What AI tools leave in their files

Terms, as the standard-setters define them

C2PA Manifest

The C2PA Technical Specification 2.4 defines a C2PA Manifest as the set of provenance information about an asset made of one or more assertions (including content bindings), a single claim and a claim signature, held in a C2PA Manifest Store.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 2.3.4 C2PA Manifest; 2.3.5 C2PA Manifest Store

The set of information about the provenance of an asset based on the combination of one or more assertions (including content bindings ), a single claim , and a claim signature . A C2PA Manifest is part of a C2PA Manifest Store .

Content Credentials

The C2PA Technical Specification 2.4 says Content Credential is the preferred non-technical term for a C2PA Manifest, that an asset's Manifest Store represents its Content Credentials, and that the term also refers to the overall C2PA technology.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 2.3.6 Content Credential

This is the preferred non-technical term for a C2PA Manifest . The C2PA Manifest Store therefore represents the Content Credentials of an asset. Content Credentials also refers to the overall C2PA technology, and is therefore essentially treated as a plural noun.

C2PA Trust List

The C2PA Technical Specification 2.4 defines the C2PA Trust List as a C2PA-managed list of X.509 certificate trust anchors that issue certificates to hardware and software signers, and the C2PA TSA Trust List as the equivalent list for time-stamping authorities.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 2.3.15 C2PA Trust List; 2.3.16 C2PA TSA Trust List

A C2PA-managed list of X.509 certificate trust anchors that issue certificates to hardware & software signers that use them to sign claims . 2.3.16. C2PA TSA Trust List A C2PA-managed list of X.509 certificate trust anchors that issue certificates to Time Stamping Authorities (TSAs).

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 14.4.1 C2PA Signers

For the c2pa-kp-claimSigning (1.3.6.1.4.1.62558.2.1) EKU, the list of trust anchor configurations shall include, but need not be limited to, the signer trust anchor configurations provided by C2PA (i.e., the C2PA Trust List).

ConformanceCoalition for Content Provenance and Authenticity (C2PA)

Quoted passage C2PA Trust List; Plan and Timeline

As part of the maturation of the C2PA ecosystem, the C2PA Conformance Program and the official C2PA Trust List (C2PA TL) were launched in mid-2025. The Interim Trust List (ITL) has been retired, since it was a temporary measure for early C2PA implementations. […] The ITL was frozen. No new entries will be added, and no updates will be made. Existing certificates will remain valid for legacy support, but no future refreshes or additions will occur. Eventually, those certificates will expire and no longer be usable for signing. However, if content was signed during the ITL certificate’s validity period, the content will always be considered valid against the legacy trust model.

ConformanceCoalition for Content Provenance and Authenticity (C2PA)

Quoted passage Conformance, paragraph 2

This Conformance Program is a risk-based, transparent and unbiased governance process intended to hold generator products, validator products and certification authorities accountable to the Content Credentials specification, the Certificate Policy and the Security Requirements . Conforming products are placed on a publicly-accessible list.

C2PA validation states (Well-Formed, Valid, Trusted)

The C2PA Technical Specification 2.4 says a C2PA Manifest may be Well-Formed, Valid or Trusted, and that any Trusted manifest is also Valid and any Valid manifest is also Well-Formed.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 14.3.2 Manifest States

Based on these statements, a C2PA Manifest may be one of the following: Well-Formed Valid Trusted Any Trusted manifest is also Valid, and any Valid manifest is also Well-Formed.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 14.3.4 Well-Formed Manifest

A C2PA Manifest is Well-Formed if validation determines that each of the following is true: The manifest’s contents abide by the normative requirements of this specification, that are validated via the validation process . Only those assertions allowed for the specific type of the manifest are present

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 14.3.5 Valid Manifest

A C2PA Manifest is Valid if validation determines that each of the following is true: The manifest is Well-Formed [ Section 14.3.4, “Well-Formed Manifest” ]. The manifest has not been modified since the manifest was signed [ Section 13.2.6, “Cryptographic validation” ]. The claim signature receives a success code of claimSignature.validated [ Section 15.7, “Validate the Signature” ]. Validation of the claim signature validity period receives the success code of claimSignature.insideValidity [ Section 15.8, “Validate the Time-Stamp” ]. The credential of the signer of the C2PA Manifest is not rejected with a failure code of signingCredential.ocsp.revoked [ Section 15.9, “Validate the Credential Revocation Information” ]. If a C2PA Manifest is Valid, then the manifest’s claim can be attributed to the claim generator which is identified by the claim_generator_info field of the claim [ Section 10.2.3, “Claim Generator Info” ].

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 14.3.6 Trusted Manifest

A C2PA Manifest is Trusted if validation determines that each of the following is true: The manifest is Valid [ Section 14.3.5, “Valid Manifest” ]. The signing credential of the C2PA Manifest receives the success code of signingCredential.trusted [ Section 15.7, “Validate the Signature” ].

Invisible watermark and visible watermark (C2PA definitions)

The C2PA Technical Specification 2.4 defines an invisible watermark as information incorporated in a substantially human-imperceptible way into an asset's digital content, for example to identify the asset or store a reference to a C2PA Manifest, and a visible watermark as a perceptible component carrying provenance information.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 2.4.3 Invisible Watermark; 2.4.4 Visible Watermark

Information incorporated in a substantially human imperceptible way into the digital content of an asset which can be used, for example, to uniquely identify the asset or to store a reference to a C2PA Manifest . 2.4.4. Visible Watermark A perceptible component of the digital content carrying some human consumable information about the provenance of the asset .

C2PA Technical Specification version in force

Version 2.4 of the C2PA Technical Specification is dated April 2026.

Content Credentials: C2PA Technical Specification, version 2.4Coalition for Content Provenance and Authenticity (C2PA)

Quoted passage 5.3.1 2.4 – April 2026

5.3.1. 2.4 – April 2026

IPTC Digital Source Type

IPTC defines the Digital Source Type vocabulary as indicating from which source a digital image was created.

Digital Source Type (NewsCodes controlled vocabulary)IPTC

Quoted passage Metadata about the scheme

Name (en-GB) : Digital Source Type Definition (en-GB) : Indicates from which source a digital image was created.

IPTC Photo Metadata Standard 2025.1IPTC

Quoted passage 11.13 Digital Source Type

11.13. Digital Source Type Row header Specification Name Digital Source Type Definition The type of the source of this digital image Help Text Select one of the values for identifying the type of the source of the digital image from the controlled vocabulary […] CV Note(s) Required: Digital Source Type NewsCodes History Note(s) Added by v 1.1 (2009), User Note added by v 2022.1 XMP Specs Iptc4xmpExt:DigitalSourceType

trainedAlgorithmicMedia

IPTC's Digital Source Type term trainedAlgorithmicMedia, named 'Created using Generative AI', means digital media created algorithmically using an AI model trained on captured content.

Digital Source Type (NewsCodes controlled vocabulary)IPTC

Quoted passage digsrctype:trainedAlgorithmicMedia

Concept ID (QCode) = digsrctype:trainedAlgorithmicMedia, ID (URI) = http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia […] Name (en-GB) : Created using Generative AI Definition (en-GB) : Digital media created algorithmically using an Artificial Intelligence model trained on captured content

compositeWithTrainedAlgorithmicMedia

IPTC's Digital Source Type term compositeWithTrainedAlgorithmicMedia, named 'Edited using Generative AI', means augmentation, correction or enhancement using a generative AI model, such as inpainting or outpainting.

Digital Source Type (NewsCodes controlled vocabulary)IPTC

Quoted passage digsrctype:compositeWithTrainedAlgorithmicMedia

Concept ID (QCode) = digsrctype:compositeWithTrainedAlgorithmicMedia, ID (URI) = http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia […] Name (en-GB) : Edited using Generative AI Definition (en-GB) : Augmentation, correction or enhancement using a Generative AI model, such as with inpainting or outpainting operations

algorithmicallyEnhanced

IPTC's Digital Source Type term algorithmicallyEnhanced, named 'Algorithmically-altered media', means modification or correction by algorithm without changing the main content, initiated or configured by a human, such as sharpening or noise reduction.

Digital Source Type (NewsCodes controlled vocabulary)IPTC

Quoted passage digsrctype:algorithmicallyEnhanced

Concept ID (QCode) = digsrctype:algorithmicallyEnhanced, ID (URI) = http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicallyEnhanced […] Name (en-GB) : Algorithmically-altered media Definition (en-GB) : Modification or correction by algorithm without changing the main content of the media, initiated or configured by a human, such as sharpening or applying noise reduction

composite (related IPTC term)

IPTC's Digital Source Type term composite, named 'Composite of elements', means a mix or composite of several elements, any of which may or may not be generative AI.

Digital Source Type (NewsCodes controlled vocabulary)IPTC

Quoted passage digsrctype:composite

Concept ID (QCode) = digsrctype:composite, ID (URI) = http://cv.iptc.org/newscodes/digitalsourcetype/composite […] Name (en-GB) : Composite of elements Definition (en-GB) : Mix or composite of several elements, any of which may or may not be generative AI