Detecting deepfakes: What detection tools can do and where they reach their limits

Why the naked eye is no longer enough

On average, people detect deepfakes barely better than chance, and the familiar lists of telltale signs go out of date with every new model generation.

A meta-analysis of 56 studies (Diel et al., 2024, published in Computers in Human Behavior Reports) puts human accuracy at 55.54 percent; statistically, the difference from a coin toss is not significant. Fraunhofer AISEC, the Fraunhofer Institute for Applied and Integrated Security, added in August 2025 that trained people detect deepfakes more reliably but do not reach the hit rates of automated systems, and that deepfakes “will become ever easier to produce in the future” (translated from German).

Even so, almost every guide starts with a list of telltale signs. Germany's Federal Office for Information Security (BSI) lists on its topic page, as of December 2022, visible artifacts along the seam around the face, blurred contours at the teeth and eyes, and a metallic sound in voices. klicksafe, the EU-funded initiative for media literacy, adds a blank stare and wrong shadows, and concedes in the same text:

“We must assume, however, that the technology will keep improving and that deepfakes will in fact no longer be recognizable as such.” (translated from German)

These tips are not wrong; they describe the flaws of the generators that existed when they were published. So the naked eye is no longer a test method. It is the reason to start one.

What to do when you suspect a deepfake

With a suspicious image or video, check origin and context first and the content itself last. The detector comes last because it only estimates; a marking from the AI tool, by contrast, can be read out and yields a finding.

1. Check the source. Who published it, on which channel, with what history? Fact-checking teams have already examined many viral cases. Platform notices such as Meta's “AI info” help you classify a piece of content but prove nothing, because some of them are generated automatically from technical information in the file.
2. Read out Content Credentials and metadata. Metadata is invisible additional information stored inside the image file; people see none of it, checking software can read it out. Content Credentials are signed origin data under C2PA, an open standard for origin information directly in the file (C2PA explained). You can read them with the verification tool of the Content Authenticity Initiative or with on:mint Verify, a free browser extension for Chrome: with a right-click, it checks any image online for Content Credentials, on:mint proof of origin and AI labeling. Verification tools distinguish “valid” (signature intact) from “trusted” (the signature chain ends at a listed trust anchor); more on this: Checking and understanding Content Credentials. If the tool finds no Content Credentials, that tells you, for now, nothing. Not every tool writes them, and metadata is often lost on upload.
3. Reverse search. The image search of common search engines shows when and where an image or video first appeared and whether earlier versions exist.
4. Context and plausibility. Check whether the statements and behavior of the person shown contradict what they usually say and do, and whether place, date, weather and other footage of the same event fit together.
5. Only then the detector, as an indication. A deepfake detector estimates how likely it is that content is synthetic, and so provides a supporting indication where markings are missing. The Code of Practice on Transparency of AI-Generated Content, the EU's practical guide to the labeling obligations, requires its signatories, as far as technically feasible, to state whether a result is based on a marking or on forensic detection, that is, on an estimate drawn from the content itself. Document the result and never decide on it alone.

The limits of detectors show how uncertain an estimate drawn from the content is.

Where deepfake detection fails

Deepfake detection in the narrow sense is forensic detection: a trained model looks for traces of synthetic generation in the content itself, without any marking having been set beforehand. Checking a marking is something else: reading out Content Credentials or a watermark. The AI Act only requires the second from providers. “Detector” here means the forensic method.

A forensic detector works with the material it was trained on; if “individual parameters are changed, the outputs are often not correct”, writes the BSI (translated from German). NIST, the US standards body, speaks in its report on synthetic content of a “cat-and-mouse game” between detection and generation. In everyday use, the detector meets exactly the material it does not know, in four places:

1. New generators. According to NIST, detectors recognize images from the generator they saw in training better than any others. A research team from Fraunhofer AISEC and EURECOM (Interspeech 2024) showed for audio that, to the detector, fakes from an unknown generator are above all different, not merely harder to detect.
2. Compressed copies. Online, deepfakes circulate compressed, downscaled, photographed off a screen or re-uploaded, and that is exactly where detectors lose performance, according to NIST. A benchmark with real cases from 2024 (Chandra et al., University of Washington and others, 2025) calls academic test data outdated: the discrimination performance of open-source detectors, meaning their ability to tell real content from synthetic content, drops by roughly half on material from the web. Why an invisible watermark survives such copies is explained in AI watermarks: what remains when the metadata disappears.
3. Errors in both directions. Realistic AI images pass as real; in a test with AI images that people can hardly identify either, almost all detectors tested rated them as real. Conversely, detectors flag real photos as synthetic; the EU Code of Practice notes that false alarms can undermine trust in a detection method, and for companies that is the more expensive error.
4. Targeted interference. Anyone who knows the detector can fool it. The BSI describes noise laid over the manipulated image: so slight that a person does not notice it, but enough to stop the detector from classifying the fake as such.

No detector has been shown to hold up against new generators and targeted attackers. The detector remains a supporting indication, which is why the law ties detectability to markings.

What the law means by detection

The AI Act requires providers of generative AI to ensure that their outputs are marked in a machine-readable format and “detectable” as artificially generated or manipulated. What is meant is establishing a marking that the provider set itself; the law requires forensic guesswork from no one.

Article 50(2) AI Act speaks of outputs that are “marked in a machine-readable format and detectable as artificially generated or manipulated”; the recitals call the process detection and list watermarks, metadata identifications, cryptographic methods for proving provenance and fingerprints, among others. The European Commission's guidelines on the transparency obligations from July 2026, which supervisory authorities go by, require both together: the marking and a means of detecting every marking used. A detection tool is then a mechanism that establishes whether content was AI-generated or AI-manipulated, typically using technical markers or signatures that verify its origin.

The Code of Practice obliges the providers of generative AI systems that have signed it to provide a detection tool for their markings, usually free of charge. Providers of marking and detection solutions can also sign the Code; on:mint has signed it and provides a free detection tool, on:mint Verify. In the Code of Practice, forensic detection is only an optional additional measure, and the Code says explicitly why: when it was published, forensic detection methods were not considered mature enough to meet the quality requirements of Article 50(2) AI Act.

Under the law, a deepfake is AI-generated or AI-manipulated image, audio or video content that resembles real persons, objects, places, entities or events and would falsely appear to be authentic (Article 3(60) AI Act). Who is the provider and who is the deployer: Who has to label AI images?.

Remember: the provider marks for machines, you disclose for people. The law relies on marking and proof, and that is exactly where the way out of the arms race lies.

Proof instead of detection: proving origin at the original

A detector estimates whether an image might be synthetic; proof of origin shows who signed it and when. For companies, the second is what counts.

A detector works like a sniffer dog: it only knows the scents it was trained on, and now and then it reacts where there is nothing. Proof of origin works like a passport with stamps: it says nothing about the holder's character, but it shows who issued it and where it has been since.

Technically, there are three methods behind this, each making a different statement. Content Credentials are based on cryptography: a digital signature shows who signed what and when; any change to the signed parts of the file breaks the link between proof and file and thereby becomes detectable. An invisible watermark is steganography: an identifier in the pixels that, unlike metadata, is designed to survive copies and format changes; if the metadata is lost on upload, the key to the stored proof stays in the image. Forensic detection is a statistical estimate without any marking.

The proof has a limit: Content Credentials deliver no verdict on whether what is shown is true. C2PA, the body behind the standard, says itself that its standard is not a cure-all against disinformation; it complements media literacy, fact-checking and digital forensics such as deepfake detection. The BSI names the limit of a signature at capture: it does not prevent “the source itself from manipulating the material beforehand” (translated from German). Fraunhofer AISEC sees exactly this as where the value lies:

“In parallel, the traceability of unaltered information should also be strengthened. In addition to exposing ‘deepfakes’, this makes it possible to label unaltered original recordings verifiably as such.” (translated from German)

If you check other people's content, you have to rely on indications. If you protect your own content, you sign it at the original and, for AI images, document the act of labeling; if a detector then flags a real product photo as an AI image, you do not have to guess, you show the proof. How to prove that your own footage is authentic: Proving authenticity.

Conclusion: Detecting deepfakes remains an arms race, proof at the original does not

The naked eye is no longer a test method, and detectors estimate with known weaknesses, because they only know yesterday's generators and lose discrimination performance on copies. That is why the AI Act requires something other than guessing: providers mark their outputs in a machine-readable format and provide a tool that detects that marking; you, as a deployer, disclose your own AI content visibly. There are two things to do: when you suspect a fake, check origin and context before the content and bring in the detector last, as an indication; for your own content, create proof at the original so that “Is this real?” is no longer a matter of estimation for anything your company puts out.

That is why we built mintys, the AI labeling app by on:mint: a visible label in the image; the same labeling in machine-readable form under C2PA in the file; an invisible watermark in the pixels that survives cropping, compression and re-uploading, meaning the usual editing; and the record of when and by whom the labeling was done. That way every image carries its digital passport and you have the proof; an additional deepfake detection estimates the AI share of a piece of content and suggests the matching label. How mintys works in detail: AI labeling with mintys.

For the opposite direction, there is on:mint Verify, the free browser extension for Chrome described above: with a right-click, it checks any image online for Content Credentials, on:mint proof of origin and AI labeling. on:mint has signed the Code of Practice on Transparency of AI-Generated Content and labels according to its procedures. In July 2026 the European Commission confirmed the Code as an adequate instrument for meeting the labeling obligations; according to its guidelines, it is so far the only EU-wide recognized practical framework for demonstrating compliance. If you label with mintys, you label in line with the Code and can expect fewer requests for information from supervisory authorities: the guidelines mainly expect additional evidence from companies that do not align their labeling with a recognized code.

On the cost side: the AI Act provides for fines of up to 15 million euros for breaches of the labeling obligation or, for companies, up to 3 percent of worldwide annual turnover, whichever is higher. For small and medium-sized enterprises, the lower of the two applies. On top of that come warning letters: the Wettbewerbszentrale, a self-regulatory body of German industry for fair competition, treats breaches of the AI Act as unfair competition and set up a complaints office for AI cases in July 2026, explicitly including missing or incorrect labeling of AI-generated advertising. Warning letters, meaning cease-and-desist demands that come with a bill for costs, are therefore to be expected.

Three approaches compared. Toward the viewer, only the visible label counts; the proof counts when third parties spread your image without the label or someone disputes that it was labeled:

With mintys you simply meet your labeling obligation under the AI Act in a single pass: label in the image, Content Credential in the file, watermark in the pixels, proof included. Label visibly under Article 50 AI Act: Label AI images now. Want to prove that your own footage is authentic instead of defending it later? Content Credentials by on:mint.

Frequently asked questions