AI Temple Fakes: 92% Detection on Kathmandu Corpus

Most detection guides still tell you to stare at AI-generated temple statues for twisted hands or melted stone. In the Kathmandu corpus, that approach failed: 92% of the synthetic uploads looked visually perfect to trained reviewers. The decisive tells lived outside the pixels—a missing sensor fingerprint and an EXIF trail that contradicted the camera claim.

That 92% figure comes from a Kathmandu University forensic pipeline that examined temple uploads. The pipeline ignored the usual visual cues and instead checked for the physical traces a real camera always leaves behind. When those traces were absent or inconsistent with the embedded metadata, the file was flagged as synthetic.

The implication is not that visual inspection is useless; it is that AI fakes have crossed the perceptual threshold. Content Credentials and other metadata are stripped by screenshots and recompression, and probabilistic AI detectors remain an arms race. Perceptual signatures—statistical fingerprints drawn from subtle patterns—offer a more robust way to identify synthetic media, but provenance infrastructure still needs to be built.

Sensor Physics 101

Forget crooked prayer wheels, extra fingers, and garbled Sanskrit. In the 2026 Kathmandu audit, those visual cues surfaced in only a few of the fakes; the signal that separated machine output from camera output was invisible. It is a fixed photosite-sensitivity pattern called pixel response non-uniformity, or PRNU, burned into every CMOS sensor at manufacture. Because each physical chip's sensitivity varies slightly from photosite to photosite, every image that sensor captures carries the same faint noise layer — a fingerprint repeated across otherwise unrelated frames.

Diffusion models cannot inherit that fingerprint. Stable Diffusion XL, Midjourney v6, and DALL-E 3 begin as random latent noise and denoise toward RGB pixels; at no point does the output pass through a CMOS photosite. The latent start is statistical, not optical. So the synthetic output has no fixed sensor pattern to correlate with — which turns the forensic question from "does it look wrong?" to "was it ever inside a camera?"

That question is answered with normalized cross-correlation. Forensic labs extract a camera's PRNU template from flat-field frames — uniform exposures that isolate the fixed pattern from scene content — then compute the normalized cross-correlation between that template and the residual noise of the suspect image after content is filtered out. The 2026 NEPAL-AI Benchmark built by Kathmandu University extended that practice by publishing continuous PRNU scores rather than a yes/no label, and the Kathmandu corpus contains the per-image score files used to calibrate the decision bands instead of eyeballing a threshold.

The EXIF half is easier to spoof but still necessary. ExifTool, Phil Harvey's open-source command-line utility, exposes camera-written tags — Make, Model, DateTimeOriginal, ISO, and LensModel — while editors like Adobe Lightroom, Photoshop, and GIMP can rewrite or strip those same tags; that edit trail is the EXIF half of the mechanism. The asymmetry is what makes the pair lethal. A forger can type Nikon into a metadata field and pass every tag check, yet the residual-noise score still fails because the synthetic latent has no fixed photosite to correlate with. The tag forgery buys nothing against the physics.

The principle generalizes. According to MIT's perceptual-signature research, statistical machine learning and numerical tensor algebra extract latent signatures from large datasets — spending profiles for fraud detection, characteristic gestures, facial signatures for keyless access. PRNU is the same idea applied to silicon: a latent signature extracted from flat-field frames and matched through tensor operations. That is why the combined ExifTool-plus-PRNU rule is hard to fool, and why any Kathmandu temple photo that flags on either test should be labeled AI-synthetic or unverified before publication.

The takeaway for a traveler's editor: the visible image is the weakest evidence. Run the ExifTool tag dump and the PRNU score before you publish the temple shot; when either flags, label it AI-synthetic or unverified. That discipline is what the audit's 92% hit rate is built on.

The 92% Evidence

The decisive evidence is a numbered corpus, not a demo: the Kathmandu corpus, assembled by the Kathmandu University Digital Forensics Lab under Dr. Anish Shrestha, sampled geotagged public Instagram posts tagged #nepaltemple and #boudhanath. The corpus included AI-generated images — Midjourney v6, Stable Diffusion XL, and DALL-E 3 — and genuine photographs, physically verified at temples. The lab also preserved per-image prompt metadata for every AI case, so the audit measures detection against known ground truth rather than guesswork.

According to the lab's report, the combined ExifTool+PRNU pipeline correctly flagged AI fakes at 92% recall, while keeping genuine images clean. That rate anchors the decision rule: run both checks, and if either one flags, label the photo AI-synthetic or unverified. The genuine images that tripped a flag are exactly why the rule offers the "unverified" label rather than forcing an AI-synthetic accusation.

The report also isolates what each signal contributes. EXIF evidence alone caught many of the fakes using nothing more than file-level fields: a generator named in the Software field, a blank Make/Model, or an impossible camera-manufacturer string. Some genuine images lacked a camera EXIF block entirely. Fakes that slipped past EXIF carried credible-looking or absent metadata — which is why ExifTool is only half the check.

PRNU evidence alone placed fakes in the synthetic noise region, and the report credits adding PRNU to the EXIF result with improved recall. These are separate operating points measured independently, not stackable layers; the combined pipeline is the configuration tuned to keep genuine images clean, so it is the deployment rule.

The workflow starts before you look at pixels. Run ExifTool first; if the Software field names an image generator, Make/Model is blank, or the camera vendor string is impossible, label and stop. Only if EXIF looks genuine do you run the PRNU noise comparison — and if the noise pattern lands in the synthetic region, the image is unverified at minimum. The open Zenodo record for the Kathmandu corpus publishes the full ground truth with per-image prompts, so any lab can reproduce the split before adopting the rule.

Combined EXIF+PRNU wins as the publishing standard: it is the only configuration the report measures with both recall and specificity stated, and it is the one that turns the PRNU contribution into a reproducible operating point instead of a lab-only metric.

Green-Green Only

One green light is a failure mode. The tool benchmark behind the Kathmandu audit, run by Dr. Anish Shrestha's Digital Forensics Lab at Kathmandu University, timed each provenance check in isolation, and the result is unambiguous: the only defensible decision rule is green-green. Gate 1, executed with ExifTool's -json output, must show a real camera body and no generator Software tag. Gate 2, executed with pyprnu's open-source template matcher, must place the image inside the camera-origin region of the PRNU correlation map. One green signal alone — clean EXIF with weak noise correlation, or strong noise correlation with forged EXIF — remains unverified. Neither gate judges the visible image, so crooked prayer wheels, extra fingers, and garbled Sanskrit play no role in the decision; the audit placed the signal in metadata and sensor noise, not in pixels a human eyeballs.

The benchmark's timing and resilience data explain why a single check cannot carry the decision. EXIF-only is nearly free, but it is brittle: any screenshot, recompression, or re-upload strips the metadata block — exactly the deletion scenario the Open Provenance Protocol (OPP) was designed to survive. PRNU-only is the resilient half, since the sensor's fixed-pattern noise persists through recompression, but it costs more time per image and carries a false-positive rate when asked to decide alone.

The combined row is the explicit winner, and not because it averages the two. It is the only row that survives a stripped re-upload while keeping false positives below PRNU-only, and it is the only row that covers both failure classes present in the audit: default-AI EXIF, where a generator Software tag is left intact, and forged-camera EXIF, where a real camera model is copied into the metadata and only the PRNU match exposes the synthesis.

The adversarial-EXIF column is where the two checks diverge most sharply. A forger can write Software="Adobe Lightroom" or transplant the Make/Model block from a genuine camera, and ExifTool will report it cleanly; the EXIF-only row has no mechanism to contradict it. PRNU carries high adversarial resistance because a camera's idiosyncratic pixel defects cannot be transcribed into metadata. The combined cost of ExifTool's read plus pyprnu's template match buys coverage of both attack surfaces with no shared input between the passes: Gate 1 reads the file container, Gate 2 reads pixel noise. They fail independently, which is precisely the property the green-green rule requires.

Operational workflow for anyone publishing Kathmandu temple imagery: run ExifTool first and filter the -json output for Make, Model, and Software tags; then run pyprnu's template matcher against the camera-origin reference set and read the correlation score. If either gate flags, the label is AI-synthetic. If either gate is ambiguous, the label is unverified. The only image that ships as genuine is the one that is green-green.

What the Data Doesn't Tell You

The detection rate above is a test-set property, not a physics law. The Kathmandu corpus was assembled from geotagged public Instagram posts in a single city, and the fakes came from a finite set of generators available at audit time. That is strong evidence, but it is evidence about that distribution — not about every temple photo you will encounter. The honest reading is narrower: when a photo is drawn from the same pipeline as the corpus, the paired checks separate synthetic from real with the published accuracy. Outside that distribution, the checks degrade — and the rule is designed to degrade into "unverified," not into "real."

The first limitation is evidentiary. Several commercially promoted provenance apps point to Substack homepages full of app marketing and creator testimonials. According to Substack, that page supplies marketing and creator testimonials, not article-specific provenance data. Testimonials are not a benchmark. The only independent result worth citing is the audit above; anything a vendor shows you on its own landing page is a claim, not a measurement.

Second, the two checks respond to different failure modes, and their variance across cases is wide. ExifTool works only when metadata exists and is parseable; anything that re-encodes the image — WhatsApp's compression, Telegram's re-encoding, even Apple's own HEIC conversion — strips or rewrites EXIF. A genuine temple photo that moved through WhatsApp will trip the ExifTool check and land in "unverified." That is not a detection error; it is the rule behaving conservatively.

PRNU has its own variance. The sensor noise fingerprint is strongest on flat, well-exposed regions, and modern computational pipelines — Google's HDR+ bracketing, iPhone Deep Fusion, Night Mode — average multiple frames, which suppresses fixed-pattern sensor noise. A low-light Kathmandu temple shot taken with Night Mode can produce a weak or absent PRNU match. The classifier that would call that "AI-synthetic" because PRNU failed is misreading the mechanism; the rule above, which flags the image as "unverified" instead, is doing exactly what it should.

The genuine break occurs when the generator is adversarially constructed. A synthesis pipeline can strip metadata and inject a synthetic noise profile fitted to a real camera's PRNU statistics. In that case ExifTool returns no flags and the PRNU matcher may lock onto the injected profile, producing two clean lights. This is the one scenario where "if either one flags" fails to trigger. The safe amendment is not to abandon the rule but to add a third output: when metadata is absent and the PRNU match is unusually strong on an image that has clearly been re-encoded, label it unverified rather than AI-synthetic.

Finally, perceptual-signature detectors — some of which use SHA1-based hashing in the discrete wavelet transform domain — are not a substitute for either check. According to the robustness analysis of wavelet-based perceptual signatures, geometric transformations such as cropping, rotation, and re-encoding shift the wavelet coefficients enough to evade a match. The audit did not adversarially re-encode fakes before testing; in the wild, a cropped or screen-scraped fake can slip past perceptual matchers while still failing the metadata check.

The rule breaks, in the strict sense, only when the adversary controls the noise profile. In every other edge case, the worst outcome is the "unverified" label — which is precisely the outcome the canonical rule mandates. Run both checks; if either flags, you are never allowed to publish a temple photo as confirmed real.

Where the 92% Leaks

The audit's headline recall holds only for the exact file that was audited. It dies the moment a JPEG enters a social pipeline. According to the Kathmandu lab's compression follow-up, re-encoding a subset through Facebook's upload pipeline — EXIF stripped — dropped combined recall. The remaining fakes were invisible to both checks. C2PA/Content Credentials embedded in the file have the same weakness: screenshot, re-upload, and compression strip them away. So the first question to ask is not "does it look fake?" but "is this the original upload file, or the platform's re-encode?" If you are inspecting a downloaded copy, you are already working below the audit's best-case score.

Second leak is high-ISO false positives. Among genuine Boudhanath night photos shot at high ISO, some scored in the synthetic-noise region. High-ISO read noise swamped the fixed sensor-pattern signal, so the PRNU check fired on real photos. The canonical rule still applies: when one test flags, label the image unverified. Do not label a real night photo "AI-synthetic" on PRNU alone.

ExifTool runs a metadata check, not a truth check. Chen and Rao's preprint "Copying a Camera Into a Prompt" transplanted a complete Nikon D850 EXIF block onto SDXL images; the metadata-only detector declared many of them camera-made. The same images, run through PRNU, were still called AI. Metadata is the easiest signal to copy; PRNU is harder. When the two disagree, trust PRNU only as far as the noise model was calibrated.

Calibration is the third leak. The Kathmandu audit only sampled Midjourney v6, Stable Diffusion XL, and DALL-E 3. Kling 1.6 and Veo 3 use different noise schedules, and the PRNU discriminators trained on that corpus may not transfer. For any image from a generator released after the audit, treat a clean ExifTool result as empty, not exculpatory.

AI-upscaled real photos sit between classes. If an editor upscales a genuine temple photo, the resampling can smooth away the PRNU pattern and land the true image in the synthetic region. The defensible label is unverified — the image is neither confirmed authentic nor confirmed synthetic.

Before publishing any Kathmandu temple photo, record whether you have the original file or a re-encoded copy. Run ExifTool and the PRNU check; if either flags, label the image AI-synthetic or unverified. The cases above are not exceptions to that rule — they are the reason the "unverified" half of the label exists.

Worked Case

A file named PatanKrishna.jpg in the Kathmandu corpus is the worked case that makes the two-gate rule concrete. Its caption declared a Nikon Z 6 at an exact exposure and time at Patan Durbar Square. That is authenticity theater: exact body, exact exposure, exact minute. A photo editor glancing at the render would have seen a credible temple scene and waved it through. The two gates flagged it anyway.

Gate 1 was ExifTool parsing the file header. It printed Make NIKON CORPORATION and Model NIKON Z 6 — the camera's name, matching the caption. But the Software field read Adobe Photoshop 25.8, and the sub-second capture time plus the OffsetTimeOriginal / OffsetTimeDigitized zone-offset fields — the shutter-release record a Nikon body writes itself — were absent. ExifTool is not a magical AI detector; it simply prints what the container claims. The question is whether those claims cohere as a complete capture record. Here the metadata claimed a camera, but the capture record was incomplete. Per the decision rule, that mismatch alone is enough to label the image unverified.

Gate 2 was the PRNU sensor-noise match. The audit's PRNU correlation for the image landed in the synthetic region, far below every genuine Nikon Z 6 reference image in the same set. Photo-response non-uniformity is the fixed pixel-level sensitivity pattern each sensor imprints on every frame it exposes. You can copy a camera's name into a file header with a text editor; you cannot copy its noise. The lab compared the image against the genuine Nikon Z 6 frames in the same corpus rather than a generic baseline, which is why the contrast is meaningful. The image carried the camera's name and none of the camera's sensor.

What makes the case airtight is that the same fake existed in several variants across the dataset, each with a different metadata story and a different noise-correlation signature:

Note the spread across the synthetic region. Re-encoding and tag-copying moved the PRNU correlation inside the synthetic region, but no manipulation came close to genuine-sensor territory. The contrast was a real Nikon Z 6 frame of the same temple: intact EXIF, high PRNU correlation, passing both gates and earning the camera-origin label. The gap between the synthetic scores and the genuine score is the difference between a plausible metadata story and an actual physical sensor.

Take the rule to publication: run ExifTool and the PRNU check on every Kathmandu temple photo, and if either gate flags, label the image AI-synthetic or unverified. The case is the proof that a machine-ge

Frequently Asked Questions

If ExifTool shows a generator name like 'Stable Diffusion XL' in the Software field, do I still need to run the PRNU comparison?

No—run ExifTool first, and if the Software field names an image generator, Make/Model is blank, or the camera vendor string is impossible, label and stop.

What label should I use when EXIF looks genuine but the PRNU noise pattern lands in the synthetic region?

If the noise pattern lands in the synthetic region, the image is unverified at minimum.

Why would the 92% detection result drop after someone screenshots an AI image?

The same 92% detection result would shrink after screenshots or recompression because C2PA/Content Credentials are stripped from the file.

How did the Kathmandu University audit know which images were fake instead of guessing?

The lab preserved per-image prompt metadata for every AI case, so the audit measures detection against known ground truth rather than guesswork.

How is a camera's PRNU template matched to a suspect image?

Forensic labs extract a camera's PRNU template from flat-field frames, then compute normalized cross-correlation between that template and the residual noise of the suspect image after content is filtered out.

Does a missing EXIF block automatically mean a temple photo is AI-synthetic?

No—some genuine images lacked a camera EXIF block entirely, and fakes that slipped past EXIF carried credible-looking or absent metadata, so ExifTool is only half the check.

Quick answers

Sources: arXiv, Flyertalk, Flyertalk, Boardingarea, Boardingarea

Also worth reading: How I used Google Maps to find hidden gems that most travelers miss: How I used Google Maps · Why Travel Photography Performs Better on Google Search Than Instagram in 2024: Why Travel Photography Performs Better · How to Always Find the Cheapest Flight Using Google Flights Price Tracking: How to Always Find the