Most "remove AI metadata" tools run one operation: delete EXIF. On a phone photo that is almost the whole story. On a generated image it is roughly a third of it, and the wrong third.
The three classes
- Exchange metadata. EXIF, IPTC, XMP. Camera fields, software strings, creator names, sometimes
DigitalSourceType. Removing this cleans captions and tool fingerprints. - Provenance manifests. C2PA in JPEG APP11, PNG
caBX, MP4uuid. Signed, structured, and invisible to a metadata editor that only knows EXIF. - Content watermarks. SynthID-class signals written into coefficients. Not metadata at all. No header operation touches them.
Order matters
If you rewrite pixels first and encode last, the encoder can reintroduce metadata: a Software string, a colour profile note, a timestamp. That is why a correct pipeline strips, rewrites, encodes, and strips again. ghostframe runs the container pass twice for exactly this reason, and the second pass is not paranoia — it is the only way to guarantee the encoder did not add a segment back.
The renamed-extension trap
Tools that switch on the file extension get fooled constantly. A PNG saved as .jpg, a WebP with an .png name, an MOV with an .mp4 name — all common, all parsed incorrectly by extension-based logic. Magic-byte sniffing fixes it: JPEG starts FF D8 FF, PNG starts 89 50 4E 47, RIFF files declare WEBP at offset 8, and ISO base media files declare ftyp at offset 4.
What "clean" should mean
A defensible check has four parts:
- The file still decodes: ffprobe or a browser decode with no error.
- No manifest carrier remains: no APP11, no
caBX, no C2PAuuid. - No AI strings remain anywhere in the container, including text chunks nobody reads.
- The pixel rewrite is measured, not asserted.
If a tool cannot show you those four results, it is asking you to trust a label instead of a measurement.