IMAGE PROVENANCE GUIDE
C2PA markers versus signature verification
Understand the difference between finding C2PA markers, validating credentials and establishing what an image actually proves.
Three different questions
Whether a file contains C2PA-related markers, whether a credential validates, and whether the depicted event is true are different questions. Provenance records can help trace creation and editing, but do not replace investigation of the scene itself.
What AIGCTrace checks
The current tool looks for C2PA-related markers, AIGC fields and generator names. It does not validate cryptographic signatures, certificate trust chains or a complete editing history. A C2PA hit is a clue for further investigation, not a successfully validated credential.
Presence and absence have limits
Markers can remain in a file, be edited, be removed or be forged. Finding one does not by itself establish AI origin. Finding none does not establish camera capture. Preserve the original file and information about where it came from.
Example: a c2pa text match
This is an illustrative example: a file contains the text c2pa and triggers a marker check. That result does not tell you whether a signature is valid, whether its signer is trusted, or whether its claims correspond to the current content. Examine the original with a tool that validates C2PA credentials and read its validation and trust results.
How to follow up
Start with the original file and consult the official C2PA specifications. Record the validation tool, time, status and stated limitations. Keep credential validation, creator statements and publication context separate; none should automatically become a guarantee that the depicted scene is true.
Sources and scope
Product limits reflect the current project implementation. Illustrative examples are not accuracy benchmarks.