DALL-E C2PA check: when a claim exists but cannot be verified
OpenAI attaches Content Credentials to image output, which makes DALL-E and GPT Image files checkable rather than guessable — but this platform also illustrates the most instructive failure mode in the whole standard. The bundled OpenAI sample carries a proper trainedAlgorithmicMedia claim whose signing certificate has expired, so validation fails outright. The claim is there; it simply cannot be relied upon. AICheck365 reports that as its own outcome instead of collapsing it into a pass or a fail.
Short answer: read the claim and the certificate as two separate findings
Look for a C2PA manifest declaring digitalSourceType = trainedAlgorithmicMedia with an OpenAI claim generator. Then check the certificate independently: valid and trusted is the strong case, valid but untrusted is routine, and an expired certificate means validation fails and the provenance claim cannot be verified at all. XMP fields and file names add context but carry no signature.
Bundled sample and verified result
| OpenAI PNG with an expired certificate | A Content Authenticity Initiative sample bundled on this site and reproducible from the sample list. |
|---|---|
| Verified result | A C2PA claim marked trainedAlgorithmicMedia is present, but the signing certificate is expired and untrusted, so validation fails — reported as evidence state D rather than as a clean detection. |
| Why that matters | It is the clearest available demonstration that "has C2PA" and "has verifiable C2PA" are different statements, and that a tool collapsing them into one badge is hiding the distinction. |
Signals to Check
| C2PA manifest | Claims, assertions, actions and the claim generator, read out so you can see what the file asserts about its own creation. |
|---|---|
| Certificate state | Whether the signing certificate is current, expired, or outside the trust list. Expired is a validation failure, not merely a trust question. |
| digitalSourceType | trainedAlgorithmicMedia is the value indicating generative AI. Its presence inside a failed validation is a claim, not a confirmed finding. |
| XMP / EXIF | OpenAI and editing-software strings can corroborate the manifest, but they are unsigned and editable. |
Four outcomes, not two
Content Credentials fail in distinguishable ways, and the bundled samples on this site demonstrate each one. Reducing them to pass or fail throws away the part you would act on:
- Valid and trusted — the signature verifies and the certificate chains to a trusted root. The strongest available evidence.
- Valid but untrusted — the Firefly sample: cryptography checks out, but the certificate is not in the list being used. Normal, not suspicious.
- Expired — this OpenAI sample: a trainedAlgorithmicMedia claim exists, but validation fails, so the claim cannot be relied upon.
- Tampered — the asset no longer matches the hash recorded in the manifest. A genuine integrity failure rather than a trust question.
Why an expired certificate is not the same as a fake
It is tempting to read a failed validation as evidence of forgery, and that reading is usually wrong. Certificates have finite lifetimes by design, so a file signed legitimately can drift past its certificate expiry simply by getting old, without anyone touching it. What the failure actually tells you is narrower and more useful: this copy no longer supports a verified provenance conclusion. If the origin matters, go back to the publisher for a current copy rather than treating the expiry as an accusation.
Checking a DALL-E file step by step
- Start from the original download — Use the file as saved from ChatGPT or the API, not a screenshot or a re-shared copy.
- Open the C2PA validator — The manifest is parsed in your browser; nothing is uploaded.
- Read whether validation succeeded — Check for signature errors and certificate expiry before reading anything the manifest declares.
- Then read the declared source type — Look for digitalSourceType = trainedAlgorithmicMedia and an OpenAI claim generator.
- Weigh the outcome honestly — A failed validation means the claim cannot be verified from this copy — not that the file is fake, and not that it is genuine.
Limits
- Re-encoding, screenshots, format conversion and non-preserving editors remove Content Credentials entirely.
- An expired or untrusted certificate is a statement about verification, not proof that the file was forged.
- Whether credentials are present can vary with the product entry point, format and export path.
- No credentials found does not mean the file is not from DALL-E, only that this copy carries no readable manifest.
Use the C2PA validator for manifest and certificate detail; run the full detector to read EXIF/XMP alongside it.
FAQ
Do DALL-E images include C2PA?
OpenAI attaches Content Credentials to image output, so an original download usually carries a manifest. Whether it survives depends on what happened to the file afterwards — any re-encode or screenshot drops it.
What does an expired certificate mean?
That validation fails: the provenance claim exists in the manifest but cannot be verified. It is not evidence of forgery — certificates expire by design, so a legitimately signed file can reach that state just by aging.
Is a failed validation worse than no credentials at all?
It is more informative. No credentials tells you nothing; a failed validation tells you a claim was made, what it said, and precisely why it cannot currently be confirmed.
Is checking free here?
Yes, and the file stays on your device. The manifest is parsed in your browser through Rust compiled to WebAssembly, with no account required.
Sources and verification records
- AICheck365 public sample records — Provenance of the OpenAI expired-certificate sample, test date and known limits.
- Content Authenticity Initiative example assets — Public source of the bundled OpenAI PNG.
- C2PA Technical Specification 2.2 — Manifest structure, assertions and signature verification requirements.
- AICheck365 methodology — How signature state, certificate state and evidence tiers are defined.