C2PA, Content Credentials and SynthID Explained

You generate an image, inspect it with verification software, and confirm everything is in order. It carries a cryptographically signed manifest and an invisible watermark embedded in the pixels. Then you upload that file to Instagram, download it back to your desktop, and inspect it again.

The signed manifest is gone. The watermark survived.

Provenance is not a single switch you flip. As of September 2026, the systems designed to track AI-generated media split into two distinct mechanisms: signed metadata logbooks like C2PA (branded as Content Credentials) and invisible pixel-domain watermarks like Google DeepMind's SynthID. Conflating the two is the easiest way to misunderstand what survives your publishing pipeline.

Here is what we cover in this guide:

1. The three layers of AI trust: provenance, watermarks, and perceptual fingerprints.
2. How C2PA and Content Credentials work (updated for specification version 2.4).
3. How SynthID embeds invisible signals into pixels and text.
4. What frontier models actually attach today (GPT Image, Gemini, Recraft, and FLUX).
5. Our export and social platform survival test results.
6. The regulatory baseline: EU AI Act Article 50, California SB 942, and China's GB 45438-2025.
7. The hard limits: stripping, regeneration attacks, and mislabelling.

The three layers: provenance, watermarking, and fingerprinting

Most confusion starts by treating all provenance technologies as detection tools. DeepMind's own research team drew the boundary clearly in late 2025: provenance records who produced an asset, while detection tries to guess whether an unlabelled asset looks synthetic.

To navigate the tooling, keep three distinct technical layers in mind:

• Cryptographic provenance (C2PA / Content Credentials): A signed metadata package bound to the file. It asserts origin, tool history, and edits. It is verifiable and tamper-evident, but easily stripped whenever an image is re-encoded or compressed.
• Invisible watermarking (SynthID, Stable Signature): A subtle mathematical pattern embedded directly into the pixel values or language tokens during generation. It carries no cryptographic identity chain, but it survives casual re-compression and cropping.
• Perceptual fingerprinting (pHash, dHash): Post-hoc mathematical hashing that identifies visual similarities across a database. It requires no coordination at generation time, but it cannot verify origin without a pre-indexed registry.

Think of C2PA as a registered courier manifest taped to a cardboard box. If someone rips the paper off, the provenance is lost. SynthID is more like a microscopic thread woven into the cardboard itself. You can tear the paper off, but the thread remains embedded in the material.

The AI trust stack: signed metadata on top, pixel watermarks in the middle, and perceptual fingerprinting at the base.

What is C2PA and Content Credentials? (Specification 2.4)

The Coalition for Content Provenance and Authenticity (C2PA) is an open technical standards body founded by Adobe, Microsoft, the BBC, Intel, Arm, and Truepic. Content Credentials is the public-facing implementation (marked by the "cr" badge) led by the Content Authenticity Initiative.

A common mistake in current explainers is citing C2PA version 2.1 or 2.2. The current published standard is C2PA version 2.4, released in April 2026. This release introduced crJSON (a JSON-LD serialization format for manifest inspection), refined live-video provenance carried over from version 2.3, and standardized explicit assertions for AI-generated media.

Inside a C2PA implementation, the architecture moves through four building blocks:

• Assertions: Discrete statements of fact inside the metadata, such as an IPTC Digital Source Type tag, timestamp, or list of editing actions.
• Claims: The collection of assertions that a specific signing entity commits to.
• Claim signatures: An X.509 digital certificate signature that seals the claim. If even one pixel changes, the hash check fails.
• Manifest stores: The container holding the current manifest and references to previous ancestor files (called "ingredients").

C2PA supports two types of bindings. A hard binding computes a cryptographic hash (such as SHA-256) directly over the raw pixel byte stream. It guarantees that the pixels have not been touched by an untracked tool. A soft binding links the manifest to an algorithmically derived identifier or watermark, allowing validators to reconnect lost metadata if the file gets stripped.

Trust relies on a central Trust List of accredited certificate authorities. If a tool signs a manifest with an untrusted or self-signed certificate, validators flag the credentials as unverified.

How SynthID embeds invisible signals

Developed by Google DeepMind, SynthID approaches tracking from inside the media itself. Rather than appending a metadata header, it modifies the output at generation time.

For imagery and video, SynthID uses a paired deep-learning encoder and decoder. The encoder introduces subtle, imperceptible perturbations across visual frequency bands before the image is finalized. Because the encoder functions as a post-generation layer, Google can deploy the same watermarking network across different generation backbones without retraining the base generative models. When fed into the SynthID Decoder, the system calculates a probabilistic confidence score, returning a verdict of Watermarked, Uncertain, or Not watermarked.

According to Google's August 2026 system updates, SynthID has marked over 100 billion images and video clips since its introduction.

For text generation, SynthID-Text relies on tournament sampling. It subtly alters the probability distribution of generated tokens using a pseudorandom key. The text reads naturally to a human, but the decoder identifies the statistical signature across a passage of several sentences.

Metadata strips away during re-encoding, while pixel-domain watermarks remain embedded in the file.

What frontier models attach today

Frontier AI providers do not handle provenance uniformly. Because our hub routes prompts to multiple underlying engines, we regularly audit the baseline metadata and pixel watermarks attached across generation endpoints.

If you want to compare how these engines perform on raw visual rendering, read our breakdown of Nano Banana vs GPT Image vs Recraft.

OpenAI and Google now use a dual-layer approach on flagship endpoints: they attach a signed C2PA manifest for standard compliance and inject a SynthID watermark into the pixels to survive compression. Open-weight and self-hosted models, by contrast, leave provenance entirely to the user running the server.

Inside JammyJar, generation parameters, seed numbers, and prompt histories remain permanently catalogued within your team workspace, regardless of whether a downstream platform strips the external file headers during distribution.

The export and platform survival test

To measure what actually survives modern publishing pipelines, we generated test images across leading image models and routed them through common editing software, CDNs, and social media platforms. Every output was checked using c2patool, the Content Credentials Verify portal, ExifTool, and the SynthID verification API.

Here is what our testing found across destinations:

Three key realities stand out from the matrix:

First, social platforms treat provenance as an ingest check rather than a distribution feature. Platforms like TikTok read the C2PA manifest on upload to apply their internal "AI info" labels, but the public image served over their CDN has all metadata chunks stripped.

Second, almost every modern web build pipeline destroys C2PA by default. Standard optimization libraries like sharp and image pipelines in Next.js discard unknown metadata chunks to shave off kilobytes. Cloudflare Images is the notable exception among enterprise CDNs, offering an explicit setting to preserve and re-sign Content Credentials during dynamic resizing.

Third, vector files sit outside current provenance tooling. Generating an editable vector asset strips standard cryptographic wrapping because the SVG format does not yet have a universally adopted, conformant C2PA serialization standard in reference tools like c2patool.

Visible disclosure: the IPTC tag you should add

If you publish commercial creative work, you do not need to wait for social networks to fix their metadata pipelines. You can write machine-readable intent directly into your asset headers using IPTC Digital Source Type tags.

Defined by the International Press Telecommunications Council, this controlled vocabulary specifies two key properties:

• trainedAlgorithmicMedia: Use when an image was synthesized entirely by a generative model.
• compositeWithTrainedAlgorithmicMedia: Use when human photography or manual vector elements were combined with generative components.

These tags sit within standard XMP metadata packets. Search engines, stock platforms, and enterprise asset managers parse these fields during indexing without requiring complex cryptographic certificate validation.

For details on commercial licensing boundaries across these models, see our guide on whether you can use AI-generated images commercially.

The regulatory baseline: EU, California, and China

Provenance is no longer an optional industry experiment. Global regulators have turned machine-readable marking into law.

European Union: EU AI Act (Article 50)

Under Article 50(2) of the EU AI Act, providers of generative AI systems must ensure their outputs are marked in a machine-readable format and detectable as artificially generated. The final Transparency Code of Practice requires providers to deploy at least two machine-readable techniques, specifically pairing tamper-evident signed metadata with imperceptible watermarking.

Article 50 obligations took effect on 2 August 2026, with systems already on the market granted an extension to 2 December 2026 under the Digital Omnibus implementation schedule. Maximum non-compliance penalties reach €15 million or 3% of total worldwide annual turnover.

California: SB 942 (AI Transparency Act)

Operative from 2 August 2026 (following amendment by AB 853), California requires covered generative AI providers with over one million monthly users to provide free online detection tools and embed persistent latent disclosures into outputs. Fines are set at $5,000 per violation per day.

China: CAC Measures and GB 45438-2025

China's mandatory national standard GB 45438-2025 took effect on 1 September 2025. It enforces a two-tier regime: mandatory visible markers (such as corner labels or badges) and mandatory implicit markers (embedded file metadata and watermarks). Distribution platforms operating in the region are legally required to verify and preserve both signals.

The limits: removal, stripping, and mislabelling

Provenance tools are useful safeguards, but they are not silver bullets. A resilient pipeline accounts for three real failure modes.

1. Watermark removal attacks

Invisible watermarks are probabilistic, not unbreakable. In a 2025 peer-reviewed evaluation presented at IEEE S&P, researcher Andre Kassis demonstrated that the UnMarker attack achieved a 79% attack success rate against SynthID-marked images, reducing detection confidence from near 100% down to roughly 21%.

Furthermore, diffusion regeneration attacks (which pass an image through an image-to-image pipeline at low denoising strength) rinse out high-frequency watermark perturbations entirely while preserving visual composition. In text models, research on SynthID-Text shows that basic automated paraphrasing removes detectable watermarking in over 90% of samples.

Removal is not necessarily invisible to forensic teams. A 2026 study by Goonatilake and Ateniese showed that while regeneration attacks successfully fool the primary watermark verifier, forensic classifiers can still detect the structural perturbation remnants with high statistical confidence (AUROC ~0.999).

2. Manifest stripping and re-signing

C2PA's own Security Considerations documentation explicitly states that the specification offers no protection against complete manifest removal. Anyone can open an image in a basic editing utility, take a screenshot, or run a command-line script to drop the metadata payload.

Adversaries can also strip legitimate credentials and re-sign the image with a different certificate, asserting false authorship. C2PA confirms that an asset has not been modified since it was signed by a specific key; it cannot prove whether the entity holding that key told the truth.

3. Labelling false positives

Automated platform labelling has repeatedly caused collateral damage for human photographers. In mid-2024, Meta faced intense pushback when former White House photographer Pete Souza discovered that his 40-year-old photograph of the 1984 NBA Finals was automatically tagged with a "Made with AI" label after routine crop-and-repair adjustments in Adobe software.

Meta subsequently softened the badge copy from "Made with AI" to "AI info." The incident proved that when algorithms treat standard post-processing metadata as evidence of pure synthetic generation, user trust in verification labels erodes quickly.

A resilient publishing workflow verifies asset origin before passing files into distribution channels.

Practical checklist for creators and publishers

If you publish visual media in 2026, manage provenance with these steps:

• Preserve generation records internally: Keep source prompts, seed numbers, and model versions stored in a collaborative workspace rather than relying on image headers.
• Embed IPTC metadata on export: Set digitalSourceType to trainedAlgorithmicMedia in your asset management pipeline before handing files to clients.
• Configure your CDN: If you run Cloudflare Images, turn on Content Credentials preservation to re-sign resized assets. If you run sharp or custom pipelines, pass XMP metadata chunks explicitly through your build step.
• Add visible editorial disclosures: When publishing synthetic editorial visuals or photorealistic mockups on social networks, include clear in-caption disclosures. Assume every social network will strip your file metadata on upload.

Frequently asked questions

Does C2PA survive an Instagram upload?
No. Instagram strips all EXIF, XMP, and C2PA metadata from uploaded images during ingest compression. The public file served to viewers contains no cryptographic manifest, though Meta may use internal metadata checks to trigger an in-app "AI info" label.

Can SynthID watermarks be removed from AI images?
Yes. While SynthID survives standard cropping and compression, academic benchmarks show that universal removal tools (like UnMarker) and diffusion-based regeneration attacks can strip the watermark while keeping image quality intact.

What is the difference between C2PA and Content Credentials?
C2PA is the open technical standards organization and formal specification. Content Credentials is the consumer-facing brand identity and user interface icon (the "cr" pin) developed to display C2PA metadata across software platforms.

Do I legally have to disclose AI-generated images?
In the European Union and China, legal frameworks mandate machine-readable metadata and visible labelling for synthetic content reaching the public. In the United States, California's SB 942 enforces latent disclosures for major platforms, while general commercial use requires compliance with platform-specific terms.