AuditImage
Guides

The C2PA manifest in DALL·E and ChatGPT images

OpenAI has embedded C2PA manifests in generated pictures since 2024. What the manifest contains, who signs it, and why it is so often missing by the time you look.

Manifest contents

An original PNG or WebP from DALL·E 3 or ChatGPT's image generation carries a C2PA manifest with, typically:

  • claim generator: OpenAI, sometimes with a version or the c2pa-rs library version.
  • c2pa.actions: one c2pa.created with digitalSourceType of http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia and softwareAgent of DALL·E or GPT-4o / ChatGPT.
  • Signer: certificate subject OpenAI, issued by the commercial CA they use.
  • c2pa.hash.data: the content hash, excluding the segment holding the manifest itself.

API output is the same, as long as you keep the original file the service returned.

How AuditImage judges it

When the active manifest's c2pa.actions contains trainedAlgorithmicMedia, the verdict is "AI-generated, declared in Content Credentials". This is the clearest possible result: the generator signed a statement that this is an AI picture.

Why it is so often missing

  • "Copy image" in the ChatGPT web app: copies pixels, no manifest.
  • Screenshots: none.
  • Uploaded to a social platform and downloaded again: most platforms strip it. Instagram and LinkedIn read and label it, but a re-download does not necessarily keep it.
  • Re-saved in an ordinary image viewer: almost always lost.
  • WebP converted to PNG or JPEG: converters rarely carry C2PA across.

OpenAI itself notes that C2PA metadata "can easily be removed either accidentally or intentionally" and should not be the only evidence.

Manual check

c2patool image.png
exiftool -JUMBF:all image.png

After uploading to AuditImage, open the "C2PA Content Credentials" section: the actions table shows trainedAlgorithmicMedia in the source type column.