Firefly image watermark detector limits

Firefly's mark is not pixel data. It is Content Credentials: a C2PA manifest, cryptographically signed and embedded in the file's metadata, asserting which tools contributed to the asset and whether a trained model produced the content.

This route parses that structure. The file is uploaded into our media workflow, where the container is read, any manifest is extracted, its signature is checked and its assertions are reported. Uploading is not incidental here. A manifest lives inside the file, so reading one requires the file.

The procedure matters less than which file you feed it.

Step 1

Obtain the original asset. A screenshot, a platform download or a re-export is a different file and will usually return a different verdict.

Step 2

Upload it here. The container is parsed, the manifest extracted, the signature verified.

Step 3

Interpret the verdict against the three states below, weighting a negative result far lower than a positive one.

Treating this as a binary is the most common analytical error in provenance checking. The three states differ not only in what they say but in how much they are worth.

Present and valid

The signature verifies and the content matches what was signed. Strong evidence about the file's declared history, because forging a valid signature is expensive and verifying one is cheap.

Present and invalid

A record exists but does not verify, or the asset has diverged from what was signed. This is informative in a different direction: it indicates modification after signing rather than absence of provenance.

Absent

Consistent with an asset that never carried credentials and equally consistent with one that lost them in transit. As evidence, close to worthless on its own.

Content Credentials are metadata, and metadata does not survive the ordinary lifecycle of an image. Re-encoding, recompression, screenshotting and most upload pipelines discard it, not as a circumvention but as a by-product of writing a new file.

That produces a strong asymmetry in what the two outcomes are worth. A positive is near-conclusive about what the file declares, because the assertion is signed. A negative is weak, because the base rate of stripping is high and rises with every hop the file makes. Any workflow that treats a clean scan as clearance has inverted the evidence.

The practical consequence is that provenance checking is a chain-of-custody question before it is a tooling question. A file received directly from its creator supports inference. The same image pulled from a social feed does not, regardless of what any detector reports.

A manifest is a signed collection of assertions. The one that answers the generation question is the digital source type. Set to trainedAlgorithmicMedia, it declares model-generated content; a composite value indicates a model contributed to an otherwise captured asset. That assertion, not the mere presence of a manifest, is what distinguishes a generated image from a camera file that also carries credentials.

The claim generator identifies the writing tool, the ingredient chain records prior assets and edits, and an X.509 certificate backs the signature. The manifest is carried in format-specific containers, an APP11 segment in JPEG, a metadata chunk in PNG, a uuid box in MP4, which is precisely why it is separable from the image data and why screenshots never carry it.

No, and the distinction is the most important one on this page. C2PA attests to origin and integrity. It establishes who signed an assertion and whether the bytes have changed since. It makes no claim about whether the depicted scene is real, staged or misleading, and a deliberately deceptive image can carry a flawless credential.

Nor is the scheme unbreakable. Certificate revocations have followed vulnerabilities found in shipped hardware, and a signing key held on a compromised device can be used to sign arbitrary content. Signed provenance raises the cost of fabrication substantially. It does not eliminate it, and a detector page that presents verification as proof is overselling the standard it depends on.

This route reads the C2PA manifest and reports what it finds. It does not perform pixel-level watermark analysis, does not assign confidence scores to an invisible in-image signal, and does not attempt to identify a model version from image content. Competing pages advertise all three.

It also does not classify an image as AI-generated from visual features. That is a different technique with different failure modes, and merging the two behind one verdict would make the result impossible to interpret. A manifest answer is precise because it is narrow, and stating the boundary is what lets the answer be trusted.

Editorial teams performing provenance review on supplied imagery, where a declared generation assertion changes captioning obligations or kills the usage outright. Agencies and brand teams auditing delivered assets against a brief that restricted generated material.

Compliance functions building a documented record of what was checked and when, where the value is the audit trail rather than the verdict. And anyone verifying, after a removal, that no manifest remains in the file they are about to publish.