You're vetting the restaurant one last time before booking, and a review site shows a photo that seals the deal: a candlelit waterfront terrace, string lights, Mom's kind of view. You book it. On Saturday there is no terrace. There never was — the "photo" was generated, uploaded with a glowing review to juice the ratings. Nobody deepfaked a president to get you; the fake that reaches most people is exactly this small. Chapter 13 was about ears. This chapter is about eyes — how the pictures are made, why no tool can reliably unmask them, and what actually helps.

How a machine paints: noise, run backward

Black box first: text goes in ("candlelit waterfront terrace, string lights, dusk"), a photograph-quality image comes out in seconds. Inside, the most common recipe — called a diffusion model — is delightfully backwards. Here's the toy version:

1. Training, forward direction: take millions of real captioned photos and ruin them on purpose — add a little static, then more, step by step, until each photo is pure television snow.
2. Training, the actual lesson: teach a neural network (Chapter 2's knob machine) to undo one step of that ruin — "given this slightly noisy image and its caption, what did the cleaner version look like?" Millions of photos, billions of knob-turns.
3. Generation: now start from fresh random static — an image that never existed — hand the model your caption, and ask it to "undo the noise" step by step. A few dozen small cleanups later (the fastest models need only a handful), a terrace fades out of the snow like a photo developing.
4. The caption steers every step. "String lights" pulls the emerging blobs toward string-light patterns; "dusk" tints the statistics of every pixel. It's Chapter 4's next-token idea in spirit — predict what plausibly comes next — except "next" means "one step less noisy."

Video generators extend the same trick through time, denoising a whole stack of frames so that motion stays consistent. That's the fact to absorb: the machine isn't cutting and pasting from real photos; it's dreaming statistically plausible pixels. Which is why the output can depict, with photographic confidence, a terrace that was never built — the visual twin of Chapter 6's hallucinated "Golden Orchid Thai."

Why "AI detectors" can't be trusted

The market's answer to fakery is a genre of tools that promise to scan an image or essay and pronounce it AI or human. Chapter 10 gave you the one-line warning; here's the full argument, because the stakes — a student accused, a photo dismissed, a fake believed — deserve it.

A detector has no registry of everything AI ever made. All it can do is judge statistical texture: does this image's grain, or this essay's rhythm, look more like the generated stuff I was shown, or the human stuff? But generators are explicitly trained to match the texture of real photos and real prose — that's the whole objective from step 2 above. So the detector is hunting for the residue of a process whose entire goal is to leave no residue, and every generator release shrinks the residue further. The result is guessing with a confidence score, and it fails in both directions:

• False alarms on real work. Stanford researchers tested widely used GPT detectors and found they "consistently misclassify non-native English writing samples as AI-generated" — polished-but-plain human prose reads as machine to a texture-sniffer. The authors' conclusion was blunt: they "caution against their use in evaluative or educational settings." A student's scholarship should never hang on a coin-flip dressed as forensics.
• Free passes on actual fakes. The same study found that simple rephrasing tricks could "effectively bypass GPT detectors." Anyone motivated enough to fake something is motivated enough to run the one extra step that launders it.

So the durable rule: no tool can reliably look at content, alone, out of context, and tell you whether it's AI. Anyone selling certainty here is selling texture-guessing. What actually works is changing the question — from "does this look generated?" to "where did this come from?" (Journalists call that a file's provenance — its origin story — and it's the word we'll use below.)

What partially works: marking content at birth

Two real systems exist, both built on the same insight: you can't reliably detect fakery after the fact, but a cooperating creator — a camera, an editing app, an AI generator — can mark content the moment it's made.

System one: invisible watermarks. One of the most widely deployed examples is Google DeepMind's SynthID, which "embeds digital watermarks directly into AI-generated images, audio, text or video" — imperceptible to you, machine-checkable later. The text version is a trick you're equipped to savor: remember Chapter 4's probability table, where the model scores every possible next token before picking one? SynthID slightly nudges those scores as each token is chosen, hiding a statistical signature in the pattern of picks — invisible in the prose, detectable in aggregate. The image and video versions are designed to survive everyday abuse — cropping, filters, changed frame rates, lossy compression — and you can check for the mark by uploading a file to Gemini and asking whether Google AI made or edited it, or through Google's SynthID Detector portal, which Google has opened to everyone after first testing it with journalists and media professionals.

System two: content credentials — a nutrition label for media. The C2PA coalition (steering members include Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Sony, TikTok, and Truepic) publishes an open standard for attaching a tamper-evident history to a file: what device or tool created it, what edits were made, cryptographically signed at each step. The result, called Content Credentials, serves — in the words of the industry group promoting it — as "a kind of nutrition label for digital content": on supporting sites you click a small pin on the image and read where it came from and how it was changed. Note the difference in spirit: SynthID marks AI content as AI; Content Credentials let authentic content prove it's authentic. One brands the synthetic; the other vouches for the real.

The asymmetry that makes sense of everything

Here is the one idea to carry out of this chapter. Both systems share a built-in limit: they only speak when the creator cooperated. A watermark check that comes back positive tells you something solid. A check that comes back empty tells you nothing at all — the image may be human-made, or AI-made by any tool that doesn't stamp its work, or stamped and then laundered by a determined stripper of metadata. The Content Credentials project says this itself: the goal is "to provide good actors with a way to demonstrate the authenticity of their content," while "there will continue to be bad actors" — the label vouches for the honest; it cannot unmask the dishonest. In symbols: found ⇒ informative; not found ⇒ silence. Never read silence as "real."

The verification habits, ranked

Putting the whole chapter in order of usefulness for an ordinary suspicious image or clip:

1. Check the source before the pixels. Who posted it, when, and do they have a history? A stunning image from an account created last Tuesday is answered by that fact alone.
2. Look for a second, independent witness. Real events leave multiple traces — other angles, other posters, local coverage. A one-source spectacle is a red flag regardless of how it was made.
3. Reverse-image search. Often finds the original — an old photo relabeled, a stock image, or the AI art post it was lifted from. Low effort, high yield.
4. Check for credentials and watermarks. Click the pin where sites support it; ask Gemini about a suspect image. Remember the asymmetry: a hit is information, a miss is silence.
5. Only then, squint at the pixels. Mangled text on signs, inconsistent shadows, jewelry that melts into skin — today's tells, but they age fast, and their absence proves nothing. Treat pixel-squinting as the tiebreaker, never the verdict.

Where to go deeper

1. Easy: contentcredentials.org — the consumer face of C2PA: what the pin looks like, how to inspect a label, and a growing list of tools and platforms that attach credentials.
2. Medium: Google DeepMind's SynthID page — clear explanations of watermarking across image, audio, video, and text, including the token-probability trick and what the watermark is designed to survive.
3. Deep: "GPT detectors are biased against non-native English writers" (Liang et al., published in Patterns) — the study behind this chapter's detector warning; short, readable, and sobering about what texture-guessing does to real people.