Content Provenance and Watermarking

The inversion

Everything in Parts II and III shared a structure. A hostile artefact arrives, and an institution asks whether it is genuine. The adversary chose the artefact, the generator, the channel and the moment; the institution has an instrument with a narrow envelope, an unpublished expiry date and no feedback when it fails.

Provenance reverses every term. Instead of asking whether an artefact an adversary produced can be shown to be false, it asks whether an artefact you produced can be shown to be yours. You control the capture device, the editing pipeline, the signing key and the publication path. Nothing about the question depends on predicting what a generator will do next.

That is why this chapter opens Part IV, and why the book turns constructive here. But the inversion comes with a condition that is usually left out of provenance advocacy, and it determines whether any of this pays: a credential on authentic material carries information only in proportion to how unusual its absence is. Early in adoption, an unsigned file tells you nothing, because almost everything authentic is also unsigned. The value is not in the signature. It is in the eventual significance of its absence.

Learning objectives

1. Explain how provenance inverts the burden of proof relative to detection, and why that changes the scaling properties.
2. Describe the C2PA manifest structure and distinguish hard bindings from soft bindings.
3. Explain what durable Content Credentials are for and what weakness they inherit.
4. State what provenance establishes and what it cannot, including the authenticated-lie failure mode.
5. Summarise the published attacks on watermarking in both the removal and spoofing directions.
6. Identify the threshold condition that determines when provenance becomes operationally useful.

How Content Credentials are built

The Coalition for Content Provenance and Authenticity specifies a structure worth understanding in outline, because its security properties follow from it. Assertions record things about an asset: metadata, the actions performed on it, thumbnails, cryptographic bindings. The assertions referenced together are collected into an assertion store; combined with additional information they form a claim; the claim is digitally signed, producing a claim signature; and the assertions, claim, signature and supporting information together form the C2PA manifest. C10.01 Established

Two kinds of binding tie a manifest to content, and the difference matters more than any other technical detail in this chapter.

A hard binding is cryptographic. It lets a validator confirm that this manifest belongs to this asset and that the asset has not been modified, by computing values that can match only this asset and no other, not even assets derived from it or other renditions of it. The specification provides byte-range hashing for arbitrary formats, box-based hashing for formats such as JPEG, PNG and GIF, BMFF-based hashing for ISO Base Media File Format files, and collection hashing for multi-asset workflows. A manifest may contain no more than one hard-binding assertion.

A soft binding is statistical. It is a content identifier that is either not statistically unique, such as a fingerprint, or embedded as an invisible watermark, and it is computed from the content of an asset rather than its raw bits, which is what allows it to survive into derived assets and alternative renditions. A manifest may contain zero or more.

C2PA’s version 2 architecture has been put through the ISO fast-track route as ISO/DIS 22144, Authenticity of information — Content credentials.

What the published attacks establish

Watermarking is the component most often presented as the answer, so it deserves the book’s standard treatment. Saberi and colleagues, at ICLR 2024, analysed this rigorously and the results cut in two directions.

For watermarking methods with low perturbation budgets, they demonstrate a fundamental trade-off between the evasion error rate, meaning watermarked images detected as unmarked, and the spoofing error rate, meaning unmarked images detected as marked, when diffusion purification attacks are applied; and they show that diffusion purification removes such watermarks effectively while applying minimal change to the image. For high perturbation budget methods, where visible-scale changes are applied, diffusion purification is ineffective, and the authors instead develop a model substitution adversarial attack that removes the watermark successfully. C10.02 Established

The spoofing direction is the one that receives least attention and deserves most. Removing a mark lets synthetic content pass as unmarked. Adding a mark to content that was never generated by the marked system lets an attacker manufacture a provenance claim, and in the inverse case lets them have authentic material reported as machine-made. That is the Chapter 2 liar’s dividend again, now with a technical artefact to point at.

Table 10.1 — The last row is a governance question disguised as a technical one. Sources: C10.01, C10.02, C10.03.

Verification you cannot perform is not verification

Watermarking at scale is now deployed. Google DeepMind’s SynthID embeds its signal into the content itself rather than into metadata, across image, audio, text and video outputs. The text variant was published in Nature in October 2024 and open-sourced, with a production implementation shipping in a widely used machine-learning library. The image, audio and video watermarks are proprietary, and confirming them requires the vendor’s own detector. C10.03 Established

Embedding into content rather than metadata is the right engineering decision, for the reason Figure 10.1 makes plain: metadata does not survive the pipeline. But it is worth naming what the proprietary case does to the trust relationship. A cryptographic credential can be checked by anyone holding a trust list, which means the claim is independently verifiable and the verifier does not have to believe the issuer. A proprietary watermark can be checked only by the party that made it. The answer is then not a verification but a referral, and an institution relying on it has transferred its judgement to a vendor rather than acquired the means to exercise its own. For a newsroom or a court that distinction is the whole question.

The threshold property

The most common objection to provenance is that credentials are easily stripped, so the scheme is pointless. The most common defence is durable credentials. Both miss what actually determines the value, which is the information content of an absent credential, and that depends entirely on adoption.

This explains a pattern that otherwise looks like institutional inertia. Each organisation evaluating provenance individually finds a weak business case, correctly, because a signature on its own output changes very little while everyone else’s output is unsigned. The returns are in the third panel and they are collective. That is an argument for standards bodies, procurement mandates and sector-wide commitments rather than for persuading firms one at a time, and it is the strongest reason the ISO route matters more than any single product feature.

Case study: durable Content Credentials

Why this is the right design anyway. The alternative is a credential that works only in the minority of cases where metadata survives, which would never reach the third panel of Figure 10.2. Accepting a weaker assurance on the recovery path in exchange for coverage is a reasonable trade, and it is a trade rather than a solution.

What follows for interface design. Because the two recovery paths carry different assurances, an honest implementation distinguishes them. A single badge that appears identically whether the manifest arrived by cryptographic hard binding or by watermark lookup is telling the user less than the system knows.

Practical scenario

Executive implications

• Sign your own output; do not try to detect everyone else’s. This is the one control in the book whose cost and difficulty you fully control, and whose effectiveness does not decay as generators improve.
• Treat the signing key as the asset. Every assurance in Figure 10.1 reduces to key custody and trust-list governance. An organisation with excellent credentials and casual key management has a presentational control.
• Retain originals. Chapter 5 noted that most organisations cannot produce the original of a disputed recording. Provenance is unavailable retrospectively, so retention policy is provenance policy.
• Do not label credentials “verified”. Say what is actually established: who signed it and what editing history is recorded. The authenticated lie is a certainty, and your interface copy decides whether it is also an endorsement.
• Prefer independently verifiable schemes. Where a provenance signal can be checked only by its vendor, you have outsourced the judgement rather than gained the capability.
• Push adoption collectively. The returns are a network effect, so sector bodies, standards work and procurement requirements move this and individual business cases do not.

Common misconceptions

Limitations and open questions

• The threshold argument is conceptual. Figure 10.2 asserts no adoption percentages, because credible cross-sector figures for credential prevalence in circulating media do not appear to exist. Measuring that prevalence would be the single most useful empirical contribution available here.
• Survival rates through real pipelines are unpublished. How often an embedded manifest reaches a viewer intact, by platform, is the number an implementer most needs and the number hardest to find.
• Trust-list governance is the real security boundary and is under-examined. Who may sign, who vouches for signers, and what happens on compromise or revocation are governance questions on which the cryptography depends entirely.
• Provenance has a privacy cost that this chapter does not resolve. A credential that records device, time and editing history can expose a source, a photographer in a hostile environment, or an activist. The specification provides for redaction, and the tension between proving origin and protecting origin is real, not a detail. An institution adopting credentials for its own material must decide what it does with material submitted by people at risk.
• No claim is made about current deployment scale. Figures circulating for marked-item counts and cross-vendor adoption were traced to secondary aggregators without method, and are excluded.

Teaching materials

Discussion questions

1. Why does provenance scale with your own output while detection scales with the adversary’s? What follows for budgeting?
2. If the returns on provenance are collective, what is the right instrument: standards, regulation, procurement, or something else?
3. Should a provenance interface distinguish a cryptographically bound manifest from one recovered by watermark lookup? What would the copy say?
4. Is a provenance signal verifiable only by its vendor worth having? Under what conditions?
5. How should a newsroom handle submitted material from a source whose safety depends on provenance not being recorded?

Assessment questions

1. Describe the C2PA manifest structure and explain why only one hard binding is permitted but many soft bindings are. (15 marks)
2. Explain the authenticated-lie failure mode and design interface copy that does not produce it. (15 marks)
3. Summarise the removal and spoofing results on watermarking and state what each implies for durable credentials. (20 marks)

Practical exercise

Establish who in your organisation would hold a content signing key, under what controls, and who could authorise its use. In most organisations this role does not exist, which means the control cannot currently be implemented regardless of budget.

Research assignment

Take ten images published by credential-signing organisations, retrieve them as a reader would through at least two platforms, and record how many still carry a valid manifest. Report the method and the attrition.

Seminar topic

“Provenance infrastructure protects institutions and endangers sources.” Argue either side.

Further reading

1. Coalition for Content Provenance and Authenticity. C2PA technical specification, version 2.x, and the Content Credentials explainer. spec.c2pa.org
2. ISO/DIS 22144, Authenticity of information — Content credentials. The standardisation route for the C2PA v2 architecture.
3. Saberi, M., Sadasivan, V. S., Rezaei, K., Kumar, A., Chegini, A., Wang, W., & Feizi, S. (2024). Robustness of AI-image detectors: Fundamental limits and practical attacks. ICLR. arXiv:2310.00076
4. Google DeepMind. SynthID, and the Nature publication of SynthID Text, October 2024. deepmind.google
5. Sadasivan, V. S., et al. (2023). arXiv:2303.11156 — for the text-watermark paraphrase result, C8.03.

Chapter synthesis

Provenance is the first control in this book whose effectiveness does not decay as generation improves, and the reason is structural rather than technical. Detection competes with a generator population that an adversary controls and continuously changes. A signature over your own output competes with nothing: the cryptography either holds or it does not, and it does not get worse when the models get better.

Three honest qualifications keep that from being a solution. The assurance is not uniform, because a manifest recovered by cryptographic hard binding and one recovered by watermark lookup after stripping carry materially different weight, and the published attacks on watermarking cut in both directions, removal and forgery. The credential answers a narrower question than its interface suggests, and the authenticated lie, arriving with a valid chain and a badge, is a certainty rather than a risk. And the value is a network effect: the organisation that signs first gains very little, because what eventually does the work is not the presence of a credential but the significance of its absence.

That last point is where the argument of this book turns outward. Nine chapters established that an institution acting alone cannot solve this at Layers 1 and 2, and Chapters 3, 5 and 9 showed that it can protect itself at Layer 4 with controls that are cheap, old and channel-based. Provenance is different in kind: it is the first layer where acting alone is genuinely insufficient and collective action is genuinely effective. Which is a question about mandates, liability and enforceable duties rather than about engineering, and that is Chapter 11.