Detecting whether an image is synthetic is a losing race — detection improves, generation improves faster, and the arms race has no stable equilibrium. Content provenance takes the opposite approach: instead of examining a file for signs of synthesis, attach a cryptographically signed record at creation describing what made it and what edited it since.
The reasoning is sound. The deployment has a structural weakness worth understanding before relying on it.
What changed in 2026
- Camera and software support broadened. More capture devices and editing applications gained the ability to write and preserve credentials through an editing workflow.
- Platform display improved unevenly. Some platforms began surfacing credential information to viewers; many continued stripping metadata on upload.
- Generative tools attached credentials by default. Major image generation services began marking output as synthetic in the credential chain.
- The absence problem stayed unsolved. With most content carrying no credential, missing metadata remained uninformative, which limits what the standard can prove.
What a credential contains
| Element |
Purpose |
| Creation record |
What device or software produced the file |
| Edit history |
What operations were applied, and by what |
| Generative disclosure |
Whether AI generation was involved |
| Signing identity |
Who vouches for the record |
| Cryptographic signature |
Detects tampering with the record itself |
| Ingredient references |
Which source assets contributed |
The chain-of-edits property is the useful part. A photograph that was captured by a specific camera, cropped in a named editor, and colour-corrected has a verifiable history. If someone alters the pixels afterwards without updating the credential, the signature no longer validates and the tampering is detectable.
The asymmetry problem
Here is the structural weakness. A credential can prove a file has a documented history. It cannot prove anything about a file with no credential — and most files have none, because most cameras, most software, and most platforms do not produce or preserve them.
So the standard supports a positive claim well and a negative claim not at all. It can establish that an image genuinely came from a particular news organization's camera. It cannot establish that an image without credentials is fabricated, because the overwhelmingly common reason for missing credentials is that nothing in the chain wrote them.
Stripping compounds this. Screenshotting an image removes the credential entirely. Many platforms strip metadata on upload for privacy and size reasons. Re-encoding removes it. So even content that started with credentials frequently arrives without them, and the recipient cannot distinguish stripped from never-present.
The practical consequence is that content credentials work for workflows where provenance is asserted and checked deliberately — newsrooms, legal evidence, insurance claims, stock licensing — and do much less in the open information environment where most people encounter media. The verification habits in how to spot deepfakes remain the day-to-day tool.
Common mistakes
- Reading missing credentials as suspicious. Most content lacks them for mundane reasons.
- Assuming platforms preserve them. Many strip metadata on upload.
- Treating a credential as a truth claim. It documents process, not accuracy — a real photograph of a staged scene has valid provenance.
- Relying on it for consumer-facing verification. Coverage is too sparse.
- Ignoring it in professional workflows. Where both ends control the chain, it works well.
FAQ
Does a content credential prove an image is real?
It proves a documented creation and edit history that has not been tampered with. Whether the scene depicted is genuine is a separate question the standard does not address.
Can credentials be faked?
The signature makes forgery difficult without a valid signing identity. The easier attack is stripping the credential and presenting the file as unmarked, which is indistinguishable from the common case.
Do AI generators mark their output?
Major services increasingly do. Open-source tools generally do not, and marking can be removed.
Is this the same as watermarking?
No. Watermarking embeds a signal in the pixels that survives some processing. Credentials are metadata attached alongside. They are complementary and both are strippable, by different means.
Where to go next
For the detection side, read how to spot deepfakes and deepfake liveness checks. For content quality rather than provenance, AI slop detection.