Provenance, Content Credentials & Trust Standards

What provenance actually proves

A Content Credential (C2PA) is a cryptographically signed manifest: a record of who or what created a file, when, with what device or tool, and what edits were subsequently applied, each signed by the tool that made the claim. When present and the signature chain verifies against the issuing authority's certificate, it proves the claim was made by that specific tool and has not been altered since signing.

AI watermarking (the most widely deployed example is Google DeepMind's SynthID) works differently: instead of an attached record, it embeds an imperceptible signal directly into the generated pixels themselves at the moment of generation, designed to survive common transformations like cropping, recompression, or format conversion.

Both mechanisms prove participation, not truth. A signed C2PA manifest proves the signing tool made a specific assertion — it does not independently verify that the assertion is accurate, only that it was made by an identifiable, authenticated source and hasn't been tampered with since.

What provenance cannot prove

Provenance signals cannot prove authenticity for content that never had them attached, cannot be retroactively added to existing files, and cannot survive every real-world processing pipeline.

• A missing signal is not evidence of manipulation or AI generation — most content simply never had one attached
• Both C2PA and SynthID only work when the originating tool participates in that specific standard; a non-participating camera, editor, or generator produces no signal at all, regardless of how the content was made
• C2PA manifests can be stripped by platforms and pipelines that don't preserve embedded metadata — social media re-uploads, screenshots, and many messaging apps routinely remove it
• A cryptographic signature proves who signed the claim, not that the claim describes reality — a compromised or malicious signing key could still produce a validly-signed false claim, though this requires access most attackers don't have
• Neither standard evaluates contextual truth: whether a genuine, unaltered photo is captioned accurately or used in the correct time and place is outside what either mechanism checks

Why metadata and provenance signals disappear

The overwhelming majority of images in circulation carry no provenance signal, for ordinary, non-suspicious reasons rather than intentional evasion.

• The capturing device or generating model predates the standard, or the manufacturer hasn't implemented it
• Upload pipelines re-encode files and drop embedded metadata as a routine, non-malicious side effect of processing (thumbnail generation, format conversion, compression)
• Screenshots and screen recordings capture only the rendered pixels, not any metadata the original file carried
• Messaging apps and some social platforms strip metadata by default, partly for user-privacy reasons (metadata can contain GPS coordinates and device identifiers)

When AI detection is still required

Because provenance and watermarking are opt-in and easily lost in transit, most images a person actually needs to evaluate — a photo from an unfamiliar source, an image already stripped of metadata by the platform it was posted on, output from a generator that doesn't embed a watermark — carry no verifiable provenance signal at all. General-purpose AI detection exists specifically for this majority case: it estimates the probability that an image was AI-generated or manipulated from the visual and technical evidence available in the file itself, without depending on any tool having opted into a standard.

How provenance and detection complement each other

The two approaches answer different questions and are strongest used together, not as substitutes for each other.

• When a verifiable Content Credential is present: it establishes a documented chain of custody from capture through editing — the strongest available evidence type, when it exists
• When no provenance signal is present (the common case): AI detection, metadata review, and manipulation analysis become the primary available evidence
• The two can also be checked together even when a signal is present — a valid C2PA manifest can coexist with AI-generated content, since some generators now sign their own outputs; detection and provenance are checking different things, not competing for the same answer

Limitations, stated directly

Limitations of C2PA: adoption is still a minority of total image volume in circulation; the standard depends on every tool in a content's history choosing to participate and preserve the chain; stripped or absent credentials are the common case, not the exception.

Limitations of AI watermarking: only identifies output from generators that implement the specific watermarking scheme; provides no signal at all for non-participating generators, edited composites, or older generation methods; robustness against adversarial removal is an active, unsettled research question, not a solved problem.

Limitations of metadata generally: easily stripped, inconsistently preserved across platforms, and — even when present and unmodified — describes the file's technical history, not whether its content or context is being represented truthfully.

If an image has a valid C2PA credential, does that mean it's authentic?

It means the signing tool made a specific, verifiable claim about the file's origin and edit history, and that claim hasn't been altered since signing. It does not independently verify that the claim is accurate, and it says nothing about whether the image is being used in an accurate context.

Does a missing provenance signal mean an image was AI-generated or manipulated?

No. Most images in circulation never had a provenance signal attached in the first place, or had it stripped during upload — a missing signal is the common case and is not, on its own, evidence of anything.

Can C2PA credentials or SynthID watermarks be faked?

The cryptographic signature behind a C2PA credential cannot be forged without the signer's private key, but a credential can be stripped from a file entirely (losing the manifest, not forging it). SynthID watermark robustness against deliberate removal is an active area of research, not a guarantee.

Why doesn't PhotoProof AI rely only on Content Credentials or watermarking?

Because most images encountered in practice carry neither signal. PhotoProof AI's own metadata review layer checks for available provenance signals as one input among several — see the Methodology page — but does not depend on any single provenance standard being present, since that would leave the majority of real-world images with no evaluation at all.