Can AI detectors be fooled?

Saving an AI image as JPEG, screenshotting it, posting it to a platform that recompresses again — each step strips signal. By the time the image circulates widely, most detectors will struggle. This is unintentional evasion: the platform compression does the work, not the user.

Tools exist that add tiny pixel-level noise to AI images, designed to push them across the decision boundary of common detectors. The image looks identical to a human but scores as 'likely authentic'. Adversarial perturbation is the cat-and-mouse frontier of the field.

For text: paraphrasing tools rewrite LLM output to defeat detectors trained on the original style. For images: pipelines that re-render an AI image through another model (style transfer, super-resolution) shift the signal patterns. For voice: adding ambient noise or compression to clones reduces clone-marker visibility.

Stripping or forging C2PA-style content credentials. Real photos can have their credentials removed (looks suspicious to a credentials-aware verifier but often passes a detector). AI images can have forged credentials added (defeats provenance-only checks). Detectors and provenance need to work together.

A 'likely synthetic' result is meaningful evidence, since it is hard to fake in that direction without re-running the generation. A 'likely authentic' result on an unknown source is much weaker evidence, since multiple plausible attacks could produce it.

The practical workflow remains: detection plus provenance plus source verification. No single layer is enough.