5.5Verification, watermark & traceability (C2PA)
The essentials in 30 seconds
- Three mechanisms: visible watermark (simple but croppable), invisible watermark (elegant but fragile), and above all C2PA provenance (Content Credentials).
- Certify the authentic: rather than detecting fakes (a lost race), prove true origin with a signed history — a necessary but insufficient tool.
- At your scale: disclose when expected or mandatory, track prompts and versions, verify what you republish.
Running case — Sonia traces and discloses, to the end
Final episode: Sonia, a freelance graphic designer in Algiers, wraps up the client's production — every delivered visual comes with its prompt, version and parameters, with a discreet “AI-generated” note in the caption; she preserves provenance metadata whenever her tools produce it and verifies the origin of any image she is asked to republish. Final episode of cases 5.1-5.4 — Sonia closes guidelines, video, avatar and campaign with traceability.
Final episode of cases 5.1-5.4 — Sonia closes production with disclosure and traceability.
1. Three traceability mechanisms
The more realistic images become, the more central traceability gets. The visible watermark: an apparent disclosure — simple and readable, but degrading and easy to crop out. The invisible watermark: an imperceptible signature inside the pixels, detectable by dedicated tools — more elegant, but fragile against compression, cropping or retouching.
The third mechanism is the most promising: standardised provenance metadata from the C2PA, known at Adobe as Content Credentials. Sonia preserves them whenever her tools produce them.
2. Certifying the authentic, with its limits
C2PA flips the logic: rather than detecting fakes (a lost race, models progress faster than detectors), you certify the authentic — an image carries a signed history: which tool created it, which edits, by whom. The standard is rolling out progressively, backed by many players.
Limits to know: still partial adoption, removable metadata (a screenshot is enough — the image becomes “uncertified”, not “fake”), an audience to educate, possible workarounds. A necessary but insufficient tool: it replaces neither critical thinking nor source verification.
3. Your responsible approach
At your scale: disclose your generated content when expected or mandatory — platform rules, regulations that vary by country and evolve, sector rules (advertising, media) — and by default unless there is reason otherwise, because transparency protects. Keep prompts, versions, parameters and source files: that is your internal traceability.
Preserve provenance metadata, and adopt the mirror reflex: verify the origin of images you receive before republishing them. Sonia thus delivers a traceable package — and refuses to republish an image of dubious origin. In case of legal doubt, have it validated by a lawyer.
🔎 Concrete example — Sonia's responsible approach
Track and disclose, without improvising.
Disclose generated content when expected/mandatory (depending on the country).
Keep prompts, version, parameters, source files.
→ preserve C2PA metadata; verify what you republish.Reading: traceable, transparent production, with a package to prove it.
Lesson: check the obligations of YOUR country — they evolve.
Section vocabulary
- Visible watermark
- An apparent disclosure flagging a generated image; readable but degrading and croppable.
Simple example: Sonia adds a discreet caption disclosure to realistic visuals.
What it is not: infallible proof of origin.
Reflex: will this disclosure survive a crop?
- Invisible watermark
- An imperceptible signature inside the pixels, detectable by dedicated tools.
Simple example: Sonia's tool signs its outputs without degrading the visual.
What it is not: protection that resists compression and retouching.
Reflex: what remains of the signature after editing?
- C2PA
- The standard for signed provenance metadata: creation and edit history.
Simple example: Sonia preserves the Content Credentials of her files.
What it is not: an infallible detector of every fake.
Reflex: does my whole chain preserve this metadata?
- Certifying the authentic
- Proving the origin of true content rather than trying to detect every fake.
Simple example: Sonia's visual carries its signed, verifiable history.
What it is not: “uncertified” meaning “fake”.
Reflex: am I concluding too fast from an absence?
- Internal traceability
- Keeping your prompts, versions and sources as proof of your approach.
Simple example: Sonia delivers every visual with its prompt, version and parameters.
What it is not: an image delivered with no documentation at all.
Reflex: can I reproduce and prove every visual delivered?
In practice — Setting up a responsible approach
- Define your disclosure rule: which content explicitly mentions AI use, and in what form.
- Check the applicable obligations (distribution platforms, regulation in YOUR country) — they evolve.
- Organise your internal traceability: keep prompts, model versions, parameters and source files.
- Preserve provenance metadata whenever your tools generate it, and verify the origin of images you republish.
Ready-to-say script — announcing transparency to the client
“Every visual I deliver will come with its prompt, the version used and the parameters — that is our traceability. I will add a discreet disclosure for generated content, I will check the obligations that apply to your release, and I will verify the origin of any image to republish. If a sensitive use comes up, I will suggest having it validated by a lawyer before release.”
To say to the client to set transparency as the standard, not an option.
Copy-paste template — visual traceability sheet
VISUAL TRACEABILITY SHEET
VISUAL: ___ · PROMPT: ___ · VERSION: ___ · PARAMETERS: ___
SOURCES: ___ · C2PA preserved? YES / NO / N/A
DISCLOSURE: note ___ placed ___ · OBLIGATIONS checked on ___
REPUBLICATION: origin verified? YES / NO · LEGAL validation if sensitive on ___Solo / small budget
Sonia alone: one folder per visual (prompt, version, parameters) is enough as internal traceability.
Small business / small team
One single displayed disclosure rule: which content carries the note, in what form.
SME in Algiers
In Algiers, Sonia agrees with the client the list of sensitive releases to have validated by a lawyer.
Starting team
Pair: one produces and tracks, the other verifies disclosure and origin before every release.
✓ Best practices
- Disclose generated content by default, especially when realistic.
- Keep prompts, versions and sources: that is your internal traceability and your proof.
- Verify the origin of images before republishing them; never conclude “uncertified therefore fake”.
✗ Common pitfalls
- Believing fake detection is reliable: models progress faster than detectors.
- Ignoring disclosure obligations, which vary by country and evolve.
- Assuming an “uncertified” image must be fake.
Key takeaways
- Three mechanisms: visible watermark (simple but croppable), invisible (elegant but fragile), provenance metadata (C2PA).
- C2PA flips the logic: CERTIFY THE AUTHENTIC rather than detecting fakes (a lost race against model progress).
- Limits: partial adoption, removable metadata (the image becomes “uncertified”, not “fake”).
- At your scale: disclose when expected/mandatory (varies by country), track your prompts and versions, verify what you republish.
48h challenge — apply tomorrow
Fill in the traceability sheet (template above) for 1 real visual of Sonia: do the disclosure and the prompt record appear in it?
- I can explain visible, invisible watermarks and C2PA in one sentence.
- My visual is tracked (prompt, version, parameters kept).
- I can verify an origin before republishing.
Frequently asked questions
Must I disclose that an image was AI-generated?
It depends on context and your country, and changes fast: platform rules (disclosure often required), regulations (transparency imposed in several jurisdictions, stricter for content likely to deceive), sector rules (advertising, media, health, finance). My advice: disclose by default — transparency protects and builds trust. A discreet caption note is often enough; be rigorous as soon as a realistic image involves people, places or events.
Can C2PA traceability really solve disinformation?
A real but partial contribution: certifying the authentic via signatures is more robust than detecting fakes, but adoption stays partial, metadata can be removed, the public must learn to verify, and workarounds exist. A necessary but insufficient tool — most useful where authenticity is a stated issue. At your scale: track, disclose, preserve, verify.
What is the logic of the C2PA / Content Credentials standard?