A screenshot of a "leaked document." A photo of an event that may or may not have happened. A clip of a public figure saying something they never said. In 2026 the default question about any piece of online media is no longer "what does this say?" but "is this real?" — and for the product teams who run upload forms, comment sections, marketplaces, and newsrooms, that question has quietly become an engineering problem.
The instinct is to reach for a detector: feed the image or text to a model that says "AI-generated" or "human." That instinct is wrong, and the evidence is now clear enough to act on. The durable answer is the opposite of detection — it's provenance: cryptographically proving where a piece of content came from and what was done to it. This post explains why the detection approach is a dead end, how the provenance standard (C2PA / Content Credentials) actually works, and what web teams should build now.
Why Detection Is a Losing Game
Detecting AI-generated content after the fact is seductive because it requires nothing from the content's creator. It also doesn't reliably work, for two structural reasons.
Watermarks degrade under ordinary editing. Google DeepMind's SynthID — the most widely deployed watermarking system, having marked over 10 billion pieces of content by May 2025 across text, image, audio, and video — embeds an invisible signal designed to survive transformations like cropping and compression. For images it holds up reasonably well. For text, independent peer-reviewed testing tells a harder story: researchers at Queen's University found that SynthID's text watermark drops from perfect detection to an F1 of 0.842 (with a 23% false-positive rate) under aggressive paraphrasing, and to 0.711 under back-translation through another language. A watermark that a round-trip through a translator can wash out is not a foundation you can build trust on.
Detectors produce false positives that hurt real users. Pure "AI or not" classifiers routinely flag genuine human work as machine-made — a failure mode that has already cost students grades and writers contracts. In any system where a wrong "this is fake" verdict has consequences, a detector's false-positive rate is not a footnote; it's the whole risk.
The deeper problem is adversarial. Detection is a cat-and-mouse game against people actively trying to evade it, and the evader moves second. Every detector becomes training data for the next generation of fakes. This is the same trap we described in using AI features without making the product fragile: building a core guarantee on a model's probabilistic guess about adversarial input is a guarantee that erodes.
The Shift: Prove Origin, Don't Detect Fakery
Provenance flips the problem. Instead of asking "is this fake?" — an unanswerable question at scale — it asks "can this content prove where it came from?" Authentic content carries a signed, tamper-evident record of its origin and edit history. Everything without that record is simply unverified, which is a far more honest and defensible status than a detector's confident-but-wrong "human" or "AI."
The industry has consolidated around one standard for this: C2PA, the technical specification behind the Content Credentials you may have seen as a small "cr" icon on images. It's developed by the Coalition for Content Provenance and Authenticity, run as a Linux Foundation Joint Development Foundation project whose members include Adobe, Google, Microsoft, the major camera makers, and — recently — Meta. As of June 2026 the current published spec is version 2.4 (April 2026). This is no longer a proposal; it's a maturing, shipping standard.
How Content Credentials Actually Work
At the core is the C2PA Manifest — a verifiable unit attached to an asset, made of exactly three parts (per the spec and white paper):
- Assertions — individual statements about the content: who created it, what device or software made it, what edits were applied, whether generative AI was used. The spec defines 20 standard assertions and is extensible beyond them; every manifest must include an actions assertion and a hard binding assertion.
- The Claim — a single structure that gathers the assertions plus the hashes that bind them to the actual bytes of the asset.
- The Claim Signature — a digital signature (a COSE structure, using X.509 certificates and SHA-256 hashes) that the claim generator produces on the signer's behalf. This is what makes the whole thing tamper-evident: alter the pixels or the metadata and the cryptographic linkage breaks, and verification fails.
The critical design distinction is between two kinds of binding:
- A hard binding is a cryptographic hash that uniquely identifies the asset (or part of it). It proves the manifest belongs to this exact file and that the file is unmodified. Every manifest has exactly one.
- A soft binding is a non-unique identifier — an invisible watermark or a perceptual fingerprint — that can match a re-rendered version of the content even after the exact bytes change. A manifest can have zero or more.
That second concept is where provenance and watermarking stop being rivals and become teammates: the watermark isn't the proof, it's the lookup key.
The Hard Part: Platforms Strip the Credentials
Here is the limitation no honest write-up should bury. C2PA's own security specification states it plainly: the design makes tampering evident, but it offers no protection against the complete removal of manifests from assets. And complete removal is exactly what happens every day — most social platforms re-encode images on upload and strip the embedded metadata, taking the Content Credential with it. Screenshot an image and the credential is gone too.
If embedded credentials were the whole story, provenance would be dead on arrival. The fallback is the soft binding: the content carries an invisible watermark or fingerprint, the full manifest lives in an external Manifest Repository, and a Soft Binding Resolution API lets a verifier recover the credential by matching the surviving watermark — even after a platform stripped the embedded copy. Infrastructure is starting to carry this load: Cloudflare became the first major CDN to preserve Content Credentials as images pass through it.
It's still imperfect — a determined actor can strip the embedded manifest and attack the watermark, and unsigned content will always exist. But the goal was never DRM. It's a verifiable chain for the honest majority, not an unbreakable lock against every bad actor.
What Web and Product Teams Should Do Now
You don't need to be Adobe to participate. The tooling is open source under the Content Authenticity Initiative, with a CLI (c2patool), a Rust library (c2pa-rs), and a browser SDK (c2pa-js) for reading and displaying credentials. Concretely:
- Sign what you publish. If your product generates or hosts original media, attach Content Credentials at the source — the moment of capture, render, or export. Provenance is only as good as how early in the pipeline it starts.
- Stop stripping credentials in your own pipeline. The most common own-goal: your image-resize, re-encode, or CDN step quietly discards C2PA metadata on every upload. Audit your media pipeline and preserve (or re-sign) credentials through transforms. This is exactly the kind of quiet decision that compounds, in the spirit of the frontend decisions that save weeks later.
- Verify on ingestion, and show users what you find. When content enters your system, read its credentials and surface the result — the "cr" icon, the capture device, the AI-tool disclosure. Don't render a binary "real/fake"; show the provenance and let users judge, the same way good human-in-the-loop design presents evidence rather than a verdict.
- Treat "unverified" as a first-class state. Most content won't have credentials for years. Design your UI for three states — verified, verified-but-edited, and unverified — not two. A missing credential is not proof of fakery.
- Get ahead of the regulation. The EU AI Act's Article 50 introduces transparency obligations to mark and disclose AI-generated content in machine-readable form, with the relevant provisions expected to apply in 2026 (confirm the exact date against the current text before you commit a roadmap to it). Building on C2PA now is the most credible way to be ready.
This is also the natural counterpart to the agentic web: as AI agents increasingly generate and act on content, machine-readable provenance is what lets one agent trust another's output instead of guessing.
The Realistic Take
Content provenance is a nutrition label, not a force field. It will not stop a determined faker, it does not retroactively authenticate the billions of unsigned files already online, and its weakest link — metadata stripping — is still being patched at the infrastructure layer. Anyone selling it as a deepfake cure is overselling.
But the alternative — detection — is a game you lose a little more every model release, with real users caught in the false positives. Provenance is winnable because it doesn't require catching liars; it only requires giving honest creators and honest software a way to prove themselves, and giving everyone else a clear, calm "unverified." For product teams, the move in 2026 is to stop asking your stack to spot fakes and start asking it to carry proof. Sign what you make, preserve what you pass through, and show people the receipts.
