Short answer. With two mechanisms that fail in opposite directions, which is why serious pipelines run both. C2PA Content Credentials attach a cryptographically signed manifest to the file recording what made it and what was done to it — strong evidence, easily removed, because stripping metadata is trivial and ordinary re-encoding does it by accident. Invisible watermarking such as Google's SynthID embeds a signal in the pixels or audio itself — it survives re-encoding, cropping and re-upload far better, but proves only that a particular generator family made the file, not its edit history, and only where a detector exists. Neither is a lie detector, and the asymmetry that matters most is this: absent provenance is not evidence of anything.
This guide covers what each mechanism establishes, where both break in a real distribution pipeline, and how to build a record that holds up when the file itself no longer carries one.
The question provenance can and cannot answer
Two questions get conflated whenever synthetic media is discussed. What made this file, and what has been done to it since? And: is what this file shows true? Provenance technology answers the first and is silent on the second.
A perfectly signed Content Credential can accompany a completely misleading image — an authentic photograph of a real event with a false caption, or a synthetic image honestly labelled as synthetic and still deployed to deceive. That is not a defect in the design; it is the correct scope. It matters because provenance is frequently marketed as an answer to misinformation, and organisations then build policy on the assumption that it settles authenticity.
The defensible version is narrower: provenance makes the origin and edit history of a file checkable, which raises the cost of certain deceptions and gives publishers a way to substantiate claims about their own content.
The asymmetry that trips people up. Provenance is meaningful when present and meaningless when absent. A file carrying a valid manifest tells you something. A file carrying none tells you nothing at all — it might be a camera original from a device that does not write credentials, or a synthetic file whose manifest was destroyed by a resize. Any policy treating missing provenance as a negative signal will eventually produce a false accusation.
C2PA Content Credentials: a signed manifest bound to the file
The Coalition for Content Provenance and Authenticity publishes an open technical specification. In outline: when an asset is created or modified, the producing application writes a manifest into the file recording assertions about it — what device or model produced it, what actions were taken, what ingredients were used — and signs that manifest with a certificate. A validator checks the signature, confirms the manifest is unaltered, and reads the chain. Where an edited asset derives from earlier assets, those appear as ingredients, so the record forms a chain rather than a single stamp.
The specification has moved quickly: version 2.3 published in January 2026 and 2.4 in April 2026, the 2.x line adding support including live video streaming and manifests for unstructured text. The practical marker of adoption is hardware and platform integration — provenance written by capture devices at the point of photography, and platforms surfacing credentials rather than discarding them.
| Claim | Established? | Why |
|---|---|---|
| The manifest is unaltered since signing | Yes | Cryptographic signature over the manifest contents |
| The signer is who they say they are | Conditionally | Depends entirely on the certificate and the trust list used to validate it |
| This asset was produced by the named model or device | As asserted | The manifest records what the producing software claimed; the validator checks the signature, not the truth of the claim |
| These edits, in this order, were applied | As asserted | Only for steps performed by C2PA-aware tools. A step taken elsewhere leaves a gap |
| Nothing else was done to this asset | No | An asset can be exported, edited elsewhere and re-signed. The chain shows what was recorded, not what was omitted |
| The content is truthful | No | Out of scope by design |
The middle rows are where the misunderstanding lives. C2PA validates the integrity of a claim; it does not independently verify the substance of the claim. Published critiques have made this point in detail, and it is worth reading them before building a policy that leans hard on credential presence.
Watermarking: a thin signal that survives the trip
Where C2PA writes into the container, watermarking writes into the content. Google's SynthID embeds an imperceptible signal directly into generated images, audio, video and text, designed to remain detectable after transformations — re-encoding, compression, cropping, colour adjustment — that remove metadata entirely. Google DeepMind's published work describes the image system as operating at internet scale, and Google reported watermarking over 100 billion items by May 2026 across its generative products, with a public detector portal that accepts an upload and reports whether a watermark is present.
The trade-offs are the mirror image of C2PA's. A watermark carries very little information — essentially "this came from a system in this family" — where a manifest carries a detailed chain. Detection generally depends on the embedding party providing a detector, which makes it vendor-scoped rather than an open standard, although cross-vendor adoption has widened. And robustness is a research question rather than a settled property: watermarks are designed to resist removal, and adversaries are designed to remove them.
- Watermarking answers "did a generator make this" across a hostile distribution path where metadata will not survive.
- C2PA answers "what exactly happened to this asset" inside a pipeline you control, and publishes a checkable record alongside the asset.
- Your own records answer both once the file has left your control and come back stripped — which is the common case.
- Neither answers "is this true", and no policy document should imply otherwise.
Building a record that survives your own pipeline
Most provenance failures are self-inflicted and happen inside the producer's own workflow, long before anything adversarial occurs.
- Audit every step for metadata survival. Run one test asset end to end — generation, edit, transcode, upload, download — checking at each stage whether the manifest is still present. The result is usually worse than expected, and it identifies exactly which tool is destroying the record.
- Sign as close to generation as possible. A credential written at generation and carried forward records more than one applied at export. Where a tool in the middle is not C2PA-aware, document the gap rather than re-signing at the end as though the chain were continuous.
- Keep an internal ledger independent of the file. Asset ID, generating model and version, prompt or brief reference, licence, human review record, labels applied, and publication destinations. When the file comes back stripped, this is the only thing that still substantiates the claim — and it is what a client audit actually asks for.
- Layer a watermark where the destination is hostile to metadata. Social platforms, messaging apps and third-party syndication routinely re-encode. A watermark that survives re-encoding is worth more there than a manifest that will not.
- Add a visible disclosure where the law or the audience needs one. A label rendered into the picture is the only mechanism guaranteed to survive every pipeline, because it is the picture. It is also the crudest, so reserve it for asset classes where disclosure is a legal duty or a genuine audience expectation.
- Validate on ingest, not only on export. If you accept assets from agencies, contributors or licensors, check credentials on arrival. Provenance you did not verify at ingest is provenance you are republishing on trust.
How this connects to the labelling rules
Provenance technology is the implementation layer for obligations now written into law. The EU AI Act's Article 50 requires providers of generative systems to mark synthetic outputs in a machine-readable format detectable as artificially generated, applying from 2 August 2026 — machine-readable marking is precisely what a manifest and an embedded watermark provide. China's labelling Measures, in force since 1 September 2025, distinguish explicit labels perceivable by users from implicit labels written into file metadata, which maps almost directly onto the visible-disclosure and embedded-provenance split above. California's AI Transparency Act requires covered providers to embed latent, machine-readable provenance in generated image, video and audio, with later phases placing duties on large platforms not to knowingly strip it.
The convergence is useful: one technical implementation — mark at export, watermark for hostile paths, visible label by asset class, internal ledger throughout — satisfies the mechanics of all three regimes without maintaining separate per-market pipelines.
How Lifewood approaches this
Lifewood applies provenance metadata and disclosure at the delivery stage of its AIGC programmes and maintains the asset-level ledger described above, because in a fifty-language delivery the ledger is the only record that survives every platform's handling. Delivery is also where the marking decision is applied once across every variant rather than retrofitted per market.
Two sentences are worth having ready for stakeholders, because the gap between how provenance is marketed and what it does causes real internal confusion. First: provenance lets us prove what we made and how, which is a claim about our own content we can substantiate to a regulator, a client or a platform. Second: it does not let us prove that someone else's content is fake, and any tool claiming to detect AI content reliably from the file alone should be assumed unreliable until it publishes its false-positive rate.
The second sentence prevents the more damaging mistake. An organisation that adopts a detection tool and starts acting on its outputs will eventually act on a false positive, and the cost of a wrong accusation is considerably higher than the uncertainty it was meant to remove. See AIGC services.
Sources and further reading
- C2PA, Content Credentials specification 2.4 and explainer — Coalition for Content Provenance and Authenticity, April 2026.
- "Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short" — a preprint, not peer-reviewed at time of writing.
- Google DeepMind, SynthID; "SynthID-Image: Image watermarking at internet scale", October 2025; and the public SynthID Detector.
- EU Artificial Intelligence Act, Article 50; China's Measures for Labeling of AI-Generated Synthetic Content; California's AI Transparency Act.
- Companion guides: AI Content Labelling Law: EU, China and the US and AI Content Governance: Disclosure and Provenance.