Sightova V3: how our AI image detector performs

Sightova V3 is the model behind every AI-image check on Sightova, in the dashboard and through the API. It detects images from all of the major AI image generators, including OpenAI's GPT Image, Google's Nano Banana, FLUX, Midjourney, Stable Diffusion, Seedream, Qwen-Image and Grok. Unlike most AI image detectors, it also detects AI edits of real photos and deepfakes and face swaps, and it shows a heatmap of the regions it believes were changed.

False accusations do real harm, so we tuned V3 to be conservative. On 61,999 pre-2022 images from ReLAION, a diverse sample of the public web, the current model wrongly flags 0.24% as AI.

We publish our methodology, our results and our failure cases below. We don't publish the composition of our training data. The numbers above are from the model in production today; the October 2026 update compares it with the previous one on identical images.

On 11 October 2026 we replaced the production model with a retrained one. Same architecture, same 512 × 512 input, same 0.85 threshold: the API and the dashboard behave exactly as before, only the answers got better. This section compares the two models on the same frozen images so the change is measurable, not a claim.

What changed

• Far more genuine images of the kinds that used to be flagged. Scans of paintings, drawings and prints; screenshots and reposted social-media images; phone photos of people in ordinary light. These were the sources of most false positives in the September model.
• The newest generators and editors, including models released after the September model was trained.
• A stricter wall between training and testing. Every image in every frozen test set below was removed from training by exact and perceptual hash before this model saw a single example, so none of the numbers in this section can be memorised.
• Selection by false positives first. Checkpoints were chosen for the lowest false positive rate across genuine image types, subject to keeping detection of AI-edited portraits above 90%, instead of for the best overall score.

Same images, both models

Every row below is the same set of images scored by the previous model and by the updated one, at the production threshold of 0.85. Genuine images first: lower is better.

AI images, higher is better:

The biggest wins are where it hurts most: museum art drops from 0.18% to 0.01% false positives, WikiArt paintings from 7.6% to 4.2%, people's own Reddit photos from 4.0% to 2.5%, while detection of the newest generators and of GPT Image portraits went up at the same time.

Where it got worse, we say so. Two commercial portrait editors, GPT Image 2.5 and Nano Banana 2, are detected one to two points less often at 0.85. The ranking on that set actually improved (AUROC 0.9981 → 0.9985): the updated model is simply more careful about calling a photo of a real person AI, and a few edits now land just under the threshold. And on the 170 genuine portraits in AI Detector Arena, five are flagged instead of one. We shipped anyway because the model as a whole flags far fewer genuine images and catches more fakes, and we are working on both regressions.

Newest generators

Two frozen hold-outs. The first: the same 1,000 free-form prompts sent to nine generators released in 2026 through a single API aggregator in September, so content is matched across generators:

The second is harder and includes GPT Image 2.5: in early October we called each vendor's API directly and asked it to reproduce one of our genuine photographs (same subject, framing and lighting), then held out 10% of the output and never trained on it. The September model predates the wave and never saw any of it; the updated model was trained on the other 90%. The matching genuine photographs are scored alongside:

GPT Image 2.5 goes from 77.0% to 88.3% on 300 photo-matched images, and Seedream 5.0 from 54.3% to 82.1%. These rates are lower than in the free-prompt table above because a generator told to copy a real photograph produces something much closer to one. FLUX.2 pro and max reproductions remain the weakest point at 35.5% and 30.0%.

The same wave also asked each vendor to edit the genuine photograph rather than regenerate it. Most pixels in those images are untouched, so, as in the DailyBench edit results below, the overall verdict catches far fewer of them:

Heatmap

The heatmap marks the regions the model believes were edited. We measure it on 3,273 AI-edited images with pixel-exact masks of the edit: how much of the highlighted area overlaps the true edit (mean IoU), and how well each image patch is ranked edited vs. untouched (patch AUROC).

In plain terms: the highlighted region now covers about 70% of the real edit instead of 61%, and it is much less likely to light up on untouched parts of the image. This is measured on our internal validation split, not on the frozen sets above.

Verified in production

Before and after the swap we ran the same two genuine images through the live dashboard: a 1911 pencil sketch from WikiArt and a screenshot of an Instagram post. The September model called both AI-generated (94% and 97%). The updated model calls both authentic (4% AI probability each). A GPT Image portrait and a Nano Banana Pro image run through the same live endpoint are flagged at 93% and 95%. Every check on sightova.com and through the API has used the updated model since the evening of 11 October 2026.

AI-generated images have become photorealistic. Counting fingers or looking for garbled text no longer works: current models follow instructions precisely and render hands, text and lighting convincingly.

The most common fake we see in 2026 isn't a fully generated image. It's a real photo that someone changed with an AI editor: a new background, a different outfit, another person placed into the scene, a forged receipt. Commercial editors make this a one-line prompt. A detector that only recognises fully generated images misses exactly the fakes trust-and-safety, fraud and identity teams care about most.

Watermarks help but aren't enough. OpenAI and Google embed invisible watermarks, and Sightova decodes them (see Watermarks). But most generators don't watermark at all, metadata is stripped by every major platform, and watermarks can be removed. A missing watermark tells you nothing, so a detector has to work from the pixels alone.

• Fully AI-generated images from current and older generators: GPT Image, Nano Banana, Nano Banana Pro, FLUX, Midjourney, Stable Diffusion, DALL·E, Imagen, Seedream, Ideogram, Recraft, Qwen-Image, Z-Image, Grok and GAN-based models.
• AI edits of real photos, from editors that regenerate the whole image (GPT Image, Nano Banana, Qwen-Image-Edit) as well as inpainting tools that only change one region.
• Deepfakes and face swaps, including face-swap, face-reenactment and talking-head methods.
• A heatmap of the regions the model believes were changed. It's trained on masks of real edits, so it points to the edited region rather than just repeating the overall verdict.
• Forged documents (IDs, passports, receipts, forms) with a separate model. See Document forgery.

An image is labelled AI-generated when the model's probability is at least 0.85. Every detection and false positive rate in this report uses that production threshold.

Architecture

V3 builds on DINOv3, Meta's self-supervised vision foundation model. DINOv3 learns general properties of images from a very large collection of photographs without labels, by teaching a "student" network to match a "teacher" across different views of the same image. The resulting features capture both fine local texture and global structure, which is exactly what AI image detection needs.

We use the large ViT-L/16 variant and fully fine-tune the whole network, not just a classifier on frozen features, so the representation itself adapts to the difference between camera and generator pixels. V3 looks at the whole image at 512 × 512, more than twice the resolution of our previous model, and has two outputs: an overall probability that the image is AI-generated, and a 32 × 32 map of which regions were edited.

Training

The composition of the training data matters more than anything else we tried. V3 is trained on a large, balanced mix of genuine and AI images:

• Genuine images covering everyday and web photography, people and portraits, landscapes, and unprocessed camera originals from a wide range of phones and cameras.
• AI images from GAN, diffusion, flow-matching and autoregressive generators released between 2018 and 2026, from both open-weight models and commercial APIs.
• AI edits with pixel masks, so the model learns what a locally edited region looks like and the heatmap learns where it is.
• Face swaps and reenactments, alongside genuine face video, so that faces alone never become evidence of AI.

Images are distorted in many ways as they're shared online, so during training we layer strong augmentations: JPEG and WebP recompression, resizing, blur, noise, colour shifts, screenshots and social-media style recompression. We apply them equally to genuine and AI images, so compression can never become a shortcut for either answer.

Before any image enters training, we compare it against every image in our evaluation sets by exact hash and perceptual hash and reject near-duplicates. None of the third-party benchmarks below contributed training images.

We evaluate every model release on the same frozen, hash-pinned image sets, using the exact production weights and preprocessing. We use one global threshold (0.85): no per-benchmark tuning and no test-time tricks.

False positives

The false positive rate is the share of genuine images that V3 wrongly labels as AI. It's the number we optimise for first.

Ordinary photographs, including smartphone photos of people, are flagged well under 1% of the time. Human-made art is the main exception; we cover it below.

AI image generators

Share of each generator's images that V3 labels as AI:

AI edits

A real photo with one AI-edited region is the hardest case for any detector, because most of the pixels are authentic. Editors that regenerate the whole frame are detected reliably. Editors that change only a small region and leave every other pixel untouched are detected far less often; for those, the heatmap is often more informative than the overall verdict.

AI-edited portraits

We keep an internal hold-out set of genuine smartphone portraits and AI edits of them made with three commercial editors, the kind of fake photo of a real person that platforms see every day. For the September model, one of the editors (Qwen-Image 2.1) was deliberately kept out of training to test how V3 handles an editor it has never seen.

Qwen-Image 2.1 was kept out of training for the September model only; the current model has seen it, so its row is no longer an unseen-editor test.

Deepfakes and face swaps

We score individual face frames from the standard deepfake benchmarks, one frame per image, without any temporal information.

Most false positives here come from the genuine frames of these 2019–2020 video datasets, which are small, blurry and heavily compressed. Ranked against ordinary web photos instead, the fakes from every one of these datasets reach an AUROC of 0.96 or higher (0.99 for Celeb-DF v2 and DFDC).

This is the one group of benchmarks where the October model is weaker than the September one: AUROC is down 0.03–0.05 on every set and the false positive rate on FaceForensics++ genuine frames roughly doubled. The October training data removed a block of face-swap material that turned out to be mislabelled, and the model was selected for the lowest false positive rate on ordinary photos, not on compressed video frames. Face-swap and deepfake video frames are the priority for the next model.

Human art

We know that wrongly calling an artist's work AI causes real harm. Photographs of physical artworks from public-domain museum collections are rarely flagged (0.0%, down from 0.8% in September). Digital scans of paintings are harder: on 2,000 WikiArt paintings, the September model flagged 7.8%. That wasn't good enough, and it was the first thing the October update fixed: on the same 2,000 paintings the current model flags 4.5%, and on 15,625 museum photographs 0.01%. Symbolist and Art Nouveau works remain the hardest styles (23.6% and 11.3%, down from 40.5% and 24.6%).

Third-party benchmarks

Public benchmarks built by other groups, scored with the production weights and the 0.85 threshold, no per-benchmark tuning. None of these images were used in training. The "compressed" columns re-score every image after downscaling to 1024 px and re-encoding as JPEG at quality 50, which is harsher than most social platforms apply.

Synthbuster and AI Detector Arena are essentially solved at this threshold. NTIRE 2026 is in-the-wild AI images with heavy re-encoding and costs us about 3% false positives. MIRAGE is the weak one: it is built from AI images as they actually circulate online, cropped, re-posted and edited, and we detect 77% of them at a 6.2% false positive rate. Published results from other detectors are better on MIRAGE than ours. Together with compressed images in general (every "compressed" column above is lower than its clean counterpart), that is on the list for the next model.

Document checks use a separate model with the same architecture, trained at a higher resolution (768 × 768) so that small text edits stay visible. It returns a probability that the document was tampered with and a heatmap of the tampered region.

It's strong on the manipulations fraud teams see most: text tampering, ID photo replacement and face morphing. It's weaker on documents edited with the newest commercial AI editors and on manual edits made in desktop paint programs, and we're working on both.

GPT Image outputs and Google Gemini (Nano Banana) outputs carry invisible SynthID watermarks. Sightova decodes both on every check and reports them separately from the model verdict. A detected watermark is strong evidence; a missing one is no evidence of authenticity.

Google's SynthID is a learned, content-adaptive mark rather than a fixed pattern, so we trained a detector to read it from native-resolution tiles. It survives paste, crop and most screenshots; it flagged none of more than 22,000 held-out images from cameras, paintings and other generators. A heavily recompressed screenshot of a Gemini image is the weakest case, and a negative there still means little: the pixel model above is the check that doesn't depend on a watermark. Details on the SynthID decoder page.

• Small local edits to an otherwise genuine photo are often missed by the overall verdict. A negative result doesn't rule out a partial edit; check the heatmap.
• Digital art and scans of paintings are flagged more often than photographs.
• Heavily compressed video stills of real faces can be flagged, which matters when checking frames from old or low-quality video.
• New generators may evade detection until they're represented in training. We re-test every release against the sets in this report.
• Adversarial attacks built specifically against V3 haven't been evaluated.
• Very small images (under 256 px) carry little evidence, and video is analysed frame by frame.

The October 2026 update delivered what the September report promised: far fewer false positives on human-made art and people's own photos, better detection of the newest generators, a sharper heatmap, and Google SynthID decoding in the product, and every benchmark in this report has now been re-run on it. Next, in order: deepfake and face-swap video frames, the one area where the update went backwards; closing the small gap on GPT Image 2.5 and Nano Banana 2 portrait edits and on genuine studio portraits without giving back the false positive gains; and detection of small local edits, where the overall verdict still misses roughly half of region-only inpaints and the heatmap has to carry the answer.

If you're a researcher or an enterprise team and want to test V3 on your own data, get in touch.

1. Siméoni, O. et al. DINOv3. Meta AI, 2025.
2. Bammey, Q. Synthbuster: Towards Detection of Diffusion Model Generated Images. IEEE OJSP, 2023.
3. Gushchin et al. NTIRE 2026 Challenge on Robust AI-Generated Image Detection in the Wild. CVPR Workshops, 2026.
4. Wang, S.-Y. et al. CNN-generated images are surprisingly easy to spot… for now (ForenSynths). CVPR, 2020.
5. Rössler, A. et al. FaceForensics++: Learning to Detect Manipulated Facial Images. ICCV, 2019.
6. Li, Y. et al. Celeb-DF: A Large-scale Challenging Dataset for DeepFake Forensics. CVPR, 2020.
7. Dolhansky, B. et al. The DeepFake Detection Challenge (DFDC) Dataset. arXiv, 2020.
8. Yan, Z. et al. DF40: Toward Next-Generation Deepfake Detection. NeurIPS Datasets and Benchmarks, 2024.
9. DailyBench (FakeBench and ManipulationBench), 2026.
10. Gowal, S. et al. SynthID-Image: Image watermarking at internet scale. arXiv:2510.09263, 2025.