Hey everyone, Alex here. Welcome back to another edition of Coding with Alex on sysseder.com.
If you’ve been keeping an eye on the news today, you might have spotted a headline that sounds like a sci-fi satire but is actually our current reality: "Mayor Mamdani Says Landlords Can't Use AI Images to Advertise." Assembly Member and mayoral candidate Zohran Mamdani recently targeted the growing epidemic of NYC landlords using generative AI tools like Midjourney or DALL-E to fabricate pristine, sunlit apartments out of dilapidated, mold-infested rooms. What looks like a cozy, exposed-brick loft online turns out to be a crumbling basement in real life.
While this might sound like a purely legislative or municipal issue, as software engineers, web developers, and DevOps professionals, this is fundamentally a technical problem that lands squarely on our laps.
When platforms like Zillow, StreetEasy, Craigslist, or Airbnb are mandated to enforce "no unlabelled AI images" policies, how do they actually do it? How do we build systems that can detect, verify, and validate the provenance of an uploaded image at scale without tanking upload performance or ruining user experience?
Today, we’re going to dive into the technical reality of GenAI image detection, metadata extraction, cryptographic watermarking, and how we can implement these verification pipelines in our own web applications.
The Technical Challenge: Why Simple "AI Detectors" Fail
When product managers hear about a ban on AI images, their immediate reaction is often: "Can't we just use an API to detect if an image is AI-generated?"
The short answer is: No, not reliably.
Heuristic-based AI detectors (which look for anomalies in pixel distribution, frequency domains, or structural patterns) are a game of cat-and-mouse. As generators like Stable Diffusion XL, Midjourney v6, and Flux.1 improve, the artifacts they leave behind shrink. Furthermore, running deep learning classification models on every single image upload in your pipeline is incredibly expensive, introduces high latency, and suffers from terrible false-positive rates (e.g., flagging a real photo taken in weird lighting as "AI-generated").
Instead of relying on fragile post-hoc detection, the industry is shifting toward provenance, metadata analysis, and cryptographic watermarking. Let's look at how we can implement a multi-layered verification strategy in our application backends.
Layer 1: Parsing Exif and Metadata (The Low-Hanging Fruit)
When generative AI engines output an image, they often write specific metadata tags into the file's Exif (Exchangeable Image File Format) data, or they omit standard camera hardware tags entirely.
For example, images generated directly via Adobe Fireplace, DALL-E 3 (via ChatGPT), or Midjourney often contain explicit creator tags or software markers. Let's write a Node.js utility using the exiftool-vendored library to inspect an uploaded image for tell-tale signs of AI generation.
Code Example: Analyzing Metadata in Node.js
import { exiftool } from "exiftool-vendored";
/**
* Analyzes an image's metadata for signs of AI generation.
* @param {string} filePath - Path to the uploaded image.
* @returns {Promise<object>} - Verification report.
*/
async function inspectImageMetadata(filePath) {
try {
const tags = await exiftool.read(filePath);
const indicators = {
isAiSuspected: false,
reasons: [],
software: tags.Software || 'Unknown',
cameraMake: tags.Make || 'Unknown',
};
// 1. Check for known AI generation software signatures
const aiSoftwares = ['midjourney', 'stable diffusion', 'dall-e', 'firefly', 'novelai'];
if (tags.Software) {
const softwareLower = tags.Software.toLowerCase();
if (aiSoftwares.some(ai => softwareLower.includes(ai))) {
indicators.isAiSuspected = true;
indicators.reasons.push(`Known AI software detected: ${tags.Software}`);
}
}
// 2. Check for the absence of physical camera metadata (Heuristic)
// Most real smartphones/DSLRs write Exif tags like FNumber, ISO, LensModel, or ExposureTime
const hasCameraHardwareMetadata = !!(tags.FNumber || tags.ISO || tags.ExposureTime || tags.LensModel);
// PNGs and web-optimized JPGs often strip this anyway, but in a real-estate context,
// landlords uploading photos taken on an iPhone should almost always have this.
if (!hasCameraHardwareMetadata && !tags.Software) {
indicators.reasons.push("Missing physical camera hardware metadata (possible stripped or generated image)");
}
// 3. Check for specific C2PA/Metadata structures (more on this below)
if (tags.CreatorTool && tags.CreatorTool.toLowerCase().includes('photoshop')) {
// Could be edited, which is fine, but flag for secondary review if paired with zero camera data
if (!hasCameraHardwareMetadata) {
indicators.reasons.push("Edited in Photoshop without original camera hardware metadata");
}
}
return indicators;
} catch (error) {
console.error("Error parsing EXIF data:", error);
throw error;
} finally {
// Best practice: keep the process clean
// exiftool.end(); // Call this on application shutdown
}
}
While EXIF scanning is fast and easy, it has a glaring vulnerability: it is trivial to strip or spoof. Any bad actor with basic knowledge of ffmpeg or online metadata-strippers can wipe these tags in milliseconds. To build a robust system, we need to look at industry standards designed specifically to combat this.
Layer 2: The C2PA Standard and Cryptographic Provenance
To truly solve the trust problem on the web, major tech giants (including Adobe, Microsoft, Intel, and ARM) formed the Coalition for Content Provenance and Authenticity (C2PA).
C2PA embeds cryptographically signed metadata (manifests) directly into the image file. These manifests are bound to the asset using public-key cryptography. If an image is generated by an authorized AI model (like Adobe Firefly or DALL-E 3), the generator injects a signed manifest stating: "This asset was generated by AI model X at time Y." If someone tries to alter the image or strip the metadata, the cryptographic signature breaks, instantly alerting the platform.
Architecting a C2PA Verification Pipeline
Here is how a modern web application (like a real estate platform) should architect its ingestion pipeline to handle C2PA metadata:
[User Uploads Image]
│
▼
[Ingestion API] ──────► [S3 Temp Bucket]
│
▼
[C2PA Validator Service] (Rust/Go sidecar)
│
├──► Valid C2PA Manifest found?
│ ├──► Yes (AI Generated) ──► Flag in DB as "AI-Generated" (Auto-label)
│ └──► Yes (Camera Original) ──► Mark as "Verified Authentic"
│
└──► No C2PA / Broken Signature
└──► Fallback to heuristic checks (EXIF, Visual AI scoring)
To implement this in our backend, we can leverage the official, open-source C2PA Rust library or its command-line tool, c2patool. Let's write a Python helper that acts as our validation service layer using the c2patool CLI binary.
Code Example: Parsing C2PA Manifests with Python
import subprocess
import json
import os
def verify_c2pa_provenance(image_path: str) -> dict:
"""
Invokes the c2patool CLI to inspect cryptographic manifests in an uploaded image.
"""
if not os.path.exists(image_path):
return {"status": "error", "message": "File not found"}
try:
# Run c2patool to get manifest details in JSON format
result = subprocess.run(
["c2patool", image_path, "--json"],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True,
check=False
)
if result.returncode != 0:
# Typically means no C2PA manifest is present in the file
return {
"status": "unverified",
"message": "No cryptographic manifest or invalid signature detected."
}
manifest_data = json.loads(result.stdout)
# Analyze the assertions made in the manifest
assertions = manifest_data.get("active_manifest", {}).get("assertions", [])
is_ai_generated = False
generators = []
for assertion in assertions:
if assertion.get("label") == "c2pa.actions":
actions = assertion.get("data", {}).get("actions", [])
for action in actions:
# Look for actions that indicate generation or synthetic creation
if action.get("action") in ["c2pa.created", "c2pa.generated"]:
if "ai" in str(action.get("softwareAgent", "")).lower():
is_ai_generated = True
generators.append(action.get("softwareAgent"))
return {
"status": "verified",
"is_ai_generated": is_ai_generated,
"generators": generators,
"raw_manifest": manifest_data
}
except Exception as e:
return {
"status": "error",
"message": f"Execution failed: {str(e)}"
}
Layer 3: Designing the UX for AI Disclosures
As developers, our job isn't just about parsing bytes in the backend; it's also about building intuitive, performant user interfaces that reflect this state.
If your system detects that an image is generated by AI (via C2PA or EXIF data), you don't necessarily have to reject the upload. Instead, you can automate compliance with local laws (like Mayor Mamdani's proposed rules) by auto-tagging the photo and disabling the landlord's ability to remove the "AI-Generated Rendering" badge on the frontend.
A Clean React Component for AI Transparancy
Here is how you might render an image on a real estate listing page with built-in, immutable verification badges:
import React from 'react';
interface ListingPhotoProps {
src: string;
alt: string;
provenance: {
isAiGenerated: boolean;
isVerifiedAuthentic: boolean;
generatorName?: string;
};
}
export const ListingPhoto: React.FC<ListingPhotoProps> = ({ src, alt, provenance }) => {
return (
<div className="relative overflow-hidden rounded-lg group">
<img
src={src}
alt={alt}
className="w-full h-64 object-cover transition-transform duration-300 group-hover:scale-105"
/>
{/* Absolute Badges based on cryptographically verified metadata */}
<div className="absolute top-3 left-3 flex flex-col gap-2">
{provenance.isAiGenerated && (
<span className="px-3 py-1 text-xs font-semibold bg-amber-600 text-white rounded-full shadow-md flex items-center gap-1">
<span className="w-2 h-2 rounded-full bg-white animate-pulse" />
AI-Generated Rendering
</span>
)}
{provenance.isVerifiedAuthentic && !provenance.isAiGenerated && (
<span className="px-3 py-1 text-xs font-semibold bg-emerald-600 text-white rounded-full shadow-md flex items-center gap-1">
✓ Verified Real Photo
</span>
)}
</div>
{provenance.isAiGenerated && provenance.generatorName && (
<div className="absolute bottom-0 inset-x-0 bg-black/70 text-gray-200 text-xs p-2 text-center transform translate-y-full group-hover:translate-y-0 transition-transform duration-200">
Created using {provenance.generatorName}. This image may not represent actual unit conditions.
</div>
)}
</div>
);
};
Conclusion: The Dev Responsibility
As regulatory pressure mounts on platforms to crack down on deceptive synthetic media, we can no longer treat image uploads as static, dumb blobs of binary data.
By implementing standard metadata extraction, adopting cutting-edge standards like C2PA, and designing software that values authenticity, we can stay ahead of compliance curves and build a more trustworthy web. Whether you are building a boutique apartment listing app or scaling a global marketplace, integrating cryptographic provenance into your pipeline today is how you prevent your code from facilitating deceptive real-estate scams tomorrow.
What's your take?
Are you seeing AI-generated photos creeping into your local listings? How is your team handling image verification and authenticity pipelines? Drop your thoughts, questions, or favorite EXIF tools in the comments below!
Until next time, keep coding, keep securing, and don't trust every sunlit loft you see on the web.
— Alex R.