ozDNA / Learn / Provenance vs detection

Content Provenance vs AI Detection: What Each Can Establish

Published October 16, 2026 · Last reviewed October 16, 2026
By Ebru Ozpolat · KOLAXA YAZILIM TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ

People often treat these as two answers to one question: is this AI? They answer different questions. They fail in different ways, and they need different things from whoever made the content. Mixing them up leads to two common mistakes. One is trusting a detector score as if it were evidence. The other is reading a missing provenance record as proof of something.

What AI detection does

An AI detector is a classifier. It is trained on examples of human-made and machine-made content, and it outputs a score for how closely a new file resembles each group. It needs nothing from the creator. That is its appeal: it works on any file, including content that was never labelled.

The cost is that the output is an estimate about statistical features, not a fact about history. Accuracy drops in predictable situations:

• New generators. A detector trained on last year's models may not recognise output from a model released after it.
• Edits and re-encoding. Cropping, resizing, compression or a light paraphrase can move content across the threshold.
• False positives. Human work that happens to look like model output gets flagged. For text, this includes formulaic writing and writing by non-native speakers.

These limits are documented, not hypothetical. OpenAI withdrew its own AI text classifier in July 2023, six months after launch, citing its low rate of accuracy. A detector score can be a reason to look closer. It cannot settle a dispute on its own.

What content provenance does

AI content provenance is a record of where content came from, created at or near the moment it was made and checkable later. Instead of studying the pixels for clues, a verifier checks evidence that was written down at creation. Depending on the system, that record can include:

• a cryptographic signature that ties the file to a signer and breaks if the file is altered;
• a content hash, a fingerprint of the exact bytes;
• a timestamp showing the content existed by a certain date;
• a perceptual fingerprint that still matches after the file is resized or recompressed;
• declared facts, such as the tool used or a statement that the content is AI-generated.

The open standard for embedding such records in media files is C2PA, shown to people as Content Credentials. How each piece is checked is covered in how to verify an AI content record.

Provenance gives strong answers, but only for content that has a record. Most content on the web today has none. Many platforms strip embedded metadata on upload, so a record attached to the original file is often missing from the copy someone actually sees.

Side by side: what each can establish

The useful comparison is not which method is better. It is which question each one can answer.

Content authenticity vs factual accuracy

Authenticity is about the file. Accuracy is about the claim. A provenance record can show that an image came from a named newsroom's camera at a given time and has not been altered since. It cannot show that the scene wasn't staged, that the caption is right, or that the photo is from the event it is said to show.

The same holds the other way. A fully authentic, signed AI image is still a made-up image. Its record simply says so honestly. For fact-checkers, provenance answers "where did this come from and has it been changed?" That narrows the work. It doesn't replace checking the claim itself.

How each one fails

Detection fails silently

A wrong detector score looks exactly like a right one. There is no way to tell from the output alone whether this is one of the cases the model gets wrong, and that is the main reason detector output is risky as evidence.

Provenance fails visibly

When provenance is missing or broken, the verifier can say so: no record found, signature does not match, signer unknown. "No record" is an honest result, but people often misread it. It means "nothing to check", not "fake". A real photo with stripped metadata and a generated image with no marking look the same to a provenance check.

Why regulation leans on provenance

Article 50(2) of the EU AI Act requires providers of AI systems that generate synthetic audio, image, video or text to mark the output in a machine-readable format, so that it is detectable as artificially generated. The obligation falls on the party that creates the content, at creation, and that is how provenance works. The Act asks the people generating content to attach the evidence, instead of asking everyone else to guess afterwards. The Article 50 transparency duties apply from August 2, 2026. This is general information, not legal advice. What applies to you depends on your product.

Using both, sensibly

1. Check for a record first. If the content carries provenance, or matches a registered original, that is the stronger evidence.
2. Read the record for what it says. It tells you who signed, when, and whether the content changed. It does not tell you the content is true.
3. Without a record, treat a detector score as a lead. Look for the original source, other copies, and context.
4. Never act on a detector score alone when the result affects a person, such as an academic integrity case, a takedown, or an accusation.

Sources

• Regulation (EU) 2024/1689 (AI Act), Article 50, EUR-Lex
• OpenAI, "New AI classifier for indicating AI-written text", including the July 2023 withdrawal note
• C2PA technical specifications, Coalition for Content Provenance and Authenticity

Keep reading

• What Are Content Credentials? A Practical Guide to C2PAWhat a C2PA manifest contains and how to verify one.
• How to Verify an AI Content RecordHashes, signatures and timestamps, step by step.