C2PA vs SynthID

C2PA wraps a signed metadata manifest around a file, while SynthID embeds a signal inside the content itself. C2PA (Coalition for Content Provenance and Authenticity) Content Credentials are a signed metadata record, a "manifest," attached to a file. It documents what produced the file, which tool was used, and what edits happened afterward.

The manifest is cryptographically bound to the file's exact bytes through hard binding: a hash of the asset is embedded in the signed manifest, so any alteration to asset or provenance breaks the match. Nothing in that mechanism touches the pixels or audio a viewer actually perceives.

It's a wrapper around the file, the same category of thing as EXIF or IPTC metadata, just signed and extensible.

SynthID, developed by Google DeepMind, works the opposite way and never touches file metadata at all.

• Images, video, and audio: the watermark is embedded directly into the generated content during creation, applied so it doesn't change perceived quality.
• Text: SynthID runs as a logits processor during generation, nudging the model's token-probability distribution using a pseudorandom function.

The text version leaves a statistical fingerprint across word choices, not a file-level marker. Because the signal lives in the content rather than a wrapper, it travels through format conversion, cropping, or a screenshot in a way a metadata field structurally cannot.

A screenshot regenerates an entirely new file from re-rendered pixels, so it breaks C2PA's hash match outright. So does re-saving in a different format, resizing, or most re-encoding.

The Coalition's own verification tool states the limitation plainly: if metadata has been removed, the image was captured as a screenshot, or the file was re-encoded, the C2PA manifest data may no longer be accessible or readable.

None of that requires an attacker. Many platforms strip embedded metadata on upload as routine processing, so credentials vanish with zero adversarial intent.

Embedded watermarks are built for exactly this scenario, and the vendors are specific about what they claim:

• Google says SynthID for images and video is designed to stand up to cropping, filters, changed frame rates, and lossy compression.
• The audio version is meant to resist added noise, MP3 compression, and changes to the speed of the track.
• Meta's Stable Signature, trained jointly with Inria directly into the decoder of its generative models rather than applied afterward, says the original watermark will likely remain in the digital data however a person transforms an image, through cropping, compression, and color adjustment.

Not one of those claims is unconditional. Google is explicit that SynthID Text's detector confidence can be greatly reduced when text is thoroughly rewritten or translated, and defeating a pixel-level watermark under determined adversarial editing remains an open research problem for every vendor.

No, they are different operations: verifying C2PA is a manifest lookup, while verifying SynthID means running a statistical detector against the content. Checking a C2PA credential means reading a manifest, not detecting a signal. The Coalition runs Content Credentials Verify for this: upload or paste a file and it shows the issuer, editing history, generating application, and thumbnail trail, if an intact manifest is present.

OpenAI runs an equivalent tool for its own outputs at openai.com/research/verify/. Either way the result works like checking a digital signature: present and cryptographically valid, or not. No confidence score when it works, no partial credit when it's been stripped.

Verifying SynthID means running a statistical detector against the content itself. For SynthID Text, Google has open-sourced a Bayesian detector, distributed through Hugging Face Transformers and GitHub.

It doesn't return a simple yes or no. It reports one of three states (watermarked, not watermarked, or uncertain) against a threshold the operator sets to trade off false positives against false negatives.

It depends on the modality: Google's standalone detector for images, video and audio is open only to approved journalists, media professionals and researchers, while the text detector is open sourced for anyone to run. For images, video, and audio, Google's checker is the SynthID Detector. You reach it either by asking the Gemini app about an uploaded file or through a standalone portal launched at I/O on May 20, 2025.

That portal is waitlist-gated for journalists, media professionals, and researchers, with no public API. At launch only image detection was live, with video and text detection promised in the coming weeks.

The most recent independent check found (journalist Henk van Ess, November 20, 2025) reported it still waitlist-only, with in-app verification hit-or-miss for audio and video and reliable for images. No later source confirms general availability.

Asking Gemini in chat had a bigger problem for part of 2026. Upload two images in one session, ask about the second, and it returned the verdict for the first. The fact-checking outlet Lead Stories caught it across four tested sessions, producing both false positives and false negatives, and after its July 13, 2026 coverage Google fixed it globally by July 16.

The in-chat route has published limits of its own. Google states Gemini "can currently only recognize content created by Google AI tools," with caps of 100MB per file, video under 90 seconds, audio under an hour, and roughly 10 checks per media type per 24 hours.

No, they ship both: OpenAI and Anthropic each pair C2PA metadata with an embedded watermark, and C2PA's own specification writes that fallback into the standard. OpenAI's clearest public statement says it is incorporating watermarking through Google DeepMind's SynthID, starting with images generated through ChatGPT, Codex, or the OpenAI API. Its stated reason: SynthID embeds an invisible watermarking layer that complements C2PA metadata-based approaches.

In OpenAI's own words, C2PA helps content carry detailed context while SynthID helps preserve a signal when metadata doesn't survive. Supported images now carry both, checkable together at openai.com/research/verify/.

The same pattern shows up across the field:

• Anthropic pairs an imperceptible watermark embedded directly in generated text with signed C2PA metadata attached to supported Claude-generated image files. On August 14, 2026, Anthropic named the text mechanism directly: a version of Google DeepMind's SynthID-Text approach, keyed word selection rather than a file-level signal, published in a technical explainer that goes well beyond what this comparison could say about Claude's text watermark before that date.
• Meta uses Stable Signature as its embedded-watermark layer for its own generative image models.
• C2PA's own specification writes the fallback into the standard: "soft binding," an invisible watermark or a cloud-hosted fingerprint lookup, is the defined recovery path when hard binding breaks.

That last one is the tell. The standard itself concedes that metadata alone doesn't survive real-world handling, which is the same admission every one of these companies has made in practice.

A present C2PA manifest or a positive SynthID detection is evidence about a generation or editing process, not proof of truth, intent, or ownership. Neither company claims otherwise.

A cryptographically valid manifest shows that whoever signed it made a set of declarations. It does not verify those declarations, since the signing tool can't know what happened upstream.

SynthID detectors carry the opposite kind of uncertainty by design. They output likelihoods rather than certainties, and Google's text detector treats "uncertain" as a first-class result rather than forcing a binary answer.

Absence proves least of all. OpenAI is explicit that its verification tool won't reach a definitive conclusion when no signal is found, because provenance signals can sometimes be stripped, so a blank result means only that nothing readable survived to that point.