What can be proved about where an image came from

Three different mechanisms, often confused

Metadata provenance: a record attached to the file saying what was done to it. C2PA and Content Credentials are this.

Invisible watermarking: a signal embedded in the pixels themselves, designed to survive editing and re-encoding. Google’s SynthID is this.

Detection: analysing an image and guessing whether it was generated. This is the least reliable of the three.

They answer different questions and have different failure modes.

C2PA and Content Credentials

The Coalition for Content Provenance and Authenticity publishes an open specification for a cryptographically signed manifest attached to an image. The manifest records the capture device or software, what edits were applied and by which tool, and whether generative tools were used. Each step signs the previous, producing a chain.

What it provides: if the chain is intact and the signatures verify against a trusted issuer, you have a strong record of what the file went through. Some cameras now sign at capture. Adobe’s applications write Content Credentials. Several generative services attach a manifest stating the image was AI-generated.

What it does not provide:

• It proves the chain, not the truth. A signed manifest on a photograph of a staged scene certifies that the camera recorded it, not that anything in front of the camera was real.
• Absence proves nothing. Almost no images have credentials. A file without a manifest is the overwhelming default, not a suspicious anomaly.
• Metadata is trivially removed. Stripping it is one command. It is not tamper-proof, it is tamper-evident: you can tell the chain was broken, and you cannot stop it being broken.
• Platforms strip it. Most social platforms re-encode uploads and discard metadata, which removes credentials along with EXIF. Some now preserve or display them; most do not.
• A screenshot destroys it entirely, and a screenshot is indistinguishable from a photograph of a screen.

The standard is worth supporting and it is not an authenticity guarantee. Treat a valid manifest as evidence, an absent one as no evidence either way, and a broken one as a reason to ask questions.

Invisible watermarking

A pixel-level signal, imperceptible to a viewer, that a matching detector can recover. Google’s SynthID is applied to images generated by several of its models and is designed to survive cropping, re-encoding, filtering and moderate resizing.

Stronger than metadata, because it is in the image rather than attached to it. Still not absolute: heavy editing, large crops, severe compression, screenshotting through a display, and deliberate adversarial processing all degrade or remove the signal, and detection requires the corresponding detector, which is not universally available.

And it is per-vendor. An image from a model that does not watermark carries no mark, which again means absence proves nothing.

Detection tools

Services claiming to tell you whether an image is AI-generated are the weakest of the three, and it is important to be blunt about this because they are widely cited.

They work by learning artefacts of particular generators, so they degrade as generators change, they produce false positives on heavily processed real photographs, and they produce false negatives on generated images that have been edited or re-encoded. Published evaluations repeatedly find accuracy well below what the marketing claims, and the error rates are not uniform across image types.

A detector’s output is a weak signal, not a finding. Do not accuse anyone on the strength of one, and do not defend yourself with one.

Visible watermarks, for a different purpose

These are about attribution and unauthorised use, not provenance.

• A visible mark deters casual reuse and is removable with the tools in this course, increasingly easily.
• Place it over the subject, not in a corner, if deterrence is the point: a corner mark crops off.
• Low opacity over a busy area is harder to remove than a solid mark on a plain background.
• For client proofs, a large diagonal mark across the whole frame is normal and expected.

The honest assessment: a visible watermark stops opportunistic reuse and does not stop anyone determined. Its main practical value for a working photographer is attribution: people who see the image know whose it is.

What a working editor should actually do

• Keep your originals. The single most useful provenance you can have is the untouched camera file with its EXIF, stored somewhere you can find it. In any dispute about what you did, that plus your layered working file is far stronger evidence than any standard.
• Write a delivery note saying what was done. One line. This has come up in every module of this course because it is the cheapest form of provenance and the most widely useful.
• Fill IPTC creator and copyright fields on delivered files. They will often be stripped, and they cost nothing and sometimes survive.
• Enable Content Credentials where your tools support it. It costs nothing and it contributes to a standard that becomes useful as adoption grows.
• Do not rely on any of this to protect you. The protection is the contract, the record and the relationship.

The unsettled part

Whether any of this should be mandatory, and in what form, is being legislated differently in different places and the requirements are moving. Several jurisdictions have introduced or proposed obligations to label synthetically generated content; the definitions, the thresholds and the penalties differ, and some are being challenged.

There is no single rule to give you, and anyone who states one confidently is describing one jurisdiction. What is stable enough to act on: keep originals, disclose generative work in writing, and do not represent generated content as a record of something that happened. Those satisfy the spirit of every rule proposed so far, and they were good practice before any of them existed.