Models can locate ordinary photos, and edits can mislead them
In plain words
A photo can reveal where it was taken even when it has no location tag or famous landmark. This paper introduces GeoTrace, which has an image-reading model list visible clues first, then use web searches to narrow down a possible place.
The authors also introduce GeoShift, which edits a few clues to point toward a different place while keeping the wider scene. On their photo test, it reduced one-kilometer location guesses by GPT-5-mini from 16.95% to 2.48%. Some images could still be located closely.
The research
A photo may disclose where it was taken even without a location tag or a famous landmark. It remains unclear whether models can combine ordinary scene clues to find a place, and whether editing a few clues can reduce that risk while keeping the rest of the image recognizable.
GeoTrace separates visual-clue listing from web-grounded geographic search, while GeoShift edits selected clues to redirect location guesses before sharing.
GeoTrace first has a model list clues, then uses web search to narrow a location. With GPT-5-mini on the authors’ 525-photo test, 16.95% of images were placed within one kilometer, versus 7.62% with direct prompting. That comparison shows structured clue search improved close localization in this setting.
The authors use those clues to design GeoShift, which edits selected details toward a compatible false location.
With GPT-5-mini as attacker, one-kilometer localization fell from 16.95% without defense to 2.48% after Gemini-3-Flash-based GeoShift, supporting reduced close-location leakage in this test.
These results come from one 525-image outdoor-photo benchmark and the reported models. GeoShift reduced close localization in those tests, but adaptive attacks recovered some successes, and the authors found images that remained precisely localizable.
Analysis
Deep
- Original paper authors
- Shanghao Shi, Jian Xiao, Hao Li, Yuanhaur Chang, Yevgeniy Vorobeychik
- Submitted to arXiv
- License
- CC BY 4.0