Proving Media Origin with C2PA

An attacker who spreads a fake has no interest in leaving a record of origin that identifies it as AI-generated. Several routes remain open, all described by NIST.

The first is the simplest: removing the metadata. Nothing obliges a platform or a tool to keep it, and NIST notes that this removal is frequent during sharing². The recipient then gets a file with no history, which is also the case for a perfectly legitimate file.

The second consists of signing it yourself. Anyone can create their own certificate and act as their own authority, with no reputation². The signature is then valid cryptographically. It is not reliable for all that: as long as the verifier has not added this signer to its "trust lists", it can detect that the signature is not trusted².

The third targets the authority itself. NIST points out that a compromised certificate authority would make it possible to issue valid certificates for falsified identities².

These limits matter all the more because generative AI improves lures. In January 2024, the UK NCSC judged that, through 2025, these models would make it difficult for everyone, whatever their level of cyber awareness, to tell whether an email or a password reset request is authentic⁴.

Three situations arise.

In the first, a verification tool displays the credentials. With Content Credentials Verify, you read the issuer and the date and time of issue¹. For content produced by an Azure OpenAI model, the page shows "Microsoft Corporation"¹.

In the second, the file displays nothing. This is the usual case after sharing, since metadata is often removed². It says neither that the file is fake nor that it is safe.

In the third, the tool reports an untrusted signature. NIST asks that the presentation software then state that the signer may not be who they claim to be². Even unsigned metadata, or metadata signed by an unknown certificate, can be displayed with a note of uncertainty about its validity².

The principle rests on a few elements, which NIST describes as follows. A digital signature is calculated over the content and its metadata with a private key kept secret. The verifier uses the matching public key to check that the signature is valid and corresponds to the data supposedly signed². If the content or the metadata change afterwards, the recipient can see it².

To say whom to trust, C2PA combines hash functions, digital signatures, certificates with public and private key pairs, and "trust lists" of certificate authorities judged reliable. The C2PA organization maintains a default central list, which was still being developed at the date of the NIST report². C2PA is also seeking to have its specification standardized by ISO/TC 171/SC 2².

Watermarking is another technique, not to be confused with metadata. NIST describes it as a mark inserted in the content itself, through the pixels or the words, without a separate channel². So-called hidden watermarks are designed to persist, unlike metadata, which is often removed². The two approaches can be combined: a robust watermark, unlikely to be removed when the image passes from one platform to another, plus signed metadata for those who receive them².

Finally, NIST flags some reservations. Privacy comes first: a user who does not know that metadata is added at capture or generation can reveal when, where, by whom and with which tool an image was produced². C2PA recommends that tools create this metadata only after the user actively agrees, but this recommendation is not binding². As for the security and complexity of the specification, third-party experts have expressed concerns².

The sources cited here do not document a specific fraud incident. They describe dated deployments, which show what these proofs of origin look like in practice.

January 2024: the NCSC assessment of AI and the cyber threat

On 24 January 2024, the NCSC published its assessment of the near-term effect of AI on the cyber threat. It judges there that AI will mainly give attackers a gain in capability in social engineering, and that generative AI already allows convincing exchanges with victims, without the translation, spelling or grammar mistakes that often give phishing away⁴.

November 2024: NIST surveys transparency approaches

In November 2024, NIST published its report on technical approaches to digital content transparency. It distinguishes provenance tracking, which includes watermarks and metadata, from synthetic content detection². It cites Adobe, which deploys C2PA in its generative AI product Firefly, and specifies that these case studies are reported by the participating entities, so they should be read as self-reported uses².

20 May 2025: Google announces SynthID Detector

On 20 May 2025, Google announced SynthID Detector, a verification portal for identifying content created with its AI tools³. You upload an image, a sound, a video or a text, and the portal looks for a SynthID watermark, then highlights the parts most likely to carry one³. Google states that more than 10 billion pieces of content already carry this watermark, and that access was initially open to testers, with a waitlist for journalists, media professionals and researchers³. The portal targets content made with Google's AI tools³. Google has also watermarked NVIDIA videos, and announces a partnership with GetReal Security for detection by other players³. A file without a SynthID watermark may come from another tool.