Building a benchmark that could break Resemble AI's detection agent

Resemble AI builds systems for detecting synthetic media. Its detector and investigative agent already handled the obvious examples. The hard part was finding the cases that remained brittle, measuring them consistently, and improving the agent without damaging decisions the detector had already made correctly.

The benchmark available at the start could not support that work. It was too easy in some areas, inconsistent in others, and not designed to measure the detector and agent as one sequential decision system. A high score on that benchmark said little about what would happen after an ordinary image upload changed the forensic signal.

Resemble partnered with Iacon to rebuild the evaluation boundary. Optimus did the technical work: it designed the challenge, attacked the detector and agent, repaired the harness, built the benchmark pipelines, ran the experiments, analyzed failures, and hardened the investigative behavior. Resemble supplied the system under test, domain context, and ground-truth review.

Study boundary	Public description
System under test	A frozen media detector followed by an investigative agent
Optimus built	The adversarial benchmark, harness, evaluation pipelines, and hardening loop
Evaluation focus	Robustness under realistic image transformations
Headline result	More than 60% fewer errors across complete frozen-suite reruns
Claim boundary	Benchmark improvement, not customer-level deployment accuracy

The benchmark had become the bottleneck

Synthetic-media detection depends on traces that may be weak, local, and easy to disturb. An image can keep the same visible subject while resizing, recompression, smoothing, or a creative filter changes the signal available to a detector. People see the same document or photograph. The detector sees a different statistical object.

That distinction shaped the study. Optimus needed to find transformations that preserved the meaning and origin of the media while changing the evidence available to the system. Clean source images alone would flatter the detector. Random corruption would create unrealistic failures. The benchmark needed stress cases that resembled the processing media receives during ordinary upload, storage, editing, and redistribution.

The work also had to test more than the detector. Resemble's investigative agent receives the detector result, examines the submitted image, gathers additional evidence, and decides whether to preserve or revise the initial call. An agent that challenges every detector error may also challenge correct calls. Measuring only its final accuracy would hide that trade.

Optimus therefore treated the detector, investigative agent, and evaluation harness as connected parts of one system. It tried to break all three.

Constructing a challenge with traceable failures

Optimus assembled the benchmark around transformed descendants of known source media. The challenge covered synthetic documents, generated product and lifestyle images, authentic camera photographs, and edited variants. Its stress conditions included resolution reduction, recompression, cropping, noise, smoothing, sharpening, and creative filters.

Each case retained enough provenance to answer two different questions:

• where did the image originate; and
• what processing happened after it was created?

Those questions often produce different evidence. A filter may make an image look stylized without making it synthetic. A resized synthetic document may lose the traces that supported the detector's original answer without becoming authentic. Keeping origin separate from later processing became one of the most important design choices in the benchmark.

The benchmark also kept authentic controls beside synthetic cases. This prevented the hardening loop from optimizing only for recovery. A system that labels every difficult upload as synthetic can appear strong on a synthetic stress set while becoming unusable for authentic media.

Optimus froze the challenge and its three-label decision contract: synthetic, authentic, or uncertain. Every scheduled case stayed in the denominator. Execution failures and malformed decisions counted as errors rather than disappearing from the report. These rules made successive runs comparable and stopped operational instability from masquerading as model quality.

Rebuilding the harness before trusting the scores

The first benchmark runs exposed failures in the evaluation machinery as well as the models. Long investigative sequences did not always complete reliably. Evidence could be produced but fail to reach the final decision. Changes in execution made it difficult to tell whether a new score came from better reasoning or a different path through the harness.

Optimus rebuilt the pipeline around a fixed sequence. Each case supplied the image, the frozen detector output, and a bounded opportunity for the agent to investigate. The harness captured the investigation, normalized the final decision, and evaluated it against the same ground-truth contract. Run artifacts stayed attached to the benchmark and evaluator revisions that produced them.

This repair work was part of the research result. A capable model inside an unreliable loop still produces an unreliable system. Once execution became repeatable, failures in the run record could guide a real intervention instead of another debugging session.

Scoring the handoff between detector and agent

Optimus reported four dimensions rather than compressing the system into one accuracy figure.

Recovery measured detector errors corrected by the investigative agent. Regression measured correct detector calls that the agent changed into errors. Reliability measured whether the configured investigation completed and returned a valid decision. Actionability recorded whether the upload should be accepted, rejected, or sent for review under the evaluation contract.

This decomposition changed the engineering conversation. A candidate could show a higher final score while introducing an unacceptable number of regressions. Another could preserve accuracy but complete far more investigations successfully. The benchmark showed which mechanism had changed, which cases benefited, and what the candidate had cost.

It also made model-dependent investigation strategies visible. A larger investigation budget did not help every model in the same way. One configuration benefited from a focused path, while another needed extended context to turn observations into useful evidence. The benchmark made that a measured configuration choice rather than a general assumption.

Four generations of improvement

Optimus used the frozen challenge as an engineering instrument across four benchmark generations.

The first generation established the mixed authentic and synthetic baseline. It exposed transformation-sensitive detector failures and showed that execution reliability had to improve before longer reasoning could help.

The second generation strengthened execution and retained useful observations across a sequence of cases. The gain came from making the investigation path more dependable, not from changing the benchmark to remove failures.

The third generation tightened evidence discipline. The agent learned to separate observations about image origin from facts about the depicted document or claim. Issuer validity, dates, and semantics may matter to a business workflow, but they do not determine how the pixels were created. Requiring image-level evidence before overruling the detector made recovery more selective and reduced avoidable regressions.

The fourth generation concentrated on known hard cases. Optimus refined the evidence categories used for low-resolution documents, filtered imagery, and other transformations that had survived earlier rounds. Because this stage reran only the difficult subset and carried forward unchanged outcomes, it is not used for the headline full-suite comparison.

Across the complete frozen-suite reruns, the best generation produced more than 60% fewer errors than the initial generation. The statement reports a relative reduction in errors and does not expose Resemble's lower absolute baseline. More importantly, it comes from complete reruns under one challenge and one scoring contract. The targeted hard-case pass provided additional engineering evidence, but it is labeled separately rather than presented as a new full evaluation.

Optimus performed the research loop

Once Resemble and Iacon approved the objective and evaluation contract, Optimus ran the benchmark-building and hardening loop without per-run human direction. It generated and organized stress cases, executed the benchmark, inspected failed trajectories, grouped recurring errors, proposed bounded changes, reran candidates, and assembled the technical report.

Humans remained responsible for the boundaries that should remain human: access to protected systems, ground-truth approval, interpretation of business risk, and authorization of public claims. Resemble did not need to disclose its internal models or customer information for Optimus to build a useful evaluation system around them.

The division of work matters because the benchmark was not a static dataset handed to an engineer. Optimus created the benchmark, broke the system with it, and used the resulting evidence to improve the system. The benchmark and the hardening process evolved together while the frozen evaluation generations preserved a valid comparison.

What Resemble retained

Resemble retained a difficult benchmark, repeatable evaluation pipelines, and a clearer model of the detector-agent handoff. New model revisions can be tested against the same recovery and regression contract. New failure cases can be added with their origin and transformation history intact. A future change that fixes one category while damaging authentic controls will appear in the record before it reaches a deployment decision.

The same structure applies to document intake, trust and safety, claims review, and marketplace media screening. The benchmark does not encode each customer's policy. It tests the shared technical question underneath those workflows: can an investigative agent recover detector failures while showing restraint around correct calls?

Reading the result correctly

This study supports a transformation-robustness claim. It does not estimate production accuracy or a customer false-positive rate. The authentic controls and document coverage are intentionally bounded, and repeated work on known failures can overfit to the frozen challenge.

The next scientific step is a complete rerun of the final configuration, followed by a fresh evaluation window with unseen generators, broader authentic media, and additional document coverage. That limitation is part of the case study because it identifies exactly what the current evidence can support.

The public account omits customer data, internal thresholds, prompts, model routing details, and case-level outputs. None of those details are needed to show the contribution. Optimus built a benchmark capable of breaking the system, made the evaluation reliable enough to trust, and used the failures to produce a more capable detection agent.