How to Spot AI-Generated Pictures

By August 2026, the European Union’s AI Act transparency obligations become fully enforceable, and two distinct methods for verifying the origin of media have emerged as clear technical options. One method is C2PA Content Credentials, an ISO/IEC 22144 standard that signs a bundle of metadata and attaches it to image, video, or audio files. The other method is watermarking, a set of techniques that embed invisible, machine-readable patterns directly into the pixels, waveforms, or tokens of the content itself. Both methods are actively used in production by major AI labs and camera manufacturers, and each has failure modes that the other does not.

Key Takeaways:

• C2PA Content Credentials maintain a signed chain of custody but can be easily removed by re-encoding, screenshots, or any tool that rewrites the file.
• Watermarks (SynthID, AudioSeal, SynthID-Text) survive recompression and resizing but are vulnerable to adversarial attacks and do not provide provenance history.
• The two methods complement each other: credentials answer “who created this and how was it edited,” while watermarks answer “was this generated by a specific model.”
• EU AI Act transparency and disclosure rules become enforceable in August 2026, prompting OpenAI, Google, Adobe, and camera makers to deploy both methods in production.
• Security engineers verifying content need an open-source C2PA library for credentials and model-specific detectors for watermarks, each with different failure modes to consider.

The Two Tracks: Credentials vs. Watermarks

The AI content authenticity field has split into two complementary approaches that address different parts of the same problem. C2PA Content Credentials, standardized as ISO/IEC 22144 and developed by the Coalition for Content Provenance and Authenticity, work by signing a metadata bundle that records who created the content, when, with what tool, and what edits were made. This bundle travels with the media file as a sidecar or embedded field. The signature uses cryptography, so anyone with the public key can verify that the metadata has not been altered since signing.

Watermarking uses a different method. Instead of attaching data separately, it alters the content itself. Google’s SynthID embeds an imperceptible pattern into outputs of its generative models across Imagen (images), Veo (video), and Lyria (audio). Meta’s AudioSeal applies a similar technique for audio, and SynthID-Text modifies the statistical distribution of token selection in generated text so that detectors can later identify the output as machine-generated. The pattern is invisible to humans but can be detected by the corresponding tool.

The main difference is where the signal resides. Credentials are stored in metadata that can be separated from the content. Watermarks are embedded inside the content and persist through transformations like resizing, cropping, and recompression. This distinction determines what each system can detect and where it falls short.

C2PA Content Credentials: Signed Metadata That Can Be Removed

C2PA’s approach is based on chain of custody. When a camera or AI tool creates content, it signs an initial “claim” that includes the device or model identity, timestamp, and thumbnail. Each subsequent edit adds a new signed assertion, so the final credential provides a verifiable history: this photo was taken on a Leica M11, edited in Adobe Lightroom, and exported with specific operations. The signatures link together using standard public-key certificates, and verification does not require trust in the platform serving the file.

Adoption is widespread and active. OpenAI signs outputs from Sora and DALL-E with Content Credentials. Adobe embeds them in Firefly generations and exports from Photoshop and Lightroom. On the capture side, camera firmware from Leica, Sony, Nikon, and Canon now signs images at the moment of capture, establishing a cryptographic root of trust at the hardware level. This provides the strongest provenance story currently available: a signed chain from sensor to screen.

The main limitation is clear. Content Credentials can be removed. A screenshot, re-encoding through a tool that does not preserve metadata, uploading to a platform that rewrites files, or even a simple copy that drops the sidecar all eliminate the credential. The content remains, but the proof does not. An attacker wanting to launder a signed deepfake can simply re-save the file. The credential disappears, and the absence of a credential cannot be distinguished from “this file was never signed.” This asymmetry (credentials prove authenticity when present but prove nothing when missing) is a core challenge platform teams must address.

Watermarking: Invisible Patterns That Persist Through Recompression

Watermarking reverses the trade-off. Because the signal is embedded in the content itself, it survives transformations that destroy metadata. Google’s SynthID embeds a watermark in the pixel or frequency domain of generated images that remains detectable after resizing, cropping, and JPEG recompression. Applying the same technique to Veo video and Lyria audio means a clip that has been screen-recorded or re-encoded still carries a detectable marker. Meta’s AudioSeal is designed for fast, localized detection of AI-generated speech, and SynthID-Text works by subtly biasing token sampling so a statistical detector can later identify the output as synthetic.

The benefit is persistence. A recompressed image loses its C2PA credential but retains its SynthID watermark. A clip that has been trimmed and uploaded to a content farm still triggers the watermark detector. For platforms aiming to identify AI-generated spam, misinformation, or non-consensual imagery at scale, watermarking provides a signal that endures real-world handling.

The drawback is vulnerability to attacks. Researchers have showed that imperceptible watermarks can be weakened or removed with targeted perturbations, and detectors can be fooled by carefully crafted inputs. Watermarks also carry much less information than credentials: they usually encode a single bit of provenance (“synthetic” versus not) rather than a full edit history. Importantly, watermark detection is probabilistic. Detectors return confidence scores, not cryptographic proof, so false positives and false negatives are inherent considerations rather than bugs that can be eliminated.

What Each Approach Detects and Where It Falls Short

The two methods do not replace each other. They answer different questions and have different weaknesses, which is why major labs use both. The table below compares their differences.

The practical takeaway for platform engineers is that neither signal alone is sufficient. A file with a valid C2PA credential but no watermark is almost certainly authentic, but a file without a credential provides no information. A file flagged by a watermark detector indicates it is synthetic, but a clean detector result does not prove the content is human-made. Effective defense requires checking both signals and treating the absence of a credential as uninformative rather than proof of authenticity.

This matches what we see across detection methods: no single signal is a perfect solution. These tools increase the difficulty of laundering synthetic media and provide platforms with initial signals for triage, but they do not make attribution automatic or forgery impossible.

The EU AI Act and August 2026 Deadline

Regulatory requirements are driving the simultaneous deployment of these two methods. The EU AI Act imposes transparency obligations on providers of AI systems that generate synthetic content. Under Article 50 of the regulation, providers must label outputs as artificially generated or manipulated, and deployers must disclose when content is synthetic. The enforceable deadline for these rules is August 2026, which explains why signing and watermarking infrastructure has moved from research to production features over the past two years.

The transparency rules are intentionally technology-neutral. They do not require C2PA or SynthID specifically; they require disclosure. Providers have settled on a practical combination. OpenAI signs Sora and DALL-E outputs with Content Credentials and has also integrated watermarking into image outputs. Google embeds SynthID across Imagen, Veo, and Lyria. Adobe combines Firefly’s Content Credentials with its broader Content Authenticity Initiative. This has become the de facto standard approach: sign what you can with C2PA, watermark what you can with embedded patterns, and disclose at deployment.

For platform teams, the compliance question is not which method to adopt but how to verify both. Platforms hosting user-generated content need to check incoming files for valid credentials and run watermark detectors, then present results to users and moderators. The enforcement date is close enough that teams still planning their verification pipelines are already behind schedule.

Verification Tools for Security Engineers

Verification is where implementation matters, and tooling maturity varies. On the C2PA side, the Content Authenticity Initiative maintains a reference open-source library for reading and validating Content Credentials. It handles certificate chain validation, manifest parsing, and signature checks, and most platform integrations use it. A verification pipeline typically extracts the credential from the file or its sidecar, validates the certificate chain against the C2PA trust list, and returns signed claims along with a validity flag. The specification and reference implementation are documented on the C2PA specification site.

On the watermarking side, detection is model-specific. Google has released a SynthID-Text detection API for flagging watermarked text, and open implementations of detector logic exist. For images, audio, and video, detectors correspond to the specific embedding used by each model, so platforms need to run multiple detectors to cover the field. AudioSeal’s detector is open and designed for low-latency use, making it practical to run at ingestion on audio uploads.

Verification costs differ significantly. Validating a C2PA signature is inexpensive and deterministic; running multiple watermark detectors on every uploaded image, video, and audio file is resource-intensive and probabilistic. Most platforms will use a tiered approach: check credentials on all content (cheap), run watermark detection on high-risk or high-volume content (expensive), and combine results to prioritize human review.

The Bottom Line for Platform Teams

The AI content authenticity field in 2026 no longer assumes a single solution. C2PA Content Credentials provide a cryptographically verifiable chain of custody that answers “who made this and how was it edited,” but the proof disappears when the file is re-encoded or screenshotted. Watermarking provides a persistent “this is synthetic” signal that survives transformations that remove credentials, but it is probabilistic, carries less information, and can be attacked adversarially.

The EU AI Act’s August 2026 enforcement deadline has pushed major labs and hardware makers to deploy both methods, which is the correct approach. Platforms that only validate credentials will miss every stripped file. Platforms that only run watermark detectors will miss every authentic-but-unsigned file and every adversarial removal. Teams that handle this well treat provenance as a layered, probabilistic signal rather than a binary stamp, and they design moderation and disclosure pipelines around the fact that absence of proof is not proof of absence.

For more on how these signals fit into broader content moderation and trust systems, see our coverage of how to comply with EU AI Act Article 50 disclosure requirements and risks of Meta AI content watermarking in 2026.

Related Reading

More in-depth coverage from this blog on closely related topics:

• How to Comply with EU AI Act Article 50
• Best Hardware for Large AI Models
• iOS 26.5 update: new features, bugs
• Meta AI Content Watermarking Risks in 2026
• Choosing the Best Local AI Inference Tools

Sources and References

Sources cited while researching and writing this article:

• Article 50 of the regulation
• C2PA specification site