How to Check If an Image Was Made With ChatGPT, Gemini or Firefly

The fastest way to find out whether an image came out of an AI generator is not to study the pixels. It is to read what the file says about itself — because the biggest generators now write it down, and many people never think to look.

This guide covers what ChatGPT, Gemini, Adobe Firefly, Microsoft’s Image Creator and the Stable Diffusion tools leave inside the file, how to read it, and why the copy you were sent may have lost all of it.

What the generators write into the file

Content Credentials (C2PA). A signed record embedded in the image: which tool made it, what was done to it, and a cryptographic signature from the company that made the tool. Checking real files from each of these tools, this is what we found:

• ChatGPT, DALL·E and GPT Image files carry credentials signed by OpenAI. The record says the picture was created with a trained AI model — the standard term is trained algorithmic media — and names the model, for example GPT-4o.
• Adobe Firefly signs as Adobe Inc., and it tells a generated picture apart from a real photo that Firefly only edited.
• Microsoft’s Image Creator and Designer sign as Microsoft Corporation, with the words “AI Generated Image”.
• Gemini and Imagen files carry credentials signed by Google, or an IPTC tag in the metadata marking them as AI-made, sometimes with the words “Made with Google AI”. Google also adds SynthID, an invisible watermark in the pixels themselves — more on that below.

Generator settings. Stable Diffusion front ends such as AUTOMATIC1111, ComfyUI and InvokeAI write the prompt, the sampler, the number of steps and the seed into the PNG they save. A file carrying “Steps: 28, Sampler: DPM++ 2M” is not a photograph.

The Software field. Some tools simply put their own name in the image’s Software or CreatorTool field.

The signature matters, not just the label

Anyone can type “Made with AI” into a metadata field, or delete it. A signed record is different: if the file was changed after it was written, the signature no longer matches, and a reader can say so.

That gives three possible answers, and they mean different things:

1. Signed, intact, and the signer is on the Content Credentials trust list — the strongest answer a file can give.
2. Signed, but the file changed afterwards — the record still says AI made it, but someone cropped, re-saved or edited it since. Many files you find online are like this, and the AI label is still informative.
3. A certificate that has since expired — older ChatGPT images are like this. The claim was genuine when it was signed.

One asymmetry is worth knowing. A file that says it was made with AI is almost always telling the truth — nobody forges that. A file that says “this is a real camera photo” is exactly what someone passing off a fake would want to write, so that claim only counts when it is signed by a camera maker or a phone the trust list recognises.

Why the copy you were sent says nothing

Most of the time, you will not find any of this — and that is not evidence of anything.

WhatsApp, most social networks and most messaging apps re-save images to make them smaller, and the metadata is dropped along the way. A screenshot never had it in the first place. So the same Firefly picture that arrives signed by Adobe as an original arrives with no record at all once it has been shared.

A missing record proves nothing either way. A real photo and an AI image look exactly the same once the metadata is gone.

What is left when the file is silent

Two things, neither of them as strong as a signature:

• An invisible watermark. Google’s SynthID survives re-saving and resizing much better than metadata does, but it can only be read with Google’s own tools; no outside checker, ours included, can see it.
• A detector model, trained on millions of real and AI images, that estimates from the pixels how likely the picture is to be generated. It is an estimate, it makes mistakes, and it should be read as one — see why AI detectors sometimes call real photos AI.

Checking a file with DiffALL

The DiffALL AI image check does both, in that order.

First it reads everything the file declares: Content Credentials (and checks the signature against the C2PA and Content Credentials trust lists, without sending your file anywhere), the IPTC AI tag, generator settings and the Software field. If the file says AI made it, you see who signed it and whether the file has changed since — and the result is 97.

If the file says nothing, a detector model gives its estimate on a scale from 3 to 97. It never reads 0 or 100, because neither the file’s record nor a model can prove anything with that kind of certainty. Below 25 we found no signs of AI; from 85 the signs are strong; in between we cannot tell, and the result says exactly that.

Try the sample AI image on the page: an Adobe Firefly picture that still carries its signed record, so you can see what a declared file looks like.

If you only remember one thing

Look for the original file. A forwarded copy, a screenshot or a re-post has almost certainly lost the one piece of evidence that would settle the question. The person who made the image, or the site it was first published on, is far more likely to have a version that still says where it came from.