GPT4o-Receipt: A Dataset and Human Study for AI-Generated Document Forensics

Yan Zhang; Simiao Ren; Ankit Raj; En Wei; Dennis Ng; Alex Shen; Jiayu Xue; Yuxin Zhang

cs.AIMar 12, 2026

GPT4o-Receipt: A Dataset and Human Study for AI-Generated Document Forensics

Authors: Yan Zhang, Simiao Ren, Ankit Raj, En Wei, Dennis Ng, Alex Shen, Jiayu Xue, Yuxin Zhang,

Abstract

Can humans detect AI-generated financial documents better than machines? We present GPT4o-Receipt, a benchmark of 1,235 receipt images pairing GPT-4o-generated receipts with authentic ones from established datasets, evaluated by five state-of-the-art multimodal LLMs and a 30-annotator crowdsourced perceptual study. Our findings reveal a striking paradox: humans are better at seeing AI artifacts, yet worse at detecting AI documents. Human annotators exhibit the largest visual discrimination gap of any evaluator, yet their binary detection F1 falls well below Claude Sonnet 4 and below Gemini 2.5 Flash. This paradox resolves once the mechanism is understood: the dominant forensic signals in AI-generated receipts are arithmetic errors -- invisible to visual inspection but systematically verifiable by LLMs. Humans cannot perceive that a subtotal is incorrect; LLMs verify it in milliseconds. Beyond the human--LLM comparison, our five-model evaluation reveals dramatic performance disparities and calibration differences that render simple accuracy metrics insufficient for detector selection. GPT4o-Receipt, the evaluation framework, and all results are released publicly to support future research in AI document forensics.

Figures & tables

Fig. 1: Recall vs. false positive rate for each detector. Upper-left is better. Claude Sonnet 4 achieves the highest overall detection (F1 = 0.975); Gemini 2.5 Flash exhibits the best calibration among effective detectors (lowest FPR = 0.023); Grok 4 reaches near-perfect recall at a 90.3% FPR; LLaMA 4 Scout has the lowest FPR but misses 89% of AI receipts. Human annotators (star) occupy a mid-tier position with moderate recall and low FPR.

Dataset	Document Type	Forgery Method	AI-gen	Forged
Tornés et al. [ 33 ]	Receipts	Copy-paste, pixel edit, text imitation	No	163
DocTamper [ 17 ]	Mixed docs (receipts, invoices)	Pixel-level text editing	No	170,000
ICDAR 2023 DTT [ 18 ]	Scene text / documents	Pixel-level region editing	No	11,385
OSTF [ 19 ]	Scene text images	Trad. editing + diffusion inpainting	Inpainting	1,980
RealDTT [ 20 ]	Text images (real-world)	Real-world digital editing	No	304,000
AIForge-Doc [ 22 ]	Financial documents	Diffusion-model inpainting	Inpainting	4,061

TABLE I: Comparison of publicly released document forgery datasets. AI-gen : No = traditional image editing (copy-paste, Photoshop); Inpainting = AI model used to modify regions of authentic documents; Full = entire document synthesized from scratch by a generative AI model.

Fig. 2: Representative samples from GPT4o-Receipt. Top row : AI-generated receipts produced by the two-stage pipeline (GPT-4o text

\rightarrow

GPT-Image-1 rendering); Bottom row : authentic receipts from ExpressExpense and Roboflow. AI-generated receipts exhibit high visual plausibility—realistic fonts, plausible merchant layouts, paper texture—but contain systematic arithmetic errors invisible to casual inspection.

Alias	Full Model	Provider	API Model Identifier
claude-sonnet	Claude Sonnet 4	Anthropic	claude-sonnet-4-6
gemini-flash	Gemini 2.5 Flash	Google	gemini-2.5-flash-preview
gpt5-nano	GPT-5 Nano	OpenAI	gpt-5-nano
grok4	Grok 4	xAI	grok-4
llama-4-scout	LLaMA 4 Scout	Meta	meta-llama/llama-4-scout

TABLE II: Multimodal LLMs evaluated as forensic detectors in this study. All models are accessed via OpenRouter and support direct image input. All models accessed between February 15–25, 2026.

Fig. 3: Detection performance of five multimodal LLMs on GPT4o-Receipt. FPR (hatched,

\downarrow

better); Accuracy, F1, Recall (

\uparrow

better).

Fig. 4: Failure rates (%) for each error category across AI-generated receipts, as assessed by each detector model. Darker red indicates higher failure rates. LLaMA 4 Scout’s near-zero error detection rates are consistent with its overall failure to identify AI-generated receipts.

Model	Arith. Pass	Sum Fail	Tax Fail	Round Fail	Factual Pass	Addr Fail
Claude Sonnet 4	2.6	97.2	75.9	45.2	17.2	59.5
Gemini 2.5 Flash	13.0	85.9	78.2	9.0	21.5	24.7
GPT-5 Nano	32.3	63.2	37.1	20.2	51.6	23.0
Grok 4	1.6	96.0	56.9	39.0	7.8	55.0
LLaMA 4 Scout	89.3	10.4	4.9	7.7	92.8	4.3

TABLE III: Forensic error rates on AI-generated receipts (%). “Arith. Pass” and “Factual Pass” are the fractions with no detected errors in each category; remaining columns show specific failure rates. These rates reflect each model’s assessments , not independently verified ground-truth errors.

ID	Dimension	Question	Response options (authentic → artificial)
Q1	Typography	Does the typography look realistic?	Yes (Realistic) / Somewhat / No (Obvious Fake)
Q2	Layout	Is the receipt layout consistent?	Yes (Consistent) / Somewhat / No (Broken/Messy)
Q3	Artifacts	Is the image free of visible artifacts?	Yes (Clean) / Somewhat / No (Noticeable Artifacts)
V	Overall	Visual realism score (1–5)	1 (clearly artificial) → 5 (indistinguishable from real)

TABLE IV: Annotation questions administered to each human evaluator for every receipt image. Responses are ordered from most authentic (left) to least authentic (right).

Fig. 5: Mean visual realism scores (

\pm

SD) for AI-generated and real receipts across all evaluators. Significance:

***

p<0.001

;

*

p<0.05

; ns not significant. Humans exhibit the largest AI-vs-real gap (1.87 points, 95% CI [1.74, 1.99]).

Evaluator	Accuracy	F1	Recall	FPR
Claude Sonnet 4	0.962 [.950–.971]	0.975 [.967–.982]	0.972 [.961–.982]	0.070 [.044–.100]
Gemini 2.5 Flash	0.848 [.826–.867]	0.890 [.874–.904]	0.807 [.779–.831]	0.023 [.009–.044]
GPT-5 Nano	0.631 [.605–.658]	0.685 [.656–.712]	0.530 [.497–.560]	0.057 [.032–.083]
Grok 4	0.780 [.756–.804]	0.873 [.857–.887]	0.999 [.996–1.00]	0.903 [.867–.935]
LLaMA 4 Scout	0.326 [.300–.351]	0.204 [.172–.240]	0.114 [.096–.136]	0.017 [.004–.034]
Majority-class ‡	0.757 [—]	0.862 [—]	1.000 [—]	1.000 [—]

TABLE V: Detection performance on GPT4o-Receipt. All evaluators assessed the full 1,235-image set (935 AI + 300 real). Human metrics are inferred via visual score threshold

\leq 3

rather than direct binary judgment (see Section VI ). Values are point estimates with 95% bootstrap confidence intervals. Best values in bold .

Fig. 6: Human detection performance across visual score thresholds. Paper default (dashed line):

\leq 3

. F1 peaks at

\leq 4

but with high FPR;

\leq 3

gives the best recall–FPR balance.

Fig. 7: Impact of arithmetic hardening on LLM detection performance. Left : Baseline F1 vs. estimated F1 when arithmetic verification is unavailable (i.e., forgeries have been pre-validated for arithmetic correctness). Right : Percentage of detection capability (F1) lost after arithmetic hardening. Claude Sonnet 4, Gemini 2.5 Flash, and Grok 4 retain

>

94% of their baseline F1, indicating reliance on multiple forensic channels beyond arithmetic; GPT-5 Nano and LLaMA 4 Scout are more dependent on arithmetic signals.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Evaluator	AI	Real	Gap [95% CI]	Sig.
Claude Sonnet 4	2.51	3.89	+1.38 [1.32, 1.44]	$***$
Gemini 2.5 Flash	3.54	4.78	+1.24 [1.16, 1.31]	$***$
GPT-5 Nano	4.01	3.99	$-$ 0.02 [ $-$ 0.08, 0.03]	ns
Grok 4	3.28	3.45	+0.17 [0.07, 0.27]	$*$
LLaMA 4 Scout	3.99	4.07	+0.09 [0.04, 0.14]	$***$
Human (n=30)	2.60	4.47	+1.87 [1.74, 1.99]	$***$

Appendix

TABLE VI: Mean visual realism scores (1–5) assigned to AI-generated vs. real receipts by each LLM and by human annotators. Gap = Real

-

AI (95% CI in brackets). Significance:

***

p<0.001

;

*

p<0.05

; ns not significant (two-sample

t

-test).

	$T\leq 2$		$T\leq 3$
Model	F1	Recall	F1	Recall
Claude Sonnet 4	0.987	51.8%	0.989	97.2%
Gemini 2.5 Flash	0.000	0.0%	0.994	62.2%
GPT-5 Nano	0.889	0.9%	0.917	12.8%
Grok 4	0.862	13.0%	0.885	58.4%
LLaMA 4 Scout	1.000	1.2%	0.976	10.9%

Appendix

TABLE VII: No-arithmetic F1 and AI-image coverage (recall) for each LLM evaluator at visual realism thresholds

T\leq 2

and

T\leq 3

. Recall = fraction of all 935 AI receipts whose visual realism score

\leq T

for that model; F1 is computed over that subset only. Positive class = AI-generated receipt.

Digital Image Forensics

Digital image forensics develops methods to detect, localize, explain, and trace image manipulation, synthetic content, and hidden data.

See all 112 papers

When the Forger Is the Judge: GPT-Image-2 Cannot Recognize Its Own Faked Documents
Apr 28, 2026Jiaqi Wu, Yuchen Zhou, Dennis Tsang Ng +5Image Editing Evaluation Image Forgery Detection
arXiv:2604.25213v1
AIForge-Doc: A Benchmark for Detecting AI-Forged Tampering in Financial and Form Documents
Feb 24, 2026Jiaqi Wu, Yuchen Zhou, Muduo Xu +6Text Forgery Detection Image Forgery Detection
Duke University · New York University · University of North Carolina +1
Beyond Natural Images: Rethinking AI-Generated Image Detection in Documents
Sep 13, 2026Zhangjie Fu, Jiazhen Yan, Yuanwen Chen +5AI-Generated Image Detection Digital Image Forensics
Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology · Baidu Inc. · School of Computer Science and Engineering, MoE Key Laboratory of Information Technology, Guangdong Province Key Laboratory of Information Security Technology, Sun Yat-sen University +1

Apr 28, 2026J/K move · Enter open · S save

When the Forger Is the Judge: GPT-Image-2 Cannot Recognize Its Own Faked Documents

Jiaqi Wu, Yuchen Zhou, Dennis Tsang Ng, Xingyu Shen+4

arXiv:2604.25213v1

Image Editing Evaluation Image Forgery Detection AI-Generated Image Detection

Open paper AskPDF arXiv

OpenAI's GPT-Image-2 has effectively erased the visual boundary between authentic and AI-edited document images: a single number on a receipt can be replaced in under a second for a few cents. We release AIForge-Doc v2, a paired dataset of 3,066 GPT-Image-2 document forgeries with pixel-precise masks in DocTamper-compatible format, and benchmark four lines of defence: human inspectors (N=120, n=365 pair-votes via the public 2AFC site CanUSpotAI.com), TruFor (generic forensic), DocTamper (qcf-568, document-specific), and the same GPT-Image-2 model as a zero-shot self-judge -- asked, to avoid the trivial "image is mostly real" reading, whether any region was generated or edited by an AI image model. Human 2AFC accuracy is 0.501, indistinguishable from chance: even side-by-side, inspectors cannot tell GPT-Image-2 receipt forgeries from authentic counterparts. The three computational judges sit only modestly above (TruFor 0.599, DocTamper 0.585, self-judge 0.532). The self-judge fails consistently, not by chance: across five prompt strategies and four policies for handling ambiguous responses, AUC never rises above 0.59. To rule out the possibility that the two forensic detectors are broken on our source domain rather than blind to AI inpainting, we calibrate each on a same-domain traditional-tampering set built for its training distribution: TruFor reaches AUC 0.962 on cross-camera splicing of our dataset, DocTamper reaches 0.852 on cross-document OCR-token splicing with two-pass JPEG re-encoding. Both retain near-published performance on traditional tampering; switching to GPT-Image-2 inpainting drops AUC by 0.27-0.36 (0.962->0.599 TruFor; 0.852->0.585 DocTamper), isolating a detection gap specific to GPT-Image-2 inpainting. We release the dataset, pipeline, four-judge protocol, and calibration sets.

Abstract

Digital Image Forensics

Explore similar work

When the Forger Is the Judge: GPT-Image-2 Cannot Recognize Its Own Faked Documents

AIForge-Doc: A Benchmark for Detecting AI-Forged Tampering in Financial and Form Documents

Beyond Natural Images: Rethinking AI-Generated Image Detection in Documents