TransparAI: AI Image Detection & EU AI Act Labeling

تفصیل

TransparAI finds AI-generated images in your WordPress media library, labels them with a visible AI badge and writes a machine-readable AI disclosure (the IPTC digital source type) into the image files themselves. That covers both duties of Article 50 of the EU AI Act for AI-generated media: a visible disclosure and a machine-readable marking. The tedious part, finding the AI content in the first place, is automated.

Automatic AI image detection

Most AI generators leave traces in the files they produce, and TransparAI reads all of the common ones:

• C2PA manifests (Content Credentials) as embedded by OpenAI (ChatGPT, DALL-E and GPT-Image), Adobe Firefly, Google Gemini (Nano Banana output included) and Bing Image Creator
• The IPTC digital source type in XMP metadata, the marking Midjourney and a growing number of tools write
• Generation parameters in PNG text chunks from Stable Diffusion (AUTOMATIC1111), ComfyUI, NovelAI and InvokeAI
• EXIF and XMP generator signatures for Flux (Black Forest Labs), Leonardo.Ai, Ideogram, Recraft, Seedream and Photoshop Generative Fill
• JPEG comment markers, C2PA declarations in MP4 video and AI declarations in MP3 audio (ID3)

Detection parses the actual file containers (JPEG segments, PNG chunks, RIFF, MP4 boxes, ID3 frames) and matches only inside real metadata blocks. It never runs a blind text search over raw file bytes, so a Spanish caption containing the word "imagenes” will not trigger anything. One catch many tools get wrong: cameras from Leica, Sony and Nikon also embed Content Credentials into real photos, so a C2PA manifest alone never auto-labels anything here.

Review queue instead of blind trust

Findings come with a confidence level. Files that explicitly declare their AI origin can be labeled automatically. Strong but informal signals land in a review queue where you confirm or dismiss them, one by one or in bulk, directly in the media library. New uploads are checked as they come in; for everything older there is a batched scan of the whole library with a progress bar, pausable at any time. Media generated by AI plugins on your own site (AI Engine, AI Power, Elementor AI, WordPress AI) is labeled at the source, no file inspection needed.

The visible AI badge

A configurable badge marks labeled media in the front end. Overlay or a caption line, four positions, three sizes, dark, light, outline or icon-only, optional generator name, optional alt text note for screen readers. An optional start date limits the badge to media uploaded on or after that day, so you can introduce the labeling on an existing site without retroactively badging older content; earlier media stay labeled in the admin only. The badge is rendered server-side, so it survives page caching, and it works with the block editor (images, galleries, covers, featured images, inline images, video and audio), the classic editor, template images, text widgets, WooCommerce product and shop pages including the gallery lightbox, Elementor free and Pro including Theme Builder, and WPBakery Page Builder, each image module tested one by one.

Themes love to stack their own layers over images (hover effects, gradient scrims, zoom icons). TransparAI checks the real paint order: a badge that is actually covered is raised, moved to a free corner or, as the last resort, turned into a caption line below the image, automatically. Every single image can also get its own badge position, a caption line or no visible badge at all, straight from its attachment details, and documented CSS utility classes give theme builders the same control per container. An optional extra labels images printed without an attachment ID (ACF fields returning a URL, sliders) and CSS background images through a small script, late-loading galleries and AJAX grids included.

Two optional disclosure layers round it off: a short site-wide note at the end of every page that contains labeled media, and a per-post checkbox that puts a configurable "created with the help of AI” line ahead of AI-written content. When a label changes, TransparAI tells the common page-cache plugins (WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache and others) to refresh, so cached pages never keep an outdated badge state.

Machine-readable AI labeling in the files

For labeled files TransparAI writes the IPTC digital source type (trainedAlgorithmicMedia, or compositeWithTrainedAlgorithmicMedia for AI-edited media) as XMP metadata into JPEG, PNG, WebP and AVIF, including every size variant WordPress generated. Google reads this field and can show an AI notice in image search. Each page additionally carries Schema.org JSON-LD (ImageObject and VideoObject with digitalSourceType) for its labeled media, so search engines get the AI declaration without opening a single file.

Your existing metadata is safe: an existing XMP packet is merged, not replaced, and unlabeling removes exactly what this plugin wrote. Writes are atomic and validated first, so a failed write cannot corrupt an image. And because image optimizers and thumbnail regeneration tend to strip metadata, TransparAI fingerprints every labeled file and restores missing AI declarations in an hourly integrity sweep.

For larger setups

Every label, review decision and repair is recorded per file with its time and the editor who made it, and the whole library can be exported as a CSV audit list straight from the plugin page, so the question "who declared this image AI-generated, and when” has an answer months later. WP-CLI commands for scanning, labeling and auditing: wp transparai scan, wp transparai status --format=csv for the same export on the command line, wp transparai verify-meta --repair to check and fix the in-file metadata. Other plugins can label media through do_action( 'transparai_mark_ai', $attachment_id, 'My Generator' ), the detection rules are extensible via filters, translation setups are covered by a bundled WPML configuration, and uninstalling cleans up across every site of a multisite network when you ask it to.

The plugin runs entirely on your server. No accounts, no telemetry, and no request to anyone else: the only HTTP request it can make is the optional delivery check, which asks your own site for one image to see whether your CDN strips the declaration on the way out. Please also read the Disclaimer section below.

The interface is available in English, German, French, Spanish, Italian and Dutch.

Contact: TransparAI@cms-admins.de

For developers

Everything below is stable API surface; the prefixes are transparai_ for hooks and options and _transparai_ for attachment meta.

Attachment meta (registered for the REST API, readable and writable with upload_files capability):

• _transparai_ai: '1' when the attachment carries the confirmed AI label, absent otherwise. This is the single source of truth for badge and file metadata.
• _transparai_type: generated or composite (AI-edited). Controls which digital source type is written.
• _transparai_source: where the detection came from (c2pa, xmp-dst, iim, png-chunk, exif, com, id3, sidecar, filename, context).
• _transparai_generator: detected generator name, for example Midjourney or OpenAI.
• _transparai_confidence: certain, likely or hint.
• _transparai_detected: '1' while an unconfirmed detection waits in the review queue. Kept strictly apart from the public label.
• _transparai_history: JSON list of the last ten events for this file, oldest first. Each entry is {"t":unix time,"e":event,"u":user ID,"s":source}, with the events flagged, confirmed, unflagged, queued, dismissed, repaired and write-failed. Written by TransparAI_Meta::record(), read with TransparAI_Meta::history() and TransparAI_Meta::last_change(); TransparAI_Meta::audit_rows() returns the rows behind both the CSV export and wp transparai status.
• _transparai_delivery: result of the last delivery check as {"t":unix time,"verdict":verdict}, with intact, stripped, unreachable, unmarked or foreign-host. Only written when the check is enabled and someone runs it; read it with TransparAI_Delivery::last_result().
• _transparai_badge_pos: badge placement for this one image, overriding the site setting. top-left, top-right, bottom-left, bottom-right, below (caption line under the image) or hidden. Absent means the site setting applies.

Label media from your own code (an AI image generator plugin, an import script):

do_action( 'transparai_mark_ai', $attachment_id, 'My Generator' );

This sets the confirmed label, records the generator name and, with file writing enabled, writes the metadata into the files. Existing labels are never overwritten.

Extend or veto detection:

add_filter( 'transparai_signatures', function ( $signatures ) { $signatures[] = array( 'pattern' => '/my-generator/i', 'generator' => 'My Generator' ); return $signatures; } );

transparai_detection_result filters the final result per file (or `null`); return `null` to veto a detection, or return a result array to add your own. Both filters receive documented shapes, see the source of `TransparAI_Detector`.

Customize the badge output:

transparai_badge_html filters the badge element per attachment (`$html, $attachment_id`); `transparai_badge_wrap_classes` filters the wrapper class list (`$classes, $attachment_id`, `0` for the shared template of the optional script).

Place badges from your theme or builder. Put one of these classes on any container and it applies to every badge inside it, which works in every builder because they all allow custom classes:

• trai-badge-top-left, trai-badge-top-right, trai-badge-bottom-left, trai-badge-bottom-right: move the badges to that corner.
• trai-badge-below: show them as a caption line under the media instead of on it.
• trai-badge-hidden: no visible badge inside this container. File metadata and structured data stay untouched.
• trai-badge-manual: keep the position as configured and switch the automatic overlay guard off for this subtree.

The first six switch the guard off by themselves, since a placement you chose should not be second-guessed. The stacking level of all badges is the CSS custom property --trai-badge-z (default 30, raised to 99 only where the guard found a real overlap); it inherits, so a theme can tune it globally or per container with a single declaration and without touching the stylesheet. The markup is one wrapper span carrying the state classes plus span.trai-badge directly after the media element.

WP-CLI (wp transparai <command>):

• scan [--all] [--dry-run]: scan the library; --all rescans everything, --dry-run only reports.
• flag <id>... [--source=<text>] and unflag <id>...: set or remove labels in bulk.
• status [--status=flagged|detected|all] [--format=table|csv|json|ids|count]: audit export, for example wp transparai status --format=csv > ai-audit.csv.
• write-meta [--dry-run] --yes and verify-meta [--repair]: write and verify the in-file metadata.
• verify-delivery [<id>...] [--sample=<n>]: fetch labeled images over their own public URL and report whether the declaration survives delivery. Needs the delivery check enabled in the settings.

Theme integration: print attachment images through wp_get_attachment_image() (or markup carrying the wp-image-{ID} class) and the badge is rendered server-side and page-cache safe. For raw URL output and CSS backgrounds there is the optional script described above; it wraps matched images with the same markup (span.trai-wrap around the image plus span.trai-badge), so any CSS you write applies to both paths.

External services

None. The plugin makes no requests to external services, and it never sends your media or any data about your site anywhere.

The optional delivery check is the only feature that makes an HTTP request at all, and it requests your own site: when you switch it on in the settings and then press "Check delivery”, the plugin downloads one image from your own public URL and compares the bytes with the file on disk. That is how an optimizing CDN or image proxy that quietly re-encodes your images and drops the AI declaration becomes visible. The check is off by default, it never runs on its own, and it stops before requesting anything if the image is served from a different host than your site.

Privacy

TransparAI processes media files locally on your server and stores its results in the WordPress database (attachment meta and one settings option). The optional delivery check, when you enable it and press the button, requests one image from your own site to see what visitors receive; nothing is sent to a third party. The per-file history records the WordPress user ID of whoever labeled, confirmed or dismissed a file, so a site can show who made a disclosure decision; it holds the last ten events per file and is removed with everything else when you uninstall with data removal enabled. It does not collect, transmit or share any data, and it sets no cookies.

Disclaimer

TransparAI is a technical tool, not legal advice, and it is provided "as is”, without warranty of any kind, to the extent permitted by applicable law (see sections 11 and 12 of the GNU General Public License, version 2).

In particular, the author makes no representation, warranty or guarantee:

• that using this plugin makes your site compliant with the EU AI Act, the Digital Services Act or any other law, regulation or standard. Legal obligations depend on your specific situation and remain solely your responsibility as the site operator; consult a qualified professional for legal questions.
• that AI-generated media is detected completely or correctly. Detection is based on metadata embedded by generators; files whose metadata was stripped carry no detectable signals, and detected metadata is an indication, not proof.
• that any function of the plugin (detection, badges, metadata writing, repair, integrations) operates without errors or interruption in every environment.

You use this plugin at your own risk. To the extent permitted by law, the author accepts no liability for damages arising from the use of, or inability to use, this software, including but not limited to lost data, lost profits or claims by third parties.