How to tell if something was made by AI (and when you can't)

This morning we paid an image model 3.5 cents for a photograph of a farmers market that does not exist. Golden light, crates of tomatoes, shoppers with woven bags: it would pass on any local news page. Then we opened its metadata to see what the file admits about itself. The answer: nothing. No AI marker, no provenance record, no fingerprint. A default note from the JPEG encoder is the only clue, and one re-save removes it.

“Is this AI?” has become a daily question for teachers, editors, moderators, and anyone with a family group chat. There are three families of tools that promise an answer: invisible watermarks, provenance labels, and detectors. Each one is real, each one works somewhere, and none of them does what most people assume. This post walks through all three, shows where each breaks, and ends with the checks that actually hold up. The honest summary comes first.

The honest answer: after the fact, you usually can’t

Every reliable signal about AI content is attached at the moment of creation, by the tool that created it. An invisible watermark is woven in while the pixels are generated. A provenance label is signed and attached when the file is saved. Both require the generator to cooperate. The third family, detectors, skips cooperation and guesses from the artifact alone, which is why it performs the worst.

Our market photo shows the gap. The model behind it participates in no watermarking scheme and signs no metadata, and it is one of hundreds of models in that position, including every open-weights model anyone runs on their own machine. Content from those sources arrives with no marks to find. Whatever detection story you read about, it applies to the subset of AI that chose to identify itself.

So the useful question is not “can AI content be detected?” It is two narrower ones. Did the tool that made this attach evidence at creation? And did that evidence survive the trip from there to your screen? The first depends on which tool was used. The second depends on every platform, app, and screenshot in between. Each of the three families answers those questions differently, and the differences are the whole story.

Invisible watermarks work, inside one company’s walls

The most serious watermarking effort is Google DeepMind’s SynthID, which embeds a signal invisible to humans directly into AI-generated images, audio, video, and text. It is genuinely robust for media: Google designed it to survive cropping, filters, frame-rate changes, and lossy compression, which means it usually survives the screenshot that kills every metadata approach. For text, it works by nudging word choices during generation, which is cleverer but more fragile: a watermark woven into word choices cannot survive someone rewording the passage.

The scale is real. By May 2025, Google said SynthID had marked over 10 billion pieces of content from its Gemini, Imagen, Lyria, and Veo models, and announced a SynthID Detector portal that highlights which parts of an upload carry the watermark. Note the asterisks, though. The portal launched with a waitlist for journalists, media professionals, and researchers, not the public. And it answers exactly one question: did a Google model make this? Content from OpenAI, Midjourney, ByteDance, or the model we used for our market photo reads as unmarked, because each vendor’s watermark is a private language only that vendor can read. Watermarking is real security with a coverage problem: it proves what one company made, and says nothing about everything else.

There is also a structural reason the coverage gap will not close. Watermarking happens inside the generation code, so it only binds models whose code the vendor controls. The moment a model’s weights are published and people run it on their own machines, any watermarking step is just a line someone can delete. That is not a criticism of open models; it is arithmetic. A watermark regime can cover the big cloud providers and nothing below them, which is why our 3.5-cent market photo, and the millions of images like it, will stay invisible to every detector portal ever built.

Provenance labels are receipts, and screenshots burn receipts

The second family tries to fix the coverage problem with an open standard. C2PA, the Coalition for Content Provenance and Authenticity, counts Adobe, Google, Meta, Microsoft, OpenAI, Sony, Amazon, the BBC, and TikTok on its steering committee, and its Content Credentials work like “a nutrition label for digital content”: a cryptographically signed record of who made a file, with what tool, and what edits followed. Some high-end cameras can sign photos at the moment of capture, Adobe’s apps preserve and extend the record through editing, and anyone can inspect a file’s credentials with the coalition’s public verify tool. Over 500 companies are involved. This is the most promising architecture in the whole space, because it aims to prove where content came from rather than guess at what it is.

The mechanics matter, because they are what make the label trustworthy. A Content Credential is not a caption; it is a manifest bound to a fingerprint of the file’s actual pixels and signed with a certificate, the same math that secures the padlock in your browser. Change the image and the fingerprint no longer matches, so tampering shows as a broken seal rather than a plausible lie. Each edit appends a new signed entry, which is how a photo can carry its history from camera through crop to publication. The specification is open, currently at version 2.3, and any tool can implement it.

It also has a failure mode you can trigger with one keystroke. Content Credentials live in metadata, and metadata does not survive contact with the internet. OpenAI said this itself when it added C2PA to DALL-E 3 images in February 2024: the metadata “can be easily removed from the image accidentally or intentionally,” most social platforms strip it on upload, a screenshot deletes it, and “an image lacking this metadata may or may not have been generated” by its tools. A signed receipt proves what it proves only while it stays attached, and the everyday internet detaches it constantly.

Detectors guess, and their mistakes land on people

The third family is the one most people actually use: paste text or upload an image, get back “97% AI.” The problem is that the best-resourced attempt at this failed in public. OpenAI launched a text classifier in January 2023 and quietly retired it that July over its “low rate of accuracy”; in TechCrunch’s own testing it caught one of seven AI-written samples. If the company that built ChatGPT could not reliably detect ChatGPT, the dozens of paid detectors promising 99% accuracy deserve your skepticism.

The misses would be tolerable if the false alarms were rare. They are not, and they are not evenly distributed. A Stanford study ran essays through seven AI detectors: writing by US-born eighth graders passed nearly perfectly, while over 61% of essays by non-native English speakers were flagged as AI-generated, and 97% of those essays tripped at least one detector. The reason is structural, not a bug: detectors flag predictable, plain wording, which is exactly how people write in a second language. The researchers also showed simple prompt tricks slip generated text past the same tools, so the detectors miss the cheaters and flag the honest.

Detection is also a moving target in a way the marketing never mentions. A detector learns the statistical tics of yesterday’s models, and every new model generation is trained, in part, to not have them. The classifier that looked respectable against 2023 text faces 2026 text with the same brand name and a worse hit rate. Any accuracy claim without a date attached is an answer to a question nobody is still asking.

Images fare no better in the wild. Meta’s labeling system is not even a guessing detector; per its own documentation, it reads the C2PA and IPTC markers that tools from Google, OpenAI, Microsoft, Adobe, Midjourney, and Shutterstock attach, and Meta admits in the same post that “there are ways that people can strip out invisible markers.” Even reading honest markers went wrong: when auto-labeling started in May 2024, photographers found the “Made with AI” badge on real photos they had merely retouched; two months later Meta renamed the label to the vaguer “AI info” rather than defend calls it could not back. That is the detector story in miniature: confident labels, wrong in both directions, softened after the damage.

Text, image, audio, video each fail in their own way

“AI detection” sounds like one problem, but the four modalities are in four different places, and knowing which one you’re looking at changes what a check is worth.

Text is the worst case: it is the only modality where the content routinely gets retyped, translated, or pasted into a new file, which launders away any conceivable mark. Images are the best case, with robust watermarks and growing provenance support. Audio shows how deep the per-provider silo goes: ElevenLabs’ own classifier checks only whether audio came from ElevenLabs, cannot see other vendors at all, and by the company’s own admission does not reliably classify audio from its newest v3 model. Video inherits every image problem plus universal platform re-encoding. And real pipelines mix modalities: an AI still animated by a video model, compressed by a platform, then screen-recorded, sheds whatever marks each stage carried.

Follow one plausible essay through the wash. A student generates a draft in a chatbot that watermarks text, pastes it into a document editor, accepts a grammar tool’s rewrites, and translates two paragraphs from another language. The watermark dissolved at the first paste. The detector that later scores this essay is not measuring any of that history; it is measuring how predictable the final wording is, which the grammar tool just optimized for. This is why the modality table above matters more than any single product claim: for text, the chain of custody is unrecoverable by design, and for images it is merely fragile.

What actually works: check the source, not the pixels

The through-line of every failure above: inspection of the artifact is weak, evidence attached at creation is strong. That is also the direction regulation is pushing. The EU AI Act’s Article 50, applicable since August 2, 2026, requires providers of generative systems to mark outputs as artificially generated in a machine-readable way, and requires deployers to disclose deepfakes. The same article obliges chatbots to tell you that you are talking to a machine when it is not obvious, and carves out artistic and satirical work, which only has to acknowledge that manipulation exists rather than plaster a label across the piece. None of this stops a screenshot or an open model on a laptop, but it moves the default from “unmarked unless someone bothers” toward “marked unless someone strips it,” and it puts the duty on the companies attaching the marks rather than the readers hunting for them.

The new default is already visible in vendor documentation. Anthropic, for example, began marking Claude’s output on exactly August 2, 2026: an imperceptible watermark in generated text plus C2PA metadata on image files, across its apps, API, and cloud partners. Read the limitations section of that page, though, because it is the same list this post has been building: marks can vanish through heavy editing, screenshots, and format conversion, short passages may not carry enough text to mark, and the absence of a mark proves nothing about origin. When the vendors attaching the marks lead with those caveats, believe them.

Until that world arrives, the checks that hold up are older ones:

• Look for credentials, and weigh them one way. Run suspect images through the Content Credentials verify tool. A signed record telling you an image came from a camera, or from DALL-E, is strong evidence. An empty result is evidence of nothing, as OpenAI’s own caveat spells out.
• Interrogate the source, not the file. Who published this, and do they answer for it? A wire photo exists in an outlet’s archive with a byline; a fabricated one exists as one orphan file. Provenance by institution predates provenance by metadata and still works.
• Cross-check the event. Real moments generate multiple independent angles, witnesses, and follow-ups. Fabrications are single-file phenomena.
• Demote detector scores to hints. Use them to decide what to look harder at, never as the accusation itself. The Stanford numbers should end the practice of failing a student on a percentage.
• Keep your own provenance. If you generate content, keep the originals and the generation records. Our own desktop app writes the prompt, model, and provider into a local record for every file it generates, which is the pattern worth demanding from any tool: the receipt should exist from the start, on your disk.

Treat unlabeled as unknown

Here is the frame worth keeping. A watermark or a signed credential can prove something is AI-made. Nothing can prove something is not. And the absence of any mark proves nothing at all, because the marks are optional, provider-specific, and one screenshot from extinction. “Unlabeled” does not mean “human”; it means “unknown.”

In practice: trust provenance when it is present, demand sources when it is absent, and refuse to let a detector percentage stand in for either. If you make things with AI, be the counterexample: label your work and keep your receipts, because undisclosed AI content is exactly what taught readers to distrust everything, and models confidently invent far too fluently for anyone to eyeball the difference anymore. The question “is this AI?” will keep getting harder. The question “where did this come from?” still has answers.

Disclaimer: This article is general information, not legal advice, and reading it creates no attorney-client relationship. Laws, regulations, and court rulings summarized here reflect sources available as of August 2026 and may have changed. Consult counsel licensed in your jurisdiction before acting on any of it.