How it works
An agent that forges, a compositor that keeps it honest.
Image AI is the whole product: vision models read, plan and verify, an image model forges, and computer vision written for this project measures exactly what changed. Dark boxes are model calls, light boxes are our own code.
Step 1, Browser
Prepare
Apply orientation, center-crop to a supported aspect ratio, resize to 1024 px, re-encode. EXIF and GPS are gone before upload.
Step 2, Vision model
Read and plan
Describes the scene, lists objects and people, and proposes three candidate edits with region, instruction, tell and hint.
Step 3, Server
Validate
Region size must fit the difficulty, stay clear of every person and have a sane outline. Otherwise the plan is rejected and planned again.
Step 4, Image model
Forge
Edits the full photo following one precise instruction. It tends to drift slightly in framing and color everywhere.
Step 5, Server
Composite
Register by shift search, match tone from a ring around the region, blend through a feathered mask. Only the planned region changes.
Step 6, Server
Measure
Diff the result against the original: blur, threshold, morphological opening. That mask is the answer key and the heatmap.
Step 7, Vision model
Verify
Compares original and forgery: applied, on target, artifacts, people untouched, plausibility. A rejection triggers a retry.
The loop is self-correcting. If no visible change comes back, if the framing cannot be registered, or if the verifier sees a flaw, the attempt is rejected and the agent retries with a stricter instruction or moves to the next candidate. At most three image calls are spent per forge, and every rejection is shown in the agent log.
The answer key
Why the heatmap is exact, not estimated
Image models repaint the whole picture, so a plain difference between input and output lights up everywhere. Fake Dojo never shows the raw model output. It takes only the planned region from it and blends that into your untouched original with a feathered mask. Every pixel outside the mask is your original pixel, bit for bit, until the final save.
Because we did the compositing ourselves, the difference between the original and the forgery is the ground truth. That mask scores your taps, draws the red heatmap, and as a by-product labels every deck card for a forgery-localization dataset (image, mask, type, difficulty).
- Alignment search
- shifts of up to 8 px, coarse then fine
- Alignment trigger
- ring difference above 12 of 255
- Tone matching
- per channel mean and deviation, 24 px ring
- Mask
- dilated 12 px or 3%, Gaussian feather
- Change threshold
- luma difference of 10 of 255
- Edit not applied
- below 0.1% changed pixels
Adaptive training
Five difficulty levels, six manipulation types
| Level | Region size | Traces |
|---|---|---|
| 1 | up to 15% | left in, JPEG 95 |
| 2 | up to 10% | left in, JPEG 95 |
| 3 | up to 8% | weakened, JPEG 90 |
| 4 | up to 4% | hidden, noise and JPEG 85 |
| 5 | up to 3% | hidden, noise and JPEG 85 |
Two hits in a row raise the level, a miss lowers it. Per type we keep hits and misses and use the mean of a Beta distribution as skill. One minus that mean, normalized, becomes the weight the planner receives, so the next forgery leans toward what you miss most. Points: 100 times the level on the first guess, 60 times on the second, minus 30 for the hint and 20 per lab tool.
- Removed object
- Look for repeated textures, smudged patterns and shadows without an owner. When something is erased, the model has to invent what was behind it, and invented ground, walls or foliage often look a little too smooth or repeat a nearby pattern.
- Added object
- Check whether the object belongs to the light in the scene. Its shadow should fall the same way as the others, its edges should be as sharp or as soft as things at the same distance, and its size should fit the perspective.
- Replaced object
- Compare the object with its neighbors. A swapped item often has a slightly different sharpness, grain or color temperature than the things next to it, and where it touches the surface below the contact shadow can look painted on.
- Altered text
- Read every sign, label and display. Edited text tends to have letters that are too even, spacing that drifts, or a font weight that does not match the rest of the sign. Ask whether the number or word still makes sense in context.
- Changed attribute
- Question colors and states. A recolored surface can lose its natural texture or reflect a color that nothing nearby explains, and a door, lamp or switch in a new state should change the light and shadows around it too.
- Lighting or shadow
- Follow the light. Every shadow in a scene should point away from the same source and have a similar softness. Reflections must show what is really opposite them. One shadow or highlight that disagrees is a strong clue.
Forensic lenses
Three classic methods, written from scratch
Error level analysis
Re-save the image as JPEG at quality 90, subtract, amplify the difference 20 times.
Areas saved a different number of times compress differently. Bright patches can hint at pasted content. Edges and fine textures are naturally brighter, so this is a clue, not proof.
Noise residual
Luma minus its 3 by 3 median, then the standard deviation over 8 by 8 blocks, shown on a color ramp.
Every camera leaves a noise fingerprint. Generated patches are often smoother or noisier than their surroundings.
Edges
Sobel gradient magnitude of the luma channel.
Seams and unnaturally clean edges around inserted objects.
Forensics give clues, not proof. The lenses run on plain pixel arrays in a Web Worker in your browser, with no library. At difficulty 4 and 5 the forger adds noise and re-compresses the whole image, and you can watch the same lenses go quiet. That is the lesson: tools help, but a trained eye and a habit of doubt matter more.
Safety and privacy
Guardrails that are enforced in code
People are never edited
The planner is told so, the server rejects any region within 5% of the image width of a detected person, and the verifier discards any result in which a person changed.
Sensitive documents are refused
IDs, receipts, chat screenshots, news articles, medical and legal documents, and photos that are mostly a person are turned away before any edit is made.
Nothing is stored
Photos exist in memory for the length of a request. Server logs contain a route, a status code and timings, never image data or plan text.
Location data never leaves your device
The browser re-encodes your photo through a canvas before upload, which removes EXIF data including GPS coordinates.
No download of live forgeries
The app has no save or share button for forged images, and a forgery is gone when you leave the page.
The API is not an open image editor
Edits can only be rendered with a signed ticket that binds the request to the photo and to the instructions the server itself validated.
Spending is capped
Live forging is limited per address and per day, and one switch turns it off. The deck modes keep working without any model.
Is a forgery trainer a good idea at all? We think so, for the same reason companies send simulated phishing mails: people learn to resist a trick by meeting it in a safe place. The edits here are small, harmless and confined to scenes, and the product only exists to show you the answer afterwards.
Models and credits
What runs under the hood
- Vision, planning, verification
- seed-2-0-lite-260428
- Image editing
- seedream-4-0-250828
- APIs
- BytePlus ModelArk
- Cost per image call
- free quota, then 0.03 USD
- Image calls per forge
- 1 to 3
Built with Next.js, React, TypeScript, Tailwind CSS, the Google Gen AI SDK, MediaPipe Hand Landmarker, zod, sharp and Vitest. Type set in Geist Sans and Geist Mono. Deck photos by Suhan Nawaz and, for the cards named web, public-domain photos from Wikimedia Commons (listed in the README).
AI disclosure: Claude Code wrote most of the code under Suhan's direction. At runtime Seed 2.0 Lite plans and verifies and Seedream 4.0 edits, both through BytePlus ModelArk. Gemini is an optional provider. Built during Banana Hacks 2026, October 10 to 11, 2026.