Image Byte Markers for AI Provenance: Raw File String Clues

A byte scan may find readable strings such as c2pa, XMP labels, trainedAlgorithmicMedia, software names, generator hints, or Content Credentials references. A useful report should show the marker category, offset, and a small context excerpt when safe.

Sometimes a normal metadata parser fails, but raw bytes still contain hints. Byte markers can also explain why a file is not purely camera-like or why a C2PA verifier should be run with a stronger trust policy.

A string can be copied, left behind after export, or appear without the full signed manifest. It can also be removed. That is why byte markers should produce a cautious explanation, not a definitive AI-generated label.

c2pa-04 is the marker-only C2PA-family fixture: evidenceLevel other_ai_provenance_marker and c2paStatus verifier_unavailable_marker_detected. ai-04 is an AI-style byte marker fixture with other_ai_provenance_marker and c2paStatus absent. Both reports are useful as raw-string context and neither should be quoted as a trusted, bound Content Credential.

This is the kind of result where a low-value detector page would usually stop too early. Img2det keeps the finding tied to the evidence category that produced it, then separates strong provenance, marker-only clues, camera-like support, and uncalibrated forensic context. That separation gives a reviewer something they can cite or challenge instead of a single unexplained score.

Open Byte Markers after C2PA. If the checker lists C2PA-like strings without signature, trust, and asset-binding success, copy the report language: marker detected, verification unavailable or absent. Do not promote a byte offset into a signed claim.

Read the Final assessment first, then open the detailed evidence matrix. The matrix shows whether the strongest available signal came from verified C2PA provenance, an AI-related marker, EXIF or camera-like metadata, byte-level context, or frequency analysis. If the top signal is weak, the right conclusion is usually uncertainty, not a stronger accusation.

Run the original file, save marker names and offsets, then check whether C2PA verification upgraded those strings. If the result matches c2pa-04 or ai-04, ask for a less processed source before making a public generator claim.

When the result will be used for editorial, moderation, or public claims, save the report language exactly as evidence language. Use phrases such as marker found, no verified manifest, camera-like support, or inconclusive. Avoid rewriting those into definitive claims like fake, real, generated, or authentic unless you also have source context outside the file.

The false positive is treating a UTF-8 fragment such as a C2PA label or provider string as cryptographic verification. The false negative is ignoring marker residue because the visual image looks photographic.

The opposite error is also common: treating a quiet report as proof that the image is camera-original. A quiet report may simply mean that useful metadata was removed, that the generator did not add supported credentials, or that the file was exported through a workflow that stripped the strongest signals.

Byte markers can survive in one export and vanish in the next. Users compare a chat PNG with a later JPEG and need the same vocabulary for marker-only versus verified provenance.

That repeatable review flow is the practical value of the site. Users can run an image, compare the result with the guide language, and return when they receive a better original file or a new version from another platform. The content supports the tool instead of acting as a doorway page for one keyword.