How to Check if an Image Was AI-Generated (and Why Metadata Matters More Than Pixels)

The honest answer: metadata, not pixels. AI image generators leave a signature trail in the file's metadata, and that trail is far more reliable than anything you can read from the pixels themselves.

Why pixel detectors struggle

Pixel-based AI detectors look for statistical patterns in the rendered image: low-frequency artifacts, overly smooth textures, weird hand anatomy, that specific Midjourney sheen on skin. These signals fade as soon as someone crops, resizes, re-encodes, or applies a 1-pixel Gaussian blur.

They also produce false positives on heavy-handed Photoshop work, and false negatives on a tuned Stable Diffusion output with carefully crafted parameters. After four years of public benchmarks, every major open detector has lost the cat-and-mouse game with simple post-processing. Closed commercial models do better, but they don't publish enough to verify, and they charge per-image fees that don't scale.

What metadata tells you instead

The generator doesn't just produce pixels — it writes a manifest. Look at the file once and you can usually see exactly what made it:

• Adobe Firefly — full C2PA Content Credential with issuer certificate.
• Midjourney — parameters XMP field with prompt, model version, seed.
• OpenAI / DALL-E 3 — dalle XMP field, plus openai software tag in EXIF.
• Stable Diffusion (AUTOMATIC1111 / ComfyUI) — Software: NovelAI or Stable Diffusion XL in EXIF, often with PNG tEXt chunks carrying generation parameters.
• Microsoft Bing Image Creator / Copilot Designer — C2PA credential.
• Ideogram — ideogram XMP field plus a C2PA attestation as of 2024.

If you see a signature, that's binding. If you see nothing, the image may still be AI — most platforms strip metadata on upload — but a confirmed signature is your strongest single signal.

How to actually read the metadata

Three options, ranked by convenience:

1. Browser drag-and-drop — drop the file into AI Metadata Ninja's tool. It shows C2PA, XMP, EXIF, GPS, and ICC in plain English, in under a second, entirely in your browser. No upload, no account.
2. ExifTool — install once, run exiftool image.jpg and parse the output. Cumbersome but exhaustive.
3. Adobe Content Authenticity Tool — a free browser extension that focuses only on C2PA, hiding everything else.

If you want a defensible reading rather than a quick glance, combine option 2 with the GitHub-hosted c2patool CLI from the C2PA reference implementation.

What to do with the answer

• You're an Etsy / Redbubble / Printify seller — disclose and clean. Most POD marketplaces require disclosure when the source asset is AI-generated, and the metadata in your file is what a buyer's dispute will read.
• You're a journalist or fact-checker — the metadata is your citation. Chain of custody starts at the named issuer on a C2PA credential.
• You're a buyer disputing an AI-as-photo listing — the metadata is your evidence. Take a screenshot of the scan result before any subsequent takedown.

Caveats to keep in mind

• Metadata is a hint, not a verdict. Stripped metadata doesn't prove the image is or isn't AI; it only proves that no signal remains.
• Signatures only matter if the issuer's certificate chain is valid. A revoked issuer (rare but possible) invalidates everything it ever signed.
• Edited files often lose their credentials by design. Open a C2PA-signed JPEG in Lightroom, hit Export, and the credential is gone — because Lightroom is not a C2PA-aware editor. The hash chain breaks. This is intentional, not a bug.

The short version

Pixels lie, especially after edits. Metadata records what tool made the file, and a credential with a valid issuer is the closest thing the internet has to a verifiable trail. Use both — and weight the metadata heavily when they're in conflict.