AI provenance
How AI Image Metadata and Content Credentials Work
AI-related evidence can appear as ordinary metadata hints or as signed Content Credentials. These mechanisms answer different questions. A software name or prompt is a declaration that can be edited; a valid credential provides tamper-evident provenance for a particular asset and claim chain.
- Reviewed
- Reading time
- 10 minutes
Ordinary AI metadata ranges from strong to weak
A file might name generator software, store a prompt, include a model identifier, or declare a digital source type such as trained-algorithmic media. Standardized fields are easier to interpret consistently, while free-text software names and prompts are clues that can be copied or removed.
Some generation systems export no readable AI fields. Other signals, such as invisible watermarks, are not ordinary EXIF or XMP and require their own detector.
Content Credentials bind claims to an asset
C2PA Content Credentials package a signed claim, assertions, ingredient relationships, and validation information in a manifest. A credential can describe the tool or organization involved, actions performed, and a digital source type. Cryptographic validation checks whether the signed structure still matches the asset.
A valid signature is not the same as universal trust. The verifier must still consider who signed it, what was asserted, whether the signer is trusted for the context, and whether the claim describes the question being asked.
A representative credential report
A generated image may expose a compact provenance chain like this.
- Claim generator
- OpenAI Media Service API
- Signed by
- OpenAI Media Service
- Digital source type
- trainedAlgorithmicMedia
- Actions
- created, converted, exported
- Validation
- Signature and asset bindings valid
The exact names and actions depend on the issuer and export path. This example does not mean every image from that service contains a credential.
Why credentials disappear or fail validation
An editor, converter, compressor, messaging service, or screenshot workflow may omit the manifest. Pixel changes can also invalidate bindings unless the new workflow issues a new credential that records the edit and references the prior asset.
Absence means no supported credential was found; it does not establish human authorship. Invalid means validation failed, which is different from merely missing or unsupported.
Sources and further reading
- C2PA Content Credentials specification
Normative architecture for claims, assertions, manifests, signatures, and validation.
- IPTC Photo Metadata User Guide
Current guidance includes AI system and prompt-related photo metadata fields.