How AI image detectors work

An AI image detector is not a lie detector. It is a stack of cheap, fallible tests that try to answer a narrower question: does this still look like it was produced or heavily rewritten by a recent generator? Lumenfix AI image detector runs that stack in your browser. The file is never uploaded. This article is the plain-language version of what the page is doing, and why “not detected” is not the same as “real.”

Why the file should stay in the tab

Most commercial detectors send the pixels to a GPU in a data center. That is fine if you are checking a press release. It is a non-starter if the photo is a passport scan, a medical still, or someone else’s unpublished work. The Lumenfix detector is a traffic engine because the marginal server cost is zero and the privacy story is the product. DevTools should show model and WASM downloads, not an upload of your JPEG.

The cost of that choice is honesty about accuracy. A hosted ensemble with extra networks and a human review queue will beat a 45 MB Vision Transformer on hard cases. We publish the approximate band on the page: about 85–90% on recent generators, worse on screenshots, heavy compression, and brand-new models.

Layer 1 — deterministic provenance

The first layer does not download the classifier.

C2PA, via @contentauth/c2pa-web, reads a manifest store if one is attached. When a generator or an editor signed the file, you can often see the product name and a validation state. A valid manifest that says the still was produced by a named model is as close to a fact as this page gets. We surface that and do not pretend the classifier is smarter.

Metadata probes look for the messy fingerprints people actually ship: Automatic1111 and ComfyUI text chunks in PNG, Midjourney XMP, IPTC DigitalSourceType=trainedAlgorithmicMedia, and the NovelAI-style alpha steganography used by some anime checkpoints. A hit here is treated as a high-confidence “this was generated or exported from a known toolchain” result. Absence of those strings means nothing. Plenty of generators strip them.

If you need to remove a manifest, you are in the wrong product. Lumenfix will not strip C2PA or SynthID. Detection is read-only.

Layer 2 — the Community Forensics classifier

When the deterministic layer is quiet, the page loads Sieve’s v0.14 Community Forensics ViT-S/16, the w5810_best_fp16.onnx weights (MIT). The SHA is pinned in the plan and checked when the file is fetched. We host the weights ourselves so the page does not hotlink GitHub.

Preprocess copies Sieve’s offscreen.js path: decode 1:1, Pillow-style triangle resample, short side 440, center crop 384, ImageNet mean and std, NCHW float32. The runtime is onnxruntime-web 1.22. WebGPU is used only on a real hardware adapter; after session create we compare a fixed input against WASM and fall back if the logit drifts by more than 0.5. You can force WASM with ?wasm=1.

Calibration is p = sigmoid(logit + 0.2). At or above 0.65 we call it AI. Between 0.25 and 0.65 we call it unsure. Below that we call it real-looking. Those cutoffs are not a court standard. They are a published operating point so two people can compare runs.

Gating matters. A 20-pixel icon is rejected. Flat color and noise do not get a score. Strong JPEG blocking or a classic upsample signature can force “unsure — this file was recompressed or enlarged” instead of a fake confidence bar.

The work runs in a Web Worker. The first visit downloads about 45 MB and then hits Cache Storage. That is why LCP on the page can stay reasonable: the hero is copy and an upload control, not the model.

Layer 3 — forensics as an attachment

Error-level analysis, a Laplacian noise view, and an EXIF digest (exifr) are shown as extras. They are not the verdict. ELA is easy to over-read. A screenshot of a screenshot lights up like a Christmas tree and still might be a camera photo of a screen. We keep those panels so a curious user can see why a file looks processed, not so we can launder a weak classifier score.

What will fool the page

Screenshots. Social recompression. Print-then-scan. A generator released last week. A real photo run through a heavy “AI enhance” slider in a phone vendor’s app. Mixing those cases is why the banner says not detected ≠ real.

If you then want to improve a photo you already believe is a camera original, use the photo enhancer or the image upscaler. Those pages upload on purpose because they call paid models. Do not confuse them with the detector.

How this differs from a watermark detector

SynthID and similar invisible watermarks are vendor-specific. We do not ship an unofficial SynthID breaker or an unofficial SynthID reader. If a file has C2PA, we read C2PA. If it does not, we use metadata and the classifier. That is the whole story for this release.

Practical use

Use the detector when a stranger sent a still and you want a second opinion before you share it. Use it when you are about to remove text from a file and you want to know whether the letters were generated in the first place. Do not use it as evidence in a dispute. Do not use it on a thumbnail.

If the three layers disagree, believe the signed manifest first, then a specific toolchain string, then the calibrated score, then the pretty ELA image last.

If you are comparing vendors, ask three questions they often dodge. Does the product upload the pixels? What is the exact checkpoint and preprocess? What happens on a 64-pixel icon and on a screenshot of a screenshot? Lumenfix answers those in the page copy and in this article because the detector is only useful if you can repeat the measurement.

Repeatability is why we pin the ONNX SHA and copy Sieve’s resample instead of calling drawImage. A one-pixel preprocess drift moves the logit. The parity script under apps/web/scripts/detector-parity.py exists so a Python reference and the browser can be compared on the same weights. If you add a sample pair to docs/bench/detector/, you can see whether a “real” and a “fake” still land on the intended side of 0.65.

Legal and workplace use is out of scope. An HR screen of a candidate’s portfolio is a human decision. The detector can tell you the file carried a ComfyUI chunk. It cannot tell you whether the candidate is honest. Do not paste a score into a rejection email.

For product people: this page exists to rank for “AI image detector” and to send qualified traffic to enhance and upscale. That only works if the copy stays modest. Over-claim accuracy and you will get a week of backlinks followed by a year of screenshots proving you wrong.

Mobile visitors should stay on Wi‑Fi for the first load. The 45 MB checkpoint is cached after that, but a cellular first hit is a bad experience and we say so on the page. Subsequent visits should not re-download the weights if Cache Storage is intact.

That is how the detector works: local, layered, and limited on purpose. The useful part is not a single percentage. It is the list of things the file actually contained.