Why this test
AI image tools can now edit a photo of a receipt in a few seconds: change a total, add a line, swap the store name, all while keeping the look of a real photo. For a team that reviews expense reports or supporting documents, the fake is no longer visible to the naked eye.
The question was simple: is an open source detector, downloaded and run as is, good enough? We measured it in October 2026.
The test bench
The real documents come from public receipt datasets, photos and scans from several countries and languages. We produced the fakes ourselves: image generators were given real receipts along with realistic instructions written from their text, such as "change the total from 38.20 to 68.20". Each fake is checked by OCR (the text really did change) and then realigned on its original, with the same framing and the same compression, so that a detector cannot cheat by spotting a different format.
The first test includes 1,000 real receipts and 183 AI images. We measured the share of correct answers and, where it helps, the AUC, which tells whether the model ranks fakes above real documents: 0.5 means chance, 1 means a perfect ranking.
The six models, one by one
Community Forensics (ViT-S)
Score without tuning: 51%. Published at CVPR 2025 by Jeongsoo Park and Andrew Owens (Owens Lab), after a preprint in November 2024.
It tells whether an entire image was generated by AI. It is a small vision network (ViT-Small) retrained on images from 4,803 different generators: the bet is that this diversity helps it recognize generators it has never seen.
Access. Code on GitHub (JeongsooP/Community-Forensics), weights on Hugging Face in two sizes (384 and 224 pixels). PyTorch and a GPU for the sample scripts, plus a notebook to try a few images.
Training data. 2.7 million generated images (1.1 TB), released under CC BY 4.0 with the note "research use only". A smaller version is noncommercial.
Commercial use. Code and weights under the MIT license: allowed. The dataset itself remains ambiguous.
ClipBased-SID
Score without tuning: 50%. Published at CVPR Workshops 2024 by the GRIP team at the University of Naples Federico II (Davide Cozzolino, Luisa Verdoliva and their colleagues), with Matthias Nießner from TU Munich.
It tells whether an entire image was generated by AI. It keeps a large CLIP model frozen and only trains a small classifier on its image representations.
Access. Code on GitHub (grip-unina/ClipBased-SyntheticImageDetection), weights included in the repository. A GPU is recommended.
Training data. 10,000 real images and 10,000 images generated by a diffusion model, available for download from GRIP. Their license is not specified.
Commercial use. Code under Apache 2.0: allowed. The weights have no separate license, so confirm before use.
DDA (Dual Data Alignment)
Score without tuning: 52%. Published at NeurIPS 2025 by a team led by Tencent YouTu Lab, with several Chinese universities.
It tells whether an entire image was generated by AI. The idea: train on real photos and their own reconstructions by an autoencoder, identical in content, size and compression, so that the detector can only learn the generation trace. The model is a large DINOv2 adapted with LoRA.
Access. Code on GitHub (roy-ch/Dual-Data-Alignment), weights on Hugging Face since February 2026. The inference script assumes a GPU.
Training data. A dataset built from COCO images, released under Apache 2.0.
Commercial use. Code and weights under Apache 2.0: allowed.
SuSy
Score without tuning: 54%. Released as a preprint in September 2024 by the HPAI team at the Barcelona Supercomputing Center.
It tells whether an image is synthetic and which generator produced it, out of five (DALL·E 3, two versions of Midjourney, two variants of Stable Diffusion). It is a small network with 12.7 million parameters. Its model card explicitly excludes manual retouching and local edits.
Access. Code on GitHub (HPAI-BSC/SuSy), weights on Hugging Face, online demo on Hugging Face Spaces. The lightest of the six.
Training data. About 5,400 real images from COCO and 18,000 synthetic images, under licenses that vary by source.
Commercial use. Code and weights under Apache 2.0: allowed, with one written restriction: do not use it to train tools designed to fool it.
NPR
Score without tuning: 50%. Published at CVPR 2024 by Chuangchuang Tan and colleagues (Beijing Jiaotong University, YanShan University, A*STAR).
It tells whether an entire image was generated by AI, by looking for the relationships between neighboring pixels left behind by the upsampling layers of generators.
Access. Code and weights on GitHub (chuangchuangtan/NPR-DeepfakeDetection), demo on Hugging Face Spaces. Light dependencies, but an old recommended environment (PyTorch 1.8).
Training data. Four categories (cars, cats, chairs, horses) from a 2020 research dataset: real photos and images generated by ProGAN, an older type of generator.
Commercial use. No license file in the repository: without a license, no usage rights are granted.
TruFor
Score without tuning: 62% (AUC 0.56). Published at CVPR 2023 by the GRIP team in Naples (Fabrizio Guillaro, Davide Cozzolino, Luisa Verdoliva), with Avneesh Sud and Nicholas Dufour.
Unlike the other five, it looks for local edits in a photo and returns a map of the suspicious area, a global score and a reliability map. It compares the image with the noise fingerprint left by the camera: an edit shows up as a departure from that fingerprint.
Access. Code on GitHub (grip-unina/TruFor), weights to download from GRIP, installation through Docker, also runs without a GPU. The training code has been public since March 2025.
Training data. Several public datasets of classic forgeries (CASIA 2.0, IMD2020, FantasticReality, and others).
Commercial use. Noncommercial: the license restricts the software to "informational and nonprofit" use and forbids any industrial or commercial activity.
In summary
TruFor was then measured on a larger test of 2,819 images: on the same fakes, it recognizes only 38% of them, and it wrongly flags more than one real receipt in four.
Why these scores are so low
These models were trained on natural photos: faces, landscapes, street scenes. A receipt is a very different kind of image, black text on light paper, often photographed at an angle and compressed several times. What they learned does not carry over.
Each family has its own reason for failing. Detectors that shrink the whole image down to 224 or 384 pixels, like ClipBased-SID, lose the fine traces that generators leave along the way. TruFor is built to spot a splice in a photo: faced with a receipt that was entirely regenerated, its anomaly map lights up on 98% of images, real and fake alike. NPR looks for the upsampling traces of generators, which the JPEG recompression of a real photo largely erases.
What about large language models?
A natural question: why not simply ask an LLM whether the image is fake? We did it on 300 images, half real, half fake:
LLMs read the text: they catch a wrong sum or an inconsistent name. When the forger has recalculated the total cleanly, they see almost nothing. Claude Sonnet 4.5 answers "authentic" nearly every time; Gemini 2.5 Pro is the best of the four, at the cost of 9% false alarms.
Our take
No public detector can be run as is on documents. To be useful, it has to be retrained on documents, real and fake, and above all on realistic fakes: edits to a single amount, not just fully invented images. That is the path we took at Koncile for our own model.
Even retrained, an image detector has its limits: a very local edit, a few dozen pixels wide, remains hard to see, and classic edits made without AI do not leave the same texture. Image analysis is therefore only one signal among others, alongside metadata, file structure and the consistency of the amounts, never a verdict on its own.
Frequently asked questions
Can a free open source model detect an AI generated image?
On documents, rarely out of the box: in our tests, the six public detectors we tried perform at chance level on receipts. They need to be retrained on documents before they become useful.
Which open source detector works best without tuning?
In our tests, none of them: TruFor gets the best score with 62% correct answers, but its AUC of 0.56 shows it ranks fakes almost at random.
Can ChatGPT or Gemini tell whether a document is fake?
They spot inconsistencies in the text, not traces in the pixels. On edits to a single amount, they catch between 8% and 56% of fakes.
Can the weights of these models be used commercially?
Not all of them. Community Forensics (MIT), DDA and SuSy (Apache 2.0) allow it; TruFor forbids it; NPR has no license at all, so no usage rights. Always check the license file for the code and the one for the weights before any production use.
