What AI images still say about themselves
We read 77 AI-generated images from Wikimedia Commons with our checker, then ran each one through six common processing steps. Most carried no provenance signal at all, and none of the Content Credentials survived processing.
Published 2026-10-12. Image Evidence study; data under CC BY 4.0.
Key findings
- 17 of 77 images (22%) carried a provenance signal our checker could read. For the other 60, the checker found nothing.
- Adobe Firefly and ChatGPT (GPT Image) carried C2PA Content Credentials most often. No signal was found in any file from Grok, Meta AI, FLUX, Stable Diffusion.
- No C2PA record survived processing (0 kept across six steps), including re-encodes that were set to keep metadata. AI declarations in IPTC or XMP metadata survived conversion and resizing, but not a default re-encode or a screenshot.
- "Invalid" did not mean edited. 5 of the 12 Content Credentials did not validate; in 5 of them the reason was an expired or invalid signing certificate, and no content mismatch was reported.
Method
The sample is 77 original files uploaded to Wikimedia Commons between 2024-01-01 and 2026-09-29, whose page names the generator that made them. Commons stores the uploaded bytes without re-encoding them. We kept at most three files per uploader for each generator and excluded images of identifiable real people. Licences: Public domain 70, CC0 6, CC BY-SA 4.0 1.
Each file was read with the same evidence code as our free checker: C2PA Content Credentials and their validation state, the signer when it is OpenAI, Google, Adobe or Microsoft, AI declarations in EXIF, IPTC and XMP metadata, and Stable Diffusion parameters in PNG files. We checked every Content Credentials result again in the live checker in Chrome and got the same answer. Each original file then went separately through six processing steps, listed in the second table.
What the files carried
| Generator | Files | C2PA | C2PA valid | Signer | AI declared in metadata | Any signal |
|---|---|---|---|---|---|---|
| Adobe Firefly | 3 | 3 | 3 | Adobe | 0 | 3 |
| ChatGPT (GPT Image) | 9 | 7 | 2 | OpenAI | 0 | 7 |
| DALL-E 2 and 3 | 10 | 1 | 1 | OpenAI | 0 | 1 |
| Midjourney | 10 | 1 | 1 | Adobe | 3 | 4 |
| Gemini, Imagen and Nano Banana | 10 | 0 | 0 | – | 2 | 2 |
| Grok | 10 | 0 | 0 | – | 0 | 0 |
| Meta AI | 6 | 0 | 0 | – | 0 | 0 |
| FLUX | 8 | 0 | 0 | – | 0 | 0 |
| Stable Diffusion | 10 | 0 | 0 | – | 0 | 0 |
| Bing Image Creator | 1 | 0 | 0 | – | 0 | 0 |
| All files | 77 | 12 | 7 | 5 | 17 |
The Midjourney file with Content Credentials was signed by Adobe Photoshop after an edit, not by Midjourney. No Stable Diffusion file kept its PNG generation parameters. Gemini images may carry a SynthID watermark in their pixels, which this checker cannot read; see our SynthID guide.
What survived processing
| Step | C2PA kept | AI metadata declaration kept |
|---|---|---|
| Converted to JPEG with macOS sips | 0 of 12 | 5 of 5 |
| Resized to half width with macOS sips | 0 of 11 | 5 of 5 |
| Re-encoded as JPEG by libvips with default settings | 0 of 12 | 0 of 5 |
| Re-encoded as JPEG by libvips, keeping metadata | 0 of 12 | 5 of 5 |
| Cropped by libvips, keeping metadata | 0 of 12 | 5 of 5 |
| Screenshot in Chrome | 0 of 12 | 0 of 5 |
Counts cover the files that carried that signal before processing. The macOS image tool cannot write WebP, so WebP files were not resized.
Why "did not validate" is not the same as "edited"
A C2PA manifest can fail validation for different reasons. If the image's content no longer matches the hashes in the manifest, the file was changed after signing. If only the signing certificate has expired or is not valid, the image can be exactly what was signed, but the signature can no longer confirm the claims. In this sample, all 5 Content Credentials results that did not validate were of the second kind: ChatGPT files whose signing certificate had expired or was reported as not valid, with no content mismatch. Our checker now names the reason instead of suggesting an edit.
What this means when you check an image
Ask for the original file, not a screenshot or a re-shared copy. A missing signal is the normal case, even for AI images, so it does not show that an image is real. When Content Credentials do not validate, read why before drawing a conclusion. Our guide on how to tell if an image is AI-generated covers the other checks.
Limitations
The files are what people uploaded to Commons, not fresh downloads from each generator, and some were made through third-party sites. The sample is small for Adobe Firefly and Meta AI and was chosen by hand, not at random, so the percentages describe this sample only. Processing was done with macOS sips, libvips and Chrome, not with Photoshop, phone galleries or social platforms. Our checker does not read SynthID or other pixel watermarks, and it currently does not detect one Microsoft manifest in the sample whose JPEG packaging departs from the C2PA rules; the SDK reports that manifest as signed with an invalid credential.
Data and citation
Download the data: one row per file, with each image's Commons page, uploader and licence, and the summary by generator. The images themselves are not republished here; follow the Commons links for each file. The data is released under CC BY 4.0. Please cite it as: Image Evidence, "AI Image Provenance Study, October 2026", https://imageevidence.com/research/ai-image-provenance.