Skip to main content
AI Watermark Removal

Modality

Metadata AI Watermarking

A C2PA Content Credential is a structured, cryptographically signed bundle of assertions, actions, and ingredients, not a single tag, and you can inspect it with real, free tools. It's also fragile in a way the standard admits in writing: C2PA's own documentation concedes the embedded copy can be stripped, which is why the spec falls back on a watermark-based soft binding rather than metadata alone.

Published 2026-08-11Updated 2026-08-11Confirmed

Key takeaways

  • A C2PA manifest is a structured bundle of assertions, actions (edit history), and ingredients (source assets), tied to the file by a cryptographic hard-binding hash and signed with a certificate chaining to a Certification Authority on the C2PA Trust List.
  • Two free tools let you check this yourself: the Content Credentials Verify tool at contentcredentials.org/verify validates a manifest in your browser, and ExifTool can read, and delete, the raw C2PA/JUMBF metadata box from the command line.
  • C2PA's own explainer concedes Content Credentials can be stripped. A screenshot carries none by definition, since it's a newly rendered file, and most re-encoding on upload breaks the hard-binding hash even when some metadata survives.
  • A missing manifest means "no metadata survived," not "not AI-generated," which is why C2PA also defines a soft-binding fallback (watermarking and fingerprinting) for when the embedded copy is gone.

Provenance stack

Where the signal lives

Metadata

C2PA and file manifests carry signed origin and edit history.

Embedded signal

SynthID or media watermarks live inside pixels, audio, video, or text.

Detector

Verification tools check whether a supported signal is present.

What's actually inside a manifest, in one pass

Confirmed

You'll get the shape of a Content Credential in about sixty seconds, plus a pointer to the deep version.

A Content Credential is not a single tag or a yes/no flag. It's a structured record, hash-bound to the file's exact bytes, then digitally signed with a certificate chaining to the C2PA Trust List.

  • Assertions: statements about who made the asset and what tools touched it.
  • Actions: a specific kind of assertion logging edit history, in order.
  • Ingredients: the source assets a file was composed from, each of which can carry its own prior manifest.

For the full structural breakdown, including the claim and created_assertions versus gathered_assertions split, the exact hashing and signing chain, and what verification actually proves, see the dedicated C2PA Content Credentials page.

This page is about something narrower: how that metadata layer compares to a watermark embedded in the content itself, and how easily it disappears.

Two real tools for checking a file yourself

Confirmed

Here's how to read a real manifest, and delete one, without taking anybody's word for how this works.

The Content Credentials Verify tool at contentcredentials.org/verify is maintained by the contentauth organization on GitHub, the open-source home for C2PA and Content Authenticity Initiative tooling.

Its own repository describes it as reading and validating C2PA data "on the client side using WebAssembly." Your file gets parsed and checked inside your browser rather than uploaded to a third-party server for inspection.

Drop a file in and it reports three things.

  • Whether a manifest is present at all.
  • Whether the hash and signature still validate.
  • What the manifest claims about origin and AI involvement.

For raw inspection outside a browser, ExifTool gets at the C2PA data directly. It's Phil Harvey's long-running command-line metadata utility, the same one people use for ordinary EXIF, XMP, and IPTC fields.

What survives an upload, and what doesn't

Confirmed

Here's the short list of everyday actions that quietly destroy a manifest, none of which require anyone to be trying.

Because the manifest depends on a hash of the exact file bytes, anything that changes those bytes without re-signing breaks the hard binding. That holds even if the underlying metadata box happens to survive.

  • A screenshot. An OS-level screen capture produces an entirely new file from rendered pixels, with no path back to the original file's manifest, so there's nothing to survive in the first place.
  • Recompression or resizing during upload.
  • Format conversion.
  • Most editing tools that re-save the file.

Meta has acknowledged the general problem directly. Describing its own use of C2PA and IPTC metadata to label AI content, Meta says "it's not yet possible to identify all AI-generated content, and there are ways that people can strip out invisible markers."

OpenAI says a version of the same thing about its own files: C2PA metadata "can be stripped, lost through uploads and downloads, or broken by transformations."

Coverage is also uneven before anything gets stripped. Anthropic notes that signed provenance metadata for generated files "may not be supported on every platform, depending on the features each platform offers."

Two field reports on how fragile this gets

Community discussion

You'll see two independent checks where provenance metadata didn't behave the way the vendor said it would.

In November 2025, an investigation cross-posted to LessWrong by a named author found something strange about Sora 2 video.

Videos carrying the visible Sora watermark had no detectable C2PA metadata via either OpenAI's own Verify tool or the open-source c2pa-rs command-line tool. Pro-tier videos without the visible watermark did carry detectable C2PA.

That runs against OpenAI's public claim that every video generated with Sora includes both visible and invisible provenance signals. No OpenAI response was documented, and this site has not replicated the test.

The second report is a June 2026 thread on OpenAI's own developer forum, still unanswered by OpenAI staff.

A developer there found a PNG with valid Content Credentials stripped to bare PNG chunks after uploading it back into a ChatGPT conversation, even though the original file still verified (SynthID plus Content Credentials) at openai.com/verify.

Treat both as independent observations rather than confirmed vendor behavior. Their practical value is the reminder that "this file had a manifest when it left the model" and "this file has a manifest now" are two separate claims.

Metadata and watermarking aren't really separate layers

Confirmed

Here's the part of the spec that quietly concedes metadata alone was never going to be enough.

It's tempting to treat "C2PA metadata" and "invisible watermark" as two unrelated things that happen to get bundled together. C2PA's own durable-credentials design blurs that line.

The soft binding the spec falls back on when the embedded manifest is stripped is, per the explainer, "watermarking and fingerprinting."

So the standard's own answer to "what happens when someone strips your metadata" is to embed a lightweight signal in the pixels and use it to look the real manifest back up from a cloud store.

That's conceptually the same move as pairing a metadata standard with a pixel-level watermark, just implemented inside the C2PA spec itself.

FAQ

What's the difference between an assertion, an action, and an ingredient in a C2PA manifest?

They're nested categories inside the same manifest. Assertions are the general class of statements about the asset (origin, tool used, AI involvement). Actions are a specific kind of assertion that logs the edit history: what was done, in what order. Ingredients are the source assets a file was composed from; each one can carry its own prior manifest, so a composite image can trace provenance back through everything used to build it, not just the most recent save.

Can I check whether a file has valid Content Credentials without installing anything?

Yes. The Content Credentials Verify tool at contentcredentials.org/verify runs in the browser (it validates the manifest client-side using WebAssembly, per its maintainers' own repository) and reports whether the hash still matches the file, whether the signature validates, and what the manifest claims. No account or third-party upload is required for the check itself.

If a photo or video has no Content Credentials, does that mean it wasn't made or edited with AI?

No. Read a missing manifest as "no metadata survived," not as evidence about origin. C2PA's own explainer acknowledges Content Credentials can be removed, which is exactly why the spec added durable credentials as a fallback. Screenshots produce a brand-new file with nothing to carry a manifest, and most re-encoding on upload or re-save changes the bytes the hard-binding hash was computed over, breaking validation even if a manifest was originally attached.

Can Content Credentials be deleted from a file?

Yes. General-purpose metadata tools can do it. ExifTool's own documentation lists the C2PA/JUMBF box as a format it can read and delete, alongside standard EXIF, XMP, and IPTC fields. What it can't do is forge a new, validating manifest in its place, since that requires a signing certificate chaining to a Certification Authority on the C2PA Trust List, a materially harder problem than deleting a box from a file.

Next steps

  • Run one of your own AI-generated images through the Verify tool, then screenshot it and run the screenshot. Watching the manifest vanish teaches this faster than any explanation. Content Credentials Verify
  • Go one level deeper into manifest anatomy: the claim structure, the hashing chain, and what a verified signature does and doesn't prove. C2PA Content Credentials
  • Compare metadata head-to-head with an embedded watermark, the pairing OpenAI now ships on the same images. C2PA vs SynthID
  • See how removal works across every layer, not just the metadata one, before assuming a stripped file is untraceable. Can AI watermarks be removed?

Sources and citation status