Holograin: Detecting Documents Redrawn by AI

An applicant photographs a payslip, opens an image app and asks it to change the net pay. Less than a minute later, for about four cents, they have a new image of the same payslip with a better number: same employer, same layout, same font, same grey scanner background.

There is no PDF editor to fingerprint, no text layer to inspect, no revision history. The file is not an edited document. It is a new image, drawn by a model.

Holograin is the detector we built for this case. It reads a scanned page or a phone photo and says whether an AI image generator redrew it. On pages that went through our upload pipeline, it catches 90% of AI-edited pages while flagging 1 genuine page in 100. It runs inside every Holofin fraud analysis on scanned financial documents.

This article covers how it works and how it compares with frontier LLMs and open AI-image detectors.

Three ways to tell a document was generated

There are three places to look for evidence that an image came out of a generator.

Provenance metadata. Some generators attach a C2PA manifest, a signed statement that the image was produced by AI. When it is present it is conclusive, and Holofin verifies it on the original upload before any conversion. But a single screenshot or re-save removes it, so its absence proves nothing.

Invisible watermarks. Some vendors embed a watermark in the pixels. Not every generator does, and each watermark can only be read with its vendor's tool. It is useful evidence when present and silent otherwise.

The pixels themselves. A scanner leaves sensor noise, a particular blur along character edges and a compression history. A phone camera leaves its own optical traces. An image generator leaves a texture of its own, invisible to the eye, in every pixel it produces. When a generator edits a document, it does not change one line: it redraws the whole page, so that texture covers the whole page.

The third source is the only one a forger cannot remove by re-saving the file. Holograin is built on it.

Why a general model is not enough

The first approach most teams try is to show the page to a frontier LLM and ask whether it was generated. We tested that on 200 pages that had gone through our upload pipeline: 100 edited by five AI generators, 100 genuine. Each model received a fraud analyst's prompt and returned a verdict with a probability.

The two LLMs fail in opposite directions. Gemini 4 Argon caught 90 of the 100 fakes and flagged 45 of the 100 genuine pages. GPT-6.1 Sol Pro flagged no genuine page and missed 60 fakes. It caught only 5% of the pages edited by GPT-5.4 image, OpenAI's own generator.

This is expected. An LLM judges whether a document is plausible, and an AI-edited payslip is plausible by construction. The evidence is not in what the page says but in how its pixels were produced. A general model also sends every document to its provider; Holograin runs on Holofin's servers.

Open AI-image detectors do look at pixels, but they are trained on photographs: faces, landscapes, scenes. A scanned document is mostly flat white with sharp black glyphs and compression artefacts, which is far outside what they have seen. In our first tests, one popular detector rated genuine documents between 0.98 and 1.0 on its "AI-generated" scale. Another, among the strongest open models, shrinks the whole page to 384 pixels before scoring it, at which size a payslip is unreadable; it scored nearly everything close to zero. Run tile by tile at full resolution, that second model caught 20% of AI-edited pages at 1% false positives.

Trained on financial documents

Holograin is a vision model trained specifically on financial documents: hundreds of thousands of pages of payslips, bank statements and annual accounts, genuine and AI-edited. Every page is seen through the channels documents actually arrive by, from the raw scan to phone photos, screenshots and our upload pipeline, so the model learns the generator's signature itself, not the artefacts of one file format.

Three properties set it apart from general-purpose detectors:

• Full-resolution, region-level analysis. Holograin examines every region of the page at native resolution and isolates the area carrying the strongest generator signature, so a page is judged on its most suspicious evidence, not on an average.
• Robust to recompression. Its detection survives the transformations a document goes through before it reaches you: JPEG recompression, messaging apps, screenshots and format conversion.
• Calibrated per acquisition channel. Each channel has its own decision threshold, set on genuine documents the model never saw in training, so the false-positive rate holds whichever way a document arrives.

Results at 1% false positives

Every figure below is measured at a single operating point: a threshold that flags at most 1 genuine page in 100. A catch rate without its false-positive rate does not describe a detector. Analysts stop reading alerts from a tool that regularly flags honest applicants, so we set the false-positive rate first and report the catch rate it allows.

For comparison, a leading open AI-image detector catches 20% of the same uploaded documents.

Generators it was not trained on

New image models are released every month, so the result that matters most is on generators the detector has never seen. A list of the generators in a training set describes what a model has already seen, not how it will handle the next one.

We kept GPT-5.4 image out of training entirely. Holograin caught 95% of its edits after upload. Two more generators it had never seen:

Our measured coverage today is Google's and OpenAI's image models. We do not claim results on families we have not measured.

Part of every fraud analysis

Holograin runs automatically on scanned documents and photos in every Holofin fraud analysis, alongside provenance verification, file forensics and content checks. A flag sends the document to a reviewer with the evidence. It never rejects an application on its own.

Questions

Which generators does Holograin detect?

Google's Gemini image models, Nano Banana among them, and OpenAI's image models. GPT-5.4 image, kept out of training, is caught 95% of the time after upload. Other families have not been measured.

How often does it flag a genuine document?

About 1 in 100, for each channel a document can arrive through. A flag goes to a reviewer and never rejects a file on its own.

Does a screenshot or a recompression remove the traces?

No. Holograin catches 97% of AI-edited pages after a phone screenshot and 90% after upload and conversion.

Does it check identity documents?

No. It was neither trained nor measured on them.

Where does the analysis run?

Holograin runs on Holofin's own servers. Scoring a page does not send it to any third-party model provider.

Summary

Holograin was trained on hundreds of thousands of financial document pages, through the same channels they reach us by, and every result is reported at 1 false positive in 100. It holds up on generators it never saw in training.

The model page, with before-and-after examples on fictitious documents, is at Holograin. An image model can redraw a payslip that no reviewer can fault by eye. It still leaves a measurable texture in the pixels, and Holograin is trained to find it.