Authenticity, provenance and content credentials

When any image can be generated or altered convincingly, the value of a photograph as evidence depends on being able to show where it came from and what was done to it. Two broad strategies exist. Detection tries to decide, from the pixels alone, whether an image is real, edited or synthetic. Provenance attaches a verifiable record of origin and history to the image, so that the question becomes "can this image prove where it came from?" rather than "does it look fake?". This lesson explains the C2PA content credentials standard in technical detail, camera and phone signing, invisible watermarks and fingerprints, the statistical limits of AI detectors, classical image forensics, and the law on synthetic images and AI authorship in Canada and the United States as of October 2026. PHOT-201 lesson 11 introduced provenance settings on cameras, and CRE-410 lessons 9 and 10 cover platform labels and creator law; here the focus is on how provenance works and what photographers can rely on.

Why detection alone fails

It is tempting to hope that software can simply tell real photographs from fakes. Detection tools exist and can be useful, but they face structural problems. Generators improve continuously, and a detector trained on yesterday's models may miss tomorrow's. Ordinary processing such as resizing, compression and screenshots destroys many of the subtle traces detectors rely on. Real photographs processed heavily by phone pipelines, which use AI throughout (lessons 2 to 8), can be flagged as synthetic. And the base rate problem means that even an accurate detector produces many false alarms when genuine images vastly outnumber fakes, or misses many fakes when they are common.

for prevalence in (0.01, 0.10, 0.50):
    n = 100_000
    fake = n * prevalence; real = n - fake
    tpr, fpr = 0.95, 0.03                         # detector: catches 95 % of fakes, flags 3 % of real images
    tp = fake * tpr; fp = real * fpr; fn = fake - tp
    precision = tp / (tp + fp); recall = tp / (tp + fn)
    print(f"{prevalence * 100:4.0f} % fakes: flagged {tp + fp:7.0f}, of which real {fp:6.0f}; precision {precision:.2f}, recall {recall:.2f}")

   1 % fakes: flagged    3920, of which real   2970; precision 0.24, recall 0.95
  10 % fakes: flagged   12200, of which real   2700; precision 0.78, recall 0.95
  50 % fakes: flagged   49000, of which real   1500; precision 0.97, recall 0.95

With a detector that catches 95 per cent of fakes and wrongly flags only 3 per cent of real images, a stream in which 1 per cent of images are fake yields flagged sets that are about three-quarters genuine photographs. Precision rises only when fakes are common. For a newsroom or court, a detector's verdict is therefore at most one piece of evidence, never proof, and a wrongly accused photographer can suffer real harm.

Classical image forensics

Forensic analysts use several techniques beyond AI classifiers. Metadata analysis examines EXIF fields, software tags and inconsistencies in dates or camera models, though metadata is easily edited or stripped. Error level analysis (ELA) re-saves a JPEG and looks for regions that compress differently, which can reveal pasted areas but produces many misleading results. Sensor pattern noise analysis exploits photo-response non-uniformity (PRNU): each sensor has a unique, faint pattern of pixel sensitivity variations, a kind of fingerprint, that can link an image to a specific camera when reference images from that camera are available. Physics-based analysis checks whether shadows, reflections, perspective and lighting directions are consistent, an approach developed by researchers such as Hany Farid. Each technique has limits, and computational photography complicates all of them: multi-frame merging and AI processing alter noise patterns and compression traces even in authentic phone photos.

How content credentials work

The Coalition for Content Provenance and Authenticity (C2PA), founded in 2021 by Adobe, Microsoft, the BBC, Intel and others and now including camera makers, news organizations and AI companies, publishes an open technical standard for provenance. The Content Authenticity Initiative, led by Adobe, promotes adoption and open-source tools, and "Content Credentials" is the consumer-facing name. A C2PA manifest is embedded in or linked to a media file and contains the following parts.

• Assertions: statements about the content, such as the capturing device, capture time, actions performed (cropped, colour adjusted, generative fill applied), the AI model used, ingredients (earlier versions or source images) and, optionally, the creator's identity.
• A claim: a bundle referencing the assertions together with a cryptographic hash of the image data, binding the manifest to these exact pixels.
• A claim signature: a digital signature over the claim made with a private key whose certificate identifies the signer, such as a camera model, an editing application or a news organization.
• A manifest store: the sequence of manifests from each step in the image's life, so that a camera's original capture manifest can be followed by an editor's manifest listing changes, each referencing the previous version as an ingredient.

Verification recomputes the hash of the image, checks it matches the claim, verifies the signature with the signer's certificate and checks whether the certificate chains to a trusted authority. If a single pixel has changed outside a signed editing step, the hash no longer matches and the credential shows as invalid. The C2PA maintains a trust list and a conformance programme for products; specification version 2.3, published in December 2025, extended signing to live streams. Viewers such as the Content Authenticity Initiative's verify tool display the history.

import hashlib
import numpy as np
rng = np.random.default_rng(420)
pixels = rng.integers(0, 256, (64, 64, 3), dtype=np.uint8)
signed_hash = hashlib.sha256(pixels.tobytes()).hexdigest()
print("hash recorded in the claim:", signed_hash[:16], "...")
edited = pixels.copy(); edited[10, 10, 0] ^= 1          # change one bit of one pixel
for name, img in [("unchanged image", pixels), ("one bit changed", edited)]:
    h = hashlib.sha256(img.tobytes()).hexdigest()
    print(f"{name:16s} {h[:16]} ... match: {h == signed_hash}")

hash recorded in the claim: e3e832b8662a9e0f ...
unchanged image  e3e832b8662a9e0f ... match: True
one bit changed  6361507672254752 ... match: False

Real C2PA hard bindings hash the file's bytes with exclusions for the manifest itself, and the claim is then signed with public-key cryptography so that anyone can verify it but only the key holder could have produced it. Because hard bindings break on any re-encoding, C2PA also defines soft bindings: an invisible watermark or a perceptual fingerprint that survives resizing and compression and can be used to look up the manifest in a cloud repository when it has been stripped from the file. Combining a manifest, a watermark and a fingerprint is sometimes called durable content credentials.

Signing at capture

Provenance is strongest when it starts at the moment of capture, before any opportunity to alter the image. Leica's M11-P (2023) was the first commercial camera to sign images with content credentials, followed by its SL3-S in 2025. Sony offers in-camera digital signatures for stills on models including the Alpha 1 II and Alpha 9 III, supplied under paid annual licences mainly for news organizations, and extended signing to video with C2PA compliance in late 2025 (Sony announcement, October 2025). Nikon added content credentials to the Z6III by firmware in 2025 but suspended the service after a vulnerability in its signing process was reported, revoking certificates. Google's Pixel 10 phones (2025) sign every photo taken with the built-in camera by default, using hardware-backed keys, and Google Photos records edits including AI changes; Samsung's Galaxy S25 series attaches credentials to images created or edited with its generative AI features rather than to ordinary captures. Product support changes rapidly; check the C2PA conformance list for current products.

The Nikon episode illustrates that provenance depends on key security: if a signing key can be extracted or misused, false images could be signed as genuine. Hardware secure elements, certificate revocation and audits are part of a credible system. It also illustrates a cost of trust: once certificates are revoked, previously signed images may show as unverified.

Watermarks and their limits

Invisible watermarking embeds a signal in the pixels themselves, imperceptible to viewers but detectable by software. Google DeepMind's SynthID watermarks images generated by Google's models, and other AI companies use their own watermarks or attach C2PA manifests to generated images. Digimarc and others offer watermarking for photographers to track their work. Watermarks survive more processing than metadata, but no watermark is perfectly robust: heavy cropping, regeneration through another model, or adversarial attacks can remove or weaken them, and an absent watermark proves nothing because most generators, especially open-source models run locally, add none. Watermarks also raise their own questions: a detector for one company's watermark says nothing about images from other systems.

Provenance therefore works asymmetrically. A valid credential from a trusted capture device is strong positive evidence that an image is an authentic capture, with a known history of edits. The absence of a credential is weak evidence of nothing, because most images, genuine or not, carry none, and many platforms strip metadata on upload. Studies around 2025 found that only a very small share of images published online carried C2PA data. For photographers whose credibility matters, the practical response is to enable signing where available, keep originals, and choose platforms and workflows that preserve credentials.

The law on synthetic images

Laws on deepfakes and synthetic imagery are changing quickly.

Canada has no single deepfake statute. Bill C-16, which received royal assent on June 18, 2026, extended the Criminal Code offence of publishing intimate images without consent (section 162.1) to sexually explicit synthetic images, including "nearly nude" depictions, and added an offence of threatening to distribute such images, with most provisions in force from July 18, 2026 (reported at the time; confirm current text). Provinces including British Columbia, Manitoba and Alberta give victims civil remedies for non-consensual intimate images, and Alberta announced amendments to cover deepfakes. The proposed Online Harms Act (Bill C-63) died when Parliament was prorogued in January 2025. Defamation, privacy torts such as appropriation of personality, the Competition Act's rules against misleading advertising and the Canada Elections Act's prohibitions on impersonation can also apply to deceptive synthetic images.

Photographers selling into Europe should also know that the EU AI Act's transparency obligations under Article 50 became applicable on August 2, 2026: providers of generative systems must mark outputs as AI-generated in a machine-readable way (with a grace period for that marking duty to December 2, 2026 under amendments adopted in 2026), and those who deploy deepfakes must disclose that the content is artificially generated or manipulated, with lighter requirements for evidently artistic, creative or satirical work (as reported; verify current guidance).

Copyright in AI-generated images

Copyright law in both countries is built around human authorship, and its application to AI output is still developing.

Canada's Copyright Act does not define "author", but courts have tied originality to an author's exercise of skill and judgment, which most commentators read as requiring a human. The Canadian Intellectual Property Office registers copyright without examining originality, and in 2021 it registered an artwork, "SURYAST", listing a human and an AI system as co-authors; a legal clinic later asked the Federal Court to correct or expunge that registration (status not confirmed at the time of writing). The federal government consulted on copyright and generative AI in 2023 and 2024, but no amendments addressing AI training or AI authorship had been enacted at the time of writing. Photographs taken by a human with AI-assisted processing remain protected in the ordinary way; purely generated images may not be.

Practical provenance for photographers

For most photographers, a few practices cover the essentials. Enable content credentials on cameras and phones that support them, especially for documentary and news work. Keep original raw files and an unbroken archive, because originals remain the most persuasive evidence of authenticity. Use editing software that records C2PA edit history when exporting, and preserve credentials when delivering to clients and publishers. Describe processing accurately in captions and metadata, using the ladder vocabulary from lesson 10. Treat detector results with caution, both when judging others' images and when your own are questioned. And keep up with change: standards, product support and laws in this area are moving faster than in almost any other part of photography.