Two large-scale deployments of content provenance technology are now live: OpenAI has integrated C2PA cryptographic signing into ChatGPT and the DALL-E image generation pipeline, and Google has deployed SynthID watermarking across Imagen, Veo, and select Gemini surfaces. Together, these represent provenance coverage for a notable portion of consumer-facing AI generation — though, as the rest of this post details, coverage is partial and deployment maturity varies significantly by product and surface.

This is worth examining carefully. Not because provenance is a solved problem — it isn’t — but because understanding what each approach actually does helps you think clearly about where the defenses work, where they fail, and what practical security guarantees you can and cannot build on top of them.

The Problem Provenance Is Trying to Solve

The core threat is authenticity confusion: content is presented in a context that implies a different origin than it actually has. The most visible version of this is synthetic media passed off as real — a fabricated quote, a generated image attributed to a real event, a cloned voice claiming to be a trusted person.

But the threat is broader than deepfakes. It also includes:

• Origin laundering: AI-generated content that strips or obscures its generation context before redistribution.
• Partial attribution: Edited content where the modification history is lost and the result is presented as an original photograph or recording.
• Compound manipulation: Authentically originated content (a real photo) that has been materially altered, presented without disclosure of the alteration.

Provenance technology addresses a specific slice of this: can you establish, at retrieval time, what created or modified a piece of content?

C2PA: Cryptographic Chain of Custody

The Coalition for Content Provenance and Authenticity is an industry working group (founded by Adobe, ARM, BBC, Intel, Microsoft, and Truepic in 2021, now including OpenAI, Google, and others) that has specified a technical standard for embedding cryptographic provenance metadata into media files.

The mechanism is a Content Credentials manifest — a signed data structure attached to the file that records:

• The tool or service that created or modified the content
• A hash of the content at the time of signing
• Any claimed assertions about origin (e.g., “this was AI-generated by DALL-E 3”)
• A chain of parent manifests if the content was derived from prior signed content

The manifest is signed with a certificate associated with a known signer identity. C2PA validation is verifier-policy-driven: each verifier maintains (or consults) a trust list of recognized signers — there is no single universal C2PA CA hierarchy, but rather a trust model where the verifier decides which credential roots it accepts. If you have the file, can verify the certificate chain, and the signer credential is in your trusted set, you can confirm that this signer attested to this specific asset state at some point — and that the content hasn’t been modified since that attestation. An important nuance: the “tool” recorded in the manifest is a claimed assertion made by the signer, not an independently verified fact about which software produced the output. The signature proves the signer attested to that claim, not that the claim is independently verifiable. Crucially: the assertion chain is cryptographically bound to the content hash, so modifying the image invalidates the signature.

OpenAI’s deployment: As of 2024, OpenAI began embedding C2PA manifests into images generated by ChatGPT and DALL-E 3. The manifest claims AI origin and records the generation timestamp. This applies at generation time — manifests can be stripped by downstream transcoding, CDN processing, or simple re-saves, so the credential may not survive all delivery paths to end users.

Google’s C2PA work: Google has similarly committed to C2PA embedding in Imagen and other generation tools, and participates actively in the C2PA standards body.

What C2PA Can Establish

C2PA gives you a reliable answer to a narrow question: Did a specific signer credential attest to this content state?

If a DALL-E image with an intact manifest is presented to you, and you verify the signature successfully, you know:

1. OpenAI’s signing infrastructure did sign this file at some point.
2. The file has not been modified since that signing.
3. OpenAI’s manifest claims it was AI-generated.

That’s a meaningful assertion. It’s not easily forgeable — you’d need OpenAI’s private signing key or a compromise of their CA chain.

Where C2PA Breaks

Stripping: The manifest is metadata. It can be removed by resaving the image, screenshotting it, or passing it through any number of image processing pipelines that don’t preserve EXIF/XMP/metadata. A screenshot of a DALL-E image has no manifest. A JPEG resaved through an aggressive compressor has no manifest. There is no content-binding that survives stripping — the signature only validates what it can see.

Absence is not evidence of inauthenticity: An image without a C2PA manifest might be AI-generated with the manifest stripped, or it might be a real photograph from a camera that doesn’t support C2PA, or it might be AI-generated by a tool that doesn’t sign. You cannot distinguish these cases from absence alone. The presence of a valid manifest is meaningful; the absence of a manifest is not.

Forgeable signing infrastructure: C2PA trust ultimately depends on the CA hierarchy and the integrity of signer credentials. A compromised signing key could produce valid-appearing manifests for false claims. This is the same PKI trust problem that underlies HTTPS certificate authorities — meaningful but not unconditional.

The social engineering surface: C2PA validates origin claims, but the claimed origin has to mean something. A well-constructed fake provider with a legitimate-looking certificate and a manifest claiming “captured by CanonCamera Pro v2.0” would pass signature validation. The trust model requires that the claimed signers are in a list of trusted entities — which requires governance and maintenance of that trust list.

SynthID: Signal in the Latent Space

SynthID takes a fundamentally different approach. Instead of attaching metadata to content, it embeds a signal into the content itself — a watermark that survives in the pixels (for images) or audio samples or token distributions, even through typical processing.

Google DeepMind published the technical details in Nature (2024). For images:

• During generation, a learned watermark is applied as a subtle, imperceptible modification to the pixel distribution.
• The watermark pattern is cryptographically keyed — only holders of the corresponding key can reliably detect it.
• The detection model is trained to recognize the statistical pattern while being robust to common image transformations: JPEG compression, resizing, slight color adjustments, and other routine processing.

For text, SynthID uses a different mechanism: token distribution shifting. The model subtly modifies the probability distribution over next tokens at generation time in a way that introduces detectable statistical patterns while preserving semantic quality. This doesn’t require post-processing; the watermark is baked into the sampling process itself.

Google has deployed SynthID across several products: Imagen (image watermarking), Veo (video watermarking), and select Gemini surfaces (text watermarking). Coverage varies by product version and surface — rollout has been incremental and not all Gemini endpoints apply text watermarking uniformly. Detection access has been made available through Google’s API, though access and coverage specifics have been product-specific and subject to change.

What SynthID Can Establish

SynthID addresses the stripping vulnerability: you can’t strip a watermark by removing metadata because the watermark is in the content. For images, the watermark signal is typically robust enough to survive a screenshot under normal display conditions — though aggressive processing, heavy compression, or unusual display pipelines can degrade or destroy it. The image section of this post treats robustness as an empirical property (which it is), and the same probabilistic framing applies here: screenshots usually work, not always. For text, the story is more constrained: text watermark detection is model- and tokenizer-specific, so patterns embedded by one model or endpoint may not be detectable by a detector calibrated for a different surface. The statistical signal survives copy-paste in principle, but detection depends on having a compatible detector for the surface that generated the content.

Detection is probabilistic — high confidence under typical transformations, degraded under severe modifications. The DeepMind paper describes detection output in terms of confidence scores, and the product API exposes a categorical interpretation (commonly: detected, not detected, inconclusive) as a convenience layer over those scores. If you’re building on the API, treat the categorical labels as bucketed confidence ranges, not hard binary outcomes — and check the actual interface contract for the endpoint you’re using, as output shape can vary by modality and API version.

Where SynthID Breaks

Destructive transformations: Heavy recompression, aggressive editing, significant cropping, or filtering can degrade the watermark signal below detection threshold. The research shows high robustness for typical processing, but adversarially optimized transformations are a different story.

Adversarial removal: If you know a watermarking scheme’s properties, you can often attack it. The SynthID paper acknowledges this and positions robustness as an empirical property rather than a theoretical guarantee. An attacker with sufficient motivation and access to a detection oracle could, in principle, probe and remove the watermark.

Scope limitation: SynthID only works for content generated by Google’s tools. A deepfake generated with an open-source model has no SynthID watermark and no C2PA manifest. The provenance problem for non-participating generators is unaddressed.

Text watermarks and quality: Token distribution shifting trades imperceptibility for robustness differently than image watermarks do. For short texts, the statistical signal is weaker — watermarking works better on longer generations. For adversarially paraphrased text, the signal degrades further.

The Interaction Between Approaches

C2PA and SynthID are complementary, not competing. The combination addresses some weaknesses of each alone:

• SynthID adds persistence that survives metadata stripping: If content is stripped of C2PA metadata but retains the pixel-level watermark, detection of likely generator participation is still possible. This is not the same as cryptographic binding — SynthID can suggest the content probably passed through a Google generator, but does not bind it to a specific signer, timestamp, or edit chain the way a C2PA manifest does.
• C2PA provides richer, auditable provenance information: When the manifest is intact, you get a full chain of custody — what generated it, when, and what transformations were applied. SynthID gives you a yes/no (or maybe) on Google-origin; C2PA gives you the detailed story.
• Cross-organization coverage: Different generators use different schemes. An ecosystem where major generators each contribute some provenance mechanism (even different mechanisms) is more robust than a monoculture, though interoperability requires convergence on standards.

The C2PA standard explicitly accommodates watermarks as an assertion type in manifests — a signed manifest can claim a SynthID watermark is present. This allows the approaches to reinforce each other when both are applied.

The Adversarial Baseline

For either approach to matter in security contexts, you need to be clear about the adversary.

Casual misattribution (someone reposts an AI image as real without thinking about it) — C2PA largely solves this for intact manifests. Browser and platform integrations that surface Content Credentials badges make the information visible at display time.

Motivated laundering (someone deliberately strips provenance to pass content as authentic) — C2PA alone is insufficient; the manifest can be removed. SynthID helps here but can be defeated by determined adversaries with sufficient processing capability.

Sophisticated disinformation (well-resourced adversary generating content with the specific intent to circumvent detection) — Neither C2PA nor SynthID provides strong guarantees. A sophisticated adversary can avoid participating generators entirely (use open-source models), strip all metadata, and perform adversarial watermark removal. Provenance technology is not a reliable control against this threat class.

This doesn’t make provenance technology useless — it substantially raises the cost and effort required for casual and moderate-sophistication misattribution, which covers a large fraction of real-world cases. But security planning that relies on provenance as a hard control against sophisticated disinformation is misplaced.

Platform and Browser Integration

The detection capability has to be integrated into distribution surfaces to matter. A C2PA manifest embedded in an image that’s displayed in a browser with no manifest-checking code doesn’t help anyone.

Current integrations:

• Adobe’s Content Authenticity Initiative provides browser extensions and an inspection tool at contentcredentials.org.
• Google’s SynthID is available through a public API for detection, and has integrations with some Google surfaces.
• LinkedIn has announced C2PA support for job candidate images.
• Leica, Nikon, and Sony have announced or begun piloting C2PA support in select camera models — establishing camera provenance in hardware, not just AI-generation provenance, though broad production rollout across model lines is still in progress.

The long-term vision is platform-level integration — when you view an image in Chrome or iOS Photos or Twitter, you see a provenance badge automatically. That requires browser and OS vendors to integrate the verification stack. The pieces exist; the distribution is incomplete.

What Security Teams Should Take From This

For content authenticity programs: C2PA manifests on AI-generated content are now production-grade at major generators. You can build policies around them. Recognize that enforcement is probabilistic, not absolute — manifests can be stripped, and absence is not proof of inauthenticity.

For disinformation threat modeling: Treat SynthID as a useful forensic tool with limited hard-guarantee value. Its primary value is in attribution assistance for investigation after the fact (you have a piece of content, you want to know if it came from a specific generator), not as a reliable prevention control.

For platform trust decisions: Neither C2PA nor SynthID resolves the underlying governance problem — who do you trust, and to make what assertions? The trust in a C2PA manifest is only as good as the trust in the signing entity. The detection capability of SynthID is only as good as your access to the detection service. Both require maintaining trust relationships with the generators themselves.

For open-source model deployments: Neither C2PA nor SynthID does anything about content generated by open-source models or private fine-tuned models. If your threat model includes adversaries who deploy their own generation stack, provenance from participating commercial generators is a partial signal at best.

Current Limitations and What’s Missing

The most significant gap in the current provenance landscape is ecosystem incompleteness. For provenance to work reliably, generators need to participate and consumers need to check. Currently:

• Major commercial generators are mostly participating or committing to participate.
• Open-source generation is largely non-participating.
• Platform verification is partial — most content is not checked at display time.
• Chain-of-custody tracking for derivative works (what if you take a real photo and AI-upscale it?) is underdeveloped.

There’s also the verification user experience problem. The technical machinery exists, but most users never see a provenance badge. Even when one is present, most users don’t understand what it means. Behavioral security properties require user-visible and user-comprehensible signals.

Content provenance is a meaningful, incrementally deployable defense against a real class of content authenticity threats. It’s not a complete solution. OpenAI and Google shipping it at scale is a genuine advance — it makes the infrastructure exist and establishes the precedent that large generators are responsible for marking their output. The security value depends on how broadly the ecosystem converges and how well the verification tooling gets integrated into the surfaces where content actually reaches users.

The honest framing: C2PA and SynthID are necessary infrastructure, not sufficient controls. They narrow the attack surface meaningfully for casual and moderate-sophistication misattribution. They do not provide reliable guarantees against motivated adversaries with their own generation infrastructure. Planning security programs accordingly is the right call.

---

Related posts: ML Model Provenance: Signing, SBOMs, and Verification — for the related problem of provenance verification for model weights rather than generated content.