How to Check Whether an Image Is AI-Generated: Content Credentials, SynthID Watermarks and What a Missing Label Does Not Prove

Image generators now produce pictures that look like photographs. Readers, journalists and teachers increasingly ask a practical question: can I check where this image came from? Two technical answers exist today. One attaches a signed record to the file. The other hides a signal inside the pixels.

This article explains both in plain English. It covers what Google announced on May 19, 2026, what the standards documents actually promise, and where the checks fail. It also follows one illustrative image through a verification routine, so you can see how to read each result.

Article index

• Why image provenance matters
• Content Credentials: a signed record that travels with the file
• Invisible watermarks and fingerprints
• What Google announced on May 19, 2026
• Limits, attacks and privacy
• A worked example
• Common mistakes
• Recap
• Research Sources

Why image provenance matters

Provenance means the recorded history of a piece of media: who made it, with what tool, and what changed afterward. Without it, you judge an image by how it looks. That is a weak test, because generated images can look convincing.

Two different problems get mixed together. The first is "was this made or edited by AI?" The second is "is this image true?" A real photo can be used with a false caption, and an AI illustration can be honestly labeled. Provenance tools address the first problem only, and only partly.

Content Credentials: a signed record that travels with the file

Content Credentials are the user-facing name for a standard from the Coalition for Content Provenance and Authenticity, or C2PA. The C2PA FAQ calls them "a cryptographically secure way to capture and express content provenance" (C2PA FAQ). In simple terms, the file carries a digitally signed record of its origin and edits.

The technical specification names the parts. A manifest bundles assertions (statements such as which actions were taken), a claim that gathers those assertions, and a signature made with the signer's credential (C2PA specification 2.2).

The manifest is tied to the image by a hard binding: cryptographic hashes that identify the asset. The specification says this lets a validator check that the manifest belongs with the asset and that the asset has not been modified. The FAQ adds that any modification, intentional or accidental, breaks the linkage and signals tampering.

The documents are also clear about what this does not prove. The FAQ says the core specification "does not support attribution of content to individuals or organizations." It also says validation confirms that ingredients were checked when used, but not the complete ingredient chain. A valid credential tells you what the signer recorded. It does not tell you the content is true.

Invisible watermarks and fingerprints

Metadata is fragile. The FAQ says it can be removed inadvertently or intentionally. A screenshot, a re-save in some software, or an upload to a platform that drops unknown metadata can all strip a manifest.

To cope, C2PA describes a second layer called a soft binding. The specification defines it as a content identifier computed from the content itself rather than its raw bits. It is either a fingerprint, which is not statistically unique, or an invisible watermark. A fingerprint is computed from the image after the fact. A watermark is inserted into the image when it is made (Durable Content Credentials documentation).

The specification keeps the two bindings separate: "a soft binding shall not be used as a hard binding." That makes sense. A hard binding proves a file is unchanged. A soft binding only helps you find a record, and the result may match a different but similar image.

The combination is called Durable Content Credentials. If a platform strips the manifest, a copy stored in an online database can be found again using the watermark or fingerprint. The documentation lists a limit: recovery depends on a copy of the manifest having been stored, and watermarks and fingerprints must use algorithms approved under the specification.

Google DeepMind's SynthID page describes one watermark system. It says SynthID adds an invisible watermark to images and video when they are created, and that the watermark is "designed to stand up to modifications like cropping, adding filters, changing frame rates, or lossy compression." That is a vendor design claim. The page does not give failure rates.

What Google announced on May 19, 2026

The following points come from Google's blog post dated May 19, 2026. Everything below is Google's statement about its own products, not an independent test.

• SynthID verification for images, video and audio was already in the Gemini app. Google says it has been used "50 million times globally."
• SynthID checks were expanding to Search, where you can ask Lens, AI Mode or Circle to Search whether an image was made with AI. Chrome was planned "over the coming weeks."
• C2PA Content Credentials verification began rolling out in the Gemini app that day. Search and Chrome support was planned for "the coming months."
• Google says OpenAI, Kakao and ElevenLabs are bringing SynthID to their AI-generated content, and that it has watermarked over 100 billion images and videos.
• A new AI Content Detection API was starting with trusted partners.

Press coverage on the same date, such as 9to5Google, matches this outline. Note the dates: the event happened on May 19, 2026, and reports followed the same day or later. This article was written on November 4, 2026. I did not verify which "coming weeks" and "coming months" features have since shipped, so check each product yourself before relying on it.

Google's post also gives no detection accuracy or failure rates for SynthID or for C2PA verification. Treat the numbers above as adoption claims, not as evidence of reliability.

Limits, attacks and privacy

A watermark only answers one question. A SynthID check looks for a SynthID watermark. By design, it says nothing about an image made with a tool that does not use SynthID. This is my reasoning from how the system works, not a statement from Google.

Missing credentials prove little. Because metadata is easy to lose, "no credentials found" mostly means the record did not survive the trip. The specification also lets validators return an unknownProvenance status when they meet unsupported constructs, which is another reason an empty result is not a verdict.

Watermarks can be attacked. A peer-reviewed NeurIPS 2024 paper, Invisible Image Watermarks Are Provably Removable Using Generative AI, describes "regeneration attacks." They add noise to disrupt a watermark, then rebuild the image with a denoiser or diffusion model. The authors tested four pixel-level schemes and report that these attacks beat earlier ones. The paper does not test SynthID, so it does not show SynthID can be removed. It does show why a claim of robustness needs independent testing.

Signers can leave things out. The specification lets creators control which provenance data is included. It says excluded asset metadata "are not attributed to the signer," and that redactions must be recorded in the claim. A credential can therefore be valid yet incomplete.

Privacy cuts both ways. Credentials can record tools and edits, which helps trust but also reveals workflow details. Before you upload a sensitive image to any online checker, remember that you are sending the file to a third party. For unpublished or private images, prefer a local tool or ask your organization's policy owner.

A worked example

This is an illustrative scenario, not a test I ran. Suppose a community newsletter editor receives an image of a flooded street, sent by a reader through a chat app. The editor wants to decide whether to publish it with a caption.

1. Collect the original file. Input: the image as received. What happens: the editor asks the reader for the original file, not a screenshot. Result: a file closer to what the camera or tool produced. Why it matters: screenshots and re-saves often remove embedded credentials.
2. Look for Content Credentials. Input: the original file. What happens: the editor opens it in a tool that reads C2PA data, such as the Gemini app's verification feature, which Google says began rolling out on May 19, 2026. Result, case A: a valid manifest names a camera app and no AI actions. Case B: a manifest records an AI generator. Case C: nothing found. Why it matters: A and B are signed statements by whoever created the record. C is not an answer.
3. If nothing is found, run a watermark check. Input: the same file. What happens: the editor uses a SynthID check in a Google product. Result: either "watermark detected" or "no watermark detected." Why it matters: a detection is a useful signal. A non-detection only rules out SynthID, not other generators.
4. Add ordinary reporting checks. Input: the image plus the reader's claim. What happens: the editor compares the scene with news reports, maps and weather records, and asks the reader when and where it was taken. Result: independent support or doubt. Why it matters: provenance tools describe how a file was made, not whether the scene happened.
5. Record and word the result. Input: all findings. What happens: the editor writes down each check and its outcome, then decides. Result: a caption such as "Reader-submitted image; origin not independently verified" if checks stay inconclusive. Why it matters: honest wording avoids both false accusations and false endorsements.

A simple log keeps the reasoning visible:

file: flood_street_original.jpg (received 2026-11-04)
credentials: none found (file may have been re-saved)
watermark check: no SynthID detected (does not rule out other tools)
independent check: location confirmed by two news reports? yes/no
decision: publish with caveat / hold / reject

If a tool errors or will not open the file, try the original format, check the file size is not zero, and fall back to the reporting checks in step 4.

Common mistakes

• Treating "no credentials" as "fake." Correction: say the record is absent or did not survive, and look for other evidence.
• Treating "no SynthID found" as "human-made." Correction: the check only covers SynthID-marked content.
• Treating a valid credential as proof the scene is real. Correction: it shows what the signer recorded and that the file is unchanged since, not that the caption is true.
• Checking a screenshot. Correction: ask for the original file first.
• Repeating vendor figures as accuracy. Correction: "50 million checks" and "100 billion watermarked items" describe usage, not correctness.
• Uploading private images to a public checker. Correction: check the tool's privacy terms first.
• Assuming rollout is finished. Correction: confirm which features are live in your region and app today.

Recap

• Content Credentials are signed records tied to a file by hashes. A broken link signals modification, but the record does not prove the scene is true.
• Invisible watermarks and fingerprints are a second layer that can help recover a stripped record, but they depend on stored copies and approved algorithms.
• Google's May 19, 2026 post is a vendor announcement. It gives adoption numbers and a rollout plan but no accuracy figures.
• Researchers have shown that some pixel-level watermarks can be removed, so robustness claims need independent testing.
• Read results as three states: signal found, no signal found, and unknown. Only the first carries information about origin.
• Combine provenance checks with ordinary verification: the original file, independent reports and careful wording.

Research Sources

• Google blog post on identifying AI-generated media online (May 19, 2026)
• Google DeepMind: SynthID
• C2PA FAQ
• C2PA Technical Specification 2.2
• Content Authenticity Initiative: Durable Content Credentials
• Invisible Image Watermarks Are Provably Removable Using Generative AI (arXiv)
• 9to5Google report on Google's AI detection in Search and Chrome (May 19, 2026)