Visual Feature Analysis
Detect landmarks, text, architecture, terrain, and other geographic signals, then estimate image difficulty.
Abstract
Images shared on social media often expose geographic cues. While early geolocation methods required expert effort and lacked generalization, large vision-language models now make location inference accessible to ordinary users. To explore the full potential and associated privacy risks, we present GEO-Detective, an agent that mimics human reasoning and tool use for image geolocation.
The agent follows a four-stage procedure that adaptively selects strategies based on image difficulty and uses specialized tools such as visual reverse search. GEO-Detective improves over baseline LVLMs, especially on images with sparse geographic features, and reduces “unknown” predictions by more than half when external clues are available. Our defense evaluation further shows that agentic geolocation remains difficult to suppress, highlighting the need for stronger location-privacy safeguards.
Method
GEO-Detective mirrors how a human investigator changes strategy as visible clues become weaker.
Strategy Execution
Select direct LVLM analysis, experience-augmented prompting, segmentation, or visual reverse search.
Results Synthesis
Compare similar images and web context, then combine the evidence into country, state, and city predictions.
Iterative Refinement
If results remain uncertain, change the strategy, add tools, and repeat within the available resource budget.
Key Results
The largest gains appear when images contain sparse or subtle geographic evidence.
Interactive comparison · o3
Accuracy by image difficulty
Accuracy (%)
MP16-Pro1,000-image test set
IM2GPS3K3,000 geotagged images
DoxBench500 recent images
LVLMso3 · GPT-4o · Gemini 2.5
From the paper
Selected quantitative results
Switch between benchmark performance and prediction uncertainty.
IM2GPS3K benchmarkGeolocation accuracy (%)
Table 2| Type | Method | @1 km | @25 km |
|---|---|---|---|
| Agent | GEO-Detective (Ours) | 11.3 | 47.5 |
| Agent | GeoMiner | 10.8 | 46.7 |
| Agent | smileGeo | 10.9 | 38.2 |
| LVLM | G3 | 16.6 | 40.9 |
| LVLM | Img2Loc | 15.3 | 39.8 |
| LVLM | GeoReasoner | 9.9 | 33.8 |
| Trained | PIGEON | 11.3 | 36.7 |
| Trained | GeoCLIP | 14.1 | 34.5 |
Takeaway: GEO-Detective achieves the best @25 km result among the evaluated agentic LVLM frameworks. G3 remains strongest at @1 km overall.
Unknown rate under o3Lower is better (%)
Table 3| Difficulty (n) | Baseline | GEO-Detective | Reduction |
|---|---|---|---|
| Easy (269) | 21.9 | 18.6 | −3.3 pp |
| Moderate (281) | 29.2 | 26.3 | −2.9 pp |
| Difficult (349) | 45.8 | 22.6 | −23.2 pp |
| Very Difficult (97) | 55.7 | 28.9 | −26.8 pp |
| Extremely Difficult (4)† | 75.0 | 50.0 | −25.0 pp |
Takeaway: the largest well-supported reductions occur on Difficult and Very Difficult images. †The Extremely Difficult subset has only four samples.
Privacy Defenses
A visible geolocation-prohibition watermark was the only tested defense that strongly suppressed agent outputs.
Watermark
Explicitly tells the model that geolocation is prohibited.
Visual Prompt Injection
Adds misleading geographic text to the image.
Trigger-based
Introduces a small visual intervention signal.
EXIF Modification
Changes metadata but leaves visible scene clues intact.
Takeaway: location-privacy safeguards must address visible scene content and agentic evidence gathering—not only metadata.
Poster
ECCV 2026 · Malmö, Sweden
BibTeX
@inproceedings{zhang2026geodetective,
title = {GEO-Detective: Unveiling Location Privacy Risks
in Images with LLM Agents},
author = {Zhang, Xinyu and Wu, Yixin and Zhang, Boyang and
Lin, Chenhao and Shen, Chao and Backes, Michael and Zhang, Yang},
booktitle = {European Conference on Computer Vision (ECCV)},
year = {2026},
url = {https://github.com/zxyreal/GEO-Detective}
}