Does a signature mean it is not AI?

No. A signature is a statement about origin, and it may itself say the content is AI-generated. Origin and AI likelihood are scored on different axes.

Does stripping metadata remove the signature?

Usually. One social upload or screenshot removes the whole manifest, so a missing signature is never grounds for suspicion on its own.

Which trust list do you use?

The report records which list was used, where it came from, when it was fetched and how many anchors it held — because with a different list the same file can reach a different conclusion.

What if the list is old?

If it was fetched more than 90 days ago, or the fetch time is unknown, it is treated as stale and labelled that way. We do not assume that something unknown is current.

Verifying C2PA Content Credentials

C2PA attaches a signed record of who did what to a file. It is useful and it is easy to misread. A valid signature means the file has not changed since it was signed — not that the signer is who they say they are.

What a manifest contains

The tool that made it, the actions performed, the ingredients used, and a field declaring whether the content is AI-generated. More and more generators write that declaration into their output, so when it is present it is the quickest and most certain answer available.

Valid is not the same as trusted

Minting a self-signed certificate and genuinely signing a manifest that claims a particular camera took the photograph costs one command. Files made that way verify as valid. So whether the certificate appears in a known trust list has to be checked separately, and reported separately from validity.

Not checking is not the same as doubting

Without a trust list installed there is no way to compare the certificate. Calling it an unknown certificate in that state is an accusation against the file. The right thing is to record that no comparison was made, and to say that installing a list will make the next analysis compare it.

Missing or broken signatures

No signature at all is ordinary and not a bad sign — most photographs never had one. A signature that does not match the content is different: it means the file changed after signing, and that is worth pursuing.

Frequently asked

Does a signature mean it is not AI?: No. A signature is a statement about origin, and it may itself say the content is AI-generated. Origin and AI likelihood are scored on different axes.
Does stripping metadata remove the signature?: Usually. One social upload or screenshot removes the whole manifest, so a missing signature is never grounds for suspicion on its own.
Which trust list do you use?: The report records which list was used, where it came from, when it was fetched and how many anchors it held — because with a different list the same file can reach a different conclusion.
What if the list is old?: If it was fetched more than 90 days ago, or the fetch time is unknown, it is treated as stale and labelled that way. We do not assume that something unknown is current.