AI Signature: Watermarks, Metadata, and Style Signals

The phrase almost never means one specific thing. That's the actual problem with it.

• A cryptographically signed provenance record, such as a C2PA Content Credential. This is a literal digital signature in the same sense an SSL certificate or a signed PDF is one.
• An invisible statistical watermark, such as Google DeepMind's SynthID, which biases which words or pixels a model picks so a matching detector can later recover a probabilistic signal. Nothing here resembles a certificate or a file you can open.
• A human-noticed stylistic fingerprint: repeated words, sentence rhythm, punctuation habits like the em dash. People treat this as though a company planted it deliberately, when it's a side effect of training data and fine-tuning.
• Whatever a commercial detector (GPTZero, Originality.ai, Turnitin-style checkers) prints as a verdict. That's a classifier's guess, not evidence that anything was inserted.

Two questions separate these cleanly. Was anything deliberately embedded, and can it be checked against a known, published mechanism?

A C2PA manifest and a SynthID watermark both answer yes to the first. They split completely on the second: the manifest is openly readable metadata with a signature you can verify, while SynthID isn't readable at all without the provider's own detector, because it was never stored as metadata in the first place.

Style tells and detector verdicts both answer no to the first. Nobody at OpenAI or Google decided to make their models favor em dashes as an identifying mark, and a classification is an inference about probability rather than a signal anyone placed.

The C2PA specification requires that a Content Credential, the manifest recording an asset's origin, edits, and tool use, be hashed (typically SHA2-256) and then signed with the private key of whatever software or hardware produced it. This runs on standard X.509 certificate infrastructure, the same public-key system underlying HTTPS and signed PDFs.

Producers who want their signatures trusted get their certificates accredited onto the C2PA Trust List. Any change to the asset or its provenance record after signing invalidates the hash chain, which is how tampering gets caught.

Leica's M11-P, announced by the Content Authenticity Initiative on October 26, 2023, was the first camera to sign photos with a C2PA Content Credential at the moment of capture. It embeds camera model, timestamp, and later edit history into a signed manifest a viewer can check in the Leica FOTOS app or at contentcredentials.org/verify.

AI image tools plug into that same signing mechanism, not the camera itself, when they attach C2PA metadata to generated output. That's why "does this have a C2PA signature" is a well-posed, checkable question in a way "does this have an AI signature" is not.

The limit is worth stating plainly. A verified manifest tells you what the signer claimed, not whether AI touched the file at some earlier, unsigned stage.

SynthID-Text works by subtly biasing the sampling algorithm a language model uses to choose each next token. It's seeded so a matching detector can later recover a statistical signal from the pattern of word choices, without retraining the model or perceptibly degrading output.

Nothing is stored as metadata, and nothing can be inspected by opening the file. The signature exists only in the statistical shape of the text: no certificate, no trust list, no manifest.

Google made the text implementation available on Hugging Face starting in October 2024, alongside the Nature paper's publication. So unlike a C2PA signature tied to one company's private certificate, SynthID-style detection code is something outside developers can run themselves, given the matching configuration used to generate the text.

Copyright analyst Jonathan Bailey tested the claim in June 2025 by running identical prompts across six chatbots. The results were wildly inconsistent.

• ChatGPT: 8 em dashes.
• Microsoft Copilot: 8.
• DeepSeek: 9.
• Claude: 2.
• Gemini: 0.
• Meta.ai: 0.

Those numbers make "em dashes mean AI" unworkable even across AI systems, let alone against human writers, who have always used the punctuation mark deliberately. Bailey's own conclusion was that no single stylistic tell reliably separates AI from human text, and that factual errors proved more diagnostic than punctuation habits.

The clearest evidence this was never a provider-controlled marker came in November 2025. OpenAI CEO Sam Altman announced that ChatGPT would finally honor custom instructions asking it to stop using em dashes, calling it a "small-but-happy win."

That fix let individual users suppress the habit through personalization settings. It wasn't OpenAI removing an embedded mechanism, because there was no discrete mechanism to remove.

Em dash frequency is a downstream statistical artifact of training data and tuning, not an inserted mark comparable to a C2PA manifest or a SynthID sampling bias. Unlike either of those, it's defeated by find-and-replace.

The first mistake is assuming a stripped C2PA manifest means "no proof of AI." A SynthID-style watermark, if one was applied, sits undisturbed inside the pixels or tokens regardless of what happened to the metadata.

The second is treating an em dash, or a positive score from a commercial detector, as though it carries the weight of a verified cryptographic signature or a matched statistical watermark. Neither is backed by any known, checkable mechanism the way C2PA and SynthID are.

So before treating "AI signature" as evidence of anything, ask which of the four is being described. The strength of every claim that follows depends entirely on the answer.