Using Gemini to Spot Fake Cosmetics: A Multimodal LLM Case Study

A bioengineering professor bought three tubes of the same lip tint, photographed each one eighteen ways, and asked Google Gemini a simple question: is this real? The answer he got back is a near-perfect teaching case for how to actually use a multimodal model — and how it will lie to you with a straight face.

On August 26, 2026, Prof. William Grover of UC Riverside's Grover Lab published "Identifying fake cosmetics using artificial intelligence," a hands-on write-up of exactly that experiment. He is, by his own description, "generally negative about AI." He came away "cautiously optimistic." Both halves of that sentence matter.

The setup

Grover acquired three packages of Rhode Peptide Lip Tint:

• Package A — a $5 unit from eBay, suspected counterfeit.
• Package B — a second $5 eBay unit, suspected counterfeit.
• Package C — bought in person at Sephora for roughly $20, later confirmed genuine by also ordering direct from Rhode's own website and comparing.

For each package he took six photos: the four sides of the box plus the front and back of the tube. He uploaded all six at once to Gemini 3.6 Flash with "Thinking" enabled and asked, "Is [this] Lip Tint authentic?" — then followed up with "Are there any other red flags you can find?"

That is the whole method. No fine-tuning, no reference database, no special tooling. A general-purpose model, a multi-image prompt, and one follow-up question.

TL;DR — what happened

Where the model was genuinely impressive

On the two counterfeits, Gemini did work that a careful human expert with a loupe might do — in seconds, across a dozen images, from a phone camera.

Package A wins:

• Caught an OCR-artifact typo — "Diisosteary**!** Malate" — where an exclamation mark had been substituted for a lowercase L.
• Spotted that the EU Responsible Person printed on the box (BIORIUS) did not match the one on the tube (PWC Services). A genuine product has one.
• Flagged batch code 112505 as a known counterfeit marker.
• Noticed the Italian recycling label read "RACCOLTA PLASTIC" — missing the final A of "PLASTICA".
• Identified an invalid Dublin Eircode: "DO1" with a letter O, where the real code is "D01" with a zero.

Package B wins: an "Octyidodecanol" typo, "Made in italy" in lowercase, "LIMITED,STANLAW" with a missing space, the French "colorees" missing its accent, and irregular spacing in the key-ingredients block.

The common thread: Gemini's edge was cross-referencing many photos at once. It held the box text and the tube text in the same context and noticed they disagreed. That is a task humans are bad at and slow at, and it is exactly what a multimodal model with a long context window is good at. This is the same capability that shows up in structured vision-language benchmarks — reading fine text off real-world objects and reasoning over it — and it is a real reason to reach for a multimodal model on document- and packaging-heavy problems.

Where it broke: photo artifacts

Most of Gemini's misses on the counterfeits were not reasoning errors. They were the model mistaking camera problems for manufacturing problems.

• It "read" the word SOLUTIONS as "SOLOTIONS" — that was lighting glare on the print.
• It claimed the box lacked border debossing. Authentic Rhode boxes do have it; the shadow just did not show it.
• On Package B it saw "Appli" (glare again), a "warped" Leaping Bunny logo that was actually fine, and "shrink wrap" that did not exist.

Grover's point is sharp: a human inspecting a package moves it. You tilt it against the light, you rotate it to kill a reflection, you look around a shadow. A fixed set of six stills gives the model none of that. His suggestion — feed it video instead, or at least many more angles under diffuse light — is the single most actionable takeaway for anyone doing real-world visual inspection with these models.

The expensive failure: a confident wrong answer

Package C was real. Grover confirmed it twice. Gemini said it showed "definitive signs of being a counterfeit."

Its evidence: "typos" — "Svnthetic Fluorphlogopite" and "Ethylhexvl Palmitate", each with a v where a y should be, plus a stray accent in "TINTA LABBRÃ".

Here is the twist: those errors are real. They are printed on the packaging. But they are also printed on genuine Rhode packaging bought straight from the brand. The authentic manufacturer shipped typos. Gemini had learned, correctly, that counterfeits are full of typos — and then applied that rule in reverse, as if a typo proved a fake.

This is the failure mode that costs you. Not "the model was unsure," but "the model was wrong and used the word definitive." A confident, fluent falsehood is harder to catch than a hedge, because nothing in the output signals that you should double-check it. The only defense is to check anyway — against ground truth you establish independently, which is precisely what Grover did by ordering direct from Rhode.

The workflow lessons

Strip out the cosmetics and this is a compact manual for using multimodal LLMs on verification tasks.

1. Multi-image input is the unlock. The model's best catches all came from comparing photos to each other. If you have several views of one thing, put them all in one prompt so the model can cross-reference them — don't ask one image at a time.
2. Follow-up prompting surfaces more. "Are there any other red flags?" pulled out findings the first answer missed. One question is a first draft; a second pass is where the depth is.
3. Control the input, not just the prompt. Half the errors here were glare and shadow. Diffuse lighting, more angles, or video would have removed them. Garbage pixels in, garbage findings out.
4. Never let one signal decide. Gemini over-weighted typography until a single class of evidence overrode everything else. Ask the model to weigh multiple independent signals, and treat any verdict that rests on one as unproven.
5. Verify against ground truth you control. The model's confidence is not evidence. Establish an independent reference — a known-authentic unit, a primary record, a direct-from-source purchase — and check the model's specific claims against it, the same discipline that source verification and out-of-band confirmation require in adjacent domains.
6. Read the model's answer like a benchmark claim, not a fact. Two right and one badly wrong out of three is a 67% hit rate on a tiny sample — useful as a triage tool, useless as a final word.

Why physical provenance still wins

Grover's own research points to the durable fix. His CandyCodes work puts random, hard-to-replicate physical patterns — think edible glitter distributions — on individual pharmaceutical doses, so authenticity is a lookup against a manufacturer registry rather than a judgment call about print quality.

That is the same instinct behind C2PA Content Credentials for digital media: prove origin at the source instead of detecting fakes after the fact. Detection — whether a human squinting at a box or Gemini reading eighteen photos — is always a step behind the forger. And as commenters on the Hacker News thread noted, counterfeiters can run the same model against their own packaging to catch the typos before shipping. An adversary with API access closes the gap you just opened.

Provenance-at-source has its own hard problems — camera-signed credentials have already been forged — but it changes the game from "spot the flaw" to "verify the signature," which is a better game to be playing.

Bottom line

Gemini 3.6 Flash did something real: it found cross-photo discrepancies in seconds that a human would likely miss, using a general-purpose model and a two-line prompt. It also did something dangerous: it called a genuine product fake, with full confidence, based on evidence that did not support the conclusion.

Use multimodal models for this kind of work the way Grover did — as a fast, cheap first pass that generates leads. Then treat every lead as a hypothesis to test against a reference you trust, not a finding to act on. The model is the intern with a magnifying glass. You are still the one who signs off.

Related reading

• What is multimodal AI? A complete guide
• Why do AI models hallucinate? A practical guide
• AI search poisoning: when the "independent reviews" are all synthetic
• Deepfake fraud: inside the $25.6 million video call scam
• How to read AI benchmarks without fooling yourself
• AI benchmark claims: a fact-checking guide
• Roboflow's VLM benchmark: GPT-5.6 Sol vs Gemini 3.5 Flash
• What is C2PA? Content Credentials explained
• C2PA Android cameras broken: forged anyway

Source: William Grover, "Identifying fake cosmetics using artificial intelligence," Grover Lab, UC Riverside Bioengineering, August 26, 2026, and the associated Hacker News discussion. Figures and photographs referenced above are the author's own first-party research.

Model names, versions, and behavior described here are accurate as of August 29, 2026 and change frequently; Gemini's responses are non-deterministic and your results will differ. This article is for general education, not authentication, legal, or safety advice — for high-stakes purchases use the manufacturer's official verification channels.