Sparkpix.ai routes detector uploads around its own WebP re-encoder to keep AI labels intact

Both labels live in metadata segments, and re-encoding an image drops those segments ^[12]. A C2PA manifest is the signed record defined by the Coalition for Content Provenance and Authenticity ^[4]. It sits in a JUMBF box: APP11 segments in a JPEG, a caBX chunk in a PNG, a C2PA chunk in a WebP ^[5]. OpenAI, Adobe Firefly and Microsoft embed one ^[4]. The IPTC label is an XMP field, Digital Source Type, which Google writes into Gemini and Imagen images ^[6].

The reader never parses those containers. It decodes the whole buffer as latin1 and runs substring searches over it ^[7]. C2PA counts as present if the text holds both "jumb" and "c2pa", or "caBX", or "C2PA" within eight characters of "jumb" ^[7]. For IPTC, trainedAlgorithmicMedia means created by a generative model and compositeWithTrainedAlgorithmicMedia means edited with one ^[6]. The longer value contains the shorter one. The composite test therefore has to run first, or every AI-edited photo is flagged as fully generated ^[8]. A test set built only from fully generated images would pass with the checks in either order ^[8].

The generator name comes from the C2PA claim, which is CBOR ^[9]. Version 2 claims store it as claim_generator_info with a name such as "ChatGPT". Version 1 claims use a single claim_generator string such as "Adobe_Photoshop/25.0 adobe_c2pa/0.7.6" ^[9]. The hand-written CBOR reader takes the string length from the type byte, from one following byte, or from two ^[10]. It returns null for strings over 200 bytes or ones that run past the end of the buffer ^[10]. When the C2PA path yields nothing, a regex match on "Made with Google AI" sets the generator to "Google AI" ^[9].

The author wrote that when either label is present, "the question is settled: the maker declared it." ^[17] With the signature unchecked, what the scan settles is that the file makes the claim. For legal provenance the post points readers to the official c2pa-rs or c2pa-node libraries ^[11]. In my view that is the right split for a triage tool, as long as the verdict text says the file claims AI origin.

The byte-for-byte path exists because of the site's own optimizer. Every upload is compressed in the browser and re-encoded to WebP before it reaches storage ^[12]. The author wrote that this is "right for an image editor and fatal for a detector" ^[13]. According to the post, the most common reason a detector finds no label is that the operator's own code stripped it ^[12].

Outside the operator's stack there is no bypass to build. Social platforms and chat apps strip labels the same way, and a screenshot creates a brand-new file ^[15]. For those images the classifier scores texture, noise and structure ^[16]. It also reads C2PA itself and returns a value between 0 and 1 ^[16]. The post was drafted with AI assistance, and its code comes from the sparkpix codebase, built on Next.js App Router and Node 24 ^[3].