When AI-generated images are so realistic that they are nearly identical to real ones, what can we use to prove they are fake? That's such a brutal trick.
Editor's Note: From time to time, we select high-quality articles from Matrix to showcase the most authentic user experiences and perspectives. The views expressed in the articles represent the authors' personal opinions, and sspai only makes minor adjustments to titles and formatting.
Pre-reading Notice: All text content in this article is written by myself, but some of the image content is AI-generated, and each image has a clear AI generation note (including the model and version number used to generate it) in the image caption.
Generated by ChatGPT Images 2.0
The image above is an AI-generated picture. If it weren't for the rather bizarre characters appearing in it, even if you stare intently, or even zoom in several times to observe the text and hair edges, it would be extremely difficult to tell that this is an AI-generated image. You might think it's a playful parody of *The Big Bang Theory*.
One of the "culprits" is ChatGPT Images 2.0, released by OpenAI last April. This model introduced Agentic reasoning capabilities into image generation models for the first time, allowing it to produce more realistic and complex light and shadow effects. Even more impressively, it has almost completely overcome the long-standing flaw of previous AI image generation models that "cannot write": the rendering accuracy of text on signs, flyers, and packaging in images is extremely high.
The age-old human truth of "seeing is believing" has officially become obsolete in 2026. When the threshold for forgery is so low that ordinary people can create nearly perfect images as evidence just by entering a few prompts, our visual trust system has already crumbled. Fortunately, crises caused by technology can still be resolved with technology: just one month after the release of ChatGPT Images 2.0, on May 20, OpenAI announced another major initiative: fully adopting the C2PA open standard and the SynthID invisible watermark technology from Google DeepMind.
C2PA: The "Digital ID Card" for AI-Generated Images
What's the most intuitive way to let others know that an image is AI-generated? Put a label on it. This is what C2PA (Coalition for Content Provenance and Authenticity) is for.
You might wonder: Isn't modifying an image's EXIF information very easy? Why bother establishing a dedicated coalition? While software engineers could cut corners by simply editing EXIF data to show their supervisors, the technical foundation of C2PA is far more sophisticated.
PKI (Public Key Infrastructure) and Digital Signatures
The underlying architecture of C2PA relies on PKI (Public Key Infrastructure), a system very familiar to cybersecurity professionals. After an AI model finishes generating an image, the AI vendor's server automatically applies a digital signature to the image using a private key, essentially giving the image a unique "digital ID card". When you receive this image, you can use the vendor's public key to verify the signature and confirm whether the image was generated by that vendor's AI model.
Chained Records
C2PA also features a design that can record information in extreme detail: chained records. If you use multiple C2PA-compatible hardware/software tools during image processing, all of their information will be recorded sequentially, without missing a single entry.
For example: Suppose you have an image generated by ChatGPT Images 2.0 with a C2PA signature. You open it in Photoshop and crop it. Instead of overwriting OpenAI's original signature, Photoshop will add a new signature from Adobe and link it to OpenAI's original signature, forming an unalterable "chain" composed of digital signatures from various vendors. Anyone who views this image can clearly see its entire lifecycle: it was created in OpenAI ChatGPT Images 2.0 and edited in Adobe Photoshop. Every step has a corresponding digital signature from the relevant vendor. If someone tries to forcibly erase or modify any part of the chain, the entire data chain will break, and this tampering can be easily detected by verification tools.
No System Is Absolutely Secure
Like all digital systems in the world, C2PA has its weaknesses — it is attached to the file's metadata layer rather than the pixel layer. So when you send an image on social platforms such as WeChat, QQ, or Weibo, the platform may aggressively remove all metadata and EXIF information (including C2PA data) to save bandwidth.
Therefore, once separated from the original file, the "digital ID card" function of C2PA becomes completely invalid — even taking a simple screenshot like this can bypass all C2PA verification.
This photo was taken with a real camera, but the image opened on the screen in this photo was generated by ChatGPT Images 2.0
To counter this kind of "shelling" behavior, AI vendors must deploy another more covert, higher-security technology.
SynthID Invisible Watermark: "Carving Words into Stone"
Luo Ji pointed at the stone tablets and said, "We have tried every storage method: optical discs, hard drives, flash memory, quantum storage... None of them have a shelf life longer than a few hundred years. In the end, we found that the only thing that can preserve information for over 100 million years is this." He patted the stone tablet beside him. "The most primitive method turns out to be the most enduring."
"Robust Steganography"
From ancient Greece using scalp tattoos and wax-coated wooden tablets to hide secret messages, to passing military intelligence with lemon juice "invisible ink" and microfilm during the World Wars, to modern days hiding information in digital images using discrete cosine transforms, human steganography has been a millennia-long cat-and-mouse game with detection technologies.
In the digital age, traditional steganography usually modifies the Least Significant Bit (LSB) of image pixels. For example, slightly adjusting the RGB value of a pixel from (0,0,0) to (1,1,1) — a change imperceptible to the human eye, but detectable by computers.
The problem is that this "traditional steganography" is quite fragile. As soon as the image undergoes slight lossy compression or a bit of noise is added, the hidden information in the image is completely destroyed. For AI-generated images, we need robust steganography: watermarks that can still be accurately read even after lossy compression, screenshots, cropping, and even applying filters and Gaussian blur.
The Technical Principle of SynthID Invisible Watermark
SynthID does not simply modify pixel colors crudely; it operates deep in the frequency domain of the image.
If you are familiar with audio processing, you know that Fourier transforms can break down sound into waveforms of different frequencies (yes, that Fourier that haunts engineering students...). The same applies to images. Through mathematical transforms (such as discrete cosine transforms), an image can be decomposed into low-frequency information (general outlines and color blocks) and high-frequency information (edges, textures, and noise). Readers who are less familiar with this concept can refer to the two images below.
The image shows low-frequency information
The right image shows high-frequency information; the original unmodified image was generated by ChatGPT Images 2.0
The SynthID algorithm quietly injects a type of micro noise invisible to the human eye into a specific high-frequency band of the image at the very early stage of image generation. It's like adding "ultrasound" to a song — you can't hear it at all, but instruments can detect it.
Adversarial Training Mechanism
SynthID's most ingenious design is that it has undergone adversarial training. When training SynthID's information injection model, Google DeepMind engineers created a model with the exact opposite function to the injection model: while the injection model adds a watermark, this counter-model tries every means to destroy the watermark — compressing the image heavily, adding excessive noise, or even using other AI image generation models to "purify" it. During this adversarial process, the injection model must constantly adjust its watermark embedding strategy, until no matter how the "anti-injection model" tampers with the image, the watermark can still be recognized. This is how SynthID achieves its unparalleled robustness.
Current Status: The Clash of Spear and Shield
Having read this far, do you still remember the title of Section 3 in Chapter 1 of this article?
No system is absolutely secure.
Could the "stamp" that vendors apply to AI-generated images ever be cracked? Of course. In the field of cybersecurity, any system that claims to be "uncrackable" will eventually prove to be a product of arrogance. This leads to the second half of the statement: there is no absolutely secure system, only continuously evolving games of cat and mouse.
Weakness and ignorance are not barriers to survival — arrogance is.
For example, last April, a GitHub developer @Aloshdenny claimed that using only more than 200 Gemini-generated images, he could disrupt the watermark injected by SynthID, "confusing the decoder and making it give up reading". In response, Google DeepMind immediately took a powerful countermeasure: dynamically changing the frequency domain where the watermark is embedded, making it impossible for any algorithm to directly remove the SynthID watermark.
Verification Methods You Can Use
While introducing the C2PA and SynthID invisible watermark technologies, OpenAI also launched a verifier. Even if the human eye cannot distinguish the authenticity of an image, the verifier can help us "separate the genuine from the fake".
If you are a creator and want to prove that your work is not AI-generated, you can also refer to the following methods:
Enable the Content Credentials Feature
If you use Adobe software, you can enable the Content Credentials feature when exporting your work. This will attach your digital signature to the exported file.
"Perks" for Users of Certain Camera Brands
Newer cameras from brands like Leica and Sony have integrated C2PA signature chips at the hardware level. These chips will attach a C2PA digital signature to every image taken with these cameras, proving to others: "Every ray of sunlight in this image traveled 8 minutes and 20 seconds through the real world, finally reaching the camera's CMOS, and being preserved in digital form for you to see."
Summary
From stone carvings to movable-type printing, from film cameras to digital mirrorless cameras, the way humans record information has been constantly changing. But our demand for "authenticity" has never faded.
Looking back at the history of the Internet, the early HTTP protocol was full of unencrypted plaintext transmissions and man-in-the-middle attacks. It wasn't until HTTPS and SSL certificates became widespread that the little "lock" icon representing security became something we take for granted. Today's countermeasure technologies such as C2PA and SynthID are in their own "HTTP era". Maybe in five or ten years, we won't need to deliberately find or use any verification tools — operating systems and browsers will complete all verification silently at the underlying level. An image without a "digital stamp" will be automatically blocked by the system, just like web pages that don't use the HTTPS protocol today, marked with a red warning that says "Your connection is not private".
Original link: https://sspai.com/post/112185?utm_source=wechat&utm_medium=social
This article is from the WeChat public account "sspai" (ID: sspaime), author: SNbing54, published by 36Kr with authorization.