An image saved from an AI tool can hold surprising extras: your prompt as plain text, a signed note naming the software that made it, or a signal woven into the pixels. They behave very differently, and people often assume one tool can handle all of them. It cannot. Here is the map.
Four kinds of traces
| Kind | Example | Lives in | Can you delete it? |
|---|---|---|---|
| Recipe | Prompt, negative prompt, seed, sampler, model; ComfyUI node graph | PNG text chunks | Yes |
| Signed provenance | Content Credentials (C2PA) manifest | Dedicated chunk, segment or box | Yes |
| Plain label | IPTC digital source type trainedAlgorithmicMedia | XMP / IPTC | Yes |
| Pixel watermark | Google SynthID and similar | The pixel values themselves | Not with a metadata tool |
The first three are metadata and can be inspected and removed. The fourth is invisible to any metadata tool by design.
Anatomy of a C2PA manifest
Content Credentials follow the open C2PA standard. An application that creates or edits an image can attach a manifest made of four parts:
- Claim: which application produced the file.
- Assertions: what happened (created, cropped, generative edit) and whether a model generated the content.
- Signature: from a certificate that identifies the signer.
- Hash binding: ties the manifest to the exact pixels. Change the picture without a new signed record and a verifier flags it.
Storage differs per format: a caBX chunk in PNG, APP11 segments in JPEG, a C2PA chunk in WebP, a box in MP4 and MOV. The Content Credentials verify page reads it and shows the history.
What it proves, and what it doesn't
- Proves: which tool claims to have made or edited the file, who signed that claim, and whether the pixels changed afterwards.
- Does not prove that the image is truthful. A real photo can be staged; a generated image can be accurate.
- Absence means little. Many editors, platforms and chat apps drop metadata, and a manifest can be deleted. A missing manifest does not make an image real or fake.
- It is a claim, not a verdict, only as reliable as the signer.
Some providers keep their own copy of the credentials and can retrieve it through an invisible watermark or image fingerprint, which is why a platform may show a label after the file's own manifest has been removed.
Who writes and who reads
Credentials are attached by default by several generators and editors, including OpenAI image generation, Adobe Firefly and Photoshop generative tools and Microsoft design tools, and certain cameras and phones can sign photos. On the platform side, Meta, TikTok and LinkedIn have said they use Content Credentials or IPTC fields for labels, and YouTube asks creators to disclose realistic synthetic content when uploading.
The recipe in a PNG
AUTOMATIC1111-style interfaces write one text entry, parameters, holding prompt, negative prompt, steps, sampler, seed, size and model identifiers. ComfyUI writes two, prompt and workflow; drop that PNG into ComfyUI and the whole graph returns. Wonderful when you want to share a method, a leak when you do not. Per-tool details are on the AI image metadata remover page.
A simple decision rule
| Situation | Suggestion |
|---|---|
| Journalism, documentary or product work where provenance helps; a platform or client requires it | Keep it |
| Prompts and workflows are your craft; client or product names, model or folder paths appear; you don't want a signer identity on a public file | Delete it |
| Any case | Archive the original; disclose AI use where your audience or a platform expects it |
Removing metadata does not change what an image is.
Inspect a file yourself
- Drop it on the AI metadata cleaner: the report names generation records, Content Credentials, XMP and comments.
- Read a manifest on the Content Credentials verify page.
- Run
exiftool -a -G1 -s image.pngor open the file in the metadata viewer.