{"course":{"slug":"image-editing","title":"Editing an Image","url":"https://addaly.com/learn/image-editing","level":"beginner","track":"create"},"lesson":{"slug":"provenance-watermarks-and-c2pa","title":"What can be proved about where an image came from","url":"https://addaly.com/learn/image-editing/provenance-watermarks-and-c2pa","position":66,"of":78,"minutes":8,"answer":"C2PA signs a chain of edits rather than certifying truth, invisible watermarks live in the pixels but only for vendors that apply them, and AI-detection services are too unreliable to accuse or defend anyone with.","keyIdea":"C2PA signs a chain of edits rather than certifying truth, invisible watermarks live in the pixels but only for vendors that apply them, and AI-detection services are too unreliable to accuse or defend anyone with, so the strongest provenance a working editor has is the kept original plus a written delivery note."},"body":{"format":"markdown","text":"## Three different mechanisms, often confused\n\n**Metadata provenance**: a record attached to the file saying what was done to it. C2PA and Content Credentials are this.\n\n**Invisible watermarking**: a signal embedded in the pixels themselves, designed to survive editing and re-encoding. Google's SynthID is this.\n\n**Detection**: analysing an image and guessing whether it was generated. This is the least reliable of the three.\n\nThey answer different questions and have different failure modes.\n\n## C2PA and Content Credentials\n\nThe Coalition for Content Provenance and Authenticity publishes an open specification for a **cryptographically signed manifest** attached to an image. The manifest records the capture device or software, what edits were applied and by which tool, and whether generative tools were used. Each step signs the previous, producing a chain.\n\nWhat it provides: if the chain is intact and the signatures verify against a trusted issuer, you have a strong record of what the file went through. Some cameras now sign at capture. Adobe's applications write Content Credentials. Several generative services attach a manifest stating the image was AI-generated.\n\nWhat it does not provide:\n\n- **It proves the chain, not the truth.** A signed manifest on a photograph of a staged scene certifies that the camera recorded it, not that anything in front of the camera was real.\n- **Absence proves nothing.** Almost no images have credentials. A file without a manifest is the overwhelming default, not a suspicious anomaly.\n- **Metadata is trivially removed.** Stripping it is one command. It is not tamper-*proof*, it is tamper-*evident*: you can tell the chain was broken, and you cannot stop it being broken.\n- **Platforms strip it.** Most social platforms re-encode uploads and discard metadata, which removes credentials along with EXIF. Some now preserve or display them; most do not.\n- **A screenshot destroys it entirely**, and a screenshot is indistinguishable from a photograph of a screen.\n\nThe standard is worth supporting and it is not an authenticity guarantee. Treat a valid manifest as evidence, an absent one as no evidence either way, and a broken one as a reason to ask questions.\n\n## Invisible watermarking\n\nA pixel-level signal, imperceptible to a viewer, that a matching detector can recover. Google's SynthID is applied to images generated by several of its models and is designed to survive cropping, re-encoding, filtering and moderate resizing.\n\nStronger than metadata, because it is in the image rather than attached to it. Still not absolute: heavy editing, large crops, severe compression, screenshotting through a display, and deliberate adversarial processing all degrade or remove the signal, and detection requires the corresponding detector, which is not universally available.\n\nAnd it is per-vendor. An image from a model that does not watermark carries no mark, which again means absence proves nothing.\n\n## Detection tools\n\nServices claiming to tell you whether an image is AI-generated are the weakest of the three, and it is important to be blunt about this because they are widely cited.\n\nThey work by learning artefacts of particular generators, so they degrade as generators change, they produce false positives on heavily processed real photographs, and they produce false negatives on generated images that have been edited or re-encoded. Published evaluations repeatedly find accuracy well below what the marketing claims, and the error rates are not uniform across image types.\n\nA detector's output is a weak signal, not a finding. Do not accuse anyone on the strength of one, and do not defend yourself with one.\n\n## Visible watermarks, for a different purpose\n\nThese are about attribution and unauthorised use, not provenance.\n\n- A visible mark deters casual reuse and is removable with the tools in this course, increasingly easily.\n- Place it **over the subject**, not in a corner, if deterrence is the point: a corner mark crops off.\n- Low opacity over a busy area is harder to remove than a solid mark on a plain background.\n- For client proofs, a large diagonal mark across the whole frame is normal and expected.\n\nThe honest assessment: a visible watermark stops opportunistic reuse and does not stop anyone determined. Its main practical value for a working photographer is attribution: people who see the image know whose it is.\n\n## What a working editor should actually do\n\n- **Keep your originals.** The single most useful provenance you can have is the untouched camera file with its EXIF, stored somewhere you can find it. In any dispute about what you did, that plus your layered working file is far stronger evidence than any standard.\n- **Write a delivery note** saying what was done. One line. This has come up in every module of this course because it is the cheapest form of provenance and the most widely useful.\n- **Fill IPTC creator and copyright fields** on delivered files. They will often be stripped, and they cost nothing and sometimes survive.\n- **Enable Content Credentials** where your tools support it. It costs nothing and it contributes to a standard that becomes useful as adoption grows.\n- **Do not rely on any of this to protect you.** The protection is the contract, the record and the relationship.\n\n## The unsettled part\n\nWhether any of this should be mandatory, and in what form, is being legislated differently in different places and the requirements are moving. Several jurisdictions have introduced or proposed obligations to label synthetically generated content; the definitions, the thresholds and the penalties differ, and some are being challenged.\n\nThere is no single rule to give you, and anyone who states one confidently is describing one jurisdiction. What is stable enough to act on: keep originals, disclose generative work in writing, and do not represent generated content as a record of something that happened. Those satisfy the spirit of every rule proposed so far, and they were good practice before any of them existed."},"check":{"question":"A client receives a photograph with no Content Credentials attached and asks whether this means it was manipulated. What is the correct answer?","options":[{"text":"Yes, since credentials are written automatically by editing software and their absence indicates they were deliberately stripped.","correct":false,"tempting":"Assumes universal adoption: most cameras and most editors write no manifest at all, so absence is the ordinary case rather than evidence of removal."},{"text":"No, because almost no images carry credentials and platforms routinely strip metadata, so absence is the default and carries no information.","correct":true},{"text":"It cannot be determined without running an AI-detection service on the file, which would settle the question.","correct":false,"tempting":"Defers to a tool whose published accuracy is too low and too variable to settle anything, producing both false positives on processed photographs and false negatives on edited generations."},{"text":"No, because credentials only record generative edits, so an image edited conventionally would never carry one anyway.","correct":false,"tempting":"Describes a narrower scope than the specification has: a manifest records capture and conventional editing steps as well as generative ones."}]},"prev":{"slug":"running-these-models-free","title":"On your own machine, with no graphics card","url":"https://addaly.com/learn/image-editing/running-these-models-free"},"next":{"slug":"when-not-to-use-any-of-it","title":"The decision, and the parts nobody has settled","url":"https://addaly.com/learn/image-editing/when-not-to-use-any-of-it"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What can be proved about where an image came from', in Editing an Image. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/image-editing/provenance-watermarks-and-c2pa (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What can be proved about where an image came from","courseTitle":"Editing an Image","module":{"index":7,"slug":"ai-inside-the-image-editor","title":"AI inside the image editor"},"answer":null,"keyIdea":"C2PA signs a chain of edits rather than certifying truth, invisible watermarks live in the pixels but only for vendors that apply them, and AI-detection services are too unreliable to accuse or defend anyone with, so the strongest provenance a working editor has is the kept original plus a written delivery note.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"three-different-mechanisms-often-confused","runs":[{"text":"Three different mechanisms, often confused"}]},{"t":"p","runs":[{"text":"Metadata provenance","b":true},{"text":": a record attached to the file saying what was done to it. C2PA and Content Credentials are this."}]},{"t":"p","runs":[{"text":"Invisible watermarking","b":true},{"text":": a signal embedded in the pixels themselves, designed to survive editing and re-encoding. Google’s SynthID is this."}]},{"t":"p","runs":[{"text":"Detection","b":true},{"text":": analysing an image and guessing whether it was generated. This is the least reliable of the three."}]},{"t":"p","runs":[{"text":"They answer different questions and have different failure modes."}]},{"t":"h2","id":"c2pa-and-content-credentials","runs":[{"text":"C2PA and Content Credentials"}]},{"t":"p","runs":[{"text":"The Coalition for Content Provenance and Authenticity publishes an open specification for a "},{"text":"cryptographically signed manifest","b":true},{"text":" attached to an image. The manifest records the capture device or software, what edits were applied and by which tool, and whether generative tools were used. Each step signs the previous, producing a chain."}]},{"t":"p","runs":[{"text":"What it provides: if the chain is intact and the signatures verify against a trusted issuer, you have a strong record of what the file went through. Some cameras now sign at capture. Adobe’s applications write Content Credentials. Several generative services attach a manifest stating the image was AI-generated."}]},{"t":"p","runs":[{"text":"What it does not provide:"}]},{"t":"ul","items":[[{"text":"It proves the chain, not the truth.","b":true},{"text":" A signed manifest on a photograph of a staged scene certifies that the camera recorded it, not that anything in front of the camera was real."}],[{"text":"Absence proves nothing.","b":true},{"text":" Almost no images have credentials. A file without a manifest is the overwhelming default, not a suspicious anomaly."}],[{"text":"Metadata is trivially removed.","b":true},{"text":" Stripping it is one command. It is not tamper-"},{"text":"proof","i":true},{"text":", it is tamper-"},{"text":"evident","i":true},{"text":": you can tell the chain was broken, and you cannot stop it being broken."}],[{"text":"Platforms strip it.","b":true},{"text":" Most social platforms re-encode uploads and discard metadata, which removes credentials along with EXIF. Some now preserve or display them; most do not."}],[{"text":"A screenshot destroys it entirely","b":true},{"text":", and a screenshot is indistinguishable from a photograph of a screen."}]]},{"t":"p","runs":[{"text":"The standard is worth supporting and it is not an authenticity guarantee. Treat a valid manifest as evidence, an absent one as no evidence either way, and a broken one as a reason to ask questions."}]},{"t":"h2","id":"invisible-watermarking","runs":[{"text":"Invisible watermarking"}]},{"t":"p","runs":[{"text":"A pixel-level signal, imperceptible to a viewer, that a matching detector can recover. Google’s SynthID is applied to images generated by several of its models and is designed to survive cropping, re-encoding, filtering and moderate resizing."}]},{"t":"p","runs":[{"text":"Stronger than metadata, because it is in the image rather than attached to it. Still not absolute: heavy editing, large crops, severe compression, screenshotting through a display, and deliberate adversarial processing all degrade or remove the signal, and detection requires the corresponding detector, which is not universally available."}]},{"t":"p","runs":[{"text":"And it is per-vendor. An image from a model that does not watermark carries no mark, which again means absence proves nothing."}]},{"t":"h2","id":"detection-tools","runs":[{"text":"Detection tools"}]},{"t":"p","runs":[{"text":"Services claiming to tell you whether an image is AI-generated are the weakest of the three, and it is important to be blunt about this because they are widely cited."}]},{"t":"p","runs":[{"text":"They work by learning artefacts of particular generators, so they degrade as generators change, they produce false positives on heavily processed real photographs, and they produce false negatives on generated images that have been edited or re-encoded. Published evaluations repeatedly find accuracy well below what the marketing claims, and the error rates are not uniform across image types."}]},{"t":"p","runs":[{"text":"A detector’s output is a weak signal, not a finding. Do not accuse anyone on the strength of one, and do not defend yourself with one."}]},{"t":"h2","id":"visible-watermarks-for-a-different-purpose","runs":[{"text":"Visible watermarks, for a different purpose"}]},{"t":"p","runs":[{"text":"These are about attribution and unauthorised use, not provenance."}]},{"t":"ul","items":[[{"text":"A visible mark deters casual reuse and is removable with the tools in this course, increasingly easily."}],[{"text":"Place it "},{"text":"over the subject","b":true},{"text":", not in a corner, if deterrence is the point: a corner mark crops off."}],[{"text":"Low opacity over a busy area is harder to remove than a solid mark on a plain background."}],[{"text":"For client proofs, a large diagonal mark across the whole frame is normal and expected."}]]},{"t":"p","runs":[{"text":"The honest assessment: a visible watermark stops opportunistic reuse and does not stop anyone determined. Its main practical value for a working photographer is attribution: people who see the image know whose it is."}]},{"t":"h2","id":"what-a-working-editor-should-actually-do","runs":[{"text":"What a working editor should actually do"}]},{"t":"ul","items":[[{"text":"Keep your originals.","b":true},{"text":" The single most useful provenance you can have is the untouched camera file with its EXIF, stored somewhere you can find it. In any dispute about what you did, that plus your layered working file is far stronger evidence than any standard."}],[{"text":"Write a delivery note","b":true},{"text":" saying what was done. One line. This has come up in every module of this course because it is the cheapest form of provenance and the most widely useful."}],[{"text":"Fill IPTC creator and copyright fields","b":true},{"text":" on delivered files. They will often be stripped, and they cost nothing and sometimes survive."}],[{"text":"Enable Content Credentials","b":true},{"text":" where your tools support it. It costs nothing and it contributes to a standard that becomes useful as adoption grows."}],[{"text":"Do not rely on any of this to protect you.","b":true},{"text":" The protection is the contract, the record and the relationship."}]]},{"t":"h2","id":"the-unsettled-part","runs":[{"text":"The unsettled part"}]},{"t":"p","runs":[{"text":"Whether any of this should be mandatory, and in what form, is being legislated differently in different places and the requirements are moving. Several jurisdictions have introduced or proposed obligations to label synthetically generated content; the definitions, the thresholds and the penalties differ, and some are being challenged."}]},{"t":"p","runs":[{"text":"There is no single rule to give you, and anyone who states one confidently is describing one jurisdiction. What is stable enough to act on: keep originals, disclose generative work in writing, and do not represent generated content as a record of something that happened. Those satisfy the spirit of every rule proposed so far, and they were good practice before any of them existed."}]}],"check":{"question":[{"text":"A client receives a photograph with no Content Credentials attached and asks whether this means it was manipulated. What is the correct answer?"}],"options":[{"text":[{"text":"Yes, since credentials are written automatically by editing software and their absence indicates they were deliberately stripped."}],"correct":false,"tempting":[{"text":"Assumes universal adoption: most cameras and most editors write no manifest at all, so absence is the ordinary case rather than evidence of removal."}]},{"text":[{"text":"No, because almost no images carry credentials and platforms routinely strip metadata, so absence is the default and carries no information."}],"correct":true,"tempting":null},{"text":[{"text":"It cannot be determined without running an AI-detection service on the file, which would settle the question."}],"correct":false,"tempting":[{"text":"Defers to a tool whose published accuracy is too low and too variable to settle anything, producing both false positives on processed photographs and false negatives on edited generations."}]},{"text":[{"text":"No, because credentials only record generative edits, so an image edited conventionally would never carry one anyway."}],"correct":false,"tempting":[{"text":"Describes a narrower scope than the specification has: a manifest records capture and conventional editing steps as well as generative ones."}]}],"order":[3,2,1,0],"why":null},"prev":{"slug":"running-these-models-free","title":"On your own machine, with no graphics card","minutes":9},"next":{"slug":"when-not-to-use-any-of-it","title":"The decision, and the parts nobody has settled","minutes":9}}}