--- id: CP-302 slug: c2pa-content-credentials-watermarking lang: en title: Proving Media Origin with C2PA description: How C2PA and Content Credentials attach a signed history to an image, video or sound, and what that signature does and does not prove. canonical_url: https://startbrain.io/cyberpedia/en/articles/c2pa-content-credentials-watermarking/ markdown_url: https://startbrain.io/cyberpedia/en/articles/c2pa-content-credentials-watermarking.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Proving Media Origin with C2PA", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/c2pa-content-credentials-watermarking/ (CC BY 4.0) wing: 4 theme: deepfake reflex: air-036 schema: G4 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/c2pa-content-credentials-watermarking/ fr: https://startbrain.io/cyberpedia/fr/articles/filigranage-c2pa-content-credentials/ es: https://startbrain.io/cyberpedia/es/articles/filigranage-c2pa-content-credentials/ sources: - "n": 1 title: Content Credentials (classic) publisher: Microsoft url: https://learn.microsoft.com/en-us/azure/foundry-classic/openai/concepts/content-credentials accessed: "2026-11-03" - "n": 2 title: "Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency" publisher: NIST url: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-4.pdf published: "2024-11-18" accessed: "2026-11-03" - "n": 3 title: "SynthID Detector: a new portal to help identify AI-generated content" publisher: Google url: https://blog.google/innovation-and-ai/products/google-synthid-ai-content-detector/ published: "2025-05-20" accessed: "2026-11-03" - "n": 4 title: The near-term impact of AI on the cyber threat publisher: NCSC (UK) url: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat published: "2024-01-24" accessed: "2026-11-03" --- # Proving Media Origin with C2PA An image, a video or a sound recording can be fabricated by an AI, then circulate with nothing to show where it came from. Content Credentials try to fill that gap: they attach to the file a signed record of origin that the recipient can verify. This record helps in judging a media file, but it does not settle the question on its own. Its absence does not prove that a file is fake, and its presence does not prove that it is genuine. This article explains what the signature guarantees, what it leaves open and what an employee can do with it. ## In 30 seconds - Where it happens: images, videos and sounds received by messaging app, social network or email, when you do not know whether they are authentic. - What the attacker wants: to pass off a fabricated media file as authentic, or to remove the label showing that it comes from an AI. - The reflex: if the media file is used to justify a decision, a payment or an instruction, check its Content Credentials, then confirm the request through a different channel from the one that delivered it. - If it is already done: alert the security team with the original file, without editing it or re-saving it. ## Straight answers ### What are Content Credentials? They are a "tamper-evident" way (one that makes any alteration visible) of revealing the origin and history of a piece of content. They rely on an open specification from the Coalition for Content Provenance and Authenticity (C2PA) [1]. In practice, a manifest is attached to the image and cryptographically signed by a certificate [1]. ### What does this record of origin contain? For images generated with Azure OpenAI, the manifest contains three fields: a description ("AI Generated Image"), the name of the software that produced the image and the timestamp of when the credentials were created [1]. The C2PA specification more broadly allows recording assertions about origin, the history of edits and the "provenance chain", meaning the content from which the file is derived [2]. ### Which types of media are covered? The specification handles image, audio and video [2]. ### How do I check a file? Microsoft gives two ways: the Content Credentials Verify web page and the open-source tools of the Content Authenticity Initiative [1]. For an image generated by an Azure OpenAI model, the page shows that the credentials were issued by Microsoft Corporation, with the date and time of issue [1]. ### If I find no record, is the file fake? No. The metadata stored in a file can be removed, which often happens when files are shared, for example on social networks [2]. It can be removed to mislead recipients about the origin of the content, or for a harmless reason such as protecting privacy [2]. A file without a record therefore remains a file of unknown origin. ### If the record is present and the signature is valid, is the content genuine? Not necessarily. A signature cannot verify that the metadata is accurate: technically, it only indicates that the signer attested to its existence at a given moment [2]. NIST gives an example: an image signed by a camera may have been modified by the AI built into the camera [2]. ## Inside the attacker's head An attacker who spreads a fake has no interest in leaving a record of origin that identifies it as AI-generated. Several routes remain open, all described by NIST. The first is the simplest: removing the metadata. Nothing obliges a platform or a tool to keep it, and NIST notes that this removal is frequent during sharing [2]. The recipient then gets a file with no history, which is also the case for a perfectly legitimate file. The second consists of signing it yourself. Anyone can create their own certificate and act as their own authority, with no reputation [2]. The signature is then valid cryptographically. It is not reliable for all that: as long as the verifier has not added this signer to its "trust lists", it can detect that the signature is not trusted [2]. The third targets the authority itself. NIST points out that a compromised certificate authority would make it possible to issue valid certificates for falsified identities [2]. These limits matter all the more because generative AI improves lures. In January 2024, the UK NCSC judged that, through 2025, these models would make it difficult for everyone, whatever their level of cyber awareness, to tell whether an email or a password reset request is authentic [4]. ## What you see on screen Three situations arise. In the first, a verification tool displays the credentials. With Content Credentials Verify, you read the issuer and the date and time of issue [1]. For content produced by an Azure OpenAI model, the page shows "Microsoft Corporation" [1]. In the second, the file displays nothing. This is the usual case after sharing, since metadata is often removed [2]. It says neither that the file is fake nor that it is safe. In the third, the tool reports an untrusted signature. NIST asks that the presentation software then state that the signer may not be who they claim to be [2]. Even unsigned metadata, or metadata signed by an unknown certificate, can be displayed with a note of uncertainty about its validity [2]. ## Under the hood The principle rests on a few elements, which NIST describes as follows. A digital signature is calculated over the content and its metadata with a private key kept secret. The verifier uses the matching public key to check that the signature is valid and corresponds to the data supposedly signed [2]. If the content or the metadata change afterwards, the recipient can see it [2]. To say whom to trust, C2PA combines hash functions, digital signatures, certificates with public and private key pairs, and "trust lists" of certificate authorities judged reliable. The C2PA organization maintains a default central list, which was still being developed at the date of the NIST report [2]. C2PA is also seeking to have its specification standardized by ISO/TC 171/SC 2 [2]. Watermarking is another technique, not to be confused with metadata. NIST describes it as a mark inserted in the content itself, through the pixels or the words, without a separate channel [2]. So-called hidden watermarks are designed to persist, unlike metadata, which is often removed [2]. The two approaches can be combined: a robust watermark, unlikely to be removed when the image passes from one platform to another, plus signed metadata for those who receive them [2]. Finally, NIST flags some reservations. Privacy comes first: a user who does not know that metadata is added at capture or generation can reveal when, where, by whom and with which tool an image was produced [2]. C2PA recommends that tools create this metadata only after the user actively agrees, but this recommendation is not binding [2]. As for the security and complexity of the specification, third-party experts have expressed concerns [2]. ## Case files The sources cited here do not document a specific fraud incident. They describe dated deployments, which show what these proofs of origin look like in practice. ### January 2024: the NCSC assessment of AI and the cyber threat On 24 January 2024, the NCSC published its assessment of the near-term effect of AI on the cyber threat. It judges there that AI will mainly give attackers a gain in capability in social engineering, and that generative AI already allows convincing exchanges with victims, without the translation, spelling or grammar mistakes that often give phishing away [4]. ### November 2024: NIST surveys transparency approaches In November 2024, NIST published its report on technical approaches to digital content transparency. It distinguishes provenance tracking, which includes watermarks and metadata, from synthetic content detection [2]. It cites Adobe, which deploys C2PA in its generative AI product Firefly, and specifies that these case studies are reported by the participating entities, so they should be read as self-reported uses [2]. ### 20 May 2025: Google announces SynthID Detector On 20 May 2025, Google announced SynthID Detector, a verification portal for identifying content created with its AI tools [3]. You upload an image, a sound, a video or a text, and the portal looks for a SynthID watermark, then highlights the parts most likely to carry one [3]. Google states that more than 10 billion pieces of content already carry this watermark, and that access was initially open to testers, with a waitlist for journalists, media professionals and researchers [3]. The portal targets content made with Google's AI tools [3]. Google has also watermarked NVIDIA videos, and announces a partnership with GetReal Security for detection by other players [3]. A file without a SynthID watermark may come from another tool. ## Sources 1. Microsoft, "Content Credentials (classic)". https://learn.microsoft.com/en-us/azure/foundry-classic/openai/concepts/content-credentials (accessed 3 November 2026) 2. NIST, "Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency", 18 November 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-4.pdf (accessed 3 November 2026) 3. Google, "SynthID Detector: a new portal to help identify AI-generated content", 20 May 2025. https://blog.google/innovation-and-ai/products/google-synthid-ai-content-detector/ (accessed 3 November 2026) 4. NCSC (UK), "The near-term impact of AI on the cyber threat", 24 January 2024. https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/c2pa-content-credentials-watermarking/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.