An allegation that an image is “AI-generated” can concern several different facts. The whole image may have been synthesised. A camera photograph may have been altered in one region. A genuine camera image may be accompanied by a false account of where or when it was taken. An expert instruction should identify which proposition matters, because no single test resolves all three.
The object supplied for examination matters as much as the allegation. An original file from a device, a messaging-app export, a web download and a screenshot are different pieces of evidence. Each may preserve a different part of the image’s history. Record where each was obtained, retain the supplied bytes, calculate integrity hashes where appropriate and keep any conversions as separately identified derivatives. NIST’s digital-evidence preservation guidance gives broader preservation context.
Authentication is proposition-specific
“Authentic” can mean that a file has remained unchanged since acquisition, that its claimed source is supported, that the scene was physically captured, or that what it depicts occurred as alleged. Those propositions require different evidence. A matching hash supports the integrity of a defined copy across a documented interval. It says nothing, by itself, about the truth of the content before that interval. A signed Content Credential may support a stated provenance claim, subject to the signer and chain. It cannot guarantee the truth of a caption or rule out staging in front of a camera.
If a file contains metadata, determine which application or system wrote each relevant field and whether subsequent export could have rewritten it. A missing field is often a statement about processing history rather than image origin. Where a C2PA manifest exists, validate its binding and signature, then examine what its assertions actually say. A provenance discontinuity should be reported as such, not automatically turned into a synthetic-origin finding.
From measurements to opinion
An AI-image detector yields a model observation. Its thresholded label may be useful if the model was tested on material sufficiently like the questioned image and the error rates are known. The examiner should identify the model version, preprocessing, relevant validation population and any reason the result may be outside that population. The reliability analysis shows why a headline accuracy figure is inadequate.
Sensor-related measurements may address the narrower question of physical camera capture versus synthetic generation. SPOT—Sensor Pattern Origin Testing measures characteristics of image noise residues and evaluates support for specified origin hypotheses. Its peer-reviewed experimental report concerns defined Dresden camera and DALL·E imagery; it does not establish universal performance on every derivative file. A likelihood ratio from a suitable examination describes relative support under the models, not the probability that a witness is telling the truth.
Interpretation should remain explicit about alternative explanations. A camera can photograph an AI-generated image on a screen. Heavy recompression can change measurable traces. A composite can contain both camera-recorded and generated regions. A whole-image result might therefore be uninformative for the actual allegation, even when the measurement itself is sound.
An expert opinion is most useful when it identifies the question asked, material examined, observations made, method and tested scope, plausible alternatives and the strength and limit of the inference. The same record may support a strong conclusion about file integrity, a qualified conclusion about camera origin and no conclusion about the person responsible. Reporting those outcomes separately preserves the evidential value of each.