How to Spot Deepfakes and AI-Generated Images: A Step-by-Step Guide

There is no single tool that catches every deepfake or AI-generated image. Cybersecurity firm ESET and the Reuters Institute for the Study of Journalism at the University of Oxford both recommend layering several checks — visual inspection, provenance metadata, watermark detection and source verification — because each method has known blind spots.

Step 1: Look for visual and audio inconsistencies

ESET's guide to spotting AI-generated misinformation lists concrete visual clues to check first: unnatural lighting, overly smooth skin textures, flickering edges and blurred backgrounds. Facial anomalies worth checking include misaligned eyes, distorted teeth and unusual blinking patterns. For video, a mismatch between the audio and the speaker's lip movements is a common sign of manipulation, according to ESET.

ESET also notes that tools used to create deepfakes often alter or erase a file's creation and modification dates, so inconsistent metadata can be a secondary clue.

Step 2: Check for Content Credentials (C2PA)

Content Credentials, built on the C2PA technical standard, record information about an image at the moment it is created by cryptographically signing it, according to the Content Authenticity Initiative (CAI). The CAI describes this record as a kind of nutrition label for digital content, showing the creator, the software or AI tool used, and whether the file was generated or edited with AI, when that information was included by the creator.

The CAI is explicit that Content Credentials are not meant to declare whether content is "real": they provide context about origin, not a verdict. The system also only works if the creating tool actually embeds a manifest.

Step 3: Check for an invisible watermark, such as SynthID

Google's SynthID embeds an imperceptible digital watermark directly into the pixels of images generated by its Imagen model, according to Google DeepMind. A separate detection model scans an image for that pattern and reports one of three results: watermark detected (likely AI-generated), not detected (unlikely AI-generated), or possibly detected, in which case DeepMind recommends treating the result with caution.

DeepMind says the SynthID watermark is designed to survive common edits such as filtering, color adjustment, rotation and JPEG compression. However, it only flags images that were watermarked at creation by Imagen or partner tools that use SynthID — an image from a model that does not use SynthID will return a "not detected" result even if it is AI-generated, DeepMind's documentation shows.

Step 4: Run a reverse image search

Reverse image search tools such as Google Lens or TinEye can reveal whether an image circulated previously in a different context, which is one of the most reliable ways to catch recycled or relabeled visuals, researchers at the Reuters Institute note. If the same picture appears attached to an older, unrelated story, that is a strong signal the current claim about it is false, independent of whether the image itself was AI-generated.

Why automated detectors can still be fooled

The Reuters Institute's review of AI detection tools found that simple edits routinely defeat them. When researchers cropped and scaled a viral image purporting to show a Pentagon explosion, detection software classified the altered version as authentic. Lowering resolution and trimming a well-known Obama deepfake video produced similar false negatives, and social-media compression of an AI-generated Biden robocall caused one detector to call a copy "highly likely real," while the original uncompressed file scored 74% likely to be fake.

The review also found that detectors trained mainly on well-known public figures, such as a head of state, performed worse on lesser-known individuals with little online presence, because the underlying models had less verified reference data to compare against.

Putting it together

1. Inspect the image or video for the visual and audio inconsistencies ESET lists, such as unnatural lighting, blinking patterns or lip-sync mismatches.
2. Check whether the file carries Content Credentials (C2PA) metadata disclosing AI generation.
3. If the image may come from a Google model, check it with Google's SynthID detector for a watermark result.
4. Run a reverse image search with Google Lens or TinEye to see whether the image has appeared elsewhere in a different context.
5. Treat any single result as inconclusive on its own, and compare the claim against coverage from established news organizations before sharing it, as the Reuters Institute and ESET both advise.