You usually cannot prove that a PDF was written by AI from the file alone. A PDF can expose technical clues such as its Creator and Producer fields, XMP metadata, or the library used to build it. Those clues describe how the file was assembled. They do not reliably identify who wrote the words or whether an AI model was involved.
Use AI-PDF detection as a screening step. If the result matters for hiring, education, insurance, legal work, or compliance, verify the document with its issuer, delivery records, signatures, and other provenance evidence.
The short answer
- A generator name is a clue, not a verdict. ReportLab, WeasyPrint, pdf-lib, PDFKit, and browser renderers are general-purpose tools.
- Missing metadata proves little. Metadata is optional and can be removed or changed.
- No detected signal does not prove human authorship. It only means the checked rules found no matching clue.
- Provenance is stronger than guesswork. Prefer signed records, trusted delivery channels, and verifiable creation history.
What PDFCheck Actually Checks
PDFCheck reads the file's classic document properties and available XMP values. Adobe describes PDF metadata as document-level information such as title, author, and creation or modification dates. XMP provides another structured metadata layer inside the file.
The current detector focuses on the Creator and Producer values. It compares them with known software signatures, then adds limited rule-based signals when an automated generator is present and the title or author is missing. Some words in the generator string, such as “python,” “script,” “automated,” or “api,” can also affect the score.
The score is an internal heuristic, not a calibrated probability. PDFCheck does not inspect a model prompt, recover an authorship history, run a semantic detector over the document's prose, or certify that a person or AI system created the content.
| Signal | What it can show | What it cannot prove |
|---|---|---|
| Creator or Producer | Software named when the PDF was saved | Who wrote the text or why the software was used |
| XMP metadata | Additional document properties and workflow fields | That every edit or creation step was recorded |
| Missing author or title | The file lacks those optional fields | Automation, deception, or AI authorship |
| Known PDF library | A library may have assembled or last rewritten the file | That an LLM generated the document's content |
| No matching indicator | The current rules found no known metadata clue | Human authorship or an untouched original |
Why PDF Libraries Create False Positives
An AI assistant can write code that uses ReportLab or pdf-lib to create a PDF. So can an accountant, a reporting system, a web application, or a developer building ordinary document automation. The library name identifies a tool in the file-production chain; it does not identify the author of the underlying content.
The official ReportLab documentation shows that applications can set internal author, title, and subject values. The pdf-lib API likewise lets software set Creator and Producer metadata. Those fields are useful observations, but editable fields are weak authorship evidence.
Treat a matching library as a reason to ask a better question: Does this creation path make sense for this document and its claimed source? A ReportLab-produced monthly report from an internal reporting service may be expected. The same signature in a document claimed to be a manually exported original may justify follow-up.
How to Check a PDF Step by Step
- 1. Preserve the original. Save the received file unchanged. Work on a copy if you need to edit, optimize, or convert it.
- 2. Open the PDF AI Detection tool. Upload the exact file you want to assess.
- 3. Read the Creator and Producer values. Note the named software, missing fields, and any matching generator indicators.
- 4. Interpret the result as a lead. A medium or high indicator means the metadata deserves review; it is not a finding of misconduct.
- 5. Compare stronger evidence. Check the sender, source system, signature status, version history, and a trusted copy from the issuer.
- 6. Record your conclusion and uncertainty. Separate observed file facts from assumptions about authorship or intent.
Use Stronger Evidence When the Decision Matters
NIST's evaluation of AI-generated text detectors found that performance varies by generator and detector. Some generators can fool many discriminators, while some discriminators perform well against particular generators. That is another reason not to turn one automated score into a final judgment.
1. Issuer and delivery evidence
Confirm the document through a known portal, account, email thread, or named issuer. Ask for the source record when authenticity matters.
2. Digital signatures
A valid signature can connect a specific file state to a certificate and show whether signed bytes changed. It still requires a trusted identity and certificate-validation workflow. Use the PDF Signature Checker as an initial inspection step.
3. Verifiable provenance
Content Credentials can carry signed provenance about an asset's origin and edits. The C2PA explainer also warns that provenance may be incomplete and cannot by itself prove that the content is true.
4. File and metadata comparison
Compare the received PDF with a trusted copy. Review page content, hashes, signatures, and metadata together. For a broader workflow, use the guide to verifying PDF authenticity.
What to Do With Each Result
| Result | Safe interpretation | Next action |
|---|---|---|
| No indicator | No current metadata rule matched | Continue ordinary source and authenticity checks |
| Low | Minor automation clue | Check whether the named software fits the claimed workflow |
| Medium | One or more notable metadata signals | Verify the source before relying on the file |
| High | Several rules produced a stronger warning | Escalate for source, signature, and provenance review; do not accuse based on the score alone |
Privacy Before You Upload
Do not upload a confidential, regulated, or legally sensitive PDF unless your organization permits the service. Use an approved local workflow when required. PDFCheck's current handling and retention boundaries are described in the Privacy Policy.
Frequently Asked Questions
Can metadata prove that ChatGPT created a PDF?
No. Metadata can name software in the production chain, but it does not prove which model or person wrote the content. A general-purpose PDF library may be used in both AI-assisted and ordinary automated workflows.
Can someone remove or change PDF metadata?
Yes. Metadata is editable and may be rewritten during export, optimization, conversion, or deliberate cleanup. Adobe's metadata overview describes document metadata and XMP as information applications can access and manipulate.
Does “no AI signature detected” mean the PDF is human-written?
No. It means the current metadata rules did not find a known signal. The file may have missing or altered metadata, or it may have been created by software outside the detector's rule set.
Should a school or employer reject a document based on this score?
Not from this score alone. Use a documented review process, allow the person to explain the workflow, and compare source, provenance, and policy evidence before making a consequential decision.
Start with the file facts. Run the exact PDF through the AI Detection tool, record the observed metadata, and verify important claims through a trusted source.