Trend report · gnews_detection · 2026-06-14
When justice fails: Why women can't get protection from AI deepfake abuse - unwomen.org
When justice fails: Why women can't get protection from AI deepfake abuse — and why the real battlefield is your file's metadata, not the image itself.
What actually flags your file
Every file you upload carries an invisible forensic signature that platforms scan automatically. In 2026, Instagram, TikTok, YouTube, and Reddit run AI-detection pipelines before human moderators ever see your content. These pipelines don't look at pixels — they read metadata.
The first signal is C2PA / Content Credentials, stored as JUMBF boxes inside the file. This cryptographic manifest, adopted by Adobe, Microsoft, Google, and most major camera and AI companies, explicitly lists whether a file was generated by an AI model and which one. A Sora export might carry 18 JUMBF atoms and 16 C2PA references flagging it as AI-generated. Platforms check for this manifest and flag files that carry it.
The second signal is XMP metadata. Even without a C2PA manifest, fields like DigitalSourceType: trainedAlgorithmicMedia or Generator: Adobe Firefly tell automated systems exactly what made the file. A raw AI export can carry 144 metadata tags — most of them unnecessary and all of them readable by any scanner with ExifTool access.
The third signal is encoder fingerprints. Video files encode their compression history in the bitstream. Tools like Lavc (FFmpeg's encoder) and x264 leave SEI (Supplemental Enhancement Information) NAL units that mark a file as machine-generated. Platforms maintain blocklists of known AI encoder signatures.
The fourth signal is missing phone-capture identity. In 2026, platforms compare uploads against a model of what a real phone photo looks like. A file missing GPS coordinates, capture timestamp, Make/Model fields, and a recognized phone encoder (like those from iPhone or Pixel) gets scored as suspicious — regardless of whether it's a deepfake or a legitimate AI image.
Here's the problem: malicious deepfakes are often stripped of ALL metadata intentionally, so they slip past these checks. Meanwhile, a creator using an AI tool for legitimate work gets flagged because their file still carries AI metadata. The detection gap is real, and it hurts the wrong people.
How Calabi handles it
Calabi runs a three-stage pipeline that makes your AI-generated file read as a normal phone recording at the file level — not by editing pixels, but by rewriting the invisible signals that platforms scan.
Stage 1: Strip. Calabi removes every detection signal: C2PA manifests (18 JUMBF atoms reduced to 0), XMP AI flags including DigitalSourceType: trainedAlgorithmicMedia, generator tags, and encoder fingerprints like Lavc and x264 SEI units. A raw AI export's 144 metadata tags get reduced to roughly 94 neutral structural tags.
Stage 2: Inject. Calabi writes authentic phone-capture identity into the file. You can choose a device profile — iPhone 15 Pro, Pixel 8 Pro, or Galaxy S24 Ultra — and Calabi injects the matching Make, Model, Software version, GPS coordinates, capture timestamp, and real-phone encoder name. The file now reads as if it was captured on that device.
Stage 3: Verify. Calabi generates a forensic proof card — the same ExifTool scan platforms use — showing exactly what was stripped and what was injected. You see the before/after state before downloading.
What about visible watermarks?
The steps
- Upload your AI-generated video or image to calabilabs.com.
- Calabi runs automatically — stripping every detection signal, injecting clean phone identity, generating the forensic proof card.
- Review the proof card — see exactly which C2PA atoms, XMP flags, and encoder signatures were removed, and which device profile was injected.
- Download the cleaned file — ready to upload without triggering automated flags.
FAQ
- What if my file has a visible watermark? Crop it before uploading. Calabi removes the invisible metadata layer that survives cropping — the signals platforms scan for that are independent of the visible image.
- Which platforms actually scan for these signals? Instagram and TikTok check C2PA manifests and XMP AI flags at upload. YouTube's Content ID and Reddit's AutoModerator use perceptual hashing combined with metadata patterns. A file stripped of these signals will pass automated checks on all of them — though no tool can guarantee platform decisions since systems evolve.
- Is stripping C2PA legal? C2PA is not a legal requirement in most jurisdictions — it's a voluntary standard. Stripping it from your own files is legal in the US and EU. Removing it from someone else's copyrighted content without permission would be a separate legal issue.
The detection infrastructure is real, it's active, and it's metadata-based. The fix is on the metadata layer — not the pixels.
→ Try Calabi free at calabilabs.com — 10 cleans, no card.