ProfilePairs: a paired real/AI-edited dataset for social profile authenticity detection

Background

With the advances of image generation models powered by AI, misuse of generated content is becoming a growing concern. A recent international assessment documents rising misuse of general-purpose AI for criminal purposes, including scams, fraud, extortion, and non-consensual imagery

Fraudsters employ several distinct methods to construct a false identity for these scams. Some steal a real photograph from an unrelated person's social media account. Others generate an entirely synthetic profile photo from a text prompt (text-to-image). A third method takes a real reference photograph and alters it using image-to-image generation guided by a text prompt. This third method is less documented in existing reporting than the first two, but it is increasingly accessible through consumer-facing image editors. Tools such as Gemini's image editing mode, OpenAI's GPT-Image, and Adobe Firefly can edit a photograph directly, enabling a user to change the background, adjust the subject's appearance, or introduce new elements to the scene.

Existing research databases for AI-generated image (AIGI) detection exhibit limited diversity in manipulation type. Most pair a real photograph against a text-to-image output as the sole contrasting case (see summary below). Detectors trained on this single pairing may fail to generalize to other manipulation types, such as image-to-image editing of a real photograph. To test this hypothesis, we construct a new database using real photographs as the source. Each real photograph is paired with a prompt that targets a specific change, such as the background or the subject's hair, producing a generated counterpart derived from that same real photograph rather than synthesized from text alone.

Gaps in existing AIGI detection datasets

We begin by reviewing the datasets most frequently cited as AIGI detection benchmarks. We evaluate each dataset from two perspectives: its general suitability for AIGI detection research, and its suitability specifically for social profile authenticity detection, with particular attention to whether the dataset contains human subjects.

On the fourth point: a substantial share of the synthetic images in ForenSynths and AIGIBench are visibly non-photorealistic (cartoon-like, painterly, or structurally distorted). A classifier can separate these from real photographs without learning anything about photorealistic, identity-preserving editing - which limits how much reported accuracy on these benchmarks says about the problem we're targeting. No dataset we reviewed is simultaneously downloadable, human-centric, image-level (not video), and difficult by virtue of photorealism rather than availability.

Dataset construction

We identify substantial value in constructing a new dataset that contrasts photorealistic real images with AI-generated counterparts, produced via image-to-image methods, depicting human subjects. Such a dataset is well suited to the development of detectors for fraudulent social profiles. The prompts used during generation may encourage minimal or regional change, such as "change my hair" or "touch up my skin." These prompts approximate those plausibly used by scammers in practice, while simultaneously providing a rigorous test of detector performance on subtle, localized manipulations.

We construct ProfilePairs, a photorealistic, image-to-image dataset, by selecting 5,000 real images containing human subjects from existing research databases. Each real image is paired with a prompt and submitted to three API providers (OpenAI, Google AI, and Fal AI), yielding up to three generated counterparts per image. A small number of generations were excluded post hoc: some were flagged for sexual content by provider-side safety filters, and in a few cases the API returned the input image unchanged, indicating that the requested edit was not applied. The final dataset comprises 5,000 real/generated image pairs (10,000 images in total). For consistent baseline comparison, we partition the dataset into training, validation, and test splits at a 70/15/15 ratio.

Preliminary results

Baseline detectors underperform relative to their reported in-domain accuracy

We evaluated a set of mainstream AIGI detectors on ProfilePairs, zero-shot, using their original pretrained checkpoints without fine-tuning. This included both dedicated detection architectures and a simple CLIP-feature-plus-linear-probe baseline. Preliminary results are in the range of ~70% accuracy on AIGI detection. This is well above chance, but substantially below the 90%+ accuracy these same methods, including the CLIP baseline, typically report on their original in-domain benchmarks (ForenSynths, GenImage, and similar).

We think this gap is informative on its own. A simple CLIP linear probe, and detectors like it, generally perform well on object-centric benchmarks (CIFAKE, GenImage) or on real-vs. non-photorealistic pairs (ForenSynths, AIGIBench), because that is a comparatively easy discrimination: non-photorealistic generations differ from real photos along coarse, global cues - texture statistics, color distribution, obvious rendering artifacts. None of that requires learning to separate a real photorealistic image from a photorealistic edited one. Our results suggest these methods were never actually solving the harder problem; they were solving an easier proxy problem that happened to correlate with it in prior benchmarks. ProfilePairs removes that shortcut, and accuracy drops accordingly.

Full baseline results, per-method and per-provider breakdowns, and cross-generator generalization numbers are pending and will be reported in the accompanying paper.

Edits are not spatially confined to the prompted region

A secondary observation from manual pair inspection: even for prompts targeting a narrow region (e.g. hair color), generators frequently introduce measurable change outside that region - background pixels shift, lighting is adjusted globally, fine texture changes propagate beyond the named target. The prompt text is a weak upper bound on the actual edited region, not a precise mask.

Because each pair shares a real reference, this is directly measurable at the pixel level (e.g. via a difference map or a perceptual similarity metric like LPIPS), which is not possible with unpaired real/synthetic datasets. We think this is a promising direction independent of the primary detection task: characterizing where and how much current generators change an image, beyond what a prompt requests, may surface detection signals (blending boundaries, regional artifact patterns) not captured by global real-vs-synthetic classifiers.

Limitations of ProfilePairs itself

• Generator coverage is a snapshot in time. Results reflect three specific providers (OpenAI, Google AI, Fal AI) at specific model versions and access dates. Image-editing endpoints update frequently; results are not guaranteed to hold for newer model versions without re-evaluation.
• One prompt per real image per provider. The current sampling design does not let us separate variation caused by the source image from variation caused by the prompt, for a given image. A future version may generate multiple prompts per image to support this.
• No demographic annotation. We do not currently annotate demographic attributes of subjects in either real or edited images. Any skew inherited from the source datasets (SocialRF, Open Images, xhlulu/FFHQ) is therefore not measured, and detector performance may not generalize evenly across demographic groups.
• Consent and provenance. Real images are drawn from existing research and community-sourced datasets. Licensing permits redistribution, but the depicted individuals did not specifically consent to appear in a dataset built for AI-editing and catfishing-detection research. This is the primary reason we're leaning toward a gated, request-based release rather than an open one.