Do Screenshots, Compression, Cropping, and AI Upscaling Fool AI Image Detectors?

An AI-generated image scores 94% on the original file. You save it as a JPEG, crop out the edges, or take a screenshot—and the score changes. Did the edit “fool” the detector?

Sometimes a transformation can reduce a detector's confidence or even flip its label. But there is no universal trick that reliably makes every generated image look human-made to every detector. The more accurate conclusion is that a detector score belongs to the exact file that was tested. Change the pixels, dimensions, or encoding, and you may change the evidence available to the model.

That is why screenshots, compressed copies, crops, and upscaled versions should not be treated as interchangeable with the original. They are related files with different forensic histories.

The short answer

• JPEG compression can remove or overwrite subtle pixel patterns. Research has shown that some detectors become more likely to classify compressed generated images as natural.
• Resizing changes spatial and frequency information. Robust detectors may tolerate it, while others can shift substantially.
• Cropping removes part of the evidence and changes the composition presented to the model. The effect depends on what was removed and how the detector processes image regions.
• Screenshots combine several changes at once: new dimensions, a new encoding, possible interface chrome, color-management differences, and loss of the original metadata.
• AI upscaling is not just enlargement. A generative upscaler may synthesize texture and detail, creating a new edited image whose score cannot be assumed to match the source.

None of these operations proves that a low-scoring image is human-made. A changed score shows sensitivity to the transformed file, not the true origin of the underlying scene.

Why small file changes can move a detector score

Pixel-based AI-image detectors learn statistical differences between real and generated examples. Depending on the model, useful signals may include texture, noise, edges, frequency patterns, semantic inconsistencies, or interactions among them. These signals are not immutable.

JPEG compression deliberately discards information. Resizing interpolates pixels. Cropping changes which regions are visible. A screenshot creates a fresh raster representation rather than preserving the original file. An AI upscaler goes further by predicting new high-resolution detail.

The 2024 paper Fake or JPEG? identified compression and image-size biases in common generated-image datasets. In its experiments, progressively compressing generated images caused a strong decline in detection recall for the evaluated models, making those images more likely to be classified as natural. The authors also showed that balancing compression and size distributions during training improved robustness and cross-generator performance. This is an important warning: a detector can learn properties of a dataset's file formats instead of—or in addition to—generation-specific evidence.

More recent work treats real-world transformations as a central evaluation problem. The NTIRE 2026 robustness challenge used a large dataset covering 42 generators and 36 transformation types, including realistic post-processing. Its premise is straightforward: images encountered in practice are routinely cropped, resized, compressed, and blurred, and these operations can disrupt detectors trained on clean data.

Research is also producing detectors designed specifically for compressed images. A CVPR 2026 paper proposed a phase-spectrum-based method because compression can both destroy fragile generation artifacts and introduce new compression artifacts. The need for specialized methods is itself evidence that “works on the original” and “works after redistribution” are different claims.

What happens with each transformation?

JPEG compression

JPEG is the best-studied item in this list. Heavy or repeated compression can smooth fine detail, introduce block and ringing artifacts, and replace parts of the original statistical signature.

The direction of the score change is not guaranteed. One detector may lose confidence in AI origin because generation traces were weakened. Another may react to the new artifacts. A third may remain stable because it was trained with compression augmentation. The responsible test is therefore paired: compare the original and compressed versions while keeping every other variable fixed.

Cropping

A crop does more than reduce dimensions. It may remove the region containing the strongest signal, isolate a suspicious texture, or shift the balance between foreground and background. Detectors that resize or center-crop inputs internally can also react differently from systems that evaluate multiple patches.

Research on cropping-aware and patch-based detection suggests that spatial coverage matters. A single whole-image score can hide variation between regions. But cropping is not a dependable evasion method: removing one part of an image may lower a score, raise it, or leave it nearly unchanged.

Resizing

Ordinary resizing creates new pixel values through interpolation. Downscaling often removes high-frequency detail; enlarging with conventional interpolation spreads existing information across more pixels. Both can affect a model that relies on frequency or texture cues.

Some vendors state that their models are designed to tolerate resizing and re-encoding. For example, Sightengine says its current pixel-based model is built for redistributed images, while acknowledging that confidence may drop on heavily degraded files or screenshots with substantial interface chrome. That is a product-specific claim, not a guarantee for all detectors or all images.

Screenshots

A screenshot is a compound transformation. It normally strips the source file's metadata, changes the pixel grid to match the display or captured region, and saves a new PNG or JPEG. Browser scaling, operating-system color handling, overlays, captions, borders, and interface elements may also enter the image.

This makes “screenshot” too broad for a scientific condition. A clean, tightly cropped screenshot of a 1:1 image is different from a phone photo of a monitor, and both are different from a screenshot that includes a social post's text and controls. Benchmark them separately.

Named platform pipelines should also be separate conditions. An upload-and-download cycle through a social or messaging app may resize, recompress, strip metadata, or convert formats, and multiple reposts can compound those changes. Record the platform, client, date, and exact order of operations instead of assuming every “repost” behaves alike.

AI upscaling

Conventional resizing estimates pixels with a fixed interpolation rule. A generative or AI upscaler can synthesize textures, sharpen edges, reconstruct faces, remove noise, or invent details. The output is therefore an AI-edited derivative, even when its low-resolution source was a camera photo.

This creates two opposing possibilities. The upscaler may overwrite traces that a detector used in the source image, or it may introduce new generative patterns that raise the score. Current primary research is much stronger on compression and resizing than on controlled, tool-by-tool AI-upscaling effects. Claims that a named upscaler always defeats—or always triggers—detectors need direct testing.

A reproducible way to test detector stability

A useful benchmark should test both generated and human-origin images. Testing only generated images measures missed detections but says nothing about false alarms on transformed real photos or artwork.

For each source image, preserve the untouched original and create deterministic variants:

1. JPEG at several documented quality levels, such as 90, 70, and 50.
2. Center and off-center crops that retain 90%, 70%, and 50% of the original area.
3. Downscales to fixed long-edge sizes, followed by conventional rescaling where needed.
4. A clean screenshot with exact capture dimensions recorded.
5. One or more named AI upscalers with the model, version, scale, and enhancement settings recorded.
6. A realistic combined pipeline, such as screenshot, crop, resize, then JPEG export.

Run the baseline and every derivative through the same detector configuration. Record the raw score, any label or threshold, errors, and abstentions. Report score distributions and label-flip rates by condition, not just a few dramatic examples. Keep generator families, real-image domains, dimensions, and file formats balanced so the benchmark does not accidentally measure dataset quirks.

Track provenance signals separately. EXIF, C2PA Content Credentials, or a provider watermark may survive one transformation and disappear after another, but their presence or absence is a different evidence channel from a pixel-classifier score. Record both without combining them into a single verdict.

Most importantly, preregister the interpretation: a lower AI score after transformation means the detector was less confident on that file. It does not establish that the image is authentic or that the transformation is a reliable bypass.

What to do with a screenshot or reposted image

If the result matters, try to obtain the earliest and highest-quality version available. Then:

• record exactly which file was tested;
• compare related versions instead of replacing one score with another;
• inspect provenance and context alongside pixel-based signals;
• treat large score changes as evidence of instability;
• avoid accusations based on a single threshold or tool.

You can check an image with detector.guru, but interpret the output as one probabilistic signal. If two versions of the same image produce different results, preserve both. The disagreement is useful information about the limits of the available evidence.

The practical conclusion

Screenshots, compression, cropping, resizing, and AI upscaling can change AI-image detector scores. The effect is real enough that modern research benchmarks explicitly include these transformations and newer methods train for robustness against them.

But “can change a score” is not the same as “always fools a detector.” Results depend on the detector, source image, generator, transformation, and settings. The safest workflow is to test the best available original, compare controlled derivatives when useful, and never treat a low score as proof of human origin.