Targeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated Media
This rule flags an agent that removes only the metadata tags proving an image was AI-generated, while leaving normal photo metadata like GPS and camera info untouched. That selectivity is the point: a full metadata wipe looks suspicious, but a surgical removal of just the provenance tag makes a generated image pass as a real photo.
How the attack works
An attacker generates or obtains AI media that carries provenance markings — a C2PA manifest, an IPTC 'DigitalSourceType' tag flagging it as trained-algorithm output, or diffusion-tool metadata like PNG 'parameters' fields. Instead of stripping all metadata (which would itself look suspicious), the agent targets only those specific provenance fields and deletes or blanks them. The rest of the file's metadata — EXIF, GPS, ICC profile — is left alone so the image still looks like an ordinary camera photo in any viewer. The rule also watches for equivalent intent expressed through platform re-upload, canvas redraw, or third-party 'metadata removal' services rather than a command-line tool.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 70ffae20-1237-40af-a6fa-75d147b1a974
- Severity
- Medium
Why it matters
An organization can end up unable to tell AI-generated images from real ones, undermining content authenticity checks, moderation, legal evidence handling, or journalism workflows that rely on provenance tags to flag synthetic media.
What you can do
- →Do not rely on metadata alone to prove an image is authentic or synthetic — cross-check with pixel-level watermark detection (e.g., SynthID, TrustMark) where available.
- →Log and review any agent actions that modify image metadata, especially operations targeting specific tag groups (JUMBF/C2PA, IPTC DigitalSourceType, PNG parameters) rather than full metadata clears.
- →Treat images with selectively missing provenance fields (present EXIF/GPS but absent generation metadata) as a review trigger, not proof of authenticity.
- →Keep audit trails of media processing pipelines so a provenance tag removed at one step can be traced back to when and how it disappeared.
Known benign look-alikes
- Photojournalists and human-rights workers removing GPS to protect a source (`exiftool -gps:all=`). Same tool, same syntax family — this rule is scoped to provenance group names and never matches gps or a blanket wipe.
- Legal or compliance de-identification and pre-press cleaning (`exiftool -all= file.pdf`). The bare `-all=` flag is deliberately NOT matched by any layer.
- C2PA verification and diagnostic tooling: `exiftool -jumbf:all -G3 -b -j -u -struct`, `c2patool inspect`, `c2pa.Reader.from_file()`. ExifTool's READ syntax has no trailing `=`; every artifact layer here requires the `=` that makes it a delete.
- Image optimisation CI: `convert -strip`, `mogrify -strip`, `jpegoptim --strip-all`, `optipng -strip all`. Not covered — imagemin ships `-strip all` by default and the developer never typed it.
- Node.js sharp strips metadata unless `.withMetadata()` is called, and Pillow drops EXIF unless `exif=` is passed. Behaviourally equivalent to stripping, but the artifact is an ABSENCE and regex cannot match an absence. Not covered by design.
- CDN image layers (Cloudflare Polish, Cloudflare Images `metadata=copyright`) strip on delivery as infrastructure default, not as anyone's decision.
- mat2 and the Tails/Whonix privacy workflow. mat2 is deliberately not treated as an indicator — it is the standard privacy tool of an entire community.
- FFmpeg transcode normalisation and reproducible builds (`-map_metadata -1`, `-fflags +bitexact`). Not covered.
- Legitimate C2PA authoring projects using `c2patool --sidecar` / `--remote`.
- Security education, detection-vendor documentation and standards commentary that enumerate these techniques will match the intent layers (4 and 5). A pattern matcher cannot separate teaching from doing.