Paper deep dive
ChatGPT Images 2.5 in the Wild: A Launch-Period Dataset and Detector Evaluation
Dennis Ng, Xingyu Shen, Ankit Raj, Kidus Zewde, Tommy Duong, Yuchen Zhou, Yuxin Zhang, Neo Tiangratanakul, Simiao Ren
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:An image tool can change its underlying generator while retaining its public name, making version attribution from online posts ambiguous. We study this problem after the ChatGPT Images 2.5 launch. Our frozen collection contains 3,478 images from 2,440 posts across 8 sources. Recorded posting times fall within the first 51.1 hours after the announcement. It records three attribution tiers and retains standalone images after image-form filtering and targeted review. Caption claims and host records provide admission evidence, not independently verified generator identity. The observed content profile depends on the source mixture: NightCafe supplies 39.0% of images but 77.0% of CLIP-assigned fantasy scenes. We then evaluate six frozen detectors at thresholds calibrated to a 5% flag rate on reference photographs. Collection flag rates range from 3.7 to 56.4%, falling 42-81 percentage points below GenImage recall. Held-out artwork false-positive rates range from 1.5 to 96.5%, so a higher collection flag rate does not by itself establish better detection. An exploratory X-only comparison with our April collection finds a higher September flag rate for Effort, and a suggestive difference for DoU, under fixed-threshold post-clustered bootstrap intervals. Attribution, content and processing differences prevent a causal interpretation of these contrasts. The collection supports analysis of reported model use during a product transition, with source and attribution evidence retained for interpretation.
Tags
Links
- Source: https://arxiv.org/abs/2609.15100v1
- Canonical: https://arxiv.org/abs/2609.15100v1
Trouble viewing inline? Open PDF directly â
Full Text
105,750 characters extracted from source content.
Expand or collapse full text
ChatGPT Images 2.5 in the Wild: A Launch-Period Dataset and Detector Evaluation Dennis Ng * Xingyu Shen * Ankit Raj * Kidus Zewde * Tommy Duong * Yuchen Zhou * Yuxin Zhang * Neo Tiangratanakul * Simiao Ren â Scam.ai * Equal contribution. â Corresponding author: benren@scam.ai Abstract.An image tool can change its underlying genera- tor while retaining its public name, making version attribution from online posts ambiguous. We study this problem after the ChatGPT Images 2.5 launch. Our frozen collection contains 3,478 images from 2,440 posts across 8 sources. Recorded posting times fall within the first 51.1 hours after the announce- ment. It records three attribution tiers and retains standalone images after image-form filtering and targeted review. Cap- tion claims and host records provide admission evidence, not independently verified generator identity. The observed content profile depends on the source mixture: NightCafe supplies 39.0% of images but 77.0% of CLIP- assigned fantasy scenes. We then evaluate six frozen detectors at thresholds calibrated to a 5% flag rate on reference pho- tographs. Collection flag rates range from 3.7 to 56.4%, falling 42â81 percentage points below GenImage recall. Held-out artwork false-positive rates range from 1.5 to 96.5%, so a higher collection flag rate does not by itself establish better detection. An exploratory X-only comparison with our April collection finds a higher September flag rate for Effort, and a suggestive difference for DoU, under fixed-threshold post-clustered boot- strap intervals. Attribution, content and processing differences prevent a causal interpretation of these contrasts. The collec- tion supports analysis of reported model use during a product transition, with source and attribution evidence retained for interpretation. Keywords: AI-generated image dataset; detector evaluation; attribution; C2PA; social media; ChatGPT Images 2.5 1 Introduction A model-specific dataset collected from online posts depends on evidence that connects each image to the claimed generator. That link becomes ambiguous when a product changes its underlying model while retaining its public name. A caption naming the product may then refer to either version, and a post made after an upgrade can still contain an older image. OpenAI released ChatGPT Images 2.5 on 8 Septem- ber2026throughgpt-image-2.5-flareand gpt-image-2.5-sunburst, alongside an upgrade to ChatGPTâs image tool [14]. Our April GPT-Image-2 collection [30] used X posts to study an earlier release. Repeating its version-silent queries would not reliably identify 2.5: in a launch-day pilot, 35 of 106 returned posts explicitly named GPT-Image-2. We therefore require explicit version evidence and retain its source. Existing research already evaluates detection on social- media samples and under online image processing [5, 10, 11]. Here we examine a specific collection problem raised by a product transition: what evidence supports version attribution, and how do the resulting admission rules and source mixture shape the observations? A companion paper studies forgery tasks with known answers [18]; this paper concerns posted images whose production histories are incompletely observed. We organize the study around three questions: 1.What evidence supports version attribution? We dis- tinguish caption claims, caption claims with a creation- language classifier, and host model records. We document admission and curation decisions and inspect delivered con- tent credentials (Sections 3.4, 3.5 and 3.6). These records make the evidence auditable without treating every admit- ted image as independently authenticated. 2.How does source composition shape the collection? We assemble 3,478 images from 2,440 posts across 8 sources and report content and collection differences by source (Sections 3.3 and 5.1). Query instruments, language meta- data, admission rules and observed time coverage differ, so the source counts do not measure relative platform activity. 3.How do published detectors respond at fixed operating points? We check six frozen implementations against a labelled benchmark, then report collection flag rates be- side held-out control FPRs (Section 6). An exploratory X- only comparison with the April release extends this record across two collection windows (Section 6.4). It does not isolate a generator-version effect. 1 arXiv:2609.15100v1 [cs.CV] 14 Sep 2026 ChatGPT Images 2.5 in the Wild2 X / Twitter (1,501)NightCafe (1,358)Xiaohongshu (325)note.com (137) Pixiv (66)Weibo (40)Instagram (40)Reddit (11) Figure 1: One illustrative image from each of the eight sources in the frozen collection. Labels give each sourceâs full image count. Examples are selected from the previously fixed illustration set and preserve their aspect ratios. This source-balanced display is not a random or proportionally representative sample; Figure 3 shows subject distributions within each source. The resulting contribution is a documented collection of attributed launch-period images and a fixed-threshold eval- uation of detector responses to it. Here, in the wild means images retrieved from online posts and galleries under the stated admission rules. The image-form filter excludes screen- shots and composites, and the collection is not a census of online use. Historical audits assess agreement with another model; their coverage limits are reported in Section 4. 2 Related Work Model-specific datasets. Broad web-image collections such as LAION-5B [22] are not organised around a specific gen- erator. Targeted datasets focus on a generator or a defined roster, as in DiffusionDB [25] and GenImage [34]. For Ope- nAI models, GPT4o-Receipt [31] collected document images with direct API provenance. Our April dataset [30] curated 10,217 GPT-Image-2 images from 6,606 X posts under cre- ator self-report, starting from 27,662 collected image records. That collection is larger than the present one but uses a single platform and attribution regime. Two follow-up studies [24, 32] predate Images 2.5, while first-look studies of GPT-4o image generation [2, 29] illus- trate how to characterise a newly released model. Our collec- tion distinguishes explicit caption-version claims from host- recorded attribution and applies an image-form filter across multiple sources. The gateway in Section 3.2 reduces the need for separate platform clients; it does not establish exhaustive coverage. Evaluation in online settings. ITW-SM [10] collects real and generated images from four social platforms and evaluates how detector design and preprocessing affect performance. TrueFake [5] studies generated images shared through social networks, while RRDataset [11] examines scenario changes, internet transmission and re-digitization. These studies al- ready establish that online conditions matter for detection. Our focus is attribution during a specific product transition: a tool can retain its name while its underlying generator changes. We record the version evidence available in captions and host fields, distinguish admission tiers, and examine the resulting collection with fixed detectors. The April comparison extends this observational record; it does not isolate the generator upgrade. Provenance in delivered files. C2PA [4] uses a signed mani- fest to describe an assetâs production history. OpenAI reports signing outputs and adding an invisible watermark [13]. In our April study, embedded credentials did not survive the inspected X delivery path. Here, the inspected generator- version field does not distinguish the tested endpoint versions (Section 3.6). Xâs âMade with AIâ label [27] and Pixivâs AI-generation declaration [16] are additional platform signals. Section 7 explains their limitations for this collection. Generated media and detection in practice. Self-reported AI images account for well under one percent of image posts in the Reddit art communities studied by Matatov et al. [12]. That is a rate of disclosed AI use; without independently ChatGPT Images 2.5 in the Wild3 identifying undisclosed AI images, it does not estimate dis- closure recall. Studies of AI political imagery on X [3] and fact-checked media [6] document other settings in which gen- erated media circulate. Image detectors often generalise poorly across generator families [7, 21, 23]. Multimodal language models are inconsis- tent zero-shot detectors [20], and deployment studies find fur- ther performance losses outside laboratory benchmarks [19]. A collection attributed to a new generator, with screenshots and composites filtered out, supports evaluation in this less controlled setting. Its attribution and processing limits remain part of that evaluation. 3 Collection We first define which posts and assets enter the collection, then distinguish version-attribution evidence from image form. These choices determine the population described in the con- tent and detector analyses. 3.1 Launch anchor and funnel Every source is filtered against a single timestamp, the @OpenAIDevsannouncement post, whose snowflake iden- tifier decodes to2026-09-08T18:58:45Z. Images 2.5 out- puts existed before it â arena evaluations were live by 2026-09-07â but arena images are anonymous and pre-launch API access was private, so the announcement is a repro- ducible scope boundary rather than a claim about the ear- liest attributable generation. Official X queries pass it as start_time; other sources take the coarsest server-side date filter they support and are filtered client-side against it (Appendix C). Gated collection and released subset share an end,2026-09-10 22:06:41Z, roughly 51.1 hours after the anchor. Figure 2 traces the records from collection to the retained images. 3.2 Collection infrastructure Five of the nine collection routes use one commercial gateway (Monid, CLI 0.1.7); Pixiv, note.com and NightCafe use public JSON endpoints directly. The gateway log records 932 calls across 5 endpoints. Endpoint details and cost accounting appear in Appendix B. The official and gateway X routes provide partly overlap- ping observations: 502 of 1,524 gateway-admitted posts ap- pear in retained official results, and 168 pass both admission rules. Different queries, schedules and admission rules pre- vent interpreting this difference as a controlled comparison of index coverage (Appendix D). 3.3 Sources, routes and yield We collect X/Twitter through two routes. The official v2 recent-search endpoint [26] has a seven-day retention window and does not provide a census of public posts. A launch-day pilot and a day-one run used the same queries. The day-one Table 1: Retained images by platform after deduplication, image- form filtering and targeted review. X combines both collection routes. The separate 12 videos are excluded. PlatformImages X/Twitter1,501 NightCafe1,358 Xiaohongshu325 note.com137 Pixiv66 Weibo40 Instagram40 Reddit11 Total3,478 run read 2,009 posts for $10.05 and yielded 594 gate-passing records from 305 posts. The gateway runs the same search but returns a partly over- lapping set (Appendix D). Both routes deliver media from the same content delivery network at the same resolutions. We merge them on post and media identifiers. The remaining seven sources use either the gateway (Xiaohongshu, Weibo and Reddit through TikHub; Instagram through a resold Apify hashtag scraper) or direct access (Pixiv, note.com and Night- Cafe). Table 1 gives retained image counts. The nine instruments differ in query, time filtering, times- tamp resolution, served format, language metadata and creation-language requirements (Appendix C). Cross-source differences therefore reflect the instruments as well as the platforms. Reddit is mainly a discussion source in this sample: 78 of 88 qualifying posts have no downloadable image. Insta- gram differs in being accessed by hashtag through a third-party scraper rather than a search index (Appendix D). 3.4 The version gate We record three attribution tiers. Caption-based admission requires a case-insensitive match to a 2.5 name, an API co- dename (Flare or Sunburst), or a 2.5 hashtag, with no ac- companying 2.0 signal (Appendix F). Posts naming only 2.0, both generations, or neither are excluded from this route. A match establishes a caption claim, not the attachmentâs true generator. âą Caption plus classifier includes 371 released images from official-API X records. Alongside the version match, these posts pass the April creation-language classifier. It uses creation phrases, shared prompts and showcase hashtags, while excluding specified announcement and promotional patterns. âą Caption-only includes 1,749 images from gateway X and the other caption-based sources. âąHost-recorded includes 1,358 NightCafe images admit- ted through the platformâs generator field. They need no version-bearing caption. Its 12 videos form a separate co- hort. ChatGPT Images 2.5 in the Wild4 version gate â2,252 deduplicate â1,555 separate 12 videos image-form filter â2,850 review â16 9 routes across 8 sources12 videos retained outside the image cohort Candidates 10,163 Attributed 7,911 Merged assets 6,356 Image inputs 6,344 Standalone 3,494 Retained 3,478 Figure 2: Collection funnel. Of 10,163 candidate asset records, 7,911 passed caption or host-record attribution; deduplication removed 274 exact (post, media, frame) repeats and 1,281 average-hash near-duplicates (Appendix G), leaving 6,356 gated assets from 3,624 posts. Image-form filtering kept the 3,494 assets labelled standalone, and targeted review removed a further 16, leaving 3,478 retained images; 12 videos are recorded separately and excluded from image statistics. dedup_audit.py replays the attribution and deduplication stages. The tier field allows each population to be selected indepen- dently (Appendix F.1). Host records state what the platform reports; we did not independently verify endpoint execution. The caption rule excludes version-silent posts and can also admit misleading or non-creation captions. Its errors are not one-sided. The earlier text audit assesses agreement about caption claims, with recall evidence restricted to recorded official-X strata (Section 4); it does not validate host attribu- tion or identify the true generator from pixels. 3.5 Image-form filter and targeted review Attribution alone does not establish image form. A caption can refer to Images 2.5 while its attachment is a screenshot; a host can identify the generator while serving a grid or composite. We therefore classify each gated image with gpt-5.4-mini from a 768-pixel thumbnail, at a cost of $0.70 per thousand images. The classifier assigns one of six image forms: a standalone image, chat or app screenshot, collage or grid, photograph of a screen, promotional graphic, or other. We retain only the standalone class. Appendix H gives the exact labels and prompt. A targeted visual review then removed 16 prompt sheets, editorial composites and end cards. Each exclusion has a recorded reason. This review corrects identified errors but does not estimate the remaining error rate. Of 6,344 gated images, 3,494 are labelled standalone and 44.9% are not: 1,661 promotional graphics, 502 chat screen- shots, 506 collages or grids, 64 photographs of screens and 117 other. The filter separates image form from provenance: the excluded collages and promotional graphics hold an unknown number of real outputs in composite form, so exclusion is not a claim that an asset is not AI-generated. Per-class counts by source are in Appendix H.1. 3.6 Content credentials and version attribution A local byte scan found C2PA markers in 31 of 66 released Pixiv files; 30 contain the searched generator-version, OpenAI and watermark strings. Marker presence is not signature vali- dation, and the remaining marker-positive file is not included in the matching-string claim (Appendix K). Earlier pilot signa- ture checks are reported separately. These observations do not establish preservation or stripping behaviour for every source or delivery path. The API-side ledger covers 1,007 files generated for the benchmark on2026-09-09: 371 Flare, 371 Sunburst and 265 GPT-Image-2. All inspected files contain the generator- version string 2.0, including both 2.5 endpoints. This is a census of that logged file set, not of all API outputs. The supported result is that the inspected generator-version field does not distinguish these tested endpoint versions; caption and host attribution remain separate evidence sources. 3.7 Coverage beyond the retained sources The retained sources do not exhaust the available online im- ages. Launch-period probes also examined model-tagged galleries and API resellers (Appendix L). A generation ser- vice need not expose a public gallery, and a model filter need not return a model field for each image. NightCafe illustrates the limits of a single probe.A 2026-09-09sample of 240 creations contained no 2.5 records. On2026-09-10, the same endpoint yielded 1,449 records with a 2.5gptImageModelfield. These samples came from a retrospectively paginated feed. They describe observed feed contents, not when the platform adopted the model. Empty re- sults from other tested endpoints likewise establish only what those queries returned. Collection records therefore retain the endpoint, query and observation date as well as the attribution evidence. 4 Historical Audits of Automated Curation We audited the version gate, screenshot filter and subject clas- sifier on an earlier collection, before the day-two expansion. Seeded samples (seed 20260909) were relabelled by gpt-5.5, a different model from the screenshot filterâs gpt-5.4-mini. The audits measure agreement with another model; they provide neither human annotation nor verified generator attribution. They cost $3.53. The screenshot audit sampled a pool of 2,910 images, in- cluding 1,382 predicted standalone images. Neither its 300 ChatGPT Images 2.5 in the Wild5 items nor the 100 subject-classification items include Night- Cafe. These audits therefore do not validate the expanded release or its host-attributed tier. Appendix I gives the sam- pling design. The intervals below are descriptive Wilson 95% intervals for raw sample proportions, not uncertainty estimates adjusted for the weighted design. Caption claims. Among 100 sampled admitted post texts, raw agreement on the text claim is 64.0% (54.2â72.7). Dis- agreements concern announcements, tutorials and marketing that name the version without claiming the posterâs own gener- ation. Appendix I.1 gives language breakdowns and the limits of the recall analysis. Image form. The auditor labelled 98.5% (91.9â99.7) of the 66 predicted standalone images as standalone. Overall raw agreement is 72.3%, with unweightedÎș = 0.65. The auditor treated some predicted collages and promotional graphics as standalone. Because theotherstratum was not sampled, the audit does not identify full-pool recall (Appendix I.2). Subject labels. On 100 earlier released images, CLIP and the auditor agree on 61.0% of labels (Îș = 0.51). We there- fore describe content as a distribution of CLIP assignments, not validated subject prevalence. Appendix I.3 reports class breakdowns and their limitations. 5 Content and Source Composition We next describe the retained images, keeping source-specific observations separate from pooled summaries; Figure 1 shows one illustrative image per source. Content labels and post metadata are measurements of this collection, not estimates of platform-wide use. 5.1 Subject matter, text and faces We apply the April studyâs three analyses to 3,478 released images: zero-shot CLIP subject classification, OCR and face detection. Appendix I.3 gives the settings and explains why the April comparison is not controlled. Source composition strongly affects the pooled subject pro- file (Figure 3). NightCafe supplies 39.0% of images but 77.0% of fantasy/surreal assignments. That class accounts for 53.6% of NightCafe images and 11.3% of X images. Removing NightCafe lowers the pooled fantasy share from 27.2% to 10.3%. These differences describe the sampled images. The small source cohorts shown in the figure cannot provide stable estimates of platform-wide preferences. OCR detects text in 39.0% of images (1,357), compared with 82.0% in April. The median number of text regions per image is 0 (April: 29). Face detection finds at least one face in 59.0% of images (2,052), compared with 59.2% in April. These measurements characterise the collections; they do not establish changes in model use. Because face detectors are biased on non-photorealistic images and CLIP assigns much of this collection to non-photographic classes, we omit the demographic histograms used in the April paper. 5.2 Languages, timing and wording The cohort contains 3,478 images from 2,440 posts. Recorded language labels span 16 languages, but their sources differ. For 1,501 X image rows, the label is the APIâs detectedlang. Another 568 rows (16.3%) use a platform default, and 1,409 rows (40.5%) have no language field (Appendix J). These la- bels describe post metadata, not text recognised in the images. The most common recorded labels in the released cohort are Japanese (703), English (675) and Chinese (631). Chinese is most common in the gated pool (2,258), but its retention rate is 27.9%, compared with 55.6% for Japanese and 62.4% for English. Source composition and image-form filtering both contribute to this difference; these counts do not measure platform adoption. Recorded posting timestamps span roughly 51.1 hours and differ from retrieval dates (Appendix J.1). Of 1,667 retained images posted from2026-09-10 05:25Zonwards, 1,358 (81%) come from NightCafe and were collected on 2026-09-10. The final interval therefore reflects that sourceâs collection route rather than demonstrating an increase in post- ing activity. We analyse wording in 1,082 caption-attributed posts with nonempty text. NightCafe is excluded because itstextfield contains creation titles rather than caption claims. English, Japanese and Chinese patterns match prompt vocabulary in 31.6% of eligible posts, editing in 10.5%, consistency in 6.8% and speed in 6.7%. Sunburst and Flare appear in 10.4% and 6.7%, respectively. These unvalidated keyword matches do not measure how often users edited images or disclosed prompts. 6 Detector Responses to the Collection We evaluate six frozen image detectors: Community Foren- sics [15], B-Free [8], Effort [28], PGC [33] (2026, SD v1.4 checkpoint), PROBE-ResNet50 [1], and DoU [9]. None is trained or fine-tuned on this collection. Because generator identity is creator- or host-attributed, the outcome is the frac- tion of images flagged, not verified detection recall. 6.1 Controls and operating point We select 400 reference images from each of five photograph pools: GeoDE, SUN397, FairFace, Pascal VOC and Food101. We separately select 400 WikiArt artworks. Source labels are inherited without new human adjudication. After exact-byte deduplication, deterministic hash ordering and alternating assignment produce equal calibration and test splits within each pool. Each detectorâs native-logit threshold is calibrated on the 1,000 calibration photographs to flag at most 5%. The 1,000 held-out photographs measure the realised false-positive rate ChatGPT Images 2.5 in the Wild6 Anime / illustration Fantasy / surreal Text graphic Photo-like portrait Product / UI mockup Nature / landscapeFoodArchitecture X / Twitter (n=1,501) NightCafe (n=1,358) Xiaohongshu (n=325) note (n=137) Pixiv (n=66) Weibo (n=40) Instagram (n=40) Reddit (n=11) 36.6%11.3%19.5%11.5%10.2%4.7%3.9%2.2% 16.5%53.6%10.3%9.7%1.6%5.7%1.5%1.0% 32.3%10.5%17.5%9.5%10.8%7.4%0.9%11.1% 45.3%0.0%11.7%21.9%13.9%3.6%2.9%0.7% 98.5%1.5%0.0%0.0%0.0%0.0%0.0%0.0% 55.0%15.0%2.5%2.5%22.5%0.0%0.0%2.5% 12.5%12.5%27.5%30.0%2.5%2.5%7.5%5.0% 54.5%18.2%0.0%18.2%0.0%9.1%0.0%0.0% Figure 3: CLIP-assigned subjects by source. Cells give percentages within each source, and row labels give image counts. The eight-class assignments show how source composition changes the aggregate distribution. They are not validated estimates of platform preferences or model capabilities. (FPR). Artwork controls provide a separate diagnostic and do not set the thresholds. Every detector scores all 3,478 collec- tion images and 2,400 controls without decoding or inference failures. DoU retains its stochastic evaluation forward pass with primary seed 42; Appendix O gives execution details and a second-seed check. What the operating point establishes. Photograph cali- bration fixes a reproducible threshold for each detector. It does not establish a 5% FPR on every source or content type. The held-out controls measure how often reference pho- tographs and artworks are incorrectly flagged; the collection rate measures how often attributed images are flagged. De- ployment precision would additionally require representative controls and the prevalence of generated images in the target stream. These experiments therefore support comparisons of the frozen cohorts, not a deployment ranking. 6.2 Harness reproduction on GenImage We check the six detector implementations on a labelled bench- mark before interpreting their collection scores. Forward-pass agreement with official code and plausible photograph FPRs are insufficient: the former can share a preprocessing error, and the latter tests no generated images. GenImage [34] provides a common reference. Community Forensics reports results on it, Effortâs released checkpoint targets it, and PROBE and PGC train on its SD v1.4 split. We score a frozen, balanced validation sample: 300 real and 300 generated images per generator across 7 generators, totalling 4,200 images. The sample is hash-selected before inference, with no fitting or tuning. This implementation check uses each detectorâs own0.5boundary. The collection compari- son in Section 6.3 instead applies the photograph-calibrated thresholds to both GenImage and the collected images. Ap- pendix O.1 gives the freeze, per-generator comparisons and a separate Community Forensics evaluation. All five detectors with a published reference agree within 3.5 accuracy points, and four agree within 1.7 (Table 3). Sev- eral per-generator patterns also reproduce. PROBE-ResNet50 reaches 57.0% versus the published 60.0% on ADM, and 49.8% versus 49.4% on BigGAN. B-Free agrees within 1.3 points on all seven generators. PGCâs published accuracy is 100.0% on 6 generators. Big- GAN is its only nonsaturated reference cell and the one that disagrees. Across all 28 per-generator comparisons, three differences exceed three standard errors of our subset esti- mate, all with our result higher. The remainder lie within three standard errors, in both directions. The benchmark results provide evidence against inverted scores or gross implementation failures. They do not prove ev- ery collection preprocessing path correct. PROBE-ResNet50âs reproduced benchmark weaknesses are consistent with its low collection flag rate of 3.7%, although that consistency alone does not identify the cause of the collection result. 6.3 Flag rates on the collection Held-out photograph FPRs range from 3.5 to 5.9%, while artwork FPRs range from 1.5 to 96.5% (Table 2). PGC, for example, flags 96.5% of reference artworks and 5.1% of pho- ChatGPT Images 2.5 in the Wild7 Table 2: Frozen-detector results at a 5% reference-photograph calibration FPR. Collection intervals are 95% post-clustered bootstrap intervals conditional on the fitted threshold. Held-out control FPRs are separated by content type. Collection flag rates are not independently verified recall. DoU uses seed 42; its intervals exclude latent-sampling variation. DetectorCollection flaggedPhoto FPR Artwork FPR (n = 3,478) (n = 1,000)(n = 200) Community Forensics 54.7% [52.8, 56.7]5.9%42.0% B-Free15.0% [13.4, 16.6]4.2%64.0% Effort43.7% [41.5, 46.2]3.5%8.5% PGC (2026)56.4% [54.2, 58.6]5.1%96.5% PROBE-ResNet503.7% [2.6, 5.1]5.3%1.5% DoU17.4% [15.1, 19.5]4.4%11.0% Table 3: Accuracy on a balanced 4,200-image GenImage validation sample at each detectorâs own0.5boundary. Means use the same 7 generators;âis ours minus published. â Community Forensics reports pooled accuracy over a set containing one additional generator, so its comparison is not exactly matched. ⥠B-Freeâs reference is another groupâs measurement. DoU reports GenImage results only graphically, so no tabulated reference is available. DetectorAcc. (%) AP (%) Published (%)â Community Forensics95.099.895.7 â -0.7 B-Free87.296.987.3 ⥠-0.1 Effort92.198.388.7 +3.4 PGC (2026)99.7100.098.1 +1.6 PROBE-ResNet5074.486.275.5-1.1 DoU88.799.8not reportedâ tographs. A high collection flag rate can therefore coexist with sensitivity to human artwork. At the same thresholds, the six detectors recall 47â100% of GenImageâs generated images with at most 4.0% false positives. They flag 3.7â56.4% of the collection. For every detector, the latter rate is lower, by 42â81 percentage points. Figure 4 places these rates beside the held-out photograph and artwork controls. It makes both observations visible: collection flag rates are low relative to benchmark recall, while artwork FPRs can be high. Interpreting either requires the corresponding population and denominator. The benchmark check supports the implementation for 4 detectors with their own published reference results (Sec- tion 6.2). It does not exclude preprocessing faults specific to platform-recompressed images: GenImage uses small bench- mark PNGs. Three per-generator comparisons exceed sam- pling error, all with our accuracy above the published value. Those discrepancies widen the observed gap. Interpreting the gap. Five additional differences prevent treating this gap as an isolated measure of detector generaliza- tion: 1. Attribution is unverified. Images incorrectly attributed to Images 2.5 can change the collection flag rate. 2.Processing differs. Some delivery routes recompress im- ages, and we have not bounded the resulting effect on detector scores. 3.Content differs. GenImage is photographic and ImageNet- derived; CLIP assigns much of this collection to non- photographic classes. The artwork controls show changes of tens of percentage points between the two control types; their content and processing are not matched. 4.Benchmark exposure differs. Effortâs checkpoint is se- lected for GenImage, while PROBE and PGC train on its SD v1.4 split. Removing the two SD-family genera- tors changes the gap range to 22â80 p, mostly through PROBE-ResNet50. 5.Some images may be edits. Editing vocabulary appears in 10.5% of 1,082 caption-attributed posts. These unvalidated keyword matches exclude NightCafe and are measured per post, so they cannot estimate or bound the share of edited images. Edits may retain real reference content and need not resemble wholly generated benchmark images. We report the observed gaps without assigning their magnitude to any one cause. Attribution and source sensitivity. Restricting the collec- tion to its most restrictive caption-based tier does not narrow the gap consistently. Among 371 official-X images admitted by both caption matching and the creation classifier, the gap widens for 5 of six detectors and ranges from 45 to 82 p. The gaps therefore persist in this subset. The restriction does not validate attribution or isolate its effect: the tier is X-only, so tier and platform remain confounded. Flag rates also vary by source (Appendix Table 10). Con- tent, attribution and processing differences are intertwined in those comparisons. These results show why source and attri- ChatGPT Images 2.5 in the Wild8 0255075100 Images flagged (%) Community Forensics B-Free Effort PGC (2026) PROBE-ResNet50 DoU (a) Benchmark and collection GenImage generated (2,100) Collected images (3,478) 0255075100 Images flagged (%) (b) Held-out labelled controls Reference photographs (1,000) Reference artworks (200) Figure 4: Detector responses at the same photograph-calibrated thresholds. Left: labelled GenImage generated-image recall (squares) and attributed collection flag rates (circles). Right: false-positive rates on held-out reference photographs and artworks. Collection bars are 95% post-clustered bootstrap intervals; control bars are 95% Wilson intervals. GenImage points show the frozen sample estimates. Sample sizes appear in the legends. The populations differ in content, provenance and processing; connecting their outcomes to a generator effect would require a controlled experiment. bution fields are needed when reusing the dataset for detection studies. 6.4 Comparison with our April GPT-Image-2 release Design. We score a fixed 3,000-image sample from 2,542 posts in the April GPT-Image-2 release [30]. Its parent release contains 10,217 images from 6,606 X posts. We use the same six checkpoints, preprocessing and score definitions as for September, whose scores are already complete. A determinis- tic hash ranking selects April images before inference. Each detector retains its photograph-calibration threshold; neither cohort sets the operating point. The primary September cohort comprises 1,501 X images from 861 posts. The pooled release is a secondary view. The cohorts are unpaired, and 95% percentile intervals use 50,000 post-clustered bootstrap draws per cohort. A 100-image pilot from the same ranking found no separation and resolved dif- ferences only to about±10 p. We then extended the prefix. This added records without reselecting them, but the expan- sion decision followed the pilot results. The reported intervals do not account for that look, so these contrasts are exploratory. A held-out April check appears below; Appendix O.2 gives coverage and sensitivity details. Comparability. April admitted generic AI-badge and name- only claims without an image-form filter. Thus, even within X, the cohorts differ in attribution rules, screenshots, content and collection window. Detector-training exposure to either release is unverified. This design compares two collections and cannot isolate the effect of upgrading the generator. Findings. The fixed-threshold 95% intervals indicate higher September X flag rates for Effort and DoU (Table 4, Figure 5). The differences are +6.1 p [+2.7, +9.6] for Effort and +3.6 p [+1.0, +6.2] for DoU. Both remain positive after a Bonferroni adjustment for 6 contrasts: Effort [+1.6, +10.8] and DoU [+0.2, +7.2]. We use 50,000 bootstrap draws to estimate these tail bounds. DoUâs adjusted interval only narrowly excludes zero and omits its latent-sampling variability. A second seed shifts the pooled September flag rate by 0.43 p at the same threshold. We therefore treat its contrast as suggestive. The other four de- tectors show no detected difference, with interval half-widths at most 3.9 p. These intervals quantify precision but do not establish equivalence. No detectorâs interval lies wholly below zero. All point estimates except Community Forensicsâ are positive. These are differences between the sampled X collections; they do not establish whether the upgraded generator is intrinsically easier or harder to detect. Check with held-out April images. We re-test the two posi- tive contrasts on 7,217 April images from 5,153 posts at ranks beyond the analysed sample. These images were not used in the sample-expansion decision. Thresholds, score definitions and September scores remain fixed, and only Effort and DoU are evaluated. Effortâs held-out contrast is +5.8 p [+2.6, +9.1]. DoU replicates at +4.7 p [+2.3, +7.3] against +3.6 p. Both con- trasts remain positive under the same family-wise adjustment, with lower bounds of +2.1 and +2.0 p. Only April is held ChatGPT Images 2.5 in the Wild9 Table 4: X-only flag rates at identical detector-specific thresholds. Entries are percentages with 95% post-clustered bootstrap intervals; differences are September minus April in percentage points (p). April uses 3,000 of 10,217 released images; September X contains 1,501. The contrasts do not identify causal generator-version effects. DoU uses seed 42. DetectorApril X (%) September X (%)Difference (p) Community Forensics 44.8 [42.9, 46.7]44.3 [41.2, 47.5]-0.5 [-4.1, +3.2] B-Free18.1 [16.6, 19.5]19.3 [16.8, 22.0]+1.3 [-1.7, +4.3] Effort22.7 [21.1, 24.3]28.8 [25.8, 31.9] +6.1 [+2.7, +9.6] PGC (2026)42.4 [40.5, 44.2]43.2 [39.8, 46.7]+0.8 [-3.1, +4.7] PROBE-ResNet502.9 [2.3, 3.5]3.8 [2.8, 4.9]+0.9 [-0.3, +2.2] DoU7.6 [6.6, 8.6]11.1 [8.8, 13.6] +3.6 [+1.0, +6.2] out. Reusing the same 1,501 September images makes the estimates correlated, so this check replicates the April side of the comparison rather than the full contrast independently. Because selection is by image rank, 1,089 posts contribute images to both April samples, including 1,894 held-out im- ages; the held-out images are therefore not independent of the analysed sample at the post level. Calibration uncertainty. A further post hoc analysis resam- ples the calibration photographs within their five source pools, refits each threshold, and resamples posts in both cohorts. The six-detector Bonferroni intervals remain positive for Effort [+1.7, +11.3] and DoU [+0.3, +7.4] p. The other four include zero (Appendix Table 12). This check propagates calibration sampling but still omits DoUâs latent-sampling variability. Composition sensitivity. Within September, widening from X to the pooled collection changes flag rates by up to 14.9 p, in both directions. For Community Forensics, Effort, PGC and DoU, this shift exceeds every AprilâSeptember difference in Table 4. Narrowing both cohorts to metadata-based attri- bution subsets (Aprilconfirmedimages and September official-X classifier admissions) leaves the Effort and DoU differences positive; only PROBE-ResNet50, whose X differ- ence is near zero, changes sign. Only the X-only comparison has a difference interval; pooled and attribution-subset views are descriptive. 7 Limitations Exploratory detector evaluation. Collection labels record attribution. Control labels are inherited from existing datasets, without matching their content or processing to the collected images. Detector-training overlap and residual perceptual duplicates are unverified, and six checkpoints cover only part of the detector landscape. Primary intervals condition on the calibrated thresholds; an additional sensitivity analysis resamples calibration photographs. DoU also samples latent noise: we fix its seed, and the reported intervals exclude that source of variation. Scope of the implementation checks. For the five detectors with a published GenImage reference, our accuracies agree within 3.5 percentage points; DoU has no tabulated reference. â10â50510 September minus April (p) Community Forensics B-Free Effort PGC (2026) PROBE-ResNet50 DoU â less oftenmore often ⶠDifference between X collections 2 of 6 intervals exclude zero Figure 5: Flag-rate differences between the September and April collections at fixed detector-specific thresholds. Positive values mean September X images are flagged more often. Bars are pointwise 95% post-clustered bootstrap intervals; those excluding zero are green. They omit DoUâs latent-sampling variability. Per-collection rates appear in Table 4. This agreement provides evidence against gross scoring errors, such as inverted logits, on that benchmark. It cannot distin- guish a harness fault from a difference between the released checkpoint and the one used for the paperâs table. Nor does it validate preprocessing for the platform-processed collection. B-Freeâs reference comes from another group. Unmatched cross-release cohorts. The April and Septem- ber cohorts are not matched by image, prompt or creator. Exact-byte and decoded-pixel checks found no shared images; creator and prompt overlap was not established. Even within X, the cohorts differ in admission rules, image-form filtering and collection window as well as attributed generator version. The pooled September view additionally changes the platform mix. The 2 contrasts excluding zero survive a Bonferroni adjustment for 6 detectors, but they identify collection dif- ferences. The observed source shifts are large enough to be plausible alternative explanations. Effort has both the largest cross-release difference and the largest deviations from its published per-generator results. Content-dependent imple- ChatGPT Images 2.5 in the Wild10 mentation differences would not necessarily cancel between these cohorts. Appendix O.3 details the collectionâs remaining limitations: attribution, historical audit coverage, selection, source compa- rability, near-duplicate removal and snapshot coverage. Plat- form AI labels likewise do not resolve generator version or establish coverage of all relevant posts. 8 Conclusion and Release This study documents the attribution evidence available when collecting online images after an image tool is upgraded with- out a new public name. The frozen snapshot contains 3,478 images from 2,440 posts across 8 sources, plus 12 separately labelled videos. Caption claims and host records provide dif- ferent admission evidence, and the inspected C2PA generator- version field does not distinguish the tested 2.5 endpoints from GPT-Image-2. None of these observations independently au- thenticates every imageâs production history. Observed content profiles and detector flag rates differ across sources. These results motivate retaining source and attribution fields when reusing the collection. They do not estimate platform-wide preferences or activity. Historical model-based audits leave a need for human review of the frozen cohortâs evidence and curation decisions; visual review alone cannot authenticate a generator version. At fixed thresholds, collection flag rates are lower than Gen- Image recall for all six detectors. The gaps remain compatible with attribution, content and processing differences. In the exploratory AprilâSeptember X comparison, fixed-threshold intervals support a higher September flag rate for Effort and suggest one for DoU. Both contrasts persist with held-out April images, which share posts with the analysed sample, and with calibration resampling; DoUâs latent-sampling varia- tion remains excluded. Matched prompts, verified generator records and controlled image processing would be needed to identify an upgrade effect. Prepared artifacts and planned release. The local snap- shot contains media,metadata.csvand a datasheet (Ap- pendix M). The collection and curation code records queries, endpoints, gate expressions, deduplication and the screenshot prompt. We plan to publish the dataset and code; the hosting location and distribution terms are not yet finalized. References [1]Zijie Cao, Weijie Tu, Yao Xiao, Weijian Deng, Liang Lin, and Pengxu Wei. Where detectors fail: Probing generative space for generalizable AI-generated image detection. arXiv preprint arXiv:2605.24906, 2026. [2] Sixiang Chen, Jinbin Bai, Zhuoran Zhao, Tian Ye, Qingyu Shi, Donghao Zhou, Wenhao Chai, Xin Lin, Jianzong Wu, Chao Tang, Shilin Xu, Tao Zhang, Haobo Yuan, Yikang Zhou, Wei Chow, Linfeng Li, Xiangtai Li, Lei Zhu, and Lu Qi. An empirical study of GPT-4o image generation capabilities. arXiv preprint arXiv:2504.05979, 2025. [3]Zhiyi Chen, Jinyi Ye, Beverlyn Tsai, Emilio Ferrara, and Luca Luceri. Synthetic politics: Prevalence, spreaders, and emotional reception of AI-generated political images on X. arXiv preprint arXiv:2502.11248, 2025. [4]Coalition for Content Provenance and Authenticity. C2PA technical specification, version 2.1. Technical report, C2PA, 2024.https://c2pa.org/specifications/spec ifications/2.1/specs/C2PA_Specification. html; accessed September 2026. [5] Stefano DellâAnna, Andrea Montibeller, and Giulia Boato. TrueFake: A real world case dataset of last generation fake images also shared on social networks.arXiv preprint arXiv:2504.20658, 2025. [6]Nicholas Dufour, Arkanath Pathak, Pouya Samangouei, Nikki Hariri, Shashi Deshetti, Andrew Dudfield, Christopher Guess, Pablo HernĂĄndez Escayola, Bobby Tran, Mevan Babakar, and Christoph Bregler. AMMeBa: A large-scale survey and dataset of media-based misinformation in-the-wild. arXiv preprint arXiv:2405.11697, 2024. [7]Diego Gragnaniello, Davide Cozzolino, Francesco Marra, Gio- vanni Poggi, and Luisa Verdoliva. Are GAN generated im- ages easy to detect? A critical analysis of the state-of-the-art. In IEEE International Conference on Multimedia and Expo (ICME), 2021. [8] Fabrizio Guillaro, Giada Zingarini, Ben Usman, Avneesh Sud, Davide Cozzolino, and Luisa Verdoliva. A bias-free training paradigm for more general AI-generated image detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 18685â18694, 2025. [9]Qinghui He, Haifeng Zhang, Qiao Qin, Bo Liu, Xiuli Bi, and Bin Xiao. Diversity over uniformity: Rethinking represen- tation in generated image detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- nition (CVPR), pages 40407â40417, 2026. [10]Despina Konstantinidou, Dimitrios Karageorgiou, Christos Koutlis, Olga Papadopoulou, Emmanouil Schinas, and Symeon Papadopoulos. Navigating the challenges of AI-generated im- age detection in the wild: What truly matters? In Proceedings of the ACM International Workshop on Multimedia AI against Disinformation (MAD), 2026. [11]Chunxiao Li, Xiaoxiao Wang, Meiling Li, Boming Miao, Peng Sun, Yunjian Zhang, Xiangyang Ji, and Yao Zhu. Bridging the gap between ideal and real-world evaluation: Benchmarking AI-generated image detection in challenging scenarios. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 20379â20389, 2025. [12]Hana Matatov, Marianne Aubin Le QuĂ©rĂ©, Ofra Amir, and Mor Naaman.Examining the prevalence and dynamics of AI-generated media in art subreddits.arXiv preprint arXiv:2410.07302, 2024. [13]OpenAI. ChatGPT Images 2.5 system card. OpenAI Deploy- ment Safety Hub, 2026.https://deploymentsafe ty.openai.com/chatgpt-images-2-5; accessed September 2026. ChatGPT Images 2.5 in the Wild11 [14]OpenAI. Introducing ChatGPT Images 2.5. OpenAI announce- ment, 2026.https://openai.com/index/intro ducing-chatgpt-images-2-5/ ; accessed September 2026. [15]Jeongsoo Park and Andrew Owens. Community forensics: Using thousands of generators to train fake image detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8245â8257, 2025. [16] pixiv. What is the âAI-generatedâ option in my work settings? pixiv App Help Center.https://app.pixiv.help /hc/en-us/articles/11877605105433 ; accessed September 2026. [17]Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning (ICML), pages 8748â8763, 2021. [18]Ankit Raj, Yuxin Zhang, Kidus Zewde, Tommy Duong, Jiaqi Gan, Xingyu Shen, Yuchen Zhou, Huaiyu Guo, Siyu Zhang, and Simiao Ren. ChatGPT Images 2.5 on forgery tasks: Test- ing advertised improvements against known answers, 2026. Companion paper, in preparation. [19] Simiao Ren, Disha Patil, Kidus Zewde, Tsang (Dennis) Ng, Hengwei Xu, Shengkai Jiang, Ramini Desai, Ning-Yau Cheng, Yining Zhou, and Ragavi Muthukrishnan. Do deepfake de- tectors work in reality? In Proceedings of the 4th Workshop on Security Implications of Deepfakes and Cheapfakes, pages 21â26, 2025. [20]Simiao Ren, Yao Yao, Kidus Zewde, Zisheng Liang, Tsang (Dennis) Ng, Ning-Yau Cheng, Xiaoou Zhan, Qinzhe Liu, Yifei Chen, and Hengwei Xu. Can multi-modal (reasoning) LLMs work as deepfake detectors? arXiv preprint arXiv:2503.20084, 2025. [21] Simiao Ren, Yuchen Zhou, Xingyu Shen, Kidus Zewde, Tommy Duong, George Huang, Hatsanai (Neo) Tiangratanakul, Tsang (Dennis) Ng, En Wei, and Jiayu Xue. How well are open sourced AI-generated image detection models out-of- the-box: A comprehensive benchmark study. arXiv preprint arXiv:2602.07814, 2026. [22]Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski, Srivatsa Kundurthy, Katherine Crowson, Lud- wig Schmidt, Robert Kaczmarczyk, and Jenia Jitsev. LAION- 5B: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 35:25278â25294, 2022. [23]Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. CNN-generated images are surprisingly easy to spot. . . for now. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR), pages 8695â8704, 2020. [24]Yijin Wang, Shuyi Wang, Wenhan Zhang, and Yuqi Ouyang. TextRich: A multi-domain benchmark for detecting AI- generated text-rich images from GPT-Image-2. arXiv preprint arXiv:2606.19259, 2026. [25]Zijie J. Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. DiffusionDB: A large-scale prompt gallery dataset for text-to-image gener- ative models. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics, pages 893â911, 2023. [26]X Corp. Twitter API v2 documentation: Recent search endpoint. X Developer Platform documentation, 2024.https://do cs.x.com/x-api/posts/recent-search; accessed September 2026. [27] X Corp. X media literacy action plan. X Help Center, 2026. https://help.x.com/en/rules-and-policies/ media-literacy-plan; accessed September 2026. [28] Zhiyuan Yan, Jiangming Wang, Peng Jin, Ke-Yue Zhang, Chengchun Liu, Shen Chen, Taiping Yao, Shouhong Ding, Baoyuan Wu, and Li Yuan. Orthogonal subspace decomposi- tion for generalizable AI-generated image detection. In Pro- ceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, pages 70268â70288. PMLR, 2025. [29]Zhiyuan Yan, Junyan Ye, Weijia Li, Zilong Huang, Sheng- hai Yuan, Xiangyang He, Kaiqing Lin, Jun He, Conghui He, and Li Yuan. GPT-ImgEval: A comprehensive benchmark for diagnosing GPT4o in image generation. arXiv preprint arXiv:2504.02782, 2025. [30] Kidus Zewde, Simiao Ren, Xingyu Shen, Jiaqi Wu, Yuchen Zhou, Tommy Duong, Zikang Zhang, Ethan Traister, and Kewen Xie. GPT-Image-2 in the wild: A Twitter dataset of self-reported AI-generated images from the first week of de- ployment. arXiv preprint arXiv:2604.25370, 2026. [31]Yan Zhang, Simiao Ren, Ankit Raj, En Wei, Dennis Ng, Alex Shen, Jiayu Xue, Yuxin Zhang, and Evelyn Marotta. GPT4o- Receipt: A dataset and human study for AI-generated document forensics. arXiv preprint arXiv:2603.11442, 2026. [32]Zirui Zhang, Yinbo Yu, Donghai Guan, Chunwei Tian, Dao- qiang Zhang, and Qi Zhu. A benchmark dataset for MLLM- generated image detection: GPT Image2 & Nano Banana2. arXiv preprint arXiv:2608.01258, 2026. [33]Xiaoyu Zhou, Jianwei Fei, Peipeng Yu, Jingchang Xie, Chong Cheng, and Zhihua Xia. PGC: Peak-guided calibration for generalizable AI-generated image detection. arXiv preprint arXiv:2605.21207, 2026. [34] Mingjian Zhu, Hanting Chen, Qiangyu Yan, Xudong Huang, Guanyu Lin, Wei Li, Zhijun Tu, Hailin Hu, Jie Hu, and Yunhe Wang. GenImage: A million-scale benchmark for detecting AI-generated image. In Advances in Neural Information Pro- cessing Systems (NeurIPS) Datasets and Benchmarks Track, 2023. ChatGPT Images 2.5 in the Wild12 Appendix The appendix provides four groups of supporting material: âąCollection design: launch context (A), gateway accounting (B), differences among nine instruments (C), route overlap (D), queries (E) and attribution rules (F). âąCuration and audits: deduplication (G), the screenshot prompt (H) and historical audits (I). âąDataset evidence: languages, timing and geometry (J), content credentials (K), the source landscape (L), prepared release files (M) and aggregate subject shares (N). âąEvaluation: detector execution, benchmark checks, cross- release comparisons and collection limitations (O). A Model context at launch On the Arena.ai blind-vote leaderboards snapshotted on 2026-09-07, a day before the announcement, both 2.5 mod- els sat above GPT-Image-2 on editing (1520±9 and 1491±9 against 1461±3 Elo, on 6,704, 5,676 and 235,928 votes, for Sunburst, Flare and GPT-Image-2 respectively). On text-to- image, both also sat above GPT-Image-2, Flare by a narrow margin (1421±13 and 1399±13 against 1381±4). The system card [13] reported a lower unsafe-presented rate (1.09% and 1.41% against 1.64%). B The billed collection stack The April collection used one scraper on one platform. Ex- tending it required additional clients, credentials, pagination logic and rate-limit handling. Here, five of nine routes share a commercial gateway (Monid, CLI 0.1.7). Each call specifies a provider, endpoint and JSON query, reducing the client code needed for another platform. The logs contain 932 calls across 5 endpoints, with latency and return code recorded per call. Table 5 lists counts and prices. Pixiv, note.com and NightCafe instead use public JSON endpoints directly, without a gateway charge. Unit economics. The official X recent-search endpoint bills $0.005 per post read; the same search through the gateway bills $0.0015 for a page of twenty posts, about 67Ăcheaper per post. Xiaohongshu is $0.015 per twenty notes and Weibo and Reddit $0.0015 per page. These are list-price ratios for fully populated pages, before repeated posts, failed calls and deduplication; they are not ratios per unique released image. The first multi-platform crawl exhausted its $0.97 balance, and Reddit and Instagram were added after a top-up (observed balance $100). The official day-one X run cost $10.05 for 2,009 posts. These costs reflect the recorded call schedule and may differ for another collector. Observed route overlap. Of 1,524 gateway-admitted posts, 502 appear in the retained official result files; 168 pass both admission rules, and 334 were returned officially but rejected there. The remaining 1,022 gateway-admitted posts were not observed in the retained official results. Those files do not preserve every billed read, and query schedules and admission rules differ (Appendix D). These counts therefore describe recorded overlap, not a causal decomposition of index cover- age. Combining routes increases observed coverage. Reproduc- tion still depends on the gatewayâs prices, endpoint availability and retrieval behaviour. Direct public endpoints avoid that intermediary where they are available. The gateway calls in Table 5 were logged by crawl/crawl_all.py and support Section 3.2. C What differs between the nine instruments Table 6 compares the routes, including query type, time filter- ing, media format and language metadata. These differences limit cross-platform comparisons even when the launch cutoff is shared. D The two X routes, and the two sources unlike the rest The retained official results contain 502 of the 1,524 gateway- admitted posts, or 33%. This is a lower bound on returned overlap: the curated files retain 1,292 posts with media, not all 2,009 billed reads. The official creation-language classifier rejects 334 of those returned posts, including 318 that pass the version regex alone (Section 3.4). Both routes admit 168 posts: 55% of 305 official posts and 11% of gateway posts. A further 1,022 gateway-admitted posts do not appear in the retained official files. Thus, the records distinguish 334 returned-but-rejected posts from 1,022 unobserved posts. They cannot uniquely assign unmatched posts to index cov- erage, because retention is incomplete and query schedules differ. Neither route is a census. All 139 gate-passing pilot posts also occur in the day-one run. Reddit mainly contributes discussion in this sample. Across four queries, the crawl read 193 posts, of which 176 were post-launch and 88 named 2.5. Only 10 had a directly down- loadable image. The other 78 (89%) were link posts, workflow write-ups or excludedpreview.redd.itre-encodes. The 11 retained images document this routeâs yield but do not provide a comparable platform sample. On Instagram, 65 of 97 returned posts named 2.5, and all of those carried images. Access through a third-party hashtag scraper, however, gives it a different sampling frame from full-text search. ChatGPT Images 2.5 in the Wild13 Table 5: The billed collection stack, fromdata/crawl/crawl_log.jsonl: every gateway call, its endpoint, its measured mean wall-clock latency and the vendorâs list price. Pixiv, note.com and NightCafe are absent: they were collected directly, without gateway charges. SourceProvider and endpointCalls Mean s List price X/Twittertikhub /twitter/web/fetch_search_timeline2736.6 $0.0015/20 posts Reddittikhub /reddit/app/fetch_dynamic_search1164.7 $0.0015/page Xiaohongshu tikhub /xiaohongshu/app_v2/search_notes2123.9 $0.015/20 notes Weibotikhub /weibo/web_v2/fetch_realtime_search3243.8 $0.0015/page Instagramapify /apify/instagram-hashtag-scraper711.9 per actor run Total932 Table 6: The launch-time cutoff, deduplication and image-form filter are shared. Caption and host attribution use different admission rules; query instrument, time filter, timestamp resolution, served format, language field and creation-language requirement are not, so cross-source comparisons in the body are comparisons of instruments as much as of platforms. A hashtag scraper and a model-tagged gallery have different sampling frames from full-text search. SourceQueryServer time filterTimestampServed asLanguageCreation lang. X, official6 families, full text start_time = anchor secondresampled JPEGAPI langrequired X, gateway6 strings, full text since: daysecondresampled JPEGAPI langnot required Xiaohongshu 4 strings, note searchone-week filtersecondtranscoded webpconstant zhnot required Weibokeyword, realtime search noneminute, relative CDN JPEGconstant zhnot required note.com4 hashtagsnone (newest first)secondre-encoded by noteconstant janot required Pixiv5 strings, caption searchnone (newest first)secondoriginal bytesconstant janot required Reddit4 strings, post searchone-week filtersecondReddit CDN JPEGnone (no field) not required Instagram3 hashtags + 1 keywordnone (scraper walk)secondInstagram CDN JPEG none (no field) not required NightCafenewest creations feedlocal anchor cutoffmillisecondCDN assetsnone (no field) host model field E Query families, dropped families and animated posts The official-API query set descends from the six April fami- lies, adapted for a name with a decimal point: hashtags cannot contain a dot, so the community settled on compressed forms such as#GPTImage25, and the dotted name appears only as phrase-quoted free text. Four April families were kept (hashtags; English creation language with a name variant; Japanese creation signals on âgenerated withâ and âtried mak- ingâ; Chinese signals on âpromptâ and âgeneratedâ), two were dropped, and two were added: a codename family targeting Flare and Sunburst, minus announcement phrasing, because those tokens are dominated by third-party platforms announc- ing availability, and a broad anti-noise family matching name variants minus comparison and release language. The gateway and non-X sources use shorter query strings (Appendix C); the collection code records every string. The two families dropped after the pilot are the feature- name queries, which carry no version signal, and the version- silent family pairing ChatGPT with prompt-sharing languageâ Aprilâs largest source of imagesâwhich is unusable for a silently upgraded model: 35 of the 106 posts it returned in the pilot named GPT Image 2 explicitly. Dropping this family re- duces coverage but avoids admitting posts without an explicit version signal. Animated posts are kept: X serves GIFs as MP4, from which we extract frames at four per second, drop consecutive near-duplicates and cap each animation at twelve frames. The release contains 69 frames from 17 animations (one to 11 each) alongside 3,409 stills; frames are marked in the manifest and correlated within an animation. F Version attribution: caption expressions and three tiers Caption-attributed records are scored by the following case- insensitive regular expressions on post text. Host-attributed NightCafe records instead require an allowed value in the plat- formâs model field. Both signals are given in Figure 6. The 2.0 signal is written in three alternatives: the prefixed form, whose negative lookahead keeps âImages 2.5â from firing as 2.0; a bare â2.0â, which in a corpus already naming 2.5 is the prior model and is what catches Chinese and Japanese comparison posts, where no English prefix precedes the number; and the compact gptimage2, guarded against âGPTimage2.5â. The bare and compact 2.0 alternatives exclude comparison posts that name both versions. The stored caption records were re-gated with these expressions;regate.pyapplies the rule by attribution route: caption records use these expres- sions (and the stored classifier decision for official X), while NightCafe records retain admission only when the recorded endpoint, field and model value agree with an allowed host- model record. Host titles are not used as a fallback version signal. F.1 Three attribution tiers The release identifies three tiers ingate_tier: official-X caption attribution plus the April creation-language classifier ChatGPT Images 2.5 in the Wild14 2.5 signal: (image|images|gpt|chatgpt)[ \-_] * 2\.5|2\.5[ \-_] * (flare|sunburst)|gptimage25|images25| image25|sunburst|flare|image2_5|2_5 2.0 signal: (gpt[ \-_] * image|images?)[ \-_] * 2(\.0)?(?![\. _])|(?<![ .])2\.0(?![ ])| gpt[ \-_] * images?2(?![ . ]) Figure 6: Case-insensitive version-gate expressions applied to post text for caption-attributed records. Each signal is a single expression; the line break is typographic. Host-attributed NightCafe records are gated on the platformâs model field instead. (371 images); caption-regex-only attribution (1,749 images); and host-recorded model attribution (1,358 images). The last tier also contains 12 separately labelled videos, excluded from image analyses. NightCafe records are admitted whengptImageModel namesgpt-image-2-5-sunburstor gpt-image-2-5-flare; caption silence is permit- ted in that tier. The host field is a platform assertion, not independent verification that the endpoint executed. The collector excludes records with its checked NSFW or underage moderation flags before curation. Re-scoring the 1,749 caption-only images with the official tierâs text classifier admits 372 (21.3%); 1,296 lack creation language it recognises. This is a comparison of automated rules, not a validation: the classifierâs phrase lists are English- and Japanese-led, and missing language fields limit its use. The three tiers must therefore remain selectable rather than interpreted as interchangeable evidence of generator identity. G Deduplication and cross-source overlap Runs are merged in the order pilot, official day one, gateway X, Xiaohongshu, Weibo, Pixiv, note.com, Reddit, Instagram and NightCafe; the first occurrence wins. Exact repeats are re- moved on the (post, media, frame) key (274); near-duplicates are removed by a 64-bit average hash (8Ă8 grayscale) at Ham- ming distanceâ€4 against every image kept so far (1,281). Replaying that pass over the run directories splits the 1,281 into 570 images whose surviving match came from the same post and 711 from a different post, 27 of them GIF frames. Of the 570 same-post drops, 302 are the same post re-fetched through a second run (gateway rows carry no media_key, so only the hash stage catches them); the re- maining 268 (255 stills, 13 GIF frames) are within-run same- post near-duplicates, possible candidates for a before-and-after pair posted as two attachments, although only 38 of those stills are X rows, the rest being carousel near-duplicates from the gallery-shaped sources. The pass did not exempt any of them. Treating every such X still as an edit-pair member gives an unverified upper-bound scenario of 38 losses (Appendix O.3). The merge order also explains why the day-one runâs 305 gate-passing posts become 160 in the merged manifest: 139 were already carried by the pilot and lose the tie to it, and 6 lost every image to hash collisions. The merged manifest therefore records no cross-run overlap; the pre-dedup overlap of Appendix D comes from thededup_audit.pyscript in the collection code. The pre-dedup overlap across sources is measured separately:analysis/also_seen_in.pyrecomputes which other sources hold a near-duplicate of each released image, using the same 64-bit average hash at Hamming dis- tanceâ€4 the merge itself uses, so it reproduces the mergeâs similarity criterion, not semantic identity. 259 of 3,478 released images (7.4%) were also seen on at least one other source: 217 on two, 36 on three, 4 on four and 2 on five. That script computes cross-source matches for the released images and stores them in a separate analysis output; these matches are not a column in metadata.csv. H The screenshot filter: prompt, cost and labels by source Every gated image is labelled with gpt-5.4-mini through the Responses API (single-pass labels with default sampling, accumulated through the snapshot) atdetail=lowon a 768-pixel JPEG thumbnail, which cost 4,955,460 input and 188,971 output tokens over 6,490 calls (762 input tokens per labelled row; the call count exceeds the 6,344 gated images because the re-gate discarded rows the filter had already la- belled). At the modelâs list price of $0.75 per million input and $4.50 per million output tokens, that is $4.57 for the whole pass, or $0.70 per thousand images. The fixed prompt asks for exactly one of six labels: You are curating a dataset of images generated by ChatGPT Images 2.5. Classify this image into exactly one label: standalone_generated: a single image as the model would output it. No app chrome, no browser, no message bubbles, not a phone/desktop screenshot. chat_screenshot: a screenshot of ChatGPT / a chat app / a browser / a phone UI that contains a generated image inside it. collage_or_grid: two or more separate images stitched together (before/after, 2x2 grid, candidates side by side). photo_of_screen: a camera photo of a monitor or phone displaying an image. promo_graphic: a marketing/announcement graphic (platform logo, ânow availableâ, pricing tables, feature lists). other: anything else. Respond with JSON only: "label": ..., "confidence": "high|medium|low", "why": ... H.1 Labels by source Table 7 gives the full breakdown summarised in Section 3.5. Instagram sits near the Xiaohongshu end (140 of 193 pro- ChatGPT Images 2.5 in the Wild15 motional). The collection design does not establish whether this reflects platform composition, the hashtag query, or other selection effects. Because the sources were queried with differ- ent instruments (Appendix C), that contrast describes what our queries returned in the collection window, not the platformsâ populations. Within X the official tier is also 11.1% promo- tional against 21.4% for the gateway rows, so part of every cross-source promotional contrast is gate tier, not platform. I Historical audit design and detail The audits concern the 9 September curation, before the 10 September NightCafe expansion. Retained per-item files record seed 20260909, identifiers, sources and strata. They lack exact run timestamps and a complete immutable sam- pling frame. We therefore report stored populations rather than reconstructing them from the current manifest. The screenshot frame contains 2,910 images: 1,382 stan- dalone, 309 chat screenshots, 302 collages, 818 promotional graphics, 38 screen photographs and 61 other. Respective sample sizes are 66, 65, 65, 66, 38 and zero. Within each sampled stratum, the recorded random-sampling rule gives inclusion probability n h /N h . The 300 sampled images come from X (217), Xiaohongshu (59), Instagram (9), note.com (6), Weibo (5) and Pixiv (4). None comes from NightCafe. The taxonomy sample also excludes NightCafe and contains 90 X images among 100 items. Its full historical frame size cannot be recovered from the summary alone. The hashes and reconstructed stratum metadata in audit-provenance.jsonidentify retained evidence, not the missing historical frame. Neither audit establishes performance on the current cohort. I.1 Version gate, per language The gate audit sampled 25 posts in each language-by-decision stratum. For English, Japanese, Chinese and other languages, respectively, the stored admitted stratum sizes are 377, 454, 309 and 100; rejected sizes are 510, 174, 221 and 82. Sam- pling probabilities are therefore 25 divided by these sizes. Rejected posts exist only for official X. Within the admitted samples, the numbers of official-X posts are 11, 8, 3 and 2. The stored summaryâs official-X recall calculation reweights these realised subsets, although the original ran- dom draw used combined-tier language-by-decision strata. We do not report that quantity as a HorvitzâThompson esti- mate. A design-consistent domain analysis with uncertainty, and a sufficiently sized official-X sample, would be needed be- fore interpreting recall. Other tiers have no sampled rejected population. Of 25 rejected texts per language, the auditor calls 10 En- glish, 15 Japanese, 12 Chinese and 4 other-language texts creation claims. These judgements are about what text claims, not which generator produced the attached pixels. I.2 Screenshot filter, per class Among images predicted standalone in the historical sam- ple, model disagreement is 1.5% (0.3â8.1). Within other sampled classes, label agreement is 69.2% (57.2â79.1) forcollage_or_grid, 62.1% (50.1â72.9) forpromo_ graphic, 90.8% forchat_screenshotand 18.4% for the 38-imagephoto_of_screencensus. The intervals describe model-label proportions in the sampled strata, not accuracy against ground truth. Weighting by historical stratum sizes gives standalone re- call only over the five sampled strata. The unsampled 61- imageotherstratum could add between zero and 61 auditor- standalone images; its contribution is unmeasured. We do not interpret the stored whole-pool implied share, which as- signs this stratum no standalone contribution, as an identified population estimate. I.3 Subject taxonomy, per class Over100historicallysampledimages, anime/illustratedagrees with the auditor on 68.2% of 44 images;text-graphicagrees on 23.5% andproduct/UI mockupon 37.5%.CLIP assigns text-graphic17 times versus the auditorâs 6, and photorealistic portrait5 times versus 29. These sample contrasts motivate caution about class prevalence; they neither calibrate the expanded release nor bound its true category shares. Content-analysis settings. Subject classification uses CLIP ViT-L/14 [17] zero-shot over the eight April category names with newly authored templates; the original April templates were unavailable, so the backbone and category names do not establish an identical classifier. EasyOCR is routed by post-language metadata: Japanese labels use Japanese and English, Chinese labels use simpli- fied Chinese and English, and all other or missing labels use English only, so the 1,409 images without language metadata all receive English-only OCR. Nonempty detections count at confidence at least 0.3. Faces use InsightFace buffalo_l. Summaries cover successfully analysed released non-video images; video decoding failures are excluded rather than counted as zero detections. Aprilâs analyses ran on a set that still contained screenshots and comparison grids, both text-bearing by construction, so every April comparison is between a cleaned and an uncleaned set under differing CLIP templates. I.4 Language field and creation claims A separate historical text audit sampled 50 released posts per language in English, Japanese and Chinese, using gpt-5.5 and seed 20260909. The auditor agrees with the recorded language on 99.3% of 150 sampled posts (English 100.0%, Japanese 100.0%, Chinese 98.0%). It reads 67.3% (59.5â 74.3) as the author presenting an image they made: Japanese ChatGPT Images 2.5 in the Wild16 Table 7: Screenshot-filter labels by source over all gated images; only the standalone column gives automated admissions before the 16 targeted review exclusions; the last column is that automated share. X is split by gate tier: official-API rows also passed the creation-language classifier, gateway and other caption-attributed rows passed the version regex alone; NightCafe uses the host model field. Videos are excluded. Redditâs 18 gated images are too few to read as a rate. SourceGated Standalone Chat Collage Promo Screen photo Other Standalone % X, official caption5483713472613767.7 X, caption regex2,0911,130195246447314254.0 Xiaohongshu1,594340198118865235021.3 Weibo165402610804524.2 note.com2621384825432652.7 Pixiv72660230191.7 Instagram193400111400220.7 Reddit18111231061.1 NightCafe1,4011,358020190496.9 Total6,3443,4945025061,6616411755.1 82.0%, English 66.0%, Chinese 54.0% (40.4â67.0). These are balanced-sample results; the pooled rate does not estimate the current releaseâs creation-claim share. The audit does not cover records without a language field, including NightCafe, and it does not validate the wording regexes as measures of user intent. J Languages, timing and image geometry Table 8 gives the language distribution of the gated pool against the release. The 1,501 X rows carry the APIâs de- tectedlang; the 568 rows (16.3%) from Xiaohongshu and Weibo (365,zh) and Pixiv and note.com (203,ja) are as- signed a platform default by construction; the 1,409 Instagram and Reddit and NightCafe rows carry none, their collectors returning no such field. Comparison with Aprilâs 32.8% Japanese share is affected by four construction choices: differential filter retention, the addition of two Japanese-first and two Chinese-first sources, platform-default labels, and missing language fields on 40.5% of rows. Changes in early adoption cannot be separated from these choices. The field also describes the post, not the image. J.1 Timing and wording Table 9 reports the earliest and latest posting timestamps among each sourceâs released images. These observed ranges do not establish complete query coverage. For NightCafe, created_atis normalised from the hostâspostedDate; retrieval and generation times are different quantities. The 10 September collection paginated the newest-items feed retro- spectively, so its retrieval date does not date every retrieved post. Figure 7 shows images by posting hour and caption wording by language. J.2 Image geometry as served Served dimensions are recorded for 371 official-API rows (10.7%). The following statistics apply only to that subset. Its images occupy 91 pixel sizes. Of these rows, 62 match an API-native size (1024Ă 1024,1024Ă 1536or1536Ă 1024), and 85 match a ChatGPT export size. Portrait images account for 51.5%, landscape for 23.7% and square for 24.8%. Dimensions alone identify neither the original output nor later transformations. Other sizes may result from editing, export or platform resampling, while native sizes do not es- tablish unchanged bytes. Generator-level frequency analysis requires a verified delivery path and transformation history. K Content credentials in detail A pilot inspected 5 Pixiv originals: 2 PNGs had manifests whose signature chains were verified as OpenAIâs, declaring trained algorithmic media and a watermark assertion. The remaining three were JPEG re-saves with no manifest detected. The correspondence between the two verified pilot files and the current release has not been established, so the pilot does not supply a verified-signature count for the current subset. A byte scan of all 66 released Pixiv files found C2PA markers in 31 (47%). Of these, 30 matched the searched gpt-imageversion 2.0 string, an OpenAI string and a wa- termark string. One marker-positive file lacked that combi- nation and remains uncharacterised. Byte-marker and string matches do not verify a manifest or its signature. The separate API ledger covers 1,007 files from the three recorded endpoints on2026-09-09; the inspected generator- version field is 2.0 throughout that ledger. This establishes a limitation of that field in those files, not all provenance assertions or all endpoints. Because the inspected field does not distinguish versions, it cannot confirm that the caption-attributed Pixiv images were generated by 2.5. Their version attribution remains caption- based. Manifest presence is not an admission signal or a released CSV field. The expanded NightCafe cohort has not received the same credential inspection, so we do not infer whether it preserves or strips C2PA. L The source landscape, platform by platform Social and creator platforms. X, Reddit, Weibo, Xiaohong- shu, Instagram and Threads expose caption-based evidence. ChatGPT Images 2.5 in the Wild17 Table 8: Language distribution, gated pool against release. âPlatform defaultâ counts released rows whose language is a per-source constant rather than a detected field; the âno fieldâ row includes NightCafe, Reddit and Instagram. Retention is the released share of the gated count. LanguageGated Released of which X (detected) of which platform default Retention English (en)1,082675675062.4% Japanese (ja)1,26570350020355.6% Chinese (zh)2,25863126636527.9% Other (French 19, 12 others, 1 undetermined)1276060047.2% No field (Instagram and Reddit and NightCafe)1,6121,4090087.4% Total6,3443,4781,50156854.8% Table 9: Observed posting ranges among released images by source (UTC). Ranges describe retained records, not known complete collection windows or generation times. SourceImages First observed posting (UTC) Last observed posting (UTC) X1,501 2026-09-08 18:58:452026-09-10 21:47:00 Xiaohongshu325 2026-09-08 19:24:472026-09-10 12:28:43 Weibo40 2026-09-09 00:26:002026-09-10 10:15:00 note.com137 2026-09-09 02:15:112026-09-10 18:05:19 Pixiv66 2026-09-08 21:11:512026-09-10 13:57:04 Instagram40 2026-09-08 20:12:432026-09-10 17:53:47 Reddit11 2026-09-09 02:36:142026-09-10 18:13:34 NightCafe1,358 2026-09-10 05:25:552026-09-10 22:06:41 Our source observations come from probes on 9â10 Septem- ber recorded in our collection notes, not an exhaustive survey. Pixiv contributes 66 released images from 18 works; all 66 carry its structured AI declaration. The declaration is still sup- plied by the uploader and does not name a generator version. Pixiv originals offer a byte-preserving delivery route in the inspected files, whereas note.com and social CDN paths can re-encode images. We do not extrapolate a tested delivery path to every asset on a platform. Credential inspection coverage is given in Appendix K. Model-tagged galleries. A host-recorded model field pro- vides an attribution route distinct from caption claims. Night- Cafeâs public creations endpoint exposesgptImageModel; the 9 September probe observed no 2.5 items among 240 newest creations. The 10 September crawl collected 1,449 creations bearing allowed 2.5 values. These snapshots show a change in observed feed contents, not a precisely measured adoption time. The frozen snapshot includes 1,358 NightCafe images and 12 separate videos. A caption-recall study could compare text against these host labels within this gallery, but would still depend on their validity and would not estimate recall on other platforms. On 10 September, SeaArtâs 2 model cards reported 1,631 and 1,161 generation tasks but 0 published works. The imagine.art probe returned no items for the 2.5 style iden- tifiers 41901 and 41902, nor among 500 newest posts. Its style_idfilter returned expected matches on control iden- tifiers; a separatemodel_idparameter did not change the results and cannot be used as attribution evidence. These are query-specific observations of no items, not evidence of no platform adoption. Mage.spaceâs public model counts rose from 117 on 2026-09-09to 221 on2026-09-10(149 Sunburst, 72 Flare), while its per-image feed remained behind login and was not collected. API resellers and aggregators. The same survey found third-party access routes including fal.ai, Kie.ai, OpenArt, Mage.space and Krea. Availability of generation does not establish a public, attributable gallery. OpenArtâs observed model-filter results did not consistently carry a corresponding per-item model field, so we did not admit them on that basis. Intermediary re-encoding is a separate provenance concern that must be checked against the actual returned bytes. Collection implications. Collect accessible social and cre- ator sources in parallel, recording their distinct gates and deliv- ery paths. Poll model-tagged galleries during the launch week: NightCafe demonstrates that a single empty probe can miss a substantial later cohort. Preserve dates and query parameters for negative observations, and keep host attribution separate from caption attribution. Choice of an official API or gateway should depend on the observed yield, cost assumptions and reproducibility of each route rather than an assumed universal ranking of their coverage. M What the release directory contains The prepared local release directory contains the image cohort and separate video assets, a flatmetadata.csv with 22 columns, and a datasheet.Each row carries a content-hash identifier, post identifier and URL (the legacy namestweet_idandtweet_urlapply across sources), recorded posting time, language, media type, frame in- dex, served dimensions, confirmation route, version sig- ChatGPT Images 2.5 in the Wild18 09-08 17:00 09-09 05:00 09-09 17:00 09-10 05:00 09-10 17:00 Recorded posting time (UTC) 0 50 100 150 Images per hour en ja zh other missing 01020304050 Text-bearing posts matched (%) Prompt Edit Speed Consistency Flare Sunburst enjazh Figure 7: Left: released images by recorded posting hour in the2026-09-08 18:58:45Zâ2026-09-10 22:06:41Zwindow (51.1 hours), stacked by recorded post language, with missing language shown separately. Differing source coverage prevents an adoption-rate interpretation. Right: share of released image posts with nonempty text whose text matches prompt-sharing, editing, speed, consistency and codename patterns, for English (364 posts), Japanese (360) and Chinese (299); these are descriptive text-pattern matches, and the other recorded languages have too few posts to plot. nal, screenshot label, query family,source_platform, pixiv_ai_type, like count and post text (the hostâs public creation title for host-attributed rows, not a verified generation prompt). The selectablegate_tierseparates official-X caption plus classifier, caption-regex-only, and host-recorded model attribution. Thesource_runfield records the surviving collection run. Host records additionally carrymodel_id, attribution_endpointandattribution_field. No author profile fields are exported. The datasheet states the frozen window, image/video counts and three admission rules. Public hosting is planned. Analyses of images exclude the video rows using media_type. C2PA signature status, per-item human adjudication and full reconstruction of the historical audit sampling frames are not provided. Cross-source hash matches remain analysis outputs rather than an attribution guarantee. These limitations should be retained when selecting a cohort or interpreting a released label. N Aggregate subject comparison Figure 8 compares CLIP-assigned subject shares with the three categories reported in April. The differing templates and image-form filters limit this descriptive comparison. O Detector Evaluation Details Selection and controls. The experiment uses the public Com- munity Forensics 384-pixel checkpoint, B-FreeâsBFREE_ dino2reg4/model_epoch_best.pth , and Effortâs genimage_checkpoint.pth,plusPGCâsPGC_ train_sdv1_4_ckpt.pth,PROBEâsResNet50_ best_model_step_19343.pth, and DoUâs released 0102030 Images assigned to class (%) Text graphic Fantasy / surreal Photo-like portrait Anime / illustration Product / UI mockup Food Nature / landscape Architecture not reported not reported not reported not reported not reported SeptemberApril Figure 8: Subject-matter distribution of the release under CLIP ViT-L/14 zero-shot classification into the eight April categories using newly authored templates.April shares are shown for the three classes that paper reported, computed on an uncleaned set that still contained screenshots and grids. Read the shares as CLIPâs: an earlier-cohort audit, excluding NightCafe, found Îș = 0.51and substantial disagreements ontext-graphicand photorealistic portrait (Section 4). best.pth . Checkpoints are selected before inspecting col- lection scores. Photograph pools derive fromMLap/GeoDE, tanganke/sun397,HuggingFaceM4/FairFace, nateraw/pascal-voc-2012, andethz/food101; artwork controls derive fromhuggan/wikiart. Selection ChatGPT Images 2.5 in the Wild19 orders candidate paths by SHA256 of the fixed prefix paper-w-controls-v1:followed by the path, retains the first 400 byte-distinct images per source, and alternates calibration/test assignment. Manifests retain source, split, image identity, and byte hashes. Execution and checks. All inference is FP32 with TF32 dis- abled. Community Forensics uses its official image processor at 384 pixels; B-Free preserves native patch processing; Effort uses RGB conversion, OpenCV linear resizing to224Ă 224, and CLIP normalization. B-Freeâs batched adapter and Ef- fortâs folded frozen SVD weights matched upstream CPU forward outputs exactly on the recorded validation cases; Ef- fort preprocessing also matched upstream on 112 pilot images. Models run sequentially on one RTX 3090, using batches of 64, 8, and 32 and respectively six, four, and four preprocessing workers with pinned memory and prefetching. PGC preserves the official native-pixel padding and center crop at 224 pixels, appends three quantization-residual chan- nels, and normalizes RGB and residual channels separately. It uses batches of 32 with four preprocessing workers. Its strict load consumed all 563 checkpoint keys, and its transform and forward path matched the upstream evaluator exactly on four recorded input images. PROBE-ResNet50 strictly loads its 320 checkpoint keys and retains native 224-pixel patch extraction, averaging patch log- its before sigmoid. Small inputs use the official black-padding policy. Image batches of eight feed GPU microbatches of 32 patches. DoU retains its official CLIP-based transform and stochas- tic forward, using batches of 32. Both use four preprocessing workers. Their adapters were checked against upstream trans- forms and forwards. The September-plus-controls runs take approximately 67, 644, 78, 78, 154, and 75 seconds. All 35,268 primary scores are finite, with exact expected image-ID coverage. Recorded checkpoint, code, and manifest hashes accompany the score files. Calibration and uncertainty. For sorted calibration logits s (1) â€Â·â€ s (n) , the threshold is set to the next representable double aboves (nââ0.05nâ) ; scores at or above the threshold are flagged. This rule conservatively handles ties and flags exactly 50 of 1,000 calibration photographs for each detector. Table 2 and the source-level rates use 1,000 post-clustered bootstrap draws; the cross-cohort comparison uses 50,000 draws per cohort. Held-out photograph FPR Wilson intervals are 4.6â7.5%, 3.1â5.6%, 2.5â4.8%, 3.9â6.6%, 4.1â6.9%, and 3.3â5.9%; artwork intervals are 35.4â48.9%, 57.1â70.3%, 5.4â13.2%, 93.0â98.3%, 0.5â4.3%, and 7.4â16.1%, in table order. All intervals condition on the fitted calibration thresholds. Overlap sensitivity. No byte-identical overlap was found between collection and control inputs, and no decoded-pixel identity was found across the control calibration/test splits. A dHash distance screen (†3) identified three cross-split Fair- Face candidate pairs, not established duplicates. Removing all six candidate images and recalibrating on 997 photographs yields held-out photograph FPRs of 6.02%, 4.21%, 3.51%, 5.02%, 5.12%, and 4.31% on 997 images, respectively. Resid- ual perceptual overlap and detector-training overlap are not excluded by these checks. Exploratory content restriction. Restricting the collection to 736 images assigned the existing CLIP categories por- trait, food, nature/landscape, or architecture gives AUROCs of 0.841, 0.535, 0.929, 0.846, 0.538, and 0.695 against the 1,000 held-out reference photographs. These are classifier- defined content proxies, not human-validated photographic images or semantically matched controls. The comparison remains secondary to the source-resolved flag rates and does not independently validate image origin. DoU stochastic evaluation. DoU samples latent Gaussian noise in its published evaluation forward pass. We preserve this behavior, using seed 42 for the primary run and record- ing batch size 32. A second full pass with seed 43 checks sensitivity without changing the primary result. With each pass calibrated on the same reference photograph split, collec- tion flag rates are 17.4% and 17.9%, and held-out photograph FPRs are 4.4% and 6.9%. Holding the primary threshold fixed instead gives a seed-43 flag rate of 17.8% and photograph FPR of 6.6%; 235 of 3,478 collection images change verdict. These two realizations do not estimate the full distribution over seeds. Post-clustered bootstrap intervals omit this addi- tional stochastic variation. Partial resume is rejected rather than silently reseeding and skipping previously scored images. O.1 Harness reproduction on GenImage Purpose of the benchmark check. Forward-pass parity and control FPRs test different parts of the implementation, but nei- ther validates the full scoring pipeline. Each adapter matches the official forward pass bit for bit on identical tensors. Both sides, however, receive already-preprocessed inputs, so this check cannot detect a shared resizing error. Held-out photograph FPRs of 3.5â5.9% show that the scores can be calibrated on real photographs. They include no gen- erated image with a known label. Together, these checks can still miss errors such as inverted score direction or an omit- ted centre crop, which can yield plausible flag rates on an unlabelled collection. Sample and comparability. GenImage [34] is a common benchmark for these detectors. Community Forensics reports results on it, Effortâs checkpoint targets it, and PROBE and PGC train on its SD v1.4 split. We evaluate a frozen validation sample with 300 real and 300 generated images from each of 7 available generators (4,200 images). It is intended to detect ChatGPT Images 2.5 in the Wild20 Table 10: Collection flag rates (%) by source, with half-widths of 95% post-clustered bootstrap intervals. CF is Community Forensics and PROBE is PROBE-ResNet50. Each detector uses the same photograph-calibrated threshold across all sources. Intervals resample posts and condition on the fitted threshold. Small sources are thin: Reddit contributes 11 images from 4 posts. Differences describe the collected sample, not the causal effect of publishing on a platform. DoU uses seed 42; intervals omit variability from its latent-noise sampling. SourceImagesPostsCFB-FreeEffortPGCPROBEDoU X1,50186144.3±319.3±328.8±343.2±33.8±111.1±2 NightCafe1,358 1,35864.1±38.2±152.6±356.0±32.4±13.5±1 Xiaohongshu32513350.8±620.3±561.5±896.9±23.1±353.8±6 note.com13729 70.1±136.6±5 78.1±1192.7±61.5±293.4±5 Pixiv6618 81.8±16 45.5±31 37.9±25 84.8±12 31.8±31 60.6±36 Instagram4018 35.0±19 10.0±15 47.5±22 47.5±24 10.0±13 17.5±14 Weibo4019 70.0±18 22.5±16 45.0±25 62.5±225.0±8 77.5±22 Reddit114 90.9±150.0±0 45.5±50 81.8±300.0±0 81.8±30 All sources3,478 2,44054.7±215.0±243.7±256.4±23.7±117.4±2 large implementation errors while accepting the sampling uncertainty of a small subset. No fitting or tuning uses this sample. Frozen sample and metric. Within each generator and class, files are ranked by SHA256 ofpaper-w-genimage-v1: followed by generator, class and filename. We retain the first 300. Selection reads filenames only and finishes before inference. Our copy contains 7 of the eight published subsets; SD v1.4 is absent. The training-domain column for PROBE and PGC is therefore not included. Accuracy uses each detectorâs own0.5boundary. Equal real and generated counts make accuracy identical to balanced accuracy within each generator. We recompute published means over the same available generators. Community Foren- sics is an exception: its published aggregate spans all eight, including the missing SD v1.4 subset, so that comparison is not exactly matched. Published references. Community Forensics, PROBE, PGC and Effort references come from their authors: [15] Table 2, [1] Table 2, [33] Table 2 and [28] Table 9, respectively. B-Free reports only averages on a recompressed GenImage variant; its reference comes from the PGC study, [33] Table 2. DoU reports GenImage results only graphically. Reference provenance matters. Third-party Effort figures are more than ten points below its own reported results. Using them would imply a roughly fifteen-point discrepancy where the comparison with the authorsâ result is much closer. Residual differences. Each generator contributes 600 im- ages, compared with twelve thousand in the full validation split. Our estimates are therefore noisier and use a different composition. Differences above one point run both ways: ours is higher in six cells, mostly Effort, and lower in five, mostly PROBE-ResNet50. The generated report records per- generator values, differences and standard errors. Community Forensics evaluation set. We also evaluate Community Forensics on a separately released, labelled held- out set [15]. A frozen balanced sample contains 10,000 images (5,000 per class) across 21 generators. Files are copied byte for byte from shards containing 51,836 released images. The harness reaches pooled average precision (AP) 0.989 and accuracy 89.8%, compared with published mean AP 0.994 and accuracy 0.912. The release does not fully specify the published AP aggregation. Averaging per-generator AP on our sample gives 0.947, rather than pooled AP 0.989. Each generator is then compared with the entire real pool, producing generated prevalence of roughly 5%. Because AP depends on prevalence, this is not directly comparable with the balanced published evaluation. Pooled AP on the balanced sample is the closest comparison we can construct. It falls about half an AP point below the published value, which lies outside our bootstrap interval [0.987, 0.990]. Accuracy likewise falls short, and the residual gap is unresolved. Averaging within released shards gives 0.989 and does not close the gap. The harness calls the authorsâ image processor in test mode, so preprocessing is not independently reimplemented. Our sampling and the published pairing of real and generated images remain possible sources of difference. On this same set, the other five detectors reach AUROCs of at least 0.850. Those out-of-distribution results lack comparable published references. We report them only as evidence against inverted or chance-level scoring. Metric computation. AP is pooled unless otherwise stated. Community Forensics evaluation intervals use 2,000 image- level bootstrap draws with seed 20260912. This set has no post-level grouping analogous to the online collection. Com- parisons with balanced published sets use balanced samples because AP depends on prevalence. The AP and AUROC implementations are checked against scikit-learnin our test suite, using continuous, integer- tied and rounded scores. Ties matter for saturated detectors: cumulative-sum AP that arbitrarily separates equal scores can disagree with the standard metric. Such an error would otherwise resemble disagreement with a published result. ChatGPT Images 2.5 in the Wild21 Table 11: Per-generator accuracy (%) on the frozen GenImage sample and published reference values. Agreement in per-generator patterns provides additional evidence beyond the mean; it does not prove checkpoint identity. DetectorADM BigGAN Midjourney SD1.5 VQDM WukongGlide Mean Community Forensics ours93.087.585.3100.0100.099.799.795.0 publishedâ B-Freeours78.067.795.899.288.397.584.287.2 published78.168.694.998.988.398.883.887.3 Effortours84.892.784.298.393.798.093.292.1 published78.777.682.499.891.797.493.388.7 PGC (2026)ours100.098.2100.0100.0100.0100.0 100.099.7 published100.086.7100.0100.0100.0100.0 100.098.1 PROBE-ResNet50ours57.049.892.099.362.399.760.874.4 published60.049.490.799.266.999.463.075.5 DoUours83.375.372.3100.098.299.592.588.7 publishedâ Scope. A released checkpoint can differ from the one used for a paperâs table. These checks cannot separate that possibility from a harness fault, so agreement supports implementation correctness without proving it. They also do not validate generator attribution or platform-specific preprocessing in the collected images. O.2 Historical-cohort comparison Frozen April input. We retrieve the published GPT-Image-2 dataset at revisiona8e3f74cd02edcab94d8c61ae0 439a9dc5d78468 , preserving all 10,217 metadata rows. The archive places 219 images inimages_overflow/ although metadata paths point toimages/. Unique file- names resolve them without substituting files. The manifest retains release order, post IDs, admission routes, languages, classifications and both byte and decoded-RGB hashes. Neither the sample nor the complete 10,217-image release overlaps September images or reference controls at either hash level. We do not apply Septemberâs screenshot filter retrospec- tively. Original classifications are 4,959confirmedand 5,258uncertainimages; recorded routes include 4,750 generic AI-badge admissions and 508 name-only admissions. These labels do not authenticate generator identity. Posts span 21â28 April 2026. Recomputed image-row lan- guage counts are 4,117 English, 3,355 Japanese and 1,959 Chinese: 40.3%, 32.8% and 19.2% of 10,217 rows. These reproduce the April shares cited in this appendix. We do not pool them with September language fields, whose sources, defaults and missingness differ. Sample selection. All six detectors use the same 3,000 im- ages from 2,542 posts. We rank the release by SHA256 ofpaper-w-april-pilot100-v1:followed by image ID and retain the first 3,000 distinct records. The prefix is inherited from the initial pilot and kept unchanged for repro- ducibility. Inference follows original release order. Selection precedes scoring and uses no quotas or score- based exclusions. It samples image records without replace- ment but does not guarantee balanced content or languages. Parent and sample manifest hashes and selected IDs are recorded. The report checks score and manifest hashes, check- point identity, preprocessing, score definitions, package ver- sions and batch configuration against September. Thresholds come from the saved September calibration report and are never refitted on April. Intervals and multiplicity. Each bootstrap draw samples sourceâpost pairs with replacement within a cohort and re- tains all images of each selected post. The rate is the re- sampled flag count divided by the resampled image count. Cohorts are resampled independently, and difference intervals use percentiles of draw-wise differences. The report uses seed 20260912, deterministic detector-specific streams and 50,000 draws to estimate the family-wise tail bounds. The six contrasts are exploratory. We report pointwise intervals and, for the two excluding zero, Bonferroni-adjusted intervals for the family of 6. Shared creators and residual image similarity can produce dependence beyond the post clusters. Attribution sensitivity. The metadata-only view restricts April to sampled records labelledconfirmed, a label held by 4,959 of 10,217 parent images. September is restricted to 371 X images inofficial_caption_classifier. These admission rules are neither matched nor independently verified. We do not compute difference intervals for this view. Per-cohort intervals can rely on as few as seven PROBE- ResNet50 flags, for which percentile-bootstrap coverage is unreliable. Duplicate and seed sensitivity. The 3,000 records contain 17 byte-duplicate groups with 19 extra images; the parent release has 122 groups and 145 extra images. The pre-specified first- occurrence sensitivity retains 2,981 records. It changes every flag rate by less than 0.1 p: Community Forensics 44.80 to 44.78, Effort 22.70 to 22.61, and DoU 7.57 to 7.48. No conclusion changes. DoU uses primary seed 42 on April. The September-only second-seed check does not quantify variability in the cross- ChatGPT Images 2.5 in the Wild22 Table 12: Sensitivity to calibration sampling. Differences are September X minus April X, in percentage points. Fixed-threshold intervals reproduce the primary analysis; the other intervals additionally resample calibration photographs within source and refit the threshold. Both analyses resample whole posts and use 50,000 draws. The 99.17% intervals adjust for six detectors; DoUâs latent-sampling variability is excluded. DetectorDifference Fixed thresholdResampled calibration (p)95% interval95% interval 99.17% interval Community Forensics-0.5[-4.1, +3.2][-4.0, +3.4][-5.3, +4.6] B-Free+1.3[-1.7, +4.3][-1.8, +4.2][-2.9, +5.3] Effort+6.1[+2.7, +9.6] [+2.8, +10.0][+1.7, +11.3] PGC (2026)+0.8[-3.1, +4.7][-2.9, +5.4][-4.4, +6.8] PROBE-ResNet50+0.9[-0.3, +2.2][-0.3, +2.3][-0.7, +2.8] DoU+3.6[+1.0, +6.2][+1.1, +6.3][+0.3, +7.4] cohort difference. Neither a favourable seed nor an attribution subset replaces the primary comparison. Resampling the calibration photographs. We add a post hoc sensitivity analysis after the primary comparison. Each of 50,000 draws resamples 200 calibration photographs within each of the five source pools, preserving the fixed source al- location, and refits the same conservative 5% threshold. It independently resamples April and September posts, retaining every image in each sampled post. Both cohorts use the same refitted threshold in that draw. Seed 20260913 and separate detector-specific streams make the calculation reproducible. The point estimates remain those at the original fitted thresh- olds. Table 12 reports all six detectors, with pointwise 95% and Bonferroni 99.17% intervals. Effort and DoU remain positive under the family-wise adjustment; all other intervals include zero. This analysis addresses calibration sampling conditional on the five chosen photograph pools. It does not account for alternative control sources, DoUâs stochastic forward pass, selection bias or attribution error. O.3 Further limitations of the collection Attribution remains unverified. Captions and host fields can misname the generator; the inspected C2PA generator- version field does not resolve that uncertainty. Xâs rendered âMade with AIâ badge was unavailable in the collection en- vironment. Pixivâs AI declaration, present for 66 images, identifies AI use rather than generator version. Historical audits do not validate the current cohort. The three automated stages were assessed by another model with- out human adjudication. Correlated errors can remain. Screen- shot and taxonomy audits contain no NightCafe examples; the caption audit cannot assess host attribution. Language quotas and unequal class sampling also limit pooled proportions. Sec- tion 4 specifies the populations and estimands. A human audit covering the frozen cohort and all attribution tiers remains future work. Selection and source comparability. Caption admission omits version-silent posts; host-attributed galleries use a dif- ferent selection rule. Queries, time filters, budgets and image- form retention differ by route, so source yields do not measure relative platform activity. Four platforms have default lan- guage labels and three have none. Source and attribution fields permit restricted analyses but do not remove these con- founders. Near-duplicate removal may discard distinct edits. Average-hash similarity does not establish semantic identity. Treating all 38 within-run, same-post X still-image drops as edit-pair members gives an unverified upper-bound scenario for that subset (Appendix G). Actual edit losses and gallery drops remain unreviewed. Caption self-report also does not reliably distinguish generation from editing. Snapshot coverage. Neither X route, nor their union, is a cen- sus. The gatewayâs prices, endpoints and retrieval behaviour can change. Reddit and Instagram were collected later, and some qualifying posts lack downloadable media. NightCafe was added later still: its host posting timestamps span only the final 16.7 hours (2026-09-10 05:25Zto2026-09-10 22:06Z). It supplies 1,358 of 1,667 images posted in that span. These are publication times, not retrieval or verified generation times. The window ends at2026-09-10 22:06:41Z, about 51.1 hours after the anchor, and covers only part of launch week. Content measurement. Summaries exclude 12 videos and failed image analyses. April comparisons mix source popula- tions, image-form filters and newly authored CLIP templates, despite a shared backbone and category names. OCR readers are selected from post-language metadata; missing or other languages receive English-only OCR. Post language can differ from image script, so unsupported scripts may be missed. The detected share is not a validated estimate of text prevalence.