exotic attack devised in a cybersecurity laboratory. People routinely crop images before posting them, sending them in messages or fitting them into different layouts.

Meta introduced the detector in July alongside Muse Image, a new generative model. Images made by the model contain an invisible watermark called Content Seal, which is meant to show that they originated from Meta’s artificial-intelligence system. The company said Content Seal was designed to withstand common changes, including cropping, resizing, compression and screenshots. But the Reuters findings showed that that’s not really the case.

Why AI Detection Is So Difficult

The phrase “AI-image detector” can give the wrong impression. It suggests that the software examines a picture and independently decides whether it is real or synthetic. That’s not what Meta’s detector does.

Instead, it searches for Content Seal, a signal embedded by Meta’s own generator. So finding that watermark provides evidence that the image came from Muse Image. Failing to find it does not prove that the picture is authentic.

The image might be a genuine photograph. It might have been produced by another company’s generator. Or it might have come from Muse Image before being altered enough to weaken or destroy the watermark.

This is the central limitation of watermark-based detection. It can provide useful positive evidence when the signal survives, but the absence of that signal tells us very little.

×

Get smarter every day...

Stay ahead with ZME Science and subscribe.

Daily Newsletter
The science you need to know, every weekday.

Weekly Newsletter
A week in science, all in one place. Sends every Sunday.
No spam, ever. Unsubscribe anytime. Review our Privacy Policy.

Thank you! One more thing...

Please check your inbox and confirm your subscription.

That makes watermark detectors different from visual-forensics systems, which analyze the content and underlying structure of an image. Such tools may search for inconsistent lighting, unusual noise patterns, errors in perspective or statistical traces left by a particular generator.

RelatedPosts

Millions of Americans are falling for AI-generated content on Facebook
How a Fake AI Image of an Escaped Wolf Sent South Korean Rescuers on Wild Goose Chase
Spotify Concedes AI Is Flooding Its Platform, Deletes 75 Million Songs (and More To Come)
Meta’s New Bracelet Lets You Control Computers Directly

Neither approach is foolproof. Google and OpenAI have also warned that alterations can interfere with their own detection technologies.

Meanwhile, an invisible watermark has to be encoded somewhere in the image data. Cropping removes some of that data altogether. Compression and resizing change pixel values, while screenshots, filters and repeated editing can introduce further distortions. A robust watermark tries to distribute its signal widely enough to survive these changes. But there is a trade-off. The signal needs to be strong enough for a machine to recover while not being visible or noticeably degrading the image.

We’re Losing the Battle With AI Detection

The Reuters test points to a broader and increasingly uncomfortable reality: systems for generating convincing fake images are improving faster than systems for identifying them.

Image detection is an asymmetric problem.

A generator only needs to produce a convincing image once. A detector may need to recognize that picture after it has been cropped, compressed, filtered, screenshotted, recombined with other images or processed by another AI system.

Watermarks work only while their signals remain detectable. Metadata can record how a file was created, but platforms and messaging services may strip it away. Visual-forensics tools can hunt for characteristic flaws, but those clues become less dependable as image generators improve.

Meanwhile, synthetic-image tools are becoming faster, cheaper and easier to use. Establishing the origin and editing history of a particular file can still require specialist tools—and sometimes remains impossible from the final image alone.

That imbalance gives fraudsters, propagandists and harassers a powerful advantage. A fabricated picture can spread across social media long before journalists, researchers or platforms establish where it came from. By the time a correction appears, the original may already have reached a much larger audience.

Regulation Can Help But It Can’t Make Detection Perfect

Some regulators are trying to address this issue. In the European Union, Article 50 of the AI Act will impose new transparency obligations from August 2, 2026.

Providers of generative-AI systems will be required to mark synthetic outputs in machine-readable formats and make them detectable as artificially generated or manipulated. The technical measures are expected to be effective, interoperable, robust and reliable as far as technically feasible. These requirements could encourage companies to build stronger provenance systems and make their tools work together. But the phrase “technically feasible” acknowledges the underlying problem: no watermark is indestructible, and no detector can reliably identify every altered image.

But this is just in one part of the world, and it’s also not enough to stop the arms race. At most, it can slow it down, but even that is probably optimistic.

For now, the advantage still belongs to the generators. Making a convincing fake is becoming easier. Establishing where an image came from is still difficult. That’s unlikely to improve anytime soon.