The Meta AI detector promises to catch Meta’s own fakes. Crop the image, and more than half slip straight past it.
The tool was meant to be a fix for the deepfake problem, not an example of it. This week Meta previewed an image detector alongside Muse Image, its most advanced image generator yet, and promised it could spot anything the model made later, even after editing.
Then Reuters ran the test. It generated 40 images with Muse Image, cropped them, and fed them back. The detector missed more than half.
How a simple crop broke it #
The numbers are the story. Reuters found the tool verified every one of the 40 original AI images. Crop those same pictures to roughly a third or a half of their size, and it failed to flag 55% of them. A crop, the kind anyone does before posting, was enough to strip the signal the detector leans on.
That signal is a watermark. Meta calls it Content Seal, an invisible marker baked into every image Muse Image produces. On its own website, Meta says the Meta AI detector can identify its images even after a crop. The Reuters analysis suggests the promise holds only up to a point.
Meta’s answer, and the catch #
Asked about the results, Meta pointed out that the detector is still a preview. The watermark is built to survive common edits, the company said, but the signal “may be lost if an image is heavily cropped”. That is the tension in one sentence.
The mark is meant to be robust, yet the most ordinary edit on the internet can rub it out.
Meta is not alone in the bind. Google and OpenAI have both warned that their own detection tools are not foolproof against people who alter images. Watermarking is the industry’s favoured answer to synthetic media, and every big lab is leaning on a version of it.
A rival marker, Google’s SynthID, recently debunked a high-profile deepfake, which is the case for the technology. Meta’s stumble is the case against trusting it alone.
Why a watermark is not a wall #
Researchers have flagged this weakness for a while. Siwei Lyu, a computer science professor at the University at Buffalo who studies image forensics, said watermark methods work well while the mark stays intact.
The trouble is what comes next. “Any modification that removes or weakens the embedded signal, such as cropping, resizing, heavy compression, or editing, may reduce their effectiveness”, he told Reuters.
Others argue the bar should not be perfection. Sarah Barrington, an AI researcher at UC Berkeley, likened watermarking to security measures that catch most threats without stopping all of them. “Even if we catch only 90%, that’s still a great leap from 0”, she said. Both points can hold at once.
A detector that misses 55% of lightly edited images sits a long way below 90%, and it feeds a growing market for AI detection that still cannot promise certainty.
The timing is the problem #
The gap matters because of when it lands. The United States is heading into a midterm election year, and platforms are bracing for a wave of AI fakes aimed at voters. Governments are moving too, with South Korea among those writing punitive laws against deceptive content.
In March, Meta’s own Oversight Board urged the company to do more about deceptive AI and to invest in stronger detection. Four months on, the flagship detector cannot reliably catch Meta’s own output once someone crops it.
None of this makes Content Seal worthless. A tool that tags fresh, unedited images still raises the cost of passing off a fake, and Meta says it plans to extend the system to video. It does puncture the idea that a watermark is a solution rather than a speed bump.
The people most likely to strip a signal are the ones a detector exists to stop. In synthetic media, as in the classroom, detection keeps arriving a step behind. On today’s evidence, catching up takes nothing more than a crop.
Get the TNW newsletter #
Get the most important tech news in your inbox each week.