A recycled real photo passes every authenticity test. I built a cross-signal forensic gate for auto claims that catches it, and proves the decision in court.

InsuranceFraud DetectionInsurtech

I set out to build a deepfake detector for auto insurance claims. A real, unedited photo beat it.

Ashutosh Singhal July 7, 202611 min read

The afternoon a genuine photo walked straight through my detector

I built the pixel-forensics signal first, because it was the part that felt like real engineering, and I was quietly proud of it. It reasons over sensor-noise and frequency-domain artifacts, the tells a diffusion model leaves behind when it hallucinates a smashed bumper. In the demo that signal is labeled simulated, a stand-in for a learned generative-artifact model I have not trained yet, and I want to say that plainly before anything else. But the logic wrapped around it was mine, and it worked. I handed it a diffusion-faked bumper and it lit up exactly the way I wanted.

Then I handed it a staged claim I had labeled CLM-C-1044, a rear-end collision in Raleigh, and it cleared the photo clean. Consistent. No artifacts. Sensor noise present. That was the correct answer, which is exactly what unsettled me, because CLM-C is fraud. The photo is a genuine camera image. In the scenario it was lifted from a settled prior claim and resubmitted against a fresh loss. My best signal was not weak. It was aimed at the wrong question. It asked "is this image fake," and for a recycled real photo the honest answer is no.

A recycled real photo passes every authenticity test in the world, because it is real.

That afternoon is the reason the thing I ended up building is not a detector at all. You can route the same four claims yourself in the running demo. Every claim, image, carrier, and historical record in it is synthetic, so nothing there is a real policyholder or a real loss. But the failure it dramatizes is not invented. It is the failure I walked into.

Why is a real photo the hardest fraud to catch?

I keep coming back to the asymmetry that broke my first design. The whole insurance-fraud arms race gets framed as "build a better deepfake detector," and I now think that framing is the trap. A single authenticity classifier fails in two directions at once. It ages out the moment image generators improve, and it is structurally blind to the oldest fraud in the book, a real photo recycled from a prior claim, because that photo passes every authenticity test by being genuine.

The pressure behind all of this is real even if my claims are synthetic. 98% of insurers report a surge in manipulated media and only 32% feel "very confident" detecting deepfakes (Verisk, 2026 State of Insurance Fraud). 36% of consumers in that same survey say they would alter a claim image. Deepfake fraud attempts are up 2,137% over three years (Facia.ai), and one UK motor carrier saw a 300% rise in AI-manipulated vehicle images in a single year (The Guardian / Milliman). The industry's reflex has been to bolt a third-party detector onto submission. 65% of carriers now run one (Verisk, 2026). That reflex catches the obvious fakes and waves the recycled real photo straight through to payment.

The FNOL intake queue with four staged claims awaiting verification — The intake queue. Four staged claims, all synthetic, wait for authentication before any damage is assessed. CLM-C-1044 (rear-end collision, Raleigh) looks the least alarming of the four at 2/5 severity, which is the point.

The line I kept writing on the whiteboard was that authentication has to be a gate, not a report. A report gets read after the money moves. A gate runs before it. And a gate cannot rest on one signal that a genuine photo defeats by definition.

Agents advise, code decides

I made one architectural decision early that I would defend to a regulator without flinching: the routing call does not belong to the language model. A forensic crew of four analysts plus one adversarial Challenger investigates a claim and produces typed verdicts. Then a deterministic policy gate, plain code sitting outside the agents, aggregates those verdicts and the raw signals against the carrier's thresholds and emits one reproducible routing decision. AUTO-PROCEED, SIU-REFERRAL, HUMAN-REVIEW, or ABSTAIN. The trust boundary is code, never an LLM self-report.

The two reasoning roles, Narrative-Consistency and the adversarial Challenger, run through a provider-swappable adapter that defaults to claude-opus-4-8, and with no API key set the whole gate falls back to a deterministic offline stub and still runs end to end. I liked that property more the longer I sat with it, because reproducibility is the thing a compliance officer actually needs. Ask the gate the same question twice and it answers the same way, and it can show its work.

Agents advise. Code decides. A regulator can audit a rule. Nobody can audit a vibe.

That is not an abstract preference in 2026. A NAIC Model Bulletin on AI has been adopted by 24 states, the Colorado AI Act takes effect June 30 2026, and the EU AI Act's high-risk deadline lands in August 2026 with penalties up to €35M or 7% of global turnover. Outsourcing the model does not outsource the liability. If a carrier automates a claims decision, it has to be able to defend that decision, and "the model was confident" is not a defense.

What does "caught" actually mean here?

When I finally watched CLM-C get caught, I wanted to know exactly which signal did the work, because I no longer trusted my own intuition about it. So I opened the decision analysis and read it line by line. The Provenance Analyst passed the claim: capture GPS within 1.1 km of the reported loss location, capture date consistent with the loss date. The Pixel-Forensics Analyst, the one I had been so proud of, also passed it, labeled simulated right on screen, artifact_score 0.06, sensor noise present. Both "is it fake" signals cleared it, exactly as they should have, because the photo is real.

CLM-C-1044 routed to SIU-referral by the deterministic policy gate — CLM-C-1044 stamped "Duplicate image · matches prior claim" and routed to SIU. The forensic pipeline ran every stage in single-digit milliseconds, but the referral itself is made by the deterministic policy gate, not by any analyst.

The catch came from the other two. The Reuse Analyst matched the photo's 256-bit perceptual hash against a historical claims index and found a settled prior claim, HIST-4019, at hamming distance 0, a pixel-for-pixel twin filed months earlier. The Narrative-Consistency Analyst read the FNOL text against the image and flagged a contradiction: the account describes a side-swipe while the photo shows rear damage. Then the adversarial Challenger, a skeptic I prompt specifically to refute every flag and try to clear the claimant, tested both flags and reported that both survived. Only then did the deterministic gate route the claim to SIU as recycled evidence.

Decision analysis showing Provenance and Pixel-Forensics consistent while Reuse and Narrative are flagged — The four verdicts side by side. Provenance and Pixel-Forensics (labeled simulated) both read consistent. The catch lives in the other two: the perceptual hash matches settled claim HIST-4019 at hamming distance 0, and the narrative describes side damage while the photo shows rear.

The detail I make everyone sit with is this: the catch does not depend on the simulated pixel signal at all. The two agents built to answer "is it fake" both cleared this claim. The two that asked "have we seen this exact image before, and does the story hold" are what stopped it. That is the entire argument for a crew over a classifier, and CLM-C is the smallest true version of it I could build.

The signals I built to spot a fake both cleared it. The ones that caught it asked whether we had already paid for this photo once.

The number I refuse to lead with

I have a benchmark result that is very easy to misuse, and I would rather defuse it myself than watch someone quote it back to me stripped of its scope. On a labeled 120-claim synthetic set (47 clean, 25 diffusion-fake, 20 recycled-real, 13 ambiguous, 15 metadata-spoofed), the gate routes every claim correctly and posts a clean sheet: 100% straight-through on clean claims, 0% false-accusation, 100% of decisions carrying a verifiable audit record, recall 1.0 against the labels. Those numbers are real, and they are also properties of a constructed set whose fraud classes carry detectable signatures by design. They are not an open-world guarantee, and I say so every single time.

The number I actually lead with is the coverage gap. Of the 35 frauds in that set that carry no authenticity artifact, the 20 recycled-real and 15 metadata-spoofed claims, a single-signal authenticity baseline catches 0 of 35. The cross-signal gate catches 35 of 35. That gap is the honest headline, because it measures the thing the incumbent approach cannot do rather than flattering the thing my constructed set makes easy.

Benchmark panel showing zero of 35 caught by a single-signal detector versus 35 of 35 by the gate — The benchmark on the labeled 120-claim synthetic set. The tile that matters is the one on the left: 0 of 35 recycled and spoofed frauds caught by a single-signal detector, 35 of 35 by cross-signal forensics. The 100% and 0% tiles are true on this constructed set, not in the open world.

I know the difference between an impressive number and a durable one. The durable claim is the shape of the gap, not the size of the percentage.

Spoliation is now a red row on screen

I did not expect the chain-of-custody piece to become the part buyers lean into, but it did, and I understand why once I watched it fail on purpose. Every decision binds the original image's SHA-256 into an append-only, hash-chained ledger. The verify-chain step recomputes every link and re-hashes each original still sitting on disk. If a GenAI "enhancement" or an upscale overwrites the original claim image, the carrier is suddenly exposed to spoliation, the destruction of evidence, in any litigation that follows.

Chain-of-custody certificate showing one row turned red after tampering — After tampering with one stored original and re-running verify-chain, row 0 turns red, "Altered · spoliation," while the sealed rows stay intact. Because the check re-hashes each original on disk, an edit surfaces as a broken chain rather than a silent overwrite.

I clicked "tamper with the selected original," ran verify, and a row went red: Altered, spoliation detected. That is the whole value made literal. Chain of custody stops being a phrase in a compliance deck and becomes a state on screen that an automated pipeline can enforce and a lawyer can read. The original is never mutated in normal operation, only sidecar artifacts, so the day someone does edit it, the record already knows.

What I still don't know

I do not think this gate is finished, and the capability I am least certain about is one I am also proudest of: the abstain path. When a claim is genuinely ambiguous, low resolution, partial metadata, nothing conclusive either way, the demo's CLM-D-1045 routes to ABSTAIN and then to HUMAN-REVIEW instead of forcing a verdict. It abstains rather than bluffing a pass or an accusation, and the adversarial Challenger exists precisely so a legitimate claimant is not thrown to SIU on a thin signal. On the synthetic set that discipline is what keeps false-accusation at 0%. In the real world I do not yet know where the abstain threshold should sit, and pretending I do would be its own kind of fraud.

There is a lot I have deliberately left stubbed. The Guidewire ClaimCenter and Duck Creek connectors, the mobile guided-capture SDK, a real C2PA verifier, and a real PRNU camera-fingerprint database are all deferred. The carrier's own Tractable or CCC severity score is accepted as an input field, not computed here, because this gate runs before damage assessment and authenticates what those systems go on to assess. It does not replace them, and I would not claim it does.

The four staged claims are all there in the demo if you want to run them through the pipeline and read the receipts yourself. What I want you to leave with is not the demo though. It is the question that reorganized my own thinking that afternoon in Raleigh, staring at a real photo my best detector had just approved.

And if you would rather watch it than read me describe it, here is the whole gate running end to end.

So here is the one I keep putting to claims and SIU leaders: if the most expensive image fraud you face is a genuine photo you have already paid a claim on once, what is your detector actually detecting?