The Three Invisible Marks on an AI Image

An image generated today can leave with evidence at three separate levels, made by different mechanisms with different failure modes. They get discussed as though they were one thing — "the AI watermark" — and they are not. One may be a text field. One may be a signed document. Another may be in the picture itself.

Layer one: metadata, which is a claim

The simplest marker is a string in the file header. xmp:CreatorTool saying DALL-E 3. A PNG text chunk called parameters holding the full prompt, seed, sampler and model name, which is what Stable Diffusion interfaces write by default and what makes local generations the easiest of all to identify.

The one worth knowing by name is the IPTC digital source type. It is an XMP property, Iptc4xmpExt:DigitalSourceType, and its value is an IRI ending in a token from a controlled vocabulary: trainedAlgorithmicMedia for something a model generated, compositeWithTrainedAlgorithmicMedia for a composite containing generated elements, digitalCapture for a photograph taken by a camera. It is the closest thing to a standard machine-readable "this is AI" flag, and a growing number of generators and camera makers write it.

It is also a text field. Anyone with a metadata editor can add trainedAlgorithmicMedia to a photograph or delete it from a generated image, in seconds, without touching a pixel. Metadata tells you what a file says about itself. That is genuinely useful and it is not evidence.

Layer two: C2PA, which is a signed document

Content Credentials solve the "anyone can edit it" problem the way the web solves it everywhere else: a signature. A C2PA manifest is a structured record — a claim naming the generator, a set of assertions describing what was done, thumbnails, hashes of the asset itself — wrapped in a COSE signature with an X.509 certificate chain.

It is stored as JUMBF, the JPEG box format, and where that box sits depends on the container. In a JPEG it goes into APP11 marker segments, each prefixed with the two bytes JP, a box instance number and a packet sequence number, because a manifest with a thumbnail comfortably exceeds the 64 KB a single segment can hold and has to be split across several. In a PNG it goes into a caBX chunk. In a WebP it goes into a RIFF chunk with the fourcc C2PA. Plenty of tools that claim C2PA support look only in APP1 and APP2, find nothing, and report the file as clean.

Reading a manifest and verifying one are different jobs. Reading gives you the claim: the generator, the actions, the declared source type, the names on the certificate. Verifying means checking the signature against a trust list and confirming that the hashes still match the pixels — which is what catches a manifest copied out of one file and pasted into another. Anything that only reads, including a browser tool, is reporting what the file asserts.

And the manifest is fragile by construction. It is bound to the bytes of the asset; edit the asset with something that does not understand C2PA and the binding is broken, so the sane behaviour is to drop it. Open in an editor, export, upload to a platform that re-encodes: gone. Not defeated — simply absent, indistinguishable from an image that never had one.

Layer three: the pixels, which do not wash out

SynthID takes the opposite approach. Instead of attaching a record to the file, it perturbs the pixel values themselves, in a pattern a matching detector can recognise and an eye cannot see. Because the mark is in the picture, it is designed to remain detectable after transformations that often remove the other two: re-encoding, cropping, colour adjustment, filters and screenshots.

What you can run is classical steganalysis and signal forensics, which examine several statistical and physical characteristics:

1. Low-bit planes and RS steganalysis. Do the low-order bits look written to? Flip the least significant bit of a natural image and it gets locally rougher in a predictable way; flip bits that already carry a payload and it does not, and the gap between the two behaviours yields an estimated share of pixels carrying an embedded bit. Per-block RS estimates generate an interactive heatmap of localized anomalies.
2. Frequency domain and 2D FFT. Mathematical 2D Fourier spectra of generative imagery often display artificial frequency harmonics: transposed convolution and upscaling layers leave characteristic periodic grids ("deconvolution artifacts"). Here, it is vital to mathematically isolate standard JPEG $8 \times 8$ block compression harmonics from anomalous generative lattice peaks, and measure the radial power spectral density slope $\alpha$ (optical camera photographs decay with power-law distribution $1/f^\alpha$ where $\alpha \approx 1.8–2.2$).
3. DCT Benford's Law conformance. The distribution of the first significant digit of AC coefficients in $8 \times 8$ Discrete Cosine Transform blocks in unmanipulated photographs follows Generalized Benford's Law. Generative synthesis and tampering induce statistical divergence measured via the Kolmogorov-Smirnov distance ($D_$).
4. Sensor noise residual profiling. In physical camera captures, photon shot noise varies with luminance (higher relative variance in shadows). Generative models with additive Gaussian noise or aggressive smoothing often exhibit unnaturally homogeneous noise variance across all brightness bands.

Be clear about what these estimates are worth. Heavy JPEG recompression, aggressive denoising and ordinary steganography all move the numbers. They answer "what statistical and spectral anomalies exist in these pixels", never "which commercial watermark is this".

How to interpret pixel analysis metrics

When container markers are absent or stripped, forensic analysis relies on spectral and statistical anomalies. Here is how to interpret key indicators:

What survives what

Read down the columns and the practical situation is plain. The two layers that carry a name and a signature are fragile in ordinary workflows, while a proprietary pixel mark is designed to be more resilient and needs its matching detector. Which is why the absence of readable markers means much less than people assume: after a re-encode, missing container evidence is common.

The regulation arriving in parallel does not resolve this. Article 50 of the EU AI Act requires providers to mark synthetic output in a machine-readable form, and those obligations started applying in August 2026 — but it does not mandate a single technical format, which is precisely why you find manifests, source-type fields and invisible pixel patterns in circulation at once.

What the browser tool can do

I built an AI watermark detector that inspects supported evidence in the browser without uploading the image to a server:

• Container & metadata inspection: scans EXIF fields, PNG text chunks, XMP properties, and IPTC DigitalSourceType vocabularies (including trainedAlgorithmicMedia and generator parameters).
• C2PA / Content Credentials parsing: locates and reassembles fragmented JUMBF boxes across JPEG APP11 segments, PNG caBX chunks, and WebP C2PA chunks, decoding the CBOR manifest and claim assertions (stating plainly that cryptographic signature validation is not performed in the browser).
• Pixel & spectral signal forensics in a Web Worker:
  • Per-channel RS steganalysis with estimated embedding rate and interactive per-block heatmap;
  • 2D FFT spectrum analyzer with thermal power spectrogram visualization, radial slope $\alpha$ decay estimation, and isolation of JPEG $8 \times 8$ harmonics from non-JPEG deconvolution grid spikes;
  • $8 \times 8$ block DCT Generalized Benford's Law compliance testing;
  • Sensor residual noise variance homogeneity evaluation across 5 luminance bands.
• Verified re-encoding: generates cleaned JPEG, PNG, or WebP output, re-scanning the container before download and blocking the save if removable EXIF, XMP, IPTC, or C2PA evidence remains. Optional low-bit perturbation is experimental and does not guarantee removal of proprietary pixel watermarks.
• Client privacy & export: all computations run strictly on the client; supports direct cross-origin image fetching without a server proxy and full JSON diagnostic report exports.

Related tools

AI Watermark DetectorInspect a JPEG, PNG or WebP for C2PA Content Credentials, declared AI metadata and generic statistical pixel anomalies. Coverage limits stay visible, and re-encoded output is scanned again for removable container markers before download.EXIF InspectorSee the EXIF, GPS and other metadata hidden inside a JPEG, PNG or WebP photo — camera model, exposure settings and the exact place it was taken — then remove exactly what you pick, or write your own title, author and copyright back in.LSB SteganographyWrite text into the least significant bits of an image's pixels so the picture looks unchanged, optionally encrypt it with an AES-256 password first, and read the message back out of the PNG later.Image OptimizerBatch-compress up to 10 PNG, JPEG or WebP images, set maximum dimensions or a target size, compare before and after, then download individually or as a ZIP — fully client-side.