Short answer
Content credentials are signed labels stored inside a media file that record where it came from and how it was made, following an open standard called C2PA; an invisible watermark instead hides a signal in the pixels themselves. Both can confirm that an image came from an AI tool when the signal is present, but a missing label proves nothing.
Follow-up question Can you rely on them to tell what's real?
Since early February, every image you make with DALL·E 3 in ChatGPT on the web, or through OpenAI's API, carries a small extra record inside the file. OpenAI says mobile users get the same by February 12. That record is a content credential, and it says, in effect, "this picture was generated by DALL·E 3, and it passed through ChatGPT." It's one of two main approaches the industry is trying for labeling AI images. The other is the invisible watermark, which Google DeepMind uses for its own image model.
The two work very differently, and the difference explains both what they're good for and how they fail.
Content credentials: a signed label in the file
C2PA stands for the Coalition for Content Provenance and Authenticity. It's a group founded by Adobe, Arm, Intel, Microsoft and Truepic that writes an open technical standard for recording the provenance of media, meaning its origin and the history of changes made to it. It merges two earlier efforts: Adobe's Content Authenticity Initiative and Project Origin, led by Microsoft and the BBC.
The idea is like a tamper-evident seal. When a tool creates or edits a file, it adds a "manifest," a block of metadata (data about the data) describing what happened, and signs it digitally so that later changes can be detected. The standard isn't only for AI: camera makers and news organizations are adopting it to show that a photo really came from a particular camera or newsroom.
OpenAI's version adds two layers. Images made through the API carry a manifest showing the DALL·E 3 model produced them. Images made in ChatGPT get a second manifest on top, recording that ChatGPT was the app involved. The cost is small: OpenAI gives illustrative examples where a PNG grows from 3.1 MB to 3.2 MB.
Invisible watermarks: a signal in the pixels
A traditional watermark is a visible logo or line of text, easy to crop out. Google DeepMind's SynthID, launched in beta last August for Google Cloud customers using the Imagen model, takes another route. It changes the pixels themselves in a pattern people can't see but a matching detector can. Two AI models are trained together, one to embed the mark and one to find it, and the detector reports one of three confidence levels.
DeepMind designed the mark to survive common edits such as filters, colour or brightness changes and JPEG compression, and it says plainly that the system isn't foolproof against extreme manipulation. Because the signal lives in the image rather than beside it, it can survive when metadata is lost. That's why DeepMind presents watermarking as a complement to metadata, not a replacement.
| Content credentials (C2PA) | Invisible watermark (e.g. SynthID) | |
|---|---|---|
| Where the signal lives | Metadata attached to the file | Inside the pixels |
| What it can tell you | Who made it, with which tool, what edits | Whether a specific tool's mark is present |
| Open standard? | Yes, anyone can read and write it | No, each company's detector reads its own mark |
| Main weakness | Easily stripped | Only the maker can check; heavy edits may defeat it |
A worked check you can do
Here is a short experiment with a DALL·E 3 image.
- In ChatGPT, generate any picture and download it directly to your computer.
- Open a C2PA viewer such as Content Credentials Verify, which OpenAI points to, and upload the file. You should see a credential stating the image came from OpenAI's tools, with the two-part history described above.
- Now open the same image on screen and take a screenshot of it. Upload the screenshot to the viewer.
- Compare. The screenshot will most likely show no credential at all, even though it is the very same picture.
Try it: Repeat step 2 with a photo you took yourself on your phone, then with an image saved from a social media post. Note which ones carry any credential. Most will show none, and that result is the most important lesson of the exercise.
Can you rely on them to tell what's real?
Use them as evidence that something is AI-made when they're present, never as evidence that something is real when they're absent. OpenAI is direct about this: metadata can be removed by accident or on purpose, most social media platforms strip it from uploaded images, and a screenshot removes it too. So, in OpenAI's words, an image without the label "may or may not" have come from its tools.
There are other gaps. Only some generators add credentials or watermarks, and open-source image models run on someone's own computer add nothing unless the user chooses to. Watermarks can only be checked by the company holding the detector. And a credential confirms the history of a file, not whether the scene it shows is true; a real photo can still be captioned misleadingly.
What these labels do well is build a positive signal over time. As more cameras, editing tools and newsrooms sign their files, a verified history will mean more, and its absence will be a reason to look harder. Until then, treat them as one clue among several, alongside the usual checks: who posted the image, whether trusted sources show the same thing, and whether the details hold together.
Sources
- C2PA in DALL·E 3 — OpenAI Help Center, February 6, 2024
- Overview - C2PA — Coalition for Content Provenance and Authenticity, January 7, 2024
- Identifying AI-generated images with SynthID — Google DeepMind, August 29, 2023