What your AI files actually know about themselves (and how to check in five seconds)

In one sentence: an AI-generated file is one of three things: a file that carries its own recipe, a file that carries a signed manifest, or a file that carries nothing, and you can tell which in five seconds by dropping it on the Archibal homepage.

Take any image or video you generated last week and ask it a simple question: what made you? Which model, which prompt, which seed? The answer depends entirely on the tool that wrote the file, and on everything that happened to it since.

Three kinds of file

Files that carry their recipe. ComfyUI writes the entire workflow graph into the PNG it saves: every node, every checkpoint and LoRA filename, the positive and negative prompt, the seed, sampler, steps and CFG. Automatic1111 and Forge write a parameters block in the same spirit. Open the file in a text editor and it is there in plain sight. This is the richest provenance any tool produces, and it is also the most fragile: crop the image, export it from Photoshop, post it anywhere, and the chunk is gone.

Files that carry a signed manifest. A growing set of tools embed Content Credentials, the C2PA standard: a cryptographically signed manifest that names the tool, the actions taken, and sometimes the ingredients. Adobe Firefly and Photoshop's generative features sign their exports. ElevenLabs signs its audio. OpenAI's image models sign theirs. The manifest does not usually contain the prompt (the standard deliberately treats that as the maker's business), but it does prove who signed it and that the bytes have not changed since. It survives more than a text chunk does, and it is stripped by the same things: most social platforms, most screenshots, most re-encodes.

Files that carry nothing. This is most of them. A render downloaded from a hosted generator's gallery is typically a clean JPEG or MP4 with, at best, an internal job id in a metadata field. Anything that has been through a messaging app, a social upload, a screenshot, a video editor's export or a format conversion has had whatever it once carried removed. It is a picture. Where it came from is now a matter of memory.

How to check

You do not need to install anything. The checker on the Archibal homepage reads a file in your browser session, returns what it finds, and keeps nothing. For a ComfyUI render you get the prompt, model, seed and settings laid out. For a signed file you get the signer, the validation state and the recorded actions. For everything else you get an honest "this file carries nothing", which is itself useful to know before a client asks.

Try it on three files: one straight from ComfyUI, one exported from Firefly or ElevenLabs, and one you downloaded from a hosted generator. The difference is the whole story.

Why studios stop relying on the file

The pattern above has a consequence that takes a while to sink in. The files you can prove things about are the ones that never left the tool. The files you actually deliver, the ones that went through an edit, a composite, a resize and a client's upload, are the ones that carry nothing. Provenance that lives inside the file is strongest exactly where you need it least.

The alternative is to record the generation at the source, at the moment it happens, from the tool itself. A ComfyUI node that pushes the workflow as the render completes. A connector that logs every job Claude orchestrates through Higgsfield, Runway, Kling or fal, with the prompt and the model that actually ran. A webhook from the tools that offer one. The record then lives outside the file, keyed to a fingerprint of the content that survives re-encoding, and it is there whether or not the delivered file kept anything.

That is what Archibal does, and the checker on the homepage is the honest demo of the problem it solves: this is what one file knows about itself. Everything else has to be captured.

One more thing the file never tells you

Even a file with a perfect recipe cannot tell you whether you were allowed to sell what it made. That depends on the model's terms, and on the route you reached it through: the same model via fal, via Comfy Cloud or via the provider's own API can sit under different contract terms. We keep those quoted from the providers' documents, per model and per route. Search a model name on the homepage and read the source before you rely on it.