1 Introduction↩︎

Synthetic media presents a challenge for digital forensics practitioners in legal proceedings [1], [2]. Probabilistic models have emerged to detect synthetic media [3]–[9], however such models often treat the risk of a false positive as equivalent to the gain of a true positive. The legal burden-of-proof and real-world risk/reward calculation can, however, differ [2], [10]. It is unknown as to whether such detection models are sufficiently independent in detecting synthetic media from other models and whether cross-corroborating the outputs of different models is sufficient to disproportionately lower false-positive to true-positive recall. Additionally, OpenAI have recently announced SynthID watermarking in synthetic images [11]–[13], however it is not known as to when they began watermarking such images in practice. We therefore seek to answer the following research questions in this paper:

• RQ1: When did OpenAI begin adding SynthID to GPT-Image-2 generated images?

• RQ2: Across different synthetic media detection approaches, how much similarity is there in the images that are detected?

• RQ3: How does cross-corroborating the output of synthetic media detection classifiers affect the ratio between false positive detections to true positive detections?

2 Related Work↩︎

2.1 AI Reasoning Approaches↩︎

At their core, Artificial Intelligence (AI) technologies are rooted in inductive reasoning [14]. In essence, they are trained with a corpus of data, and apply general learnings to specific situations [15].

Deductive reasoning, generating a provably correct answer from general rules, has long been a problem in computer science. In 1936 Turing [16] demonstrated a computer cannot be a flawless, terminating solver of every deductive problem.

Experimentally, in the era of Large Language Models (LLMs), Apple’s “The Illusion of Thinking” paper [17] demonstrated failure cases in high-reasoning tasks amongst LLMs. Natural language reasoning models have improved dramatically, but remain below the human ceiling [18]. Additionally, recent work [19] has highlighted that chain-of-thought reasoning models will often choose an answer first and then use reasoning to generate a chain-of-thought argument in support of it.

However, an alternative approach to lowering AI failure rates exists. Pikies & Ali at Cloudflare [20] demonstrated in 2021 that by placing a second-line good/bad Convolutional Neural Network (CNN) classifier behind traditional string similarity algorithms, false positive rates could be decreased asymmetrically to the cost on true positive performance. In other words, whilst validation leads to a failure to act upon some true positive results, it disproportionately mitigates false positives. This is particularly of use when some high-risk decision is made as a result of some AI output.

This can be considered a form of abductive reasoning, i.e. from a multi-signal factual matrix identifying the simplest and most likely explanation. This has been applied to LLMs under various scenarios. For example, ReConcile [21] uses multiple LLMs to form an initial opinion, and then the LLMs are provided visibility of each other’s answers and engage in debate to arrive at a final consensus answer. CrossCheckGPT [22] evaluates low consistency between models to identify potential sources of hallucination. FUSE [23] leverages multiple candidate answers and multiple verifiers to estimate verifier reliability and then identify the best supported answer.

2.2 Deep Fakes in Forensic Evidence↩︎

Synthetic media poses a challenge for legal decision making. One challenge is introducing fabricated evidence into proceedings [1]. Another challenge is described by Chesney & Citron [2] as the “liar’s dividend”, where someone confronted with evidence can claim it is AI-generated to create reasonable doubt or move the burden-of-proof to verifying the material is authentic.

The “liar’s dividend” represents an extension of the “Trojan Horse Defence” or the “SODDI Defence” (the “Some Other Dude Did It Defence”). Whilst approaches have been developed to address this in digital forensics in child sexual abuse material cases [10], there is limited work considering this in the emerging area of allegations of deep-fake evidence. This can be especially pertinent in cases where the provenance of media is not known due to a lack of verifiable chain-of-custody.

Whilst so far we’ve discussed reasoning approaches applicable in AI development, rules on determining the admissibility and reliability of evidence can vary by jurisdiction. For example, as outlined in Raitt on Evidence [24]: “Scotland is unique in retaining a general principle that crucial facts in criminal cases cannot be proved by the testimony of one witness alone, but must be corroborated by evidence derived from a second independent source.”

Whilst the accuracy score of AI models is often computed with equal weight to true positive, false positive, true negative and false negative results, the real-world risks of a mistaken decision on the basis of such a result can vary. Professional engineering guidance often focuses on judgement in balancing the competing forces of risk and reward. In the Guidance on Risk [25] for the UK engineering professions regulator, the Engineering Council, it is stated: “Therefore it is important for engineering professionals to understand the level of risk that is acceptable in pursuit of objectives – the risk appetite. Risk appetite defines the boundaries within which risk-based decision making can occur, be controlled and expectations set. Some elements of an engineering activity will be non-negotiable and there will be no appetite for risk. In all cases, there is a need for engineering professionals to exercise informed judgment and leadership in order to manage the risk, consistent with their organisation’s defined risk appetite. All risk decisions should be pursued in line with risk appetite.”

2.3 Deep-Fake Detection↩︎

Multiple approaches exist for deep-fake detection. The leading approach has so far been to use detector models to evaluate whether media is synthetic or human. DeepFakeBench initially focussed on benchmarking models detecting facial forgery [3], however general purpose AI-media detectors have started to emerge - accordingly, many such general purpose models lack independent benchmarking, particularly in out-of-domain experiments.

Independent benchmarks can differ from those originally published. For example, Community Forensics [4] originally claimed an accuracy of 89.2% but later independent benchmarking [5] reported an accuracy of 75% (though one table in the pre-print describes the accuracy as 78% instead). However, there exist other models [6], [7] for which we were unable to identify independent benchmarking.

Closed-source vendor models have also been subject to evaluation. For example, a model by Hive Moderation has been subject to analysis [8] which focussed on artwork (280 human-generated and 350 AI-generated) producing an overall accuracy of 98.03% and later [9] of a sample of 200 images (100 human-generated and 100 AI-generated) an accuracy of 100%.

An alternative approach has been C2PA metadata [26], where metadata is applied to an AI-generated media file. However, this can trivially be removed either intentionally or unintentionally (e.g. uploading to a website which strips such data [27]).

Google DeepMind have also produced an approach known as SynthID [12] for watermarking synthetic media. Such watermarking is dependent on the generator applying this watermark. On the 19th May 2026, OpenAI [11] reported that they were including such watermarks in images generated through their models, but the exact rollout date is unclear. Whilst Google [13] have reported self-evaluated accuracy of a derivative partner deployment of SynthID (SynthID-O) at a configured fixed 0.1% false positive rate, there is no evaluation of OpenAI’s production deployment of SynthID.

2.4 Literature Gap↩︎

We have identified three key gaps in synthetic media detection. Firstly, there has been little independent investigation of SynthID and its accuracy. One key open question in relation to OpenAI’s deployment is when images began being watermarked.

Secondly, there are models which remain without independent benchmarking in out-of-domain contexts. We further have not identified any literature evaluating the extent to which probabilistic detection models form independent judgements.

Finally, we have not identified any literature on whether corroboration of multi-model outputs can reduce the risk of false positives and what the impact is on detection rates generally. Answering such questions can aid in the forensic identification of synthetic media, assisting in the development of reasoning in other areas of AI development.

3 Methodology↩︎

The following synthetic media detection approaches are used in this paper:

• M-A: Fine-tuned SigLIP2 classifier (60,000 AI-generated images and 60,000 human-generated) [7].

• M-B: SigLIP2 & DINOv2 Ensemble model (OpenFake training data, \(\approx 95,000\) images for training) [6].

• M-C: Community Forensics commfor-model-384 classification model (2.7 million images, including 4803 generators) [4].

• M-H: Hive Moderation API [8], [9].

• SynthID: OpenAI deployment of SynthID [11].

The following data sources were used for evaluation data:

• 2000 GPT-Image-2 AI-generated images sourced from X (formerly Twitter) 21st April – 28th April 2026 (no cryptographically verified provenance due to C2PA metadata stripping) [27].

• 2000 human-generated images (Flickr material uploaded between 2004 and early 2014) [28]

As the local models (M-{A,B,C}) were trained prior to the launch of GPT-Image-2 on the 21st April 2026 [29], GPT-Image-2 generated media should be out-of-domain for all; however, for M-H, secondary classification results did indicate the model was in-distribution.

From this point, all 4000 were classified using the local models (M-{A,B,C}). Due to Hive Moderation limiting API queries to 100/day, over \(\approx 4\) days, 400 images were classified (200 AI-generated, 200 non-AI). Secondary classification scores (i.e. which particular model was used) were also stored. As OpenAI do not offer a SynthID API and we identified restrictive rate limiting, 400 images were graded over the course of \(\approx 4\) days using a headless Chrome browser (the same subset as those subject to the Hive Moderation API).

We then investigated as to when there was a date at which images began being positively classified as containing the SynthID watermark, the independence of synthetic media detector models and the performance of abductive approaches.

4 RQ1: OpenAI SynthID Investigation↩︎

None of the non-AI images were detected as containing a SynthID watermark. 36 of those which were AI generated were disclosed as containing a SynthID watermark by OpenAI (see Table 1). Note that C2PA metadata results were all negative, as metadata is removed when a media file is uploaded to X [27].

OpenAI-covered images only (N=400).

The dataset provides a date as to when the image was shared on X (formerly Twitter), indicating that images containing SynthID began to appear on the 25th April 2026 (as shown in Table 2 and Figure 1). This is just under a month before OpenAI publicly announced this on the 19th May 2026 [11].

GPT-Image-2 images with OpenAI coverage and a known date (N=200).

5 RQ2: Independence of Synthetic Media Detectors↩︎

Across 4000 images, we saw varying performance from the three open-source models, as shown in Table 3.

N=4000 (2000 AI / 2000 real).

Note that the M-C model saw an exceptionally low false positive rate, but lower true positive count than any other model. We identified that the reason for this was the model was poorly calibrated on this out-of-domain dataset. As shown in Figure 2, there is a separation between the AI and non-AI images, but at a very low threshold. As shown in Figure 3, it is possible to adjust this threshold for optimisation purposes on this model. \(\phi\) correlation of recall on AI images is shown in Figure 4, a \(\phi\) of 1 indicates that the detected AI images are effectively the same as another detector whilst a \(\phi\) closest to 0 indicates the models are fully complementary.

Turning next to the subset of 400 images which were subject to the open-source models, Hive Moderation (M-H) and the SynthID verification, both M-C and M-H saw 0% false positive rates on this dataset as shown in Table 4. As we saw across the entire dataset, M-C did yield a false positive, despite a very low recall rate, so accordingly this should not be taken to assume that M-H has an absolute zero false positive rate across larger datasets - however it does indicate it is very low (despite strong recall). However, as shown in Table 5 we found that model M-A saw the most cases where it was the only model to correctly positively identify an AI-generated image. The \(\phi\) correlation of recall on AI images is shown in Figure 5, including SynthID. The negative correlations on SynthID detectors are expected as a majority of the AI-generated images did not have the SynthID watermark embedded during OpenAI’s rollout.

N=400 (200 AI / 200 real).

Common subset, N=200 AI images.

Finally, Table 6 shows the top generator attribution from Hive Moderation of images it attributed to be AI-generated. The fact that the top attributed model is gptimage2 indicates that GPT-Image-2 was in-distribution for the model.

Hive-detected GPT-Image-2 images (N=168).

6 RQ3: Corroborated Approaches↩︎

On the subset of 400 images, we saw a rapid decrease in false positive rate from 28% to 2% simply by relying on the output of two detectors instead of just one. This dropped to 0% when corroboration spanned three detectors. This is shown in Table 7. Interestingly, if the most disparate probabilistic detectors alone required corroboration (M-C and M-A), there were no false positives, but the recall rate dropped to just 7.5% as only 15 true positives were recorded. The absolute accuracy rate where any model was corroborated with the output of any other was 94.8%, beating even M-H at 92.0% accuracy.

5 detectors; N=400 (200 AI / 200 real).

Where the out-of-domain detectors were used across all 4000 images, the results are shown in Table 8. In terms of accuracy metric, an uncorroborated finding from any one model beat the performance of any individual model, however note that the false-positive rate under this configuration was significant (20.7%). By contrast, requiring corroboration between two models dropped this false positive rate to 1.7% and to 0% between three models.

3 detectors; N=4000 (2000 AI / 2000 real).

This effect can be seen in Table 9 (for all four detectors) and Table 10 (for the three out-of-domain detectors), where a FP/TP rate is calculated (i.e. the cost of obtaining a true positive for each false positive, a higher value indicates a greater cost).

4 detectors; N=400. FP/TP = false positives per true positive (0.00 = zero FP). Final two rows: most-disparate pair M-C, M-A.

3 detectors; N=4000. FP/TP = false positives per true positive (0.00 = zero FP). Final two rows: most-disparate pair M-C, M-A.

7 Analysis & Limitations↩︎

In relation to RQ1, in the week following the launch of GPT-Image-2 by OpenAI, we found evidence that SynthID watermarks began appearing on the 25th April 2026. Of 200 AI-generated images, 36 contained this watermark. Of 200 non-AI images, OpenAI found none of these images contained the watermark. This finding is useful for forensic practitioners in demonstrating that even before official launch, SynthID watermarking can be useful to assess the provenance of such images (but should not be considered conclusive).

In relation to RQ2, across the five detectors evaluated, M-H (Hive Moderation) and M-B showed the greatest similarity in images they would detect, however still only yielded a \(\phi\) correlation of 0.35. For probabilistic detectors, M-A and M-C yielded the greatest dissimilarity. The probabilistic detectors all yielded varying performance when considering accuracy and precision. Future work may wish to consider when detectors are running in out-of-domain circumstances, how recalibration could affect these metrics.

In relation to RQ3, across the three detectors on 4000 images, we found that requiring corroboration between the output of two detectors reduced the ratio of false positive to true positive detections (FP/TP) from 0.22 to 0.02. Increasing the corroboration to three models reduced this ratio to 0.00. A similar effect was seen in the subset of 400 images classified using five detectors.

Future work may wish to consider this on alternative datasets, such as an alternative newer dataset of human-generated images and other synthetic media generators. We note that a single model operated at a stricter threshold also trades recall for precision; a comparison of corroboration against threshold-tuned single models and score-level fusion is left to future work. Where rates of zero are reported, the 95% Clopper–Pearson upper bound is 1.83% for N=200 and 0.18% for N=2000.

8 Conclusion↩︎

This paper highlights the importance of diversity of reasoning in Artificial Intelligence models. Whilst there has historically been a tendency to consider that larger singular models are better, our research here has shown that corroboration of the output of multiple models can produce disproportionately lower false positives to true positives, even in the context of synthetic media detection.

For forensic practitioners specifically, this provides quantifiable results showing this phenomenon in this context. This paper also provides forensic practitioners, for the first time, quantifiable results showing OpenAI’s SynthID watermark demonstrated no false positives for synthetic media detection and evidence that such watermarking was in operation before the official launch.

In relation to Artificial Intelligence development, accuracy metrics have typically considered false positives and true positives to be of equal weight. Where risk exists in the case of an erroneous output or a legal burden-of-proof is different, this metric may not be applicable. This paper highlights that there exists a route beyond this inductive reasoning approach, even where deductive conclusions cannot be reached. Abductive approaches, which seek to identify the most likely conclusion based on corroborating the output of multiple models, provide a path forward.

However, a key limitation (and area for future work) is that in a world where models become larger and there is greater potential for overlap in training data, it is unclear whether such approaches require the creation of more models in more domains (such as LLMs) that share less similarity in design and training.

References↩︎

---

1. This research was funded by NCSC, part of GCHQ.↩︎