C2PA vs AI watermarking: what each tells you

Four signals, four different questions

An image arrives with an 'AI-generated' label. That label, an invisible watermark, a Content Credential and an AI detector result offer different evidence. Treating them as equivalent can turn a useful clue into an unsupported conclusion.

C2PA 2.4 describes signed provenance: recorded statements about a file's origin and changes, cryptographically associated with the content. It can describe AI and non-AI workflows. It does not inspect pixels and independently decide whether AI made them. [1] Encypher's provenance explainer introduces the signing, embedding and verification workflow. [5]

• Visible label: text or a badge communicates a claim to people. The visible mark alone does not establish cryptographic validity.
• Embedded watermark: a deliberate signal inside content, read by a compatible detector. SynthID embeds imperceptible signals in supported AI outputs. [2]
• Signed provenance: a C2PA manifest records statements and lets a verifier check their integrity, content association and signing credential. [1]
• Post-hoc classifier: a model estimates whether existing content resembles AI output, without requiring a deliberately inserted signal. Such classifications can be wrong. [4]

How watermarks and provenance work together

SynthID illustrates AI watermarking. Google DeepMind describes signals embedded in images, audio, video and text; its text method adjusts token probabilities during generation. Detection looks for that system's signal, rather than a universal property of everything made with AI. [2]

A C2PA manifest can supply richer context: recorded creation, editing and source material. C2PA also supports soft bindings, including watermarks and fingerprints, to help discover a credential when embedded metadata is missing. A watermark used for discovery and an AI-origin watermark need not carry the same information. [1]

Illustrative example: a publisher releases an AI illustration with a visible disclosure, a supported generation watermark and signed provenance recording its workflow. A reader can see the disclosure, check for the watermark and inspect the credential. Each answers a different question.

• Robustness depends on the system and transformation. Google warns that repeated alterations can prevent detection. [3]
• A recovered provenance record still needs validation; a lookup match alone is not a valid signature or an exact content match. [1]

What a missing signal means

No credential does not mean fake. C2PA is optional, metadata can be removed, and applications differ in what they can retrieve and display. No detected watermark does not mean human-made: the generator may use another system, or alterations may defeat detection. [1][3]

Classifier confidence is not proof. OpenAI withdrew its 2023 text classifier for low accuracy; that historical example does not measure every current detector. [4]

• Identify the tool, supported content types and what its result actually covers.
• Inspect available provenance details instead of relying on a badge alone.
• Seek the publisher's original file and corroborate the claim with independent reporting.
• Record unresolved gaps rather than translating 'not found' into 'authentic' or 'AI-free'.