Real or fake?

AI is technology that lets computer systems imitate human learning and problem solving. It can make photos, voices and videos that look and sound real. In this lesson, we call these fakes. This lesson is about what to do before you trust or share one.

Two studies tested how well people can tell.

A paper published in 2022 reports a test with 315 people. They saw faces, each real or made by a computer. People were right 48.2% of the time, about half. That is close to chance, the score you would expect from guessing between two answers.

A paper published in 2023 reports a test with 529 people. Some heard one short speech clip at a time. They correctly spotted the fake clips 73% of the time, about 7 in 10. So they missed about 3 in 10 fake clips.

These studies tested faces and speech clips, not video. They show that looking or listening hard is not a safe check.

Nightingale and Farid (published 14 February 2022) used 800 faces, some real and some made by a computer. Each person judged 128 of them. A second group of 219 people got training and feedback after each answer. They scored 59.0% on average. Their score did not rise over the test: 59.3% on the first 64 faces and 58.8% on the second 64. The paper calls the first group’s score “close to chance performance of 50%”. The people were paid workers from an online platform, so they are not a sample of everyone. The text we read does not give the dates of the testing.

Mai and others (published 2 August 2023) used clips of one speaker in each language reading sentences, in English and in Mandarin. When a person heard one clip at a time, they were right 70.35% of the time overall. They called 67.78% of the real clips real. A speech deepfake is a voice made by a machine learning model. Machine learning means a computer finds patterns in examples. The paper says that “providing examples of speech deepfakes only improves results slightly”, and that detection should get harder as speech tools improve.

The notice of 3 December 2024 from the US Federal Bureau of Investigation (FBI) lists signs to look for, such as “distorted hands or feet, unrealistic teeth or eyes”. The two studies above found that people’s own judgement was not reliable. Lesson 1.9, Images and sound, shows how AI handles pictures and sounds.

The file itself cannot settle it. So check things outside the file.

First, stop. Do not share it until you know what it is. Mike Caulfield wrote SIFT, a set of four moves for checking online media. SIFT says the same.

Then try these three checks. Each one points outside the file.

Who posted it? Find out who is behind the post before you trust it.

Is it somewhere else? Look for the same photo, clip or story in other places you trust. Trace the photo or clip back to where it first appeared.

Can you reach the person another way? If a call or message asks for money, end it. Look up the official contact details and call back. Never use a number given by the caller.

A call that pushes you to act fast is a warning sign. If your family made a secret word, ask for it.

SIFT is four moves written by Mike Caulfield (post dated 19 June 2019): “Stop”, “Investigate the source”, “Find better coverage”, and “Trace claims, quotes, and media back to the original context”. Our first two checks follow its last three moves. Calling back comes from ComReg and the FBI, below. The page says of the first move: “Don’t read it or share media until you know what it is.”

ComReg, Ireland’s communications regulator, says: “Instead, end the call, look up their official contact details and contact them back to verify if the call is legitimate.” It also says: “Never use a number given to you by the caller.” It says to “Hang up if a caller pressures you, claims that urgent action is needed or threatens negative consequences.” We read the page on 9 October 2026. It shows no date.

The FBI’s notice of 3 December 2024 says criminals can use AI-made audio “to impersonate well-known, public figures or personal relations to elicit payments”. It advises: “Create a secret word or phrase with your family to verify their identity.” It also advises hanging up, “researching the contact of the bank or organization purporting to call you, and call the phone number directly.”

Some files carry a label. A content credential is a record of a file’s history, attached to the file. It can say where the file was made, what was done to it and whether AI was used.

The Coalition for Content Provenance and Authenticity (C2PA) is a group. It was formed to build an open standard for checking where digital content came from. A standard is a set of rules that many groups agree to follow.

It wrote the standard for credentials, which are digitally signed. A digital signature is a code added to a record. It helps show who signed the record and that it has not changed.

The signer is whoever signed the record. A trust list is a list of who a tool will trust, like the lists a web browser keeps.

C2PA says a tool can check three things about a credential. Its record has not been tampered with. The record belongs to this file. The signer is linked to a known trust list. Checks like these do not say that the record is “true”.

A credential can be removed. C2PA’s own list of common questions asks if the record can be removed. It answers “Yes it can.” So a missing credential does not show if a file is real or fake.

A watermark is a mark put into a file. Some are visible, like a logo across a picture. An invisible watermark is hidden, and a tool can look for it.

Google’s tool for this is SynthID. Google says its mark can survive filters and colour changes. Google also says it is not foolproof against extreme changes.

Treat a label or mark as one more piece of evidence.

The C2PA explainer (version 2.2, 22 April 2025) says a Content Credential is “a cryptographically bound structure that records an asset’s provenance”. Cryptographically bound means tied to the file by a mathematical code, so a change to the file or the record no longer matches. It holds statements about an asset, such as its origin, what was done to it with which tools, and “use of AI”. It says credentials show “whether the provenance information is well-formed and free from tampering, valid and trusted”. It also says “It is not a cure-all for misinformation”. To help when metadata (data about a file, such as when and where it was made) is removed, it describes “durable Content Credentials”, which add a watermark or fingerprint (a way to recognise a file by its content) so the credential can be found again in cloud storage (files kept online by a company).

Google DeepMind (29 August 2023) calls SynthID “a tool for watermarking and identifying AI-generated images”. It says the mark remains detectable “even after modifications like adding filters, changing colours” and after lossy compression, and that “SynthID isn’t foolproof against extreme image manipulations”. For text, Google DeepMind (14 May 2024) says SynthID’s “confidence scores can be greatly reduced when an AI-generated text is thoroughly rewritten or translated”. These are Google’s own statements about its own tool.

Zhao and others (NeurIPS 2024) report a “regeneration attack”: add random noise to an image to destroy the watermark, then rebuild the image. They found that “pixel-level invisible watermarks are vulnerable” to it, across four methods. A pixel is one dot of an image. Their abstract does not name SynthID. They add that watermarks that keep the image meaning could be a defence.

The European Union (EU) has a law on AI, called the AI Act.

It has a rule for certain AI systems that create images, audio, video or text. Their providers must mark what the systems make, so a machine can detect it.

A provider makes an AI system, or has one made. It then offers the system under its own name.

There are exceptions. One is for systems that only help with standard editing. Systems already on the market before 2 August 2026 have until 2 December 2026. Lesson 3.7, The law: AI rules in Ireland and the EU, covers the law.

Article 50(2) says providers of AI systems “generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated.” Article 3(3) says a provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service “under its own name or trademark”. The duty is on the provider, not on a person who makes a picture. The duty “shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.” Article 111(4) says providers whose systems were on the market before 2 August 2026 “shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.” We read the consolidated text of 27 July 2026 on 9 October 2026. A mark does not show that a file is true, as the section above says.

Stop and check shows three invented scenarios, one at a time. They are a photo in a group chat, a voice message and a video. For each, you pick real, fake or can’t tell yet.

Then you see our reading and the checks to make before you trust or share it.

Looking or listening did not settle it in the studies above. So “can’t tell yet” comes first, and the checks come before any answer. Nothing is scored.

Each scenario is text, with the picture or sound described in words. No real person, voice or face is used. The outcome shown for each is invented, and the page says so. It shows how the checks work. It does not show how often a check works.