The published evidence says document-forgery detection does not generalise out of the box. That finding is why Nio exists — and why we build the way we do.
01 — The short version
Detectors that look excellent on their training distribution collapse on AI-forged documents. General-purpose AI barely beats chance. The gap isn’t a better model — it’s calibration, context and explanation.
02 — The papers
Benchmark — AI-forged financial documents
AIForge-Doc: detecting AI-forged tampering in financial and form documents
Wu et al., 2026 · arXiv:2602.20569
A benchmark of 4,061 AI-forged documents built by inpainting numeric fields in real receipts and forms with consumer diffusion APIs. Specialised detectors collapse outside their training distribution: DocTamper falls to AUC 0.563 (from 0.98 in-distribution), and a zero-shot GPT-4o judge scores 0.509 — essentially chance.
The generalisation problem: a detector that aces its own benchmark can still be blind to the forgeries actually arriving today.
DOCFORGE-BENCH: a zero-shot benchmark for document forgery detection
Zhao et al., 2026 · arXiv:2603.01433
14 detection methods evaluated across 8 datasets, zero-shot, with published pretrained weights — the realistic deployment scenario. No method works reliably out of the box across document types; standard thresholds are badly miscalibrated because tampered regions in documents are an order of magnitude smaller than in natural images.
The calibration problem: off-the-shelf models need per-domain calibration before their scores mean anything operationally.
Can multi-modal (reasoning) LLMs detect document manipulation?
Liang et al., 2025 · arXiv:2508.11021
A study of state-of-the-art multimodal LLMs on document-fraud detection. Most score around AUC 0.5 — chance level; the best reaches 0.71; all trail specialised detection networks.
Pointing a frontier LLM at a PDF is not a verification strategy — specialised, calibrated pipelines outperform generality.
A technique for the detection of PDF tampering or forgery
Grobler, Makura & Venter, 2025 · arXiv:2507.00827
Tampering can be detected from a PDF’s internal page objects and metadata — changes that are invisible in the rendered image. The visual layer and the file layer tell different stories.
Why forensic signals are a first-class family in Nio: the file itself testifies, independently of what it looks like.
Signals must be combined — forensic, content and contextual — because each one alone fails somewhere that matters.
02
Calibrate to the domain
Scores are only useful once calibrated to the documents a market actually produces — for us, the Croatian stack: legal forms, diacritics, registry behaviour, domestic ERP output.
03
Explain, or it didn’t happen
A score no analyst can defend in front of an auditor is operationally worthless. Explanation is the product, not the garnish.
A note on our own numbers: we commit to measuring detection rate and false-positive rate on real document flows — and to publishing measured figures, not projections. Until then, you will not find an accuracy claim on this site.