C2PA for AI-Generated Content

C2PA can describe AI involvement in digital content, but it does not do so with one universal AI-generated flag. It represents provenance through several connected signals: actions that record what happened, digital source types that classify how content was created or altered, ingredients that identify source assets and computational inputs, optional model disclosures, and signatures that make those statements tamper-evident.

That distinction matters because AI involvement is rarely binary. A text-to-image output, a camera photograph modified with generative fill, a human-designed advertisement containing one synthetic element, and a photograph processed with conventional noise reduction are four different histories. A useful Content Credential should preserve those differences instead of flattening them into the same label.

C2PA is also a provenance system, not an AI detector. A verifier reads statements issued by a claim generator and checks their integrity, asset binding, signature, and trust context. It does not inspect pixels or audio and independently infer that a model was used. An absent disclosure therefore means that the available credential does not disclose AI involvement; it does not prove that no AI was involved.

The strongest implementations treat C2PA as a vocabulary for explaining a production process. They record where the asset began, which model-assisted actions occurred, which inputs contributed, how much human review was declared, and which organization or service signed the resulting record. [1]

Why AI provenance is not a binary classification

The phrase AI-generated content is useful in conversation, but it covers many technically different workflows. Some assets are produced almost entirely by a trained model. Others begin as camera capture and receive a localized generative edit. Others contain a synthetic ingredient alongside photographs, typography, and human illustration. Still others use machine-learning techniques for denoising, transcription, translation, or quality enhancement without replacing the main subject matter.

C2PA represents those differences at the level of events and relationships. The same final file can contain evidence about its origin, the actions applied after origin, the assets or data used as inputs, and the model or software involved. A validator can then present a description proportionate to the evidence rather than forcing every workflow into one category.

The C2PA signals used for AI content

No single assertion carries the entire AI story. The main signals work together, and each answers a different question.

Actions and digital source types

The actions assertion is the primary timeline for creation and editing. In a standard manifest, at least one actions assertion must appear among the claim generator's created assertions. If an asset is created from nothing - including generation by a model - the first action is c2pa.created. If an existing asset is opened as the parent for editing, the first action is c2pa.opened and points to a parentOf ingredient.

For de novo creation, the c2pa.created action carries a digitalSourceType that describes the nature of the asset at inception. A text-to-image, text-to-video, or comparable generative-media output can use the IPTC value trainedAlgorithmicMedia, whose current human-readable label is "Created using Generative AI." C2PA also defines trainedAlgorithmicData for non-media data produced by a trained model. [1]

Other source types help distinguish nearby cases. compositeWithTrainedAlgorithmicMedia describes media edited using generative AI, such as inpainting or outpainting. algorithmicallyEnhanced describes algorithmic alteration that does not change the main content, such as sharpening or noise reduction. digitalCreation describes content created by a human using non-generative digital tools. The exact URI is machine-readable; the user interface should present a clear human label and retain the underlying value for technical inspection. [5]

A digital source type belongs to a recorded action or ingredient context. This is why a final composition may not have one meaningful all-purpose AI classification. A blank canvas may begin with c2pa.created and the C2PA-specific empty source type, then receive a placed AI-generated component. The resulting history can accurately say that the work contains synthetic material without claiming that the entire asset originated from a model.

Actions can also identify the software agent, time, affected region, related assertions, and ingredients involved. A generative edit may therefore be represented as an edit action associated with a generative source type and a region of interest, while the original photograph remains visible as a validated parent ingredient.

Ingredients represent prompts, models, source media, and other inputs

Ingredients turn AI provenance into a graph. A parentOf ingredient represents the asset from which the current rendition was derived. A componentOf ingredient represents material placed into a composition. An inputTo ingredient represents data used by a computational process. These relationships are especially useful for AI workflows because they can connect output to prompts, reference images, source audio, models, adapters, datasets, or other generation inputs.

C2PA 2.4 allows ingredient data to be embedded in the manifest or authenticated through an external reference. The specification includes an example in which a text prompt is represented as an inputTo ingredient and model information is represented as another input. It also defines asset-type values for prompts, seeds, generators, model formats, and datasets. [2]

An ingredient with its own Content Credential can bring that provenance into the new asset's Manifest Store. For example, a captured photograph used as an image-to-image input can retain its camera-origin credential. A model file can have its own credential describing its type and version. A fine-tuned model can identify a base model and fine-tuning dataset as ingredients. This creates a chain that can extend beyond the output file into the production system itself. [4]

Not every input should be published. Prompts may contain personal data, trade secrets, unreleased product names, copyrighted passages, security-sensitive instructions, or information about a customer. Model identifiers may expose proprietary infrastructure. Large model and dataset objects may be impractical to embed. Implementers should decide which inputs are public, which are referenced through controlled services, which are summarized, and which remain only in private audit records.

Omitting an input can be legitimate, but the interface should preserve uncertainty. A credential that discloses generative creation without exposing the prompt is still useful. It should not be presented as a complete account of every instruction, retrieval source, model weight, or hidden system component involved.

The AI Disclosure assertion in C2PA 2.4

C2PA 2.4 introduced the c2pa.ai-disclosure assertion to provide additional machine-readable AI transparency information. It is designed to complement actions and digitalSourceType, not replace them. Actions explain what happened to the asset; the AI Disclosure assertion adds structured information about the model and the declared level of human involvement. [3]

The assertion requires a modelType. It can also include a human-readable modelName, a modelIdentifier such as a package or URI-style identifier, a content profile, scientific-domain values, and assertion metadata. The content profile can declare one of three human oversight levels:

• fully_autonomous - no human review after the model output;
• prompt_guided - a human supplied prompts or configuration but did not provide final approval; or
• human_validated - a human reviewed or approved the final output before release.

These levels describe declared workflow participation. They do not certify that the review was competent, independent, careful, or sufficient for a particular risk. A human_validated value does not mean that the content is accurate, lawful, safe, or free from manipulation. It means that the signer is asserting that a human approval step occurred.

The AI Disclosure assertion is not a substitute for model provenance. A model name typed into an assertion is still a statement. Stronger systems can connect the output to a model ingredient with its own signed Content Credential, an attestation from the execution environment, or another identity mechanism. The assertion is also not automatically required for every AI-assisted asset. An organization may choose to require it through product policy, customer contract, or regulation, but the base provenance record can still represent AI involvement through actions, source types, and ingredients.

Keep the model, tool, signer, and human roles separate

AI workflows involve several identities that are easy to conflate:

• The model is the trained computational artifact used during generation or editing.
• The software agent is the application, API, device, or service that performed a recorded action.
• The claim generator constructs the assertions and claim.
• The signer controls the signing credential and issues the Content Credential.
• The human actor may provide a prompt, select inputs, edit the result, approve it, or publish it.
• The model provider, application provider, customer organization, and publisher may all be different entities.

A model identifier should not be inferred from the signing certificate. A software-agent name should not be treated as verified human authorship. A customer using a hosted generation API may be the creative decision-maker while the service signs the output. Conversely, a publisher may add a later manifest without having operated the model. Good interfaces present each role under its own heading and show which claims are cryptographically attributed to which signer.

Created and gathered assertions can further distinguish responsibility. Information generated and endorsed by the signing service can appear among created assertions. Attestations, user-provided statements, or data supplied by another component may be gathered and protected by the claim without being attributed to the signer in the same way. This prevents the signature from silently converting every imported statement into the signer's own factual claim.

Three representative AI provenance workflows

1. Text-to-image generation

1. A user submits a text prompt and optional reference inputs to a generation service.

2. The service creates a new image. The first action is c2pa.created with digitalSourceType set to trainedAlgorithmicMedia.

3. The action identifies the serving software or generation application. The prompt, model, seed, and reference media may be represented as inputTo ingredients when disclosure and privacy policy permit.

4. An optional AI Disclosure assertion records the model type, model identifier, and declared human oversight level. A prompt-only workflow without final approval may use prompt_guided.

5. The service constructs a standard manifest, binds it to the final encoded image, signs the claim, and verifies the completed output before release.

A user-facing summary might say: "Created using generative AI. Prompt guided. Model information available." It should not say that the credential proves the scene is real or that the prompt is complete.

2. Generative modification of a captured photograph

1. A photographer captures an image with a camera-origin Content Credential.

2. An editor opens the photograph as a parentOf ingredient. The new manifest begins with c2pa.opened rather than c2pa.created.

3. The editor uses generative fill to extend the background. The workflow records an edit action with an appropriate generative source type and, where practical, identifies the affected region.

4. The original capture manifest is preserved as ingredient provenance. The edit application may identify the model and a human approval step.

5. Because the image content changed, the editor issues a new standard manifest with a new hard binding.

A useful presentation is: "Captured photograph edited using generative AI; original capture provenance available." Calling the entire image AI-generated would discard the most important fact: the asset still descends from a specific captured parent.

3. Human composition containing an AI-generated ingredient

1. A designer starts with a blank document or creates a layout using non-generative tools.

2. The designer places an AI-generated illustration into one region of the composition.

3. The illustration appears as a componentOf ingredient, ideally with its own manifest. A c2pa.placed action points to that ingredient.

4. Typography, captured photographs, and other components keep their own ingredient relationships. Human editing actions describe the composition work.

5. The final manifest represents a mixed provenance graph rather than assigning one origin label to every pixel.

A useful presentation is: "Human-created composition containing AI-generated content." This is more informative than either "AI-generated" or "not AI-generated."

Prompts, seeds, and model information

Prompts and generation parameters can be valuable provenance, but they are not mandatory evidence for every use case. The exact prompt may help reproduce an output, explain creative intent, or distinguish one generation event from another. A seed can help identify a deterministic branch of a generation process. A model identifier can connect the output to documentation or a separately signed model artifact.

Those fields also create risk. Prompts can expose personal information, confidential strategy, harassment, medical data, unreleased creative work, or internal system instructions. Seeds and model endpoints can facilitate extraction or abuse. External references can create long-lived tracking and availability dependencies. Public credentials should therefore follow data-minimization rules rather than treating maximum disclosure as automatically better.

A production system may use several disclosure layers: a public Content Credential with a model family and high-level source type; an authenticated customer view with more detailed model and parameter information; and a private audit record containing exact prompts, seeds, policy decisions, and safety events. C2PA can protect public or externally referenced information, but it does not require every operational detail to travel with the asset.

Content Credentials for models, datasets, and AI systems

C2PA can protect more than the final generated image, video, audio file, or document. The specification defines asset-type values for AI and machine-learning datasets, generators, prompts, seeds, and many model formats. The AI/ML guidance describes credentials for models, training datasets, inference inputs, and outputs. [4]

A model credential can bind provenance to a particular model artifact and describe its type or version. A dataset credential can protect a collection or reference its component files. A fine-tuned model can identify its base model and fine-tuning data as ingredients. An output credential can then refer to the model credential and the inputs used during inference. In principle, this creates an end-to-end chain: training materials and software, model build, fine-tuning, deployment, inference inputs, and final output.

The chain is only as complete as the participating systems make it. A signed model file does not prove that the training data were lawful, representative, unbiased, or free from hidden contamination. A dataset hash proves that the referenced dataset representation has not changed; it does not prove that every item was correctly licensed or labelled. C2PA supplies integrity and provenance evidence that other governance and evaluation processes can use.

What a verifier can and cannot conclude

When an AI-related Content Credential validates, a verifier may be able to establish that a particular signer issued a claim containing specific AI-related assertions, that the referenced assertions have not changed, and that the protected asset corresponds to the applicable hard binding. The verifier may also evaluate the signer under a trust policy and traverse any available ingredient or model provenance.

The verifier cannot conclude, from C2PA alone, that:

• the declared model actually executed unless stronger attestation or trustworthy system evidence supports that claim;
• all prompts, retrieval sources, tools, or hidden inputs were disclosed;
• human review was careful or meaningful merely because human_validated was declared;
• content without an AI disclosure was created without AI;
• an invalid or missing credential means the asset is deceptive;
• AI-generated content is false, harmful, or low quality; or
• the implementation satisfies a particular law, platform rule, or customer policy.

C2PA deliberately records provenance rather than deciding whether content is true or trustworthy in every context. AI disclosure should therefore be presented as evidence about a recorded workflow, not as a moral or factual verdict. [6]

Implementation principles for AI-content systems

For generators and editing tools

• Record the correct inception event. Use c2pa.created for new model output and c2pa.opened when editing an existing parent asset.
• Choose digital source types narrowly. Distinguish generative creation, generative editing, algorithmic enhancement, and non-generative digital creation.
• Preserve parent and component provenance instead of flattening a mixed work into one label.
• Represent prompts, models, reference media, and datasets as ingredients only when the disclosure is useful and permitted.
• Keep model identity, software-agent identity, signer identity, organization identity, and human participation separate.
• Use the AI Disclosure assertion where model and oversight information materially improves transparency or is required by policy.
• Do not publish sensitive prompts, personal data, hidden system instructions, or proprietary model details by default.
• Sign the final asset representation and independently verify the completed output before delivery.
• Retain private audit evidence for facts that should not be exposed in the public manifest.
• Test downstream transformation and metadata-preservation behavior so disclosures do not disappear unnoticed.

For validators and user interfaces

• Describe the specific role of AI: created, edited, enhanced, placed as an ingredient, or used as a computational input.
• Distinguish whole-asset origin from AI involvement in one component or region.
• Display the signer, model disclosure, software agent, and human oversight as separate facts.
• Identify which values are verified by cryptographic integrity and which remain signer assertions.
• Do not infer no AI from missing metadata, and do not infer deception from a missing or invalid credential.
• Preserve unknown, unavailable, ambiguous, and partially disclosed states instead of forcing a binary badge.
• Protect prompt text, external links, thumbnails, model metadata, and other manifest content as untrusted input.
• Keep technical provenance results separate from legal, safety, authenticity, or factual-truth conclusions.

Common misunderstandings

The simplest mental model

• Actions say what happened.
• digitalSourceType says what kind of source or process was involved at that action.
• Ingredients say what parent, component, prompt, model, dataset, or input contributed.
• The AI Disclosure assertion adds model and declared human-oversight information.
• The software agent identifies the application or service performing an action.
• The signing credential identifies who issued the provenance claim under a trust policy.
• A valid signature protects the record; it does not independently prove every statement or the truth of the content.
• The best user experience describes the role of AI instead of displaying a context-free AI badge.

C2PA is most valuable for AI-generated and AI-assisted content when it preserves nuance. It can show that an asset was generated by a model, that a photograph was selectively altered, that a human composition contains a synthetic ingredient, or that an algorithm performed a non-generative enhancement. Those are different histories, and they should remain different histories after signing, distribution, and verification.

A mature AI-transparency system therefore uses C2PA as a structured account of the production process. It records the origin, actions, inputs, models, human decisions, and signer responsible for the statements. It leaves factual truth, legal compliance, safety, and policy decisions to the additional systems that are equipped to evaluate them.

Sources and notes

[1] C2PA Technical Specification 2.4, "Actions". Mandatory creation/opening actions, digitalSourceType, software agents, ingredients, regions, and the generative-AI action example.

[2] C2PA Technical Specification 2.4, "Ingredient" and "Asset Type". Input relationships, embedded or external ingredient data, prompt and model examples, and AI/ML asset-type values.

[3] C2PA Technical Specification 2.4, "AI Disclosure". The c2pa.ai-disclosure assertion, model information, scientific-domain metadata, and human oversight levels.

[4] C2PA Guidance for Artificial Intelligence and Machine Learning 2.4, "AI-ML Model Content Credential", "AI-ML Training Data Set Content Credential", and "AI-ML Output Content Credential". Non-normative architectures for model, dataset, inference-input, and output provenance.

[5] IPTC NewsCodes, "Digital Source Type" vocabulary. Current controlled terms and definitions for generative creation, generative editing, algorithmic alteration, capture, composites, and digital creation.

[6] C2PA and Content Credentials Explainer 2.4, "Core Principles" and the AI/ML discussion. Content Credentials record verifiable provenance signals without making value judgments about factual truth or overall trustworthiness.