What are C2PA Content Credentials and AI watermarks?

Four layers of AI labeling

AI content can be labeled in several independent ways. They solve different problems, and most serious systems use more than one.

China's labeling measures, in force since 2025-09-01, name two of these directly: explicit labels that people can see or hear, and implicit labels in file metadata, with digital watermarks encouraged. The EU AI Act's Article 50 similarly requires generative AI providers to mark synthetic output in a machine-readable, detectable way.

How a C2PA manifest works

C2PA (Coalition for Content Provenance and Authenticity) publishes an open technical specification. The consumer name for its data is Content Credentials. A manifest is built from three parts:

1. Assertions: statements about the file, such as the creating tool, the actions taken (created, cropped, color adjusted), a thumbnail, and ingredients (earlier files it was made from).
2. A claim: a list that points to those assertions, with hashes so none can be changed later.
3. A claim signature: a digital signature made with the signer's private key and identified by an X.509 certificate, the same kind of certificate system used by HTTPS.

The manifest also contains a hard binding: a cryptographic hash of the image or video data. If even one pixel changes after signing, the hash no longer matches and a validator reports that the content was altered. When a C2PA-aware editor makes a change, it adds a new manifest that lists the old one as an ingredient, which builds a chain of edits.

In common formats such as JPEG, PNG and MP4, manifests are stored in JUMBF boxes inside the file. A file can also carry only a link to a manifest stored elsewhere.

Content Credentials (simplified view)
  Signed by:     Example Camera Co. (certificate valid)
  Created with:  Example Image Generator
  Actions:       c2pa.created
    digitalSourceType: trainedAlgorithmicMedia
  Then:          c2pa.cropped, c2pa.color_adjustments (Example Editor)
  Ingredients:   1 earlier file
  Hash check:    content matches signature

The C2PA explainer is clear about the scope: provenance tells you where content came from and how it changed. It does not say whether the content is true. A signed photo of a staged scene is still staged.

IPTC digital source type: the AI field in metadata

The IPTC, the standards body for news media metadata, maintains a vocabulary called digital source type. The same terms are used in IPTC photo metadata and inside C2PA action assertions. The terms most relevant to AI are:

Platforms read these values to decide when to show labels such as "Made with AI" or "AI info". On its own, an IPTC field is not signed, so anyone can write or remove it. Inside a C2PA manifest the same value is covered by the signature.

Why stripping metadata removes the credentials

Metadata and embedded manifests live next to the image data, not in it. Anything that writes a new file from the pixels alone drops them:

• Taking a screenshot or screen recording.
• Uploading to a platform that re-encodes images and removes metadata for privacy or size.
• Converting format, for example PNG to JPEG, in a tool that does not copy metadata.
• Running a metadata remover, which is designed to delete EXIF, GPS, XMP and similar blocks.
• Copying and pasting an image between apps through the clipboard.

This is expected behavior, not a flaw in one tool. Removing location data before sharing a photo is good privacy practice; for example, cv.cm's EXIF tool strips EXIF and GPS data in the browser, and it will remove embedded credentials along with them. If you need to prove where an image came from, keep the original signed file and share it unchanged.

C2PA's answer is durable Content Credentials: combining the hard binding with a soft binding, meaning an invisible watermark or a perceptual fingerprint. A validator that finds the watermark or fingerprint can look up the original manifest in a manifest repository even after the file's metadata was removed.

Invisible watermarks such as SynthID

An invisible watermark changes the content itself in a way people do not notice but a detector can find. Google DeepMind's SynthID, for example, is described as covering images, video, audio and text. For images and video it is designed to survive cropping, filters, frame-rate changes and lossy compression; for audio, added noise, MP3 compression and speed changes. For text, it slightly adjusts the probabilities of the words the model chooses.

Important limits apply to every watermark of this kind:

• Only the matching detector can read it. A SynthID check says nothing about images from a model that uses a different watermark or none at all.
• Robust does not mean permanent. Heavy edits, regenerating the image with another model, or rewriting text can weaken or remove the signal.
• Text watermarks are weakest on short passages and on text that has been translated or paraphrased.
• A watermark shows that a cooperating provider generated or edited the content. It does not show which parts were changed or whether the scene is true.

Personal invisible watermarks are a different tool for a different job. A mark you hide in your own photo, for example with cv.cm's watermark tool, helps you show later that a copy came from your file. It is not an AI label and no platform reads it.

The limits of AI detection

No method can look at an arbitrary file and reliably say "AI" or "real". Keep these rules in mind:

1. A valid credential tells you who signed and what they declared. Trust depends on whether you trust that signer.
2. Missing credentials prove nothing. Most real photos online have none, because platforms strip them and most cameras do not sign.
3. A watermark found is strong evidence for that provider's model. No watermark found is weak evidence of anything.
4. Classifier-style AI detectors, which guess from visual or statistical patterns, have false positives and false negatives. Do not use them alone to accuse someone.
5. Combine signals: credentials, watermarks, the source account, the earliest upload, and ordinary checks such as reverse image search and looking for physical errors.

For creators, the practical rule is simple: keep your generator's original files with their credentials, add a visible label where your platform or law requires one, and do not try to remove AI marks from content you publish.