Meta AI detector fails to identify half of its own cropped fakes.

      The Meta AI detector aims to identify fakes produced by Meta itself. However, after cropping an image, over half of them bypass the detector unnoticed. The tool was intended to be a solution for the deepfake issue, rather than a demonstration of the problem. Recently, Meta showcased an image detector alongside Muse Image, its most advanced image generator, claiming it could recognize any creations from the model, even after modifications.

      However, when Reuters conducted a test, generating 40 images using Muse Image, cropping them, and re-submitting them, the detector failed to identify more than half of them.

      The issue arose from a basic crop. Reuters discovered that the tool verified all 40 original AI-generated images, but after cropping those images down to about a third or a half of their original size, it did not flag 55% of them. A simple crop, a common practice before sharing, was sufficient to eliminate the signal the detector relies on.

      The core of the issue lies in a watermark known as Content Seal, which Meta claims is an invisible marker embedded in every image created by Muse Image. On its website, Meta asserts that the Meta AI detector can still identify its images post-cropping, but the Reuters findings indicate this holds true only to a certain extent.

      In response to the test results, Meta emphasized that the detector is still in preview mode. They stated that while the watermark is designed to endure typical edits, the signal "may be lost if an image is heavily cropped." This highlights the contradiction in one statement: the mark is intended to be durable, yet a common online editing practice can erase it.

      Meta isn't facing this challenge alone either. Google and OpenAI have also cautioned that their detection tools are not infallible against altered images. Watermarking remains the industry’s preferred approach to synthetic media, with major labs relying on various versions of it. For instance, Google’s SynthID recently disproved a notable deepfake, showcasing the technology's potential, yet Meta’s shortcomings present an argument against solely relying on it.

      Experts have pointed out this vulnerability for some time. Siwei Lyu, a computer science professor focused on image forensics at the University at Buffalo, mentioned that watermark methods are effective as long as the mark remains intact. The problem arises when modifications occur. “Any change that removes or weakens the embedded signal—like cropping, resizing, or heavy compression—can diminish their effectiveness,” he told Reuters.

      Others believe the goal shouldn't be absolute perfection. AI researcher Sarah Barrington from UC Berkeley analogized watermarking to security systems that may not catch every threat but still mitigates significant risks. “Even if we catch only 90%, that’s still a great leap from 0,” she said. Both perspectives can coexist.

      Nevertheless, a detector that misses 55% of slightly edited images is far below the 90% effectiveness and contributes to an expanding market for AI detection that still cannot ensure reliability.

      The timing of this issue is crucial as well. The United States approaches a midterm election year, and platforms are preparing for an influx of AI-generated fakes targeting voters. Governments, including South Korea, are also drafting punitive regulations against misleading content.

      In March, Meta’s Oversight Board recommended the company take further action against deceptive AI and enhance detection capabilities. Four months later, the primary detector still struggles to reliably recognize Meta’s own content once cropped.

      Despite this, Content Seal is not entirely ineffective. A tool that marks new, unedited images still increases the difficulty of passing off a fake, and Meta plans to expand this system to video. However, it challenges the notion that a watermark is a definitive solution rather than merely an obstacle. Those most likely to remove a signal are precisely those a detector is designed to catch. In the realm of synthetic media, as in education, detection continually arrives a step behind. Given the current evidence, catching up requires nothing more than a crop.