C2PA vs Invisible Watermarks: The Two-Layer Provenance Model, Explained
Updated September 2026
Two years ago, AI provenance meant a metadata tag. Today the industry describes a stack: a signed manifest inside the file that is easy to strip, and an imperceptible watermark inside the content that is not, with the second able to point back at the first. Understanding the two layers tells you exactly what a cleaning tool is doing and, just as important, what it is not.
Quick answer
The two layers:
- 1Hard-bound manifest (C2PA Content Credentials): signed metadata inside the file. Readable by anyone, stripped by any metadata tool or by many upload pipelines.
- 2Soft-bound or standalone watermark (SynthID and similar): a signal in the pixels, audio or word choice. Needs the maker's detector, survives stripping and screenshots.
- 3Platforms mostly read the first layer today. StripShot removes the first layer and says so; it does not touch the second.
Layer one: the manifest in the file
C2PA, the standard from the Coalition for Content Provenance and Authenticity, stores a signed manifest inside the file: the tool that created the content, the actions taken on it, and a cryptographic signature that makes tampering detectable. In a JPEG it sits in an APP11 segment as JUMBF boxes; in a PNG it is a caBX chunk; in an MP4 it is a uuid box; in a PDF or a DOCX it can be a metadata stream or a package part. Adobe, OpenAI, Microsoft and Google all write it.
It is hard-bound, meaning it lives inside this exact file. That makes it strong against tampering and weak against removal: change the file and the signature breaks, but strip the segment and the manifest is simply gone. Screenshots drop it, many social platforms drop it on upload, and a metadata tool removes it in milliseconds without touching a pixel.
Layer two: the watermark in the content
The second layer answers the weakness of the first. An imperceptible watermark, SynthID for Google's outputs and equivalents elsewhere, is embedded in the pixels of an image, the frames of a video, the waveform of audio or the word choices of text. It has no segment to strip. It survives cropping, compression, re-encoding and screenshots because it is spread through the content rather than attached to it. Only the maker's detector, holding the key, can read it.
The C2PA specification connects the two through soft bindings: a watermark or perceptual fingerprint can serve as a lookup key for a copy of the manifest kept in a remote store. Strip the file, screenshot it, re-upload it, and a platform that checks the soft binding can still fetch the original provenance.
| C2PA manifest | Invisible watermark | |
|---|---|---|
| Where it lives | File metadata (APP11, caBX, uuid box, XMP, package parts) | The content itself: pixels, frames, waveform, word choice |
| Who can read it | Anyone with a C2PA reader or verify site | Only the maker's detector with the key |
| Survives screenshot | No | Yes (images, video) |
| Survives metadata stripping | No | Yes |
| Survives paraphrase (text) | Not applicable | Weakened |
| What platforms read today | The main trigger for AI labels on Meta, LinkedIn, TikTok | Emerging; Google and Meta check their own marks |
| StripShot | Removes it, binary-level, verified by re-scan | Out of scope; stated on every page |
Why the distinction matters for creators
- Labels are mostly layer one. The Made with AI label on Instagram, the CR icon on LinkedIn and the AI tag on TikTok are driven by C2PA and related metadata. Removing that layer removes the trigger, which is why metadata tools work for the common case.
- Detection can be layer two. A platform that runs SynthID or its own watermark detector can identify content with no metadata at all. Google-generated images and video are the clearest example.
- Editing tools add layer one back. Photoshop's generative features attach C2PA even to a photograph you took yourself. A quick scan before publishing catches that.
- Text is layer two only. Pasted text has no file to carry a manifest; whatever mark it has is in the words. That is why text pages on this site talk about hidden characters and writing tells rather than promising removal.
What honest metadata removal looks like
It names the layer it works on. StripShot removes C2PA, XMP, IPTC, EXIF, document properties and hidden characters, verifies each removal by re-scanning, and states on every page that pixel, audio and statistical text watermarks remain. A tool that promises to make content undetectable is promising to remove layer two, and outside the vendor nobody can verify that.
The regulatory backdrop
The EU AI Act's Article 50, enforceable from August 2, 2026, requires providers of generative systems to mark outputs in a machine-readable way, and the two-layer model is how the industry has chosen to comply: a manifest for interoperability and a watermark for durability. Deployers who publish AI content commercially have their own disclosure duties. Removing a manifest from your own file for privacy is a technical step; whether you must disclose AI involvement when you publish is a separate question that the metadata does not answer for you.
Check an image
See whether your image carries a C2PA manifest
Runs in your browser. Nothing is uploaded.
Need unlimited strips?
Scans are free. Pro is unlimited.
Images, video, audio, documents, PDF and text in one tool. Pro adds unlimited strips, whole-folder batches and zip download with a JSON report.
Frequently asked questions
What is the difference between C2PA and a watermark?
C2PA is a signed record stored in the file's metadata: who made it, with what tool, and what was done to it. Anyone can read it and any metadata tool can remove it. An invisible watermark is a signal embedded in the pixels, audio or words themselves. It needs the maker's detector to read and survives most edits. Many AI outputs now carry both.
What is a soft binding in C2PA?
A way to reconnect content to its manifest after the metadata is gone. The specification allows a fingerprint or an invisible watermark to act as a lookup key for a manifest stored elsewhere, so provenance can be recovered even from a stripped or screenshotted copy.
Which platforms read C2PA?
Instagram, Facebook and Threads use it to apply AI labels. LinkedIn shows a Content Credentials icon. TikTok reads it for its AI-generated label. Pinterest uses it alongside other signals. Google Search and YouTube have announced support in various forms.
If I remove C2PA, is the file free of provenance?
Not necessarily. If the generator also embedded an invisible watermark, that layer remains, and a platform that checks it can still identify the content. Removing C2PA removes the metadata trigger that most platform labels use today, which is useful, but it is not the same as removing all provenance.
Is it legal to remove C2PA from my own files?
For your own content, removing metadata is generally an ordinary privacy step. Where you have a duty to disclose AI use, under a platform's rules or a law such as the EU AI Act's Article 50, removing the metadata does not remove the duty. StripShot's disclaimer covers this in plain terms.