C2PA vs. SynthID: what metadata removal actually removes

A lot of tools promise to "remove AI watermarks." Most of them are being loose with the truth, because modern AI images carry two fundamentally different kinds of marking — and only one of them can be removed by cleaning the file.

If you share, publish, or clean AI-touched images, this distinction is the single most useful technical fact to internalize. Here it is, without the marketing.

Two marks, two layers

C2PA Content Credentials live in metadata. A C2PA manifest is a cryptographically signed block of data embedded alongside the image data — same neighborhood as EXIF and XMP. It records what tool made the image, when, and what operations touched it, and it's signed so the claim can be verified. We've covered how it works in detail.

SynthID lives in the pixels. Google DeepMind's watermark subtly adjusts pixel values themselves in a pattern that's invisible to you but detectable by Google's classifier. There is no metadata block to find — the mark is the image. Google embeds it in everything from Gemini and Imagen, and had watermarked over 10 billion pieces of content by mid-2025.

Since May 2026, the two systems overlap: OpenAI now embeds both — a C2PA manifest and a SynthID watermark — in images from ChatGPT and its API, and launched a public "Verify" site for checking them. Dual marking is quickly becoming the norm among major generators.

What survives what

This table is the whole post:

The pattern: C2PA is fragile, SynthID is durable. C2PA's designers know this — fragility is inherent to metadata, which is why the standard is paired with watermarking rather than competing with it. The two are complementary by design: metadata carries the rich, verifiable detail; the watermark persists when the metadata doesn't.

Durable isn't indestructible — heavy cropping, aggressive re-generation, or adversarial attacks can degrade a pixel watermark, and researchers publish removal attacks regularly. But nothing you'd do in the course of normally editing or sharing an image will remove SynthID. Metadata cleaning certainly won't.

So what does cleaning an AI image actually do?

When you strip metadata from, say, a ChatGPT image, here's the honest accounting.

Removed: the C2PA manifest (the signed "this was made by OpenAI" assertion), any XMP/IPTC tags naming the tool, and — for local Stable Diffusion files — the PNG text chunks carrying your full prompt, seed, model, and parameters (what each generator embeds). This is real, meaningful removal: anyone inspecting the file no longer gets a readable declaration of its origin, and your prompts stay yours.

Not removed: the SynthID watermark, if the generator embedded one. Google's detector — and OpenAI's Verify, for their images — can still identify the file. Also unaffected: pixel-level AI classifiers (Hive and similar), which analyze image content and never cared about your metadata in the first place.

Also worth knowing: platform labels triggered by metadata (like Instagram's "AI info") respond to cleaning, because the platforms read the metadata layer. Detection systems that analyze pixels do not.

Why we're telling you this

Search for "remove SynthID" and you'll find a shelf of tools happy to take your money for something between partially effective and impossible. We build a metadata remover, so it would be commercially convenient to imply metadata removal makes AI images untraceable.

It doesn't, and we won't. Our position, same as on our FAQ: CleanImages removes the metadata layer — completely, verifiably, locally in your browser. That's valuable for privacy: your prompts, your tools, your workflow details, and the machine-readable AI declaration are all in that layer. But if an image carries a pixel watermark, it will still carry it afterward, and we'd rather you know that before you share than find out after.

How to think about it

Use the two-layer model to decide what you actually need.

If your concern is privacy and prompt confidentiality — you don't want files you share to advertise your tools, prompts, workflow, or generation parameters — metadata cleaning solves your problem. That data lives in the metadata layer, and stripping it works. Inspect a file first to see which layer your concern actually lives in, then remove the manifest if that's the layer that matters to you.

If your concern is a platform mislabeling your lightly-edited real photo as AI, metadata cleaning solves that too, because the labels are metadata-triggered.

If your goal is to make a fully AI-generated image pass as human-made to anyone determined to check — that's not achievable by cleaning files, and increasingly it's not achievable at all. Between SynthID-class watermarks, pixel classifiers, and (since August 2026 in the EU) legal requirements for AI providers to mark outputs, the detection stack no longer depends on metadata. Plan accordingly, and be skeptical of any tool that promises otherwise.

TL;DR

C2PA is metadata: rich, verifiable, and gone the moment you strip metadata or take a screenshot. SynthID is pixels: invisible, durable, and unaffected by anything a metadata tool does. Cleaning an AI image removes the readable data layer — a genuine privacy win — while the watermark layer stays. Any tool that tells you otherwise is selling you the wrong half of the truth.