# ChatGPT Images 2.5 on Forgery Tasks: Testing Advertised Improvements Against Known Answers

arXiv: https://arxiv.org/abs/2609.13617 · HTML: https://mlsanity.com/paper/2609.13617/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 38 references that are in the map.
- First posted on arXiv 12 Sep 2026.

## Builds on (most cited first, 18 of 18)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [DINOv2: Learning Robust Visual Features without Supervision](https://mlsanity.com/paper/2304.07193/) (2023)
- [DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generation](https://mlsanity.com/paper/2208.12242/) (2022)
- [Chatbot Arena: An Open Platform for Evaluating LLMs by Human Preference](https://mlsanity.com/paper/2403.04132/) (2024)
- [LLM Evaluators Recognize and Favor Their Own Generations](https://mlsanity.com/paper/2404.13076/) (2024)
- [Scaling Open-Vocabulary Object Detection](https://mlsanity.com/paper/2306.09683/) (2023)
- [ImgEdit: A Unified Image Editing Dataset and Benchmark](https://mlsanity.com/paper/2505.20275/) (2025)
- [TextDiffuser: Diffusion Models as Text Painters](https://mlsanity.com/paper/2305.10855/) (2023)
- [AnyText: Multilingual Visual Text Generation And Editing](https://mlsanity.com/paper/2311.03054/) (2023)
- [TruFor: Leveraging all-round clues for trustworthy image forgery detection and localization](https://mlsanity.com/paper/2212.10957/) (2022)
- [AEROBLADE: Training-Free Detection of Latent Diffusion Images Using Autoencoder Reconstruction Error](https://mlsanity.com/paper/2401.17879/) (2024)
- [Community Forensics: Using Thousands of Generators to Train Fake Image Detectors](https://mlsanity.com/paper/2411.04125/) (2024)
- [Spatial Dual-Modality Graph Reasoning for Key Information Extraction](https://mlsanity.com/paper/2103.14470/) (2021)
- [Revisiting Tampered Scene Text Detection in the Era of Generative AI](https://mlsanity.com/paper/2407.21422/) (2024)
- [GEditBench v2: A Human-Aligned Benchmark for General Image Editing](https://mlsanity.com/paper/2603.28547/) (2026)
- [GPT-Image-2 in the Wild: A Twitter Dataset of Self-Reported AI-Generated Images from the First Week of Deployment](https://mlsanity.com/paper/2604.25370/) (2026)
- [AIForge-Doc: A Benchmark for Detecting AI-Forged Tampering in Financial and Form Documents](https://mlsanity.com/paper/2602.20569/) (2026)
- [When the Forger Is the Judge: GPT-Image-2 Cannot Recognize Its Own Faked Documents](https://mlsanity.com/paper/2604.25213/) (2026)

## Built on by (most cited first, 2 of 2)

- [ChatGPT Images 2.5 in the Wild: A Launch-Period Dataset and Detector Evaluation](https://mlsanity.com/paper/2609.15100/) (2026)
- [Agents That Edit Documents: Measuring Agentic PDF Forgery Against a Non-Agentic Control](https://mlsanity.com/paper/2609.23953/) (2026)

## Abstract (arXiv)

OpenAI released ChatGPT Images 2.5 on 8 September 2026, advertising more precise local edits, better consistency across edits, more faithful reference products and sharper detail. We evaluate these claims on four forgery tasks with answers fixed in advance: receipt-field alteration, repeated editing, product placement and small-print rendering. GPT-Image-2 provides same-week baselines at a cheaper and a more expensive tier. A limited improvement appears in receipt editing. After alignment, OCR detects changes to surrounding text in 31.7% of Flare outputs, against 44.2% for the cheaper baseline. This gain is concentrated on CORD receipts and sensitive to shifts of a pixel or less; the forged value itself is no more often correct. Repeated editing and fine print show no measurable gain. Product codes become more legible mainly because Images 2.5 draws the product larger. Defence outcomes change little: localisation remains weak for both generations. A detector that flags 68.6% of controlled benchmark images flags only 35.9% of images posted online. Advertised improvements therefore transfer unevenly to the tested forgery capabilities, while substantial detection limitations remain.