SynthID vs C2PA: what metadata removal can and cannot touch

Two very different systems get called “AI watermarks”. One is a record attached to the file. The other is a pattern hidden in the picture. The difference decides exactly what a metadata remover can do, and it is the most misunderstood thing in this whole area.

The short version

	C2PA Content Credentials	SynthID
What it is	A signed provenance manifest	An imperceptible pattern in the pixel values
Where it lives	A JUMBF block in the file container, beside the image data	In the image data itself
Who writes it	OpenAI, Adobe, Microsoft, Google and others, plus some cameras	Google’s generative models
Who can read it	Anyone with a C2PA verifier	Google’s own detection tools
Survives a screenshot	No	Designed to
Survives re-compression	Usually not	Designed to
Removed by a metadata remover	Yes	No

C2PA: a label in the file

A C2PA content credential is a manifest — a structured record saying which tool made the file, when, and what was done to it — signed with the issuer’s certificate. It sits in a block of its own: an APP11 segment in a JPEG, a caBX chunk in a PNG, a jumb box in HEIC and AVIF.

The signature makes it tamper-evident. You cannot edit a credential to say something false without the verification failing. You can, however, remove it entirely, and the C2PA design anticipates that. A file with no credential is in the same state as every ordinary photo that never had one.

Because the manifest sits beside the pixels rather than inside them, removing it is a container edit. Nothing about the picture changes.

SynthID: a signal in the pixels

SynthID is Google DeepMind’s watermarking system. At generation time it nudges the pixel values in a pattern people cannot see but a detector can. Google applies it to output from its image, video and audio models, and says it is designed to survive the ordinary things that happen to images: cropping, resizing, filters and compression.

There is no SynthID block to point at in the file. It is not metadata at all. That also means it is not an open standard in the way C2PA is — detection depends on Google’s tools, and Google has published limited detail on how robust it is against deliberate attack. Treat confident claims in either direction with care.

Why the two are paired

They answer different questions. A credential answers who says so, verifiably — but it is lost the moment a file is screenshotted or re-saved by software that does not carry it forward. A watermark answers does this image still carry a mark after the label is gone — but on its own it cannot say much beyond that.

So the industry direction is to use both: a readable, signed record for the ordinary case, and a pixel-level mark for when the record has been stripped. Google has said it pairs SynthID with C2PA credentials on some of its products. Other providers use their own watermarking alongside credentials, and platforms add classifiers that look for the statistical traces generation leaves behind.

What this tool does to each

It removes the C2PA manifest, the XMP packet (including the digital source type field that declares AI involvement), EXIF, and the PNG text chunks where Stable Diffusion interfaces write your prompt.

It does nothing to SynthID or any other pixel watermark. That is not a gap waiting to be filled — it follows from how the tool works. The compressed image data is copied through byte for byte, so whatever is in the pixels leaves exactly as it arrived. A tool that re-encodes your image disturbs the pixels more than this one does, not less, and still does not remove a watermark designed to survive re-encoding.

We will not add pixel manipulation to defeat watermarks or detectors. It degrades your image, and its purpose is to mislead a system built to label content accurately. About sets out that line.

Which one should you care about?

From a privacy point of view, the credential is usually the one worth reading. A C2PA manifest can record the tool, the account context, timestamps and an edit history — details about you and your workflow. Google describes SynthID as identifying content as generated by its models; it has not described it as carrying account-level identity.

From a disclosure point of view, neither changes your obligations. If a platform, a client or a law expects you to say an image is AI-generated, removing the credential does not satisfy that, and the watermark will usually still be there regardless. Say so in the caption.

For how this plays out on one specific platform, see what triggers Instagram’s AI info label. For the legal side, see is removing metadata illegal?