Forensic Cleaner by Two Tensors

Bypass AI image detection: the mechanism

What image detectors actually score, what the cleaning pass changes, what it leaves alone, and how to drive the whole thing from the API.

Open Forensic Cleaner View pricing

A detector scores a file, not a photograph.

Nothing inside an image announces that a model made it. A detector estimates that from measurable properties of the pixels, and those properties fall into a few recognisable groups.

Statistical fingerprints

Camera output carries the marks of the hardware that made it: sensor noise that shifts with exposure, the interpolation pattern of a colour filter array, falloff toward the edges of the frame. Generated output carries the marks of a decoder instead. Upsampling stacks tend to leave periodic structure in the frequency domain, noise more uniform than any sensor produces, and channel relationships no lens creates. Almost none of it is visible at 100% zoom. It lives in the high-frequency residual, which is where a classifier learns to look.

Compression and resampling history

A file also records what happened after it was made. JPEG quantisation leaves a signature and resaving compounds it; any resize leaves interpolation traces. Because most detectors were trained on images scraped from the web, they partly learn the pipeline a file travelled through rather than how it was created. That is why one will sometimes score a photograph you shot yourself as near-certain AI.

Generator-specific regularities

The third group is narrower. Model families reconstruct fine detail in characteristic ways, most visibly in hair, fabric, foliage, and skin, and latent decoders can leave structure aligned to the grid they decoded from. A detector trained on one generation of outputs behaves closer to a model classifier than to a general test, which is much of why detectors agree with each other so poorly.

Embedded watermarks are a separate problem

SynthID is not a statistical accident. It is embedded deliberately at generation time, so it is built to survive edits that would wash out an incidental fingerprint. Forensic Cleaner treats it as an optional stage of its own, covered on the SynthID remover page.

Reading a detector score

  • Scores are not calibrated A 92 from one detector and a 92 from another are not the same quantity, and neither is a probability you can act on.
  • Disagreement is normal Different training sets weight different features. Test against more than one before you conclude anything.
  • The target moves Third-party detectors are retrained on someone else's schedule. A result that held last month is not evidence about this month.

What the pass changes, and what it deliberately does not.

Reducing a detector signal is trivial if you are allowed to wreck the image. The constraint that makes it useful is that the output has to stay the same picture.

Reduced

The low-level residual a classifier keys on: frequency-domain regularity, noise that is too clean, decoder texture signatures.

Preserved

Composition, subject, colour relationships, and edge structure at the scale a person looks at. The model is optimised for visual similarity.

Side effect

Validation converts uploads to lossless webp, and embedded EXIF does not survive it. A property of the pipeline, not a metadata tool.

Opt in

SynthID removal is a stage you enable, priced separately, and it can run alone with detector bypass switched off.

Strength and resolution are the two dials that move the outcome.

How Strong and Quality differ

Strong is the sensible first attempt. It changes the residual band more, which gives it the best chance of clearing a detector on the first run and the highest chance of a visible cost: smearing, grain, or a colour cast on difficult sources. Quality, on paid plans, is gentler. Its effect is much harder to see, and on a hard image it may not be enough alone. Run Strong first, then Quality if Strong worked but changed more than you wanted. Small or distant faces are the usual failure case for aggressive settings, because few pixels are spent on the face and the change lands directly on the features.

Why downscaling to 1024 can change the answer

The downscale option is not cosmetic. Most of what a detector reads sits in the highest frequency band, and resampling rewrites that band outright: detail above the new sampling limit is discarded, and the local pixel relationships that survive are interpolated rather than original. A downscale is a signal reduction in its own right, on top of whatever the cleaning pass did.

It also changes the file's dimensions, and for detectors whose scores track resolution and compression more closely than origin, that alone can move the result. It tends to make SynthID removal more reliable too. The cost is a smaller image: free accounts cap at 768px, paid plans at 1024px, with a maximum output near 2 megapixels. Before spending credits, run the file through validation and read its AI slop score, which estimates how hard that image will be to clean. For the click by click version rather than the mechanism, see the step by step guide.

In internal testing, Forensic Cleaner reached about a 90% clean rate across three popular AI image detectors. That figure is an average over a test set measured in internal testing, not a prediction about your image and not a guarantee.

The product reduces detector-facing signals. It does not promise invisibility, and it cannot promise any named detector or platform will accept a result. Process only images you own or hold a licence to process, and read the Safety Guidelines before working on anything sensitive.

API automation

Run the whole sequence from your own code.

API access is included with Pro and Scale. The stages are the same ones the web app runs, with each one under your control.

  1. Upload the image

    Send the file and keep the upload id that comes back. Same formats as the web app: PNG, JPG, and WEBP.

  2. Let validation run

    Dimension and safety checks run before any cleaning, and this stage produces the AI slop score. Read it before you queue work: it is the earliest signal that an image will need a retry budget.

  3. Create the bypass

    POST /api/v1/bypasses with the api_image_upload_id from the upload step. detector_bypass defaults to true; remove_synthid_watermark is off unless you set it, and detector_bypass: false gives SynthID-only output. Send an idempotency key so a retried request cannot create a second job.

  4. Poll the job

    Jobs are asynchronous. Poll status rather than assuming a result is waiting, and handle the failure states explicitly. How many jobs you can keep in flight depends on your plan.

  5. Download the output

    Fetch the finished image once the stages you selected report complete. If both stages are enabled, both have to finish.

  6. Delete what you no longer need

    Remove uploads and outputs through the API when you are done, so nothing sits in account history longer than intended.

Read API docs

API access comes with Pro at $49 a month and Scale at $149 a month. Credit packs reload credits but do not unlock it. Plan detail is on the pricing page.

Questions about the mechanism.

Why does a detector flag a photograph I took myself?

Because much of what many detectors learned is file history rather than provenance. Resolution, JPEG quantisation, and resampling traces are easy features to learn, and in a scraped training set they correlate with AI images. A heavily compressed or heavily resized real photograph can land on the wrong side of that boundary.

What actually changes in the file when I run a bypass?

The pass targets the low-level residual that classifiers score: regularity in the frequency domain, noise more uniform than a sensor produces, and decoder texture signatures. Composition, subject, and edge structure at normal viewing scale are left intact, because the output has to stay recognisably the same image.

Why do two detectors give me completely different scores?

They were trained on different data, they weight different features, and their outputs are not calibrated against one another. A 92 from one tool is not comparable to a 92 from another. Testing against several is the only way to get a usable picture.

Should I start with Strong or Quality?

Start with Strong. It changes more and gives the best chance of clearing a detector on the first run. Move to Quality if Strong worked but altered the image more than you wanted. Quality is gentler and is available on paid plans only.

When is the 1024px downscale worth using?

When a cleaned output is still flagged, especially by a detector that appears to react to resolution and compression. Resampling rewrites the high-frequency band those tools read, and it tends to make SynthID removal more reliable. The trade is a smaller image: free accounts cap at 768px, paid plans at 1024px.

Does the cleaned file still carry the original EXIF?

No. Validation converts uploads to lossless webp, and embedded metadata does not survive that conversion. Treat it as a property of the pipeline rather than a metadata scrubbing feature, and check the output yourself if metadata removal is the thing you actually need.

Can the whole workflow run without the web app?

Yes, on Pro and Scale. Upload, validation, bypass creation, status polling, download, and deletion are all reachable through the API, so the web app is a convenience rather than a requirement.

Retention and deletion are described in the Privacy Policy. What you may and may not process is set out in the Safety Guidelines.