Steganography vs Metadata -- Two Ways AI Images Carry Hidden Information

When you look at an AI-generated image, you see pixels arranged into a coherent picture. But hidden beneath the surface, there are two distinct layers of invisible information: metadata embedded in the file structure, and steganographic watermarks woven into the pixel data itself. Both carry information about the image's origin, but they work in fundamentally different ways -- and understanding the difference matters for anyone who creates, distributes, or analyzes AI-generated content.

The distinction between these two approaches has become critical in 2026. As regulators push for AI content labeling, the industry is split between metadata-based solutions like C2PA and steganographic approaches like Google's SynthID. Here is how each works, where they excel, and where they fall short.

How Metadata Carries Hidden Information

Metadata is structured information stored alongside the image data in a file. It lives in defined blocks within the file format -- EXIF sections in JPEG files, XMP packets, IPTC headers, and C2PA manifests. This data is separate from the actual pixel values that form the visible image.

EXIF metadata is the most familiar type. Every time a camera or smartphone captures a photo, it writes EXIF data including the camera model, exposure settings, date and time, and potentially GPS coordinates. AI image generators write their own EXIF fields -- DALL-E 3 images, for example, contain a "Software" tag identifying the OpenAI API, and Midjourney embeds a "Description" field with the generation prompt.

XMP metadata (Extensible Metadata Platform) is an Adobe-developed standard that uses XML formatting to store richer information. XMP can contain entire provenance chains, editing histories, and copyright assertions. C2PA manifests are frequently embedded within XMP packets.

IPTC metadata was developed for news organizations and includes fields for captions, credits, keywords, and copyright notices. Some AI tools populate IPTC fields automatically.

C2PA manifests are the most complex form of metadata in AI images. A single C2PA manifest can be 50 to 320 kilobytes and contains cryptographic assertions about the image's origin, the tools used to create it, and a digital signature from the tool provider. The C2PA standard was developed by a coalition including Adobe, Microsoft, BBC, and the New York Times.

How Steganographic Watermarks Work

Steganography takes a fundamentally different approach. Instead of storing information in the file structure, steganographic techniques encode information directly into the pixel values of the image itself. The changes are imperceptible to the human eye but can be detected by specialized algorithms.

Google SynthID is the most prominent steganographic watermarking system for AI images. Introduced by Google DeepMind in 2023 and expanded throughout 2024-2025, SynthID embeds a watermark into the image during the generation process. The watermark modifies pixel values in ways that are statistically invisible but mathematically detectable.

According to Google DeepMind's published research, SynthID was designed with three key properties:

1. Imperceptibility: The watermark introduces changes so subtle that human observers cannot distinguish between watermarked and unwatermarked images, even in side-by-side comparisons.

2. Robustness: The watermark survives a wide range of image transformations. In DeepMind's testing, SynthID remained detectable after JPEG compression at quality levels as low as 50%, cropping that retained only 25% of the original image, color adjustments including brightness and contrast changes of up to 40%, and resizing operations that doubled or halved the image dimensions.

3. Detectability: A trained detection model can identify the watermark with high accuracy, even when the image has been significantly modified.

The technical approach behind SynthID involves embedding a signal into the frequency domain of the image. Rather than modifying individual pixel values directly, the watermark operates on the image's frequency components -- the same mathematical space used by JPEG compression algorithms. This frequency-domain approach is what gives SynthID its robustness against compression and cropping.

Metadata vs Steganography -- A Detailed Comparison

To understand when each approach is appropriate, consider their fundamental trade-offs.

The key insight is that metadata and steganography are complementary, not competing approaches. Metadata carries rich provenance information -- who created the image, when, with what tool, and a cryptographic chain of custody. Steganography carries a simple but resilient marker that says "this image was generated by a specific AI system."

DeepMind's Research Findings on SynthID

Google DeepMind published detailed findings on SynthID's performance in a 2024 paper, with updated benchmarks released in 2025. The key results provide the most rigorous publicly available data on steganographic watermarking robustness:

• Overall detection accuracy: 98.7% on unmodified AI-generated images. After moderate transformations (JPEG compression at quality 75%, 50% crop, brightness adjustment of 20%), detection accuracy remained above 90%.

• Aggressive transformation tolerance: Under heavy editing -- including color inversion, 75% JPEG compression, and combination attacks -- detection accuracy dropped to approximately 72%. This is still well above random chance (50%).

• False positive rate: The system maintained a false positive rate below 0.5% across all test conditions, meaning it rarely flagged non-AI images as AI-generated.

• Comparison to naive watermarking: SynthID outperformed simple LSB (Least Significant Bit) watermarking by a factor of 4x in robustness tests. LSB watermarks were destroyed by JPEG compression, while SynthID persisted.

• Multi-tool compatibility: SynthID watermarks applied by Google's Imagen were detectable by Google's verification API but not by Microsoft's C2PA-based detection tools, highlighting the fragmentation in the current detection ecosystem.

What This Means for Creators and Platforms

For creators, the dual-track nature of AI image provenance creates practical challenges. If you generate images with Google's tools, your images carry SynthID watermarks. If you use Adobe Firefly, your images carry C2PA metadata. If you use Midjourney or DALL-E via OpenAI's API, your images carry EXIF and C2PA metadata but no steganographic watermark.

For platforms that need to detect AI-generated content -- social media networks, stock photo sites, news organizations -- the fragmentation means building multi-layer detection pipelines. A practical approach involves:

1. First pass: Check for C2PA and EXIF metadata. This is fast, lightweight, and catches images that have not been processed.

2. Second pass: Run steganographic detection for SynthID and similar watermarks. This requires more computational resources but catches images that have been shared, screenshotted, or reformatted.

3. Third pass: Apply pixel-level forensic analysis for images that pass both metadata and watermark checks but still exhibit suspicious characteristics.

For individual creators who want to understand what hidden data their images carry, the first step is inspection. You can check metadata easily -- tools like RemoveAI Image display all EXIF, XMP, IPTC, and C2PA data embedded in your files. Steganographic watermarks require specialized detection APIs, which are currently limited to Google's verification service for SynthID.

FAQ

Can steganographic watermarks be removed?

Yes, but it is significantly harder than removing metadata. Research has shown that adversarial attacks -- targeted noise injection, careful image transformations, and model-specific perturbations -- can degrade or destroy steganographic watermarks. A 2025 study from ETH Zurich demonstrated that a combination of JPEG compression at quality 40%, Gaussian noise injection, and targeted adversarial perturbations could reduce SynthID detection accuracy to approximately 55%, barely above chance. However, these same transformations also visibly degraded image quality, making the attack impractical for images that need to look good.

Does every AI image generator embed watermarks or metadata?

No. While major commercial tools (DALL-E, Midjourney, Adobe Firefly, Google Imagen) embed some form of provenance data, open-source models like Stable Diffusion do not include metadata or watermarking by default. Users running Stable Diffusion locally can generate images with zero identifying information. The EU AI Act's requirements apply to providers placing AI systems on the EU market, but enforcement against individual open-source users is impractical.

If metadata can be easily stripped, why bother with C2PA?

C2PA's value is not in being impossible to remove -- it is in creating an industry-standard provenance chain that works at scale. When every major tool provider embeds C2PA data, and every major platform checks for it, the baseline detection rate for AI-generated content rises dramatically. Images that lose their metadata through legitimate sharing processes are a known issue, which is why the C2PA standard is evolving to work alongside steganographic approaches for defense in depth.

Conclusion

Metadata and steganography represent two fundamentally different philosophies for tracking AI-generated images. Metadata carries rich, structured provenance information but is fragile -- easily stripped by routine file operations. Steganographic watermarks are resilient, surviving compression and cropping, but carry minimal information and require specialized detection tools.

The future of AI image provenance lies in combining both approaches: C2PA metadata for detailed provenance chains, and steganographic watermarks for resilient detection. Until the industry converges on a unified standard, understanding both systems -- and knowing what your images carry -- is essential.

Want to see what metadata your AI images contain? Inspect your files for free at RemoveAI Image -- all processing happens locally in your browser with no uploads required.