False positives in AI image detection

Ask most people what an AI image detector should do and they'll say "catch the fakes." Ask a forensic examiner and they'll worry about the other error first: the real photograph the detector wrongly calls AI. That mistake has a name, the false positive, and in almost every setting that matters it is the more expensive of the two. This article is about why, and about the number no honest detector should hide.

Two errors, and they are not equal

Every detector makes two kinds of mistake:

• False positive: a genuine photo flagged as AI.
• False negative: an AI image that slips through unflagged.

You can trade one for the other by moving the decision threshold, so a single "accuracy" figure tells you almost nothing until you know how that trade was made. The two errors also land differently depending on who is harmed. Flag a real family photo as synthetic in a fraud review, a news desk, or a courtroom, and you haven't made a small error; you've accused something authentic of being fake. That is the failure that ends trust in a method.

The base rate is why false positives dominate

Here is the part that surprises people. Even a low false-positive rate produces mostly false alarms when the thing you're hunting for is rare.

Imagine a moderation queue of 1,000 images, and suppose 20 of them are actually AI-generated (the exact numbers here are illustrative; the shape of the result is not). Run a detector calibrated to a 5% false-positive rate:

• Of the 980 real photos, up to about 49 get wrongly flagged.
• Of the 20 AI images, a realistic detector catches roughly half, so about 11.

So the detector raises around 60 flags, and 49 of them, the clear majority, are false alarms on real photographs. The rarer the AI images in your pile, the worse this ratio gets. A detector's false-positive rate isn't a footnote to its accuracy; when the base rate is low, it is the thing that decides whether the output is usable at all.

This is why the first question to ask any detector is not "how many fakes does it catch?" but "how often does it cry wolf on real photos, and on what kind of real photos was that measured?"

The 0.5 trap

Most detectors output a score between 0 and 1 and leave you to pick a cutoff. The tempting default, 0.5, is where a lot of tools quietly fall apart on real-world images. Compression, resizing, and screenshotting scramble exactly the high-frequency statistical traces a detector reads, and an un-calibrated model often reads that damage as evidence of synthesis.

In our own benchmark, a well-known public detector run at its default 0.5 threshold flagged about 27% of genuine photographs as AI once they had been through a messenger re-encode. Nothing is wrong with that model's science; everything is wrong with using it at a threshold nobody calibrated for the images it's actually seeing.

How a false-positive rate gets capped

The alternative to a guessed threshold is a measured one. Our benchmark run (full_v4) scores 8,064 images across 8 conditions, because real images don't arrive clean; they arrive re-compressed, screenshotted, and re-shared. For each condition and each false-positive budget, the operating threshold is set so that every real source in the benchmark stays at or under the cap. The noisiest real source is the one that sets the bar.

That produces two verdict settings, and both are printed on the report itself:

• Standard: at most 5% of real photographs flagged.
• Strict: at most 1%, the setting for evidentiary work.

The threshold is never the naive 0.5, and it is different for a clean file than for a screenshot of a WhatsApp image. A verdict without a stated false-positive cap and the condition it was measured under is not a measurement; it's a guess wearing a number.

What capping the false positives costs

Holding the false-positive rate down is not free, and you should hear the price from us. The detector's ranking quality under the hardest condition, a screenshot of a WhatsApp image, has an AUC of 0.933, which sounds excellent. But you can't act on a ranking; you need a threshold, and at a threshold that keeps false positives capped the honest detection numbers are lower:

• At the standard (≤5%) cap, the detector catches roughly 55–64% of AI images depending on condition. Under that hardest condition specifically, it's about 55%.
• At the strict (≤1%) cap, it catches roughly 36–45%, about 43% under the hardest condition.

The gap between the impressive AUC and those operating rates is the price of alarms you can defend. Every detector pays it; most quote the top number and go quiet about the rest. For the fuller picture of why one accuracy figure is usually a non-statement, see how accurate AI image detectors really are.

Why forensic work chooses the strict cap

If a flag might end up in front of someone paid to break it, the 1% cap is the one to use, and the trade-off is deliberate: fewer catches in exchange for alarms that hold. Two consequences follow directly from a capped false-positive rate, and neither should be buried:

1. A flag is strong evidence. At the strict setting, a flagged image came from a process wrong about real photographs at most 1% of the time.
2. "Not flagged" is not "real." A detector calibrated to protect real photos deliberately lets borderline AI images pass rather than inflate false alarms. Absence of a flag is absence of evidence, never a certificate of authenticity.

What a low false-positive rate still can't buy you

• It doesn't beat the base rate for you. A 1% false-positive rate is still 1%; on a large pile of genuine images that is real people wrongly flagged. Detection is a filter for human review, not a verdict machine.
• Unseen generators move the numbers. A cap measured against known generators may not hold against a model released last week, ours included.
• Heavier degradation means less signal. The more an image has been compressed, cropped, or downscaled, the less any statistical method can say, and the report states the condition it estimated.
• It never proves authenticity. A capped false-positive rate makes a flag trustworthy. It does not make the absence of a flag mean "genuine."

If you take one thing from this: a detector's honesty is legible in its false-positive rate. A tool that publishes the rate, the conditions it was measured under, and the detection power it costs is one you can reason about. A "99% accurate" badge with none of that is a slogan, and slogans don't survive scrutiny.