Image: TechcityAuthority

Picture a striking image that spreads fast. On one site it carries a small tag saying it was made with AI. A friend sends you a screenshot of the same picture on a chat app, and the tag is gone. Nothing about the image looks different. So which version is telling the truth?

The honest answer is that both can be, and that is the problem. AI image labels come in two main forms. One lives in the file. The other lives in the pixels. They behave very differently once an image starts moving around the internet. This guide explains what each one can prove, where each one breaks, and how to read a result without being misled by it.

Two kinds of label

The first kind is C2PA metadata, also called Content Credentials. The Coalition for Content Provenance and Authenticity describes it as an open technical standard that records the origin and edits of digital content. The group compares it to a nutrition label. The record is signed with cryptography and stored inside the image file. It can say which tool made an image, when, and what changed afterward. Camera makers and news outlets use it too, not only AI companies.

The second kind is an invisible watermark woven into the pixels. The best known is SynthID, built by Google DeepMind. According to Google DeepMind, it is designed to withstand cropping, filters and lossy compression. It carries much less detail than a C2PA record. It mostly says that a supported AI tool made the image.

Google uses both. So does OpenAI. In a May 19, 2026 announcement, OpenAI said it was adding SynthID through a partnership with Google, starting with images from ChatGPT, Codex and its API. OpenAI already added Content Credentials to its images and says it is now a C2PA conforming generator. Its help center says images from those products now carry both signals. It also notes some gaps. Coverage varies by product, model, export path and creation date. API models planned for imminent retirement, including gpt-image-1 and gpt-image-1.5, are not covered.

Image: TechcityAuthority

Why the metadata usually disappears

Metadata sits around the pixels, not inside them. Anything that rebuilds the file can drop it. OpenAI says so plainly. In its announcement, the company wrote that metadata can be stripped, lost through uploads and downloads, or broken by format changes, resizing or screenshots. A screenshot is a brand new file. It copies what is on screen and leaves the old record behind.

Social platforms add to this. A research page from AFIP, which calls itself the Alliance for Forensic Integrity and Provenance Standards, says it tested six major platforms. It reports that Instagram, X, TikTok, WhatsApp and LinkedIn stripped C2PA data every time. Facebook kept it in about 40% of cases, but only in certain creator flows. Ordinary re-shares lost it. AFIP notes that platforms strip metadata for legitimate privacy and bandwidth reasons. Two caveats apply. AFIP promotes its own forensic checks as an alternative to C2PA, and its findings have not been independently reviewed.

A separate preprint on Zenodo by independent researcher Anand Sundaramoorthy points the same way. It has not been peer reviewed. The author ran ten AI images through a Canva export, a screenshot, a WhatsApp transfer and an Instagram post. The paper says the C2PA record was gone after the first step in every case.

Why the watermark tends to last

A pixel watermark travels with the picture itself. In July, Ars Technica put SynthID through a stress test. Reporter Ryan Whitwam wrote a script that compressed and resized two Google AI images over and over, 300 times. By the end they were barely recognizable blobs. Gemini still flagged both as carrying SynthID. A screenshot of the result also kept the mark.

Ars did find limits. After 300 rounds of compression, cropping 20% from the border made SynthID undetectable. A 50% crop broke it earlier, at around 250 rounds. Those images were badly degraded by then, but the point stands. Heavy damage plus heavy cropping can wipe the signal. OpenAI gives a similar warning and says heavy cropping and compression can make the watermark undetectable.

Pushmeet Kohli of Google DeepMind told Ars, "Through the whole development process, we sort of assumed that a technology like this will be attacked." Ars also noted that the original SynthID research paper says the watermark is not meant to withstand adversarial attacks. In plain terms, it is built to survive everyday sharing. It is not promised to beat someone who sets out to remove it. Ars pointed to a Reuters finding that cropping often removed Meta's own watermark, a reminder that not every watermark is equally tough.

The Zenodo preprint reached a similar result for ordinary use. It says SynthID survived every single action and every chain of actions, for both Google and OpenAI images, when read by each company's own detector.

The detection gap

A watermark only helps if someone can read it. This is where things get messy.

OpenAI's checker at openai.com/verify looks for OpenAI signals only. The company says it does not detect AI content from other providers. Ars reported in July that Google offered no public SynthID webpage or API at the time. Checks ran through Gemini and were capped at about 10 images a day. Ars also reported that each company's detector failed to recognize the other company's SynthID images. The Zenodo preprint describes the same split and concludes that no single public tool read both.

That picture may be shifting. Google DeepMind's SynthID page now says its SynthID Detector portal is expanding to everyone. It says the portal checks content from Google and partners, naming OpenAI, NVIDIA and Kakao, with Apple listed as coming soon. Google told Ars it was working with industry partners to make verification "more accessible and unified." How well the expanded portal reads other companies' images has not yet been independently tested.

Even a perfect shared detector would leave a hole. Open image models that people run on their own computers usually add no label at all. Ars made this point too. A missing watermark can simply mean the image came from a tool that never added one.

When two labels disagree

A paper on arXiv from researchers at Case Western Reserve University and UCLA describes an odder failure. The authors call it an integrity clash. An image carries a valid, signed C2PA record saying a human edited it. Yet its pixels hold an AI watermark.

The researchers say building one is easy. The C2PA standard lets a record leave out the field that declares AI involvement. They tested 500 AI images marked with Meta's Pixel Seal watermark. The watermark survived JPEG compression, a 10% crop and simulated screenshots. Meanwhile the Content Credentials verify tool showed the images as human edited. The paper argues that checkers should read both layers together. Its own combined audit flagged every one of 3,500 test images correctly.

The lesson for readers is simple. A clean C2PA record is a claim by whoever signed it. It is not proof that no AI was involved.

Image: TechcityAuthority

A reader checklist

Here is how I would approach a suspicious image, based on what the companies and researchers above have published.

1. Treat a positive result as useful but narrow. If OpenAI's tool or Google's detector finds its signal, the image very likely came from that company's tools. OpenAI stresses that this does not confirm the content is accurate, unedited, owned by the poster or shown in the right context.

2. Treat a negative result as close to meaningless. OpenAI lists several reasons a real AI image can show no signal. It may predate the labels. It may come from an unsupported product. Its metadata may be stripped, or its watermark degraded. And no company's checker sees everything.

3. Use the checkers that exist. That means openai.com/verify for OpenAI images, Gemini or Google's SynthID Detector for Google and its partners, and the Content Credentials verify tool for C2PA records. Try the earliest copy you can find, since every re-upload can strip more.

4. Run a reverse image search. Older or larger copies may still carry metadata, or reveal where the picture first appeared.

5. Read a C2PA record as a statement, not a verdict. The arXiv research shows a record can truthfully be signed and still leave out AI use.

6. Check the context. Who posted it first? Does a trusted outlet report the same event? Do other photos from other people match it? No label answers those questions for you.

What the labels can and cannot prove

The published evidence points one way. C2PA metadata is detailed but fragile, and it rarely survives a screenshot or a social upload. SynthID is sturdy through everyday sharing, though Ars showed heavy cropping on top of heavy compression can beat it, and Google's own researchers never promised it would stop a determined attacker. Detection is still split across companies, even as Google says that is changing.

So when one site labels an image as AI and another does not, the label that is missing tells you very little. The label that is present tells you where the image likely came from. Neither one tells you whether it is true.