Synthetic Media Forensics

Scope

The object under examination can be wholly generated, partly generated, conventionally edited, or assembled from multiple sources. AI assistance is a workflow property, not a single visual appearance. Separate questions about generation, modification, ownership, and distribution. A synthetic voice can appear inside an otherwise genuine recording; generated text can be embedded in a manually authored document.

Why the field matters

A persuasive recording can circulate without its original encoding, timestamps, or production context. The investigative task is to establish which claims the available evidence can support, rather than to assign an authenticity label to every pixel or sentence. This matters when a derivative has become the only publicly available object.

Evidence sources

• Original media and derivatives, including container structure, codecs, frame timing, audio tracks, and embedded metadata.
• Editing projects, source images, generation records, uploads, export settings, and model configuration where available.
• Content Credentials, manifests, cryptographic signatures, watermark results, distribution records, and independently acquired copies.

Typical investigative questions

• Is this the original file or a transformed copy, and what changed between versions?
• Which portions are consistent with generation or alteration, and what non-AI explanations remain?
• Do creation-side records connect a particular workflow to this object?
• What does a verified provenance assertion actually say, and who signed it?

Examination methods

Preserve the acquired bytes and record the source before decoding or re-encoding. Inventory metadata and file structure, then compare available originals and derivatives. For video, examine temporal as well as frame-level properties; for audio, distinguish codec effects from signal features. Generated text usually lacks a unique durable trace of the model that produced it.

Use statistical detectors only with a documented version, tested conditions, and a relevant population. Record false positives, false negatives, thresholds, and sensitivity to transformations when these are known. An unexplained percentage is not a calibrated probability that the case proposition is true. NIST AI 100-4 provides an overview of these method families.

Corroborating evidence

A project file, source asset, application record, or signed creation assertion can connect a media object to a workflow. Compare byte hashes for identical files and explain when perceptual similarity is used for derivatives. Independent sender copies may clarify whether a sharing platform stripped metadata. Two detectors trained on similar material are not necessarily independent corroboration.

Common failure modes

• Treating compression artifacts as unique evidence of AI generation.
• Testing a screen capture as though it were an unmodified original.
• Applying an image model to another medium or a text detector outside its validated domain.
• Reporting a watermark or signature result without the validation settings and trust assumptions.

Limitations

Cropping, transcoding, recompression, noise, and manual edits can alter both detection signals and provenance bindings. Unknown generators and unfamiliar domains can defeat assumptions learned from a test set. Missing metadata can mean that it was removed, was never recorded, or is held elsewhere. These possibilities should remain distinguishable in the report.

Reporting cautions

State what was observed in the exact examined file, then describe the method and the inference. Write “the tested detector classified this derivative as synthetic under these settings” when that is the observation. Do not turn that result into a claim about a named creator or model without separate evidence. Media perception and memory raise additional questions explored by the adjacent project Synthetic Imprinting; those questions do not replace digital examination.

How do you examine a widely shared image?

Treat the original file, repost, and screenshot as separate objects. Preserve each acquired version and record dimensions, encoding, metadata, and source. Compare visible content and documented transformations before applying a detector whose tested input conditions may differ from the shared copy.

A useful answer states which version was examined, which claim was tested, and what independent records support the result. A missing credential or a compression artifact leaves several explanations possible; keep those alternatives visible.

Related fields & glossary terms

• Provenance Forensics
• AI Artifact Forensics
• Synthetic Identity Forensics

Apply the examination methods, inspect the evidence classes, and check relevant external standards and specifications.