C2PA vs AI Detection: Why Content Credentials Are Not Enough

Camera makers have started signing photographs at the sensor. The idea behind it is clean: if a cryptographic record of origin travels inside the file from the moment of capture, “is this photo real” becomes a question you can answer by reading the file rather than squinting at it. Content credentials, built on the C2PA standard, are the most serious attempt anyone has made at restoring photographic evidence as evidence.

Then the photo gets posted to a social platform, and the record is gone.

This is not a flaw in the cryptography. It is a mismatch between how provenance is designed to work and how images actually move across the internet. Understanding that gap is the difference between knowing what content credentials give you and expecting something they were never built to deliver.

What content credentials actually promise

A C2PA manifest is a signed statement bound to the content of a file. When a camera or an AI tool creates an image, it writes a record of the device, the software, the time, and any declared AI involvement, then signs that record with a certificate. Every subsequent edit in a supporting application appends a new signed layer, so the manifest reads as a chain rather than a single stamp.

The promise is narrow and worth stating precisely. A valid manifest proves that a particular device or piece of software produced this exact sequence of pixels, and that the record has not been altered since. That is a real guarantee, and before C2PA there was nothing like it.

What it does not promise is that the picture is true. The signature covers the file, not the world in front of the lens. A phone that photographs a monitor displaying a deepfake produces a perfectly valid, correctly signed image of a fake. The chain of custody is intact; the content is still a lie.

Where the chain breaks

The manifest lives inside the file’s metadata container. Metadata is the first thing the internet throws away.

Platforms re-encode uploads to save bandwidth and normalise formats. Messaging apps compress aggressively before delivery. A screenshot does not copy a file at all, it rasterises what is on screen into a new one. Each of these is routine, none of them is malicious, and every one of them ends the chain.

The pattern is that credentials survive controlled, cooperative handling and disappear the moment an image enters ordinary circulation. Which is exactly where verification matters most. Nobody needs to check the provenance of a photo they took themselves ten seconds ago. They need to check the one that arrived in a group chat with no source and a confident caption.

The absence problem

Here is the failure mode that makes stripping worse than it first appears.

If credentials became a reliable marker of authenticity, their absence would start to read as suspicion. That inference is wrong today and will stay wrong for years. Almost nothing online carries a manifest: older cameras, scanned documents, screenshots, any image that has been through a messaging app, the entire archive of everything published before the standard shipped. Absence is the default state of the internet.

The risk cuts both ways, and it has a name. The liar’s dividend describes what happens when a genuine but inconvenient image can be dismissed because verification is now expected. “No credentials, so who knows” is a cheap way to discard real evidence. A verification culture built on provenance alone hands that move to anyone who wants it.

What the pixels still hold

When the metadata is gone, the image itself is what remains, and generated images are not statistically identical to photographed ones. They carry traces of how they were made.

Diffusion and GAN models synthesise images through repeated operations that leave structure in the frequency domain: periodic patterns and spectral regularities that a camera sensor does not produce. Frequency analysis looks for that fingerprint. Compression degrades it but does not always erase it, because the artefacts are a property of the generation process rather than of the file format.

Error Level Analysis works on a different principle, mapping where compression is inconsistent across an image in a way that can expose splices and local edits. It is noisier on re-encoded files, which is precisely why it should never be read alone.

A trained model score evaluates the whole image against learned patterns of generated content, and a face-swap check looks for the specific geometry of a substituted face. None of these needs a manifest. None of them cares which platform the image passed through.

The honest caveat is that these signals weaken as an image is compressed and re-compressed. A screenshot of a screenshot is a poor forensic input. But weakened evidence about the actual pixels beats a categorical “no data” from a metadata reader that has nothing left to read. We have written separately about why detection has to be signal-based rather than metadata-based.

Two questions, two tools

Setting them side by side makes the division of labour obvious.

Read the failure rows together. Provenance fails on stripped metadata; detection fails on extreme compression. They do not fail in the same conditions, which is the entire argument for running both.

How to use them in practice

The workable habit is to check provenance first, because when it is present it is the stronger evidence, then fall through to the pixels when it is not.

1. Look for credentials. Run the file through a C2PA checker. If a valid manifest is attached, you have a verified device, a timestamp and an edit history. Read what it actually claims rather than treating a green tick as a verdict on the scene.
2. If the manifest is invalid, take it seriously. A present-but-broken signature is a different situation from no signature at all. Something modified the file after signing.
3. If there are no credentials, expect that. Move to pixel analysis rather than drawing a conclusion from the absence.
4. Use the best copy you can obtain. Every re-compression costs you signal. Ask for the original file before settling for a screenshot, the same discipline that applies to checking a forwarded photo.
5. Read across layers, not from one number. A single moderate signal on a heavily compressed image means little. Several independent layers pointing the same direction means considerably more.
6. Keep provenance and truth separate. Signed origin is not accuracy. Whether the caption describes what the picture shows is an editorial question no cryptography answers.

Where this is heading

Sensor-level signing is a genuine improvement and adoption is climbing. The bottleneck is not capture, it is distribution: credentials will only mean much when platforms consistently preserve and display them, and that transition is measured in years rather than quarters. Even at full adoption, the archive of unsigned images already online never gets retrofitted.

So the realistic end state is layered. Provenance carries the images created and handled inside cooperating systems. Detection carries everything else, which will remain the larger share for a long time. Anyone building a verification workflow on one of the two is choosing which half of the problem to be blind to.

FAQ

Does C2PA survive being posted to social media?

Usually not. Most platforms re-encode uploads and discard the metadata container holding the manifest. A correctly signed photo typically reaches viewers with no credentials. A few platforms preserve them, but that is still the exception.

If an image has no C2PA credentials, does that mean it is fake?

No. Nearly every image online lacks a manifest, including genuine photographs, screenshots and anything sent through a messaging app. Absence is the default, not a signal.

What is the difference between provenance and detection?

Provenance verifies where a file came from using a signed record supplied by the creator. Detection analyses the pixels for statistical traces of AI generation. Provenance needs the chain intact; detection works on whatever pixels remain.

Can a C2PA manifest be faked?

Forging the signature is hard. The weak point is what the signature covers: it attests that a device produced this file, not that the scene was real. A signed photograph of a screen showing a deepfake is validly signed and still false.

Should I trust an image more because it has valid content credentials?

Somewhat. Valid credentials tell you which device produced the file and what edits followed, which is real information. They are not a truth claim about the scene, and checking the pixels still adds value when the stakes are high.