C2PA and invisible watermarks: how they differ, and why AI images use both

Published 12 October 2026

Two techniques do most of the work of marking AI-generated images. A C2PA manifest is signed metadata attached to the file. An invisible watermark is a signal hidden in the pixels themselves. They fail in different ways, which is why the larger AI providers now use both.

Side by side

	C2PA manifest	Invisible watermark
Where it lives	In the file's metadata	In the image's pixels
What it carries	A full, signed statement: who signed it, what tool made the file, and how AI was involved	A small payload, usually an identifier
Who can read it	Any C2PA reader, from any vendor	Only a detector for that watermark
Forging it	A changed manifest no longer validates, because it is cryptographically signed	Depends on the scheme. The payload itself is not a signed statement
Removing it	Easy. Many tools and platforms strip metadata, often by accident	Harder. It survives some edits, but heavy processing can destroy it

C2PA Content Credentials

C2PA is an open standard from the Coalition for Content Provenance and Authenticity (C2PA, the Coalition for Content Provenance and Authenticity). A manifest is a set of assertions, such as "this image was created by a trained model", signed with a certificate. Any conforming reader can check the signature and show the statement, so the mark is interoperable by design.

Its weakness is that it is metadata. Digimarc notes that uploading to a social network, sending through a messaging app or editing in a phone app commonly strips it (Digimarc, "How Digital Watermarks Strengthen C2PA Content Credentials"). A screenshot never carries it at all.

Invisible watermarks

A watermark changes the pixels slightly, in a pattern a detector can find again after the image has been re-encoded or resized. Two examples:

SynthID, from Google DeepMind, embeds a signal directly into generated media (OpenAI Help Center, "Provenance signals in OpenAI-generated content").
TrustMark, Adobe's open-source watermark, was built to pair with C2PA (Adobe TrustMark: using TrustMark with C2PA).

A watermark carries little information and needs its own detector. On its own it can say "this carries mark number N" but not, in a signed and portable way, who made the image or how.

Why they are combined

Each covers the other's weakness. If the manifest is stripped, a watermark that carries an identifier can be used to look up a stored copy of the manifest. C2PA calls this link a soft binding, and Adobe describes it as a durable Content Credential (Adobe TrustMark: using TrustMark with C2PA). If the watermark is damaged, the manifest, where it survives, still carries the full signed statement.

Providers do this in practice:

OpenAI says images generated with ChatGPT, Codex or its API carry both Content Credentials and SynthID watermarks (OpenAI Help Center, "Provenance signals in OpenAI-generated content").
Anthropic says Claude attaches Content Credentials to the files it generates, where supported, and embeds watermarks in generated text (Claude Help Center, "How Claude marks AI-generated content").

Neither is proof

A determined attacker can strip the metadata and process an image until the watermark fails. A file with no mark has not been shown to be human-made. Measure how well a watermark survives on your own images before relying on it. In Tellmark's own test, a TrustMark watermark decoded on 20 of 20 test images after JPEG re-encoding at quality 75, a 50% resize and a WebP round trip. Nothing beyond those three changes was measured (Tellmark, what marking cannot do).

How Tellmark uses both

Tellmark adds a signed C2PA manifest stating that an image was made or changed by AI, plus a TrustMark watermark carrying a mark ID. If the manifest is stripped and the watermark survives, the checker reads the ID and finds the original record. To add a manifest yourself, see how to add C2PA Content Credentials in Python.

Sources

Related guides

Describes technical measures. Not a legal assessment.