Evidence ledger and references
Every substantial factual claim in this book carries an identifier resolving to this ledger, which records the source, what it establishes, and the limits of that evidence.
Every substantial factual claim in this book carries an identifier resolving to this ledger, which records the source, what it establishes, and the limits of that evidence. Claims are not promoted to Established on the strength of a single secondary report.
| Claim | Assertion | Source and status | Limitation |
|---|---|---|---|
| C1.01 | Arup Hong Kong: fifteen transfers, HK$200m ≈ US$25.6m, after a synthetic multi-party video call; firm confirmed May 2024. | Hong Kong police statements, Feb 2024; company confirmation, May 2024. Established | No independent forensic report published; tooling unidentified. |
| C1.02 | The adversarial generator/discriminator training framework. | Goodfellow et al. (2014), arXiv:1406.2661. Established | None material; foundational and widely replicated. |
| C1.03 | Early detectors exploited generator-specific upsampling traces and generalised poorly across generators. | Pinned in Chapter 6 to Durall et al. (2020) and Corvi et al. (2023). Established | Resolved: see C6.01 and C6.02. The trace and the transfer failure are each established; no single generalisation figure is claimed for the field. |
| C1.04 | Style-based GAN architecture advanced facial synthesis quality. | Karras et al. (2019), arXiv:1812.04948. Established | Quality claims are qualitative here; no observer-study figure asserted. |
| C1.05 | Denoising diffusion: forward noising, learned reverse step. | Ho et al. (2020), arXiv:2006.11239. Established | None material. |
| C1.06 | Latent-space diffusion reduced generation cost enough for wide deployment. | Rombach et al. (2022), arXiv:2112.10752. Established | "Consumer scale" is the author's characterisation, not a figure from the paper. |
| C1.07 | Zero-shot voice cloning needs only a short reference sample, removing per-target training. | Pinned in Chapter 5 to Wang et al. (2023), arXiv:2301.02111. Established | Resolved: see C5.01. Three seconds is VALL-E's figure; other systems differ and no general minimum is claimed. |
| C2.01 | Synthetic audio impersonating Michal Šimečka and journalist Monika Tódová circulated two days before Slovakia's 30 September 2023 election. | Contemporaneous fact-checking and press-freedom reporting, incl. International Press Institute. Established | No published forensic analysis identifying the generation tool. |
| C2.02 | The clip fell inside Slovakia's 48-hour pre-election moratorium and exploited a platform policy then scoped to video rather than audio. | Reporting on the moratorium and on Meta's manipulated-media policy scope at the time. Established | Policy has since changed; the gap is historical and should not be cited as current platform policy. |
| C2.03 | FCC forfeiture of $6m (Sept 2024) and 26 state counts (May 2024) against Steve Kramer for the AI-voice robocall; the fine and a $22,500 award reported as unpaid. | FCC forfeiture order; New Hampshire indictment; subsequent reporting on non-payment. Established for the orders; Emerging for payment status. | Payment status rests on reporting at a point in time and may change; no claim is made about votes affected. |
| C3.01 | July 2024: a Ferrari executive stopped a voice-cloning attempt impersonating CEO Benedetto Vigna by asking which book Vigna had recently recommended. | Bloomberg reporting, July 2024; subsequently analysed in MIT Sloan Management Review. Established | Account is second-hand; Ferrari has not published a first-party incident report. |
| C3.02 | March 2019: a UK energy firm transferred €220,000, about US$243,000, after a call imitating the voice of its German parent-company chief executive. | Wall Street Journal via the insurer Euler Hermes. Emerging | Company unnamed; no forensic report; the use of AI voice software is an analyst inference, not an established finding. Widely cited well beyond what the source supports. |
| C3.03 | August 2023: Retool was breached via SMS phishing plus a synthetic voice call; 27 cloud customer accounts were compromised, and cloud-synced one-time codes removed the second factor. | Retool's own disclosure, September 2023, plus contemporaneous reporting. Established | Losses attributed to downstream customers are reported, not independently audited. |
| C3.04 | April 2024: a LastPass employee received WhatsApp voice messages impersonating CEO Karim Toubba, identified the channel as off-policy, and reported it. No breach. | LastPass first-party blog post; AI Incident Database record 1100. Established | None material; the organisation disclosed it voluntarily and promptly. |
| C3.05 | May 2024: attackers used a voice clone of WPP CEO Mark Read with public video footage in a Teams meeting set up from a fake WhatsApp account. Unsuccessful. | Internal email from Read, reported May 2024; AI Incident Database record 983. Established | Details of the request rest on the reported internal email rather than a published report. |
| C3.06 | 13 November 2024: FinCEN issued Alert FIN-2024-Alert004 on deepfake-enabled fraud against financial institutions, with nine red-flag indicators and a SAR key term. | FinCEN Alert FIN-2024-Alert004, primary document. Established | Describes indicators and reported trends; publishes no detector performance figures and no prevalence estimate. |
| C4.01 | FaceForensics++ comprises 1,000 authentic YouTube videos and 4,000 manipulated versions from four methods: two identity swaps (DeepFakes, FaceSwap) and two reenactments (Face2Face, NeuralTextures). | Rössler et al. (2019), ICCV, arXiv:1901.08971. Established | Dataset composition only; no claim here about detector accuracy on it. |
| C4.02 | DFDC: best public-set average precision 82.56%; best private black-box average precision 65.18%, by a model ranked fourth on the public set. | Dolhansky et al. (2020), arXiv:2006.07397. Established | One challenge at one point in time. Not current detector performance, and not evidence that detection has failed to improve since. |
| C4.03 | Mean frame-level AUC across the detection methods evaluated in the Celeb-DF paper was 56.9% on Celeb-DF against 82.3% on the FaceForensics++ DeepFakes subset. | Li et al. (2020), CVPR. Established | A mean across the specific methods that paper evaluated, not a figure for any single detector or for the field. |
| C4.04 | LipForensics pretrains a spatio-temporal network on lipreading and fine-tunes on fixed mouth embeddings, so as to attach to high-level mouth dynamics rather than manipulation-specific artefacts. | Haliassos et al. (2021), CVPR, arXiv:2012.07657. Established | Method and design intent. Comparative performance is reported relative to the methods that paper evaluated; no figure is asserted here. |
| C4.05 | At 90% sensitivity and 90% specificity, precision is 8.3% at 1-in-100 prevalence, 0.9% at 1-in-1,000 and 0.09% at 1-in-10,000; raising specificity to 99% shifts each figure one decade. | Author’s computation from the stated formula. Analysis | Arithmetic, not measurement. It holds for any detector with those operating characteristics and says nothing about whether any real detector attains them. |
| C5.01 | VALL-E synthesises an unseen speaker from a three-second enrolled recording, preserving the emotion and acoustic environment of the prompt; pretrained on 60,000 hours of English speech. | Wang et al. (2023), arXiv:2301.02111. Established Resolves C1.07. | A research system. Says nothing about the quality or sample requirements of any commercial product. |
| C5.02 | A 37.9-hour found-audio dataset of public figures, 17.2 hours of it deepfakes, on which prior methods performed poorly, with degradation reported up to one thousand per cent. | Müller et al. (2022), Interspeech. Established | Relative to the baselines that paper evaluated, in 2022. Not a general multiplier and not evidence about current systems. |
| C5.03 | ASVspoof 5 drew crowdsourced data from almost two thousand speakers with 53 participating teams, and reports that performance degrades under adversarial attacks and under neural encoding and compression. | ASVspoof 5 overview (2024), arXiv:2408.08739. Established | Closed and open challenge conditions with a bounded attack set; not a measurement of field performance. |
| C5.04 | Classical narrowband telephony carries roughly 300 Hz to 3.4 kHz at an 8 kHz sampling rate. | ITU-T Recommendation G.711. Established | Standard engineering background. The claim that most spoofing residue lies above this band is marked as analysis, not measurement. |
| C6.01 | Common up-sampling leaves generative CNNs unable to reproduce natural spectral distributions; the distortion supports detection, with up to 100% accuracy reported on public benchmarks; the same paper proposes spectral regularisation that removes it while improving quality and training stability. | Durall, Keuper & Keuper (2020), CVPR, arXiv:2003.01826. Established Resolves C1.03, with C6.02. | The 100% figure is on the public benchmarks of the time and is quoted here to show how high a perishable signal can score, not as a performance claim. |
| C6.02 | Detectors built for GAN imagery struggle on diffusion-generated images, and even when retrained on diffusion output often fail to generalise across different diffusion models. | Corvi et al. (2023), ICASSP. Established | Concerns image detectors and the generators evaluated in that paper; not a claim about video or audio pipelines. |
| C6.03 | DeepfakeBench was motivated by non-uniform data pipelines, inconsistent model inputs, differing experimental settings and non-standardised metrics; it unifies 15 detection methods across 9 datasets under common protocols. | Yan et al. (2023), NeurIPS Datasets and Benchmarks. Established | Establishes that published numbers were not comparable. It does not follow that any particular published ranking was wrong. |
| C6.04 | Detection benchmarks have scaled content and condition diversity far more than generator family diversity, which is the axis governing transfer. | Author’s analysis of the dataset record. Analysis | No accepted metric for generator diversity exists, so Figure 6.1 expresses direction of travel rather than coordinates, and the claim is open to refutation by such a metric. |
| C7.01 | Against a classifier at 0.95 AUC: flipping the lowest bit of each pixel gave AUC 0.0005; perturbing 1% of image area gave 0.08; a single added noise pattern gave 0.17; a black-box attack gave 0.22. | Carlini & Farid (2020), CVPR Workshops. Established | One classifier, 2020, under the authors’ conditions. Establishes mechanism and cost, not current performance of any deployed system. |
| C7.02 | White-box and black-box pipelines fool neural deepfake detectors into classifying fake videos as real, and the perturbations are, in the authors’ words, “robust to image and video compression codecs, making them a real-world threat”. | Hussain, Neekhara et al. (2021), WACV. Established | Quoted from the abstract. Per-condition success rates are reported in the paper and are not reproduced here. |
| C7.03 | A successful evasion produces no observable event, so a deployed content detector’s real-world evasion rate is unmeasurable in principle from the defender’s side. | Author’s analysis. Analysis | An argument from the structure of the problem, not an empirical finding. It is falsified by any deployment that can produce a genuine loss signal for evaded items. |
| C8.01 | OpenAI’s AI Text Classifier identified 26% of AI-written text as likely AI-written and mislabelled human-written text as AI-written 9% of the time; released January 2023, withdrawn 20 July 2023 citing low accuracy, including on short and paraphrased text. | OpenAI’s own announcement and withdrawal notice. Established | Figures are from OpenAI’s challenge set of English texts. Not a claim about any other vendor’s tool. |
| C8.02 | Across seven GPT detectors on TOEFL essays by non-native English writers: 61.22% average false-positive rate; 19.8% flagged unanimously; 97.8% flagged by at least one; roughly 5% false positives for native writers; enriching vocabulary with ChatGPT cut the average from 61.3% to 11.6%. | Liang et al. (2023), Patterns 4(7). Established | Seven specific tools in 2023 on one essay corpus. The perplexity mechanism generalises; the exact rates should be re-measured for any current tool. |
| C8.03 | Recursive paraphrasing cut a watermarking scheme’s true-positive rate from 99% to 15% at a 1% false-positive rate, with AUROC falling from 99.8% to 67.9%; the paper also relates best-possible detector AUROC to the total variation distance between human and machine text distributions, yielding an impossibility result. | Sadasivan et al. (2023), arXiv:2303.11156. Established | The impossibility result holds under the paper’s framework and assumptions. It does not assert that no machine text is ever detectable. |
| C8.04 | Text detectors measure statistical typicality rather than provenance, so their false positives fall systematically on atypical human writers; coordination is the better-posed question because its signal is behavioural rather than textual. | Author’s analysis, grounded in C8.01 to C8.03. Analysis | The second half is an argument about problem framing, not a validated detection method. Coordination analysis has its own documented disparate-impact risks, stated in the chapter. |
| C9.01 | FBI IC3 public service announcement I-051525-PSA, 15 May 2025: a campaign active since April 2025 using smishing texts and AI-generated vishing voice messages impersonating senior US federal and state officials, targeting officials and their address-book contacts to harvest credentials; IC3’s recommended protection is to verify by calling a known number. | FBI IC3 advisory, primary. Established | An advisory describing a campaign and giving guidance. It publishes no victim count, loss figure or success rate. |
| C9.02 | Sora 2, released 30 September 2025, generates video with synchronised dialogue, sound effects and lip-synced speech, and offers a likeness feature from a short reference video under a consent framework with visibility of featuring videos and revocation. | OpenAI product announcement. Established | A vendor description of capability and policy. No independent assessment of output quality or of whether the consent framework resists circumvention. |
| C9.03 | Every human verification heuristic consumed by synthesis so far is a judgement about the artefact; every heuristic still standing is a property of the channel or of a shared secret. Three of four arriving capabilities consume perception and leave channel control intact; synthetic identity is the exception because it removes the counterparty. | Author’s analysis over C1.01, C3.06, C5.01, C9.01 and C9.02. Analysis | A framework, not a measurement. The agentic-impersonation component is separately marked Emerging and carries two stated predictions by which it can be refuted. |
| C10.01 | C2PA manifest structure: assertions, assertion store, claim, claim signature. Hard binding is cryptographic, matches only that exact asset and not derived assets or renditions, max one per manifest, with byte-range, box-based, BMFF and collection hashing. Soft binding is a fingerprint or invisible watermark computed from content, zero or more permitted. Durable Content Credentials combine both so a manifest is recoverable from an external repository after metadata stripping. C2PA v2 submitted via ISO fast-track as ISO/DIS 22144. | C2PA technical specification and explainer, primary. Established | A specification, not a deployment measurement. Nothing here establishes how often manifests survive real distribution pipelines. |
| C10.02 | For low perturbation budget watermarks, a fundamental trade-off holds between evasion and spoofing error rates under diffusion purification, which removes such watermarks effectively with minimal image change; for high perturbation watermarks, purification is ineffective but a model substitution adversarial attack removes them. Spoofing attacks cause unmarked images to be detected as marked. | Saberi et al. (2024), ICLR, arXiv:2310.00076. Established | Concerns statistical watermarks and image detectors. It does not apply to cryptographic claim signatures, which require a signing key to forge. |
| C10.03 | SynthID embeds its signal into content rather than metadata across image, audio, text and video; the text variant was published in Nature in October 2024 and open-sourced with a production implementation in a widely used library, while the image, audio and video watermarks are proprietary and require the vendor’s detector to confirm. | Google DeepMind materials and contemporaneous reporting of the Nature publication. Established | Circulating figures for total marked items and cross-vendor adoption trace to secondary aggregators without published method and are excluded from this book. |
| C10.04 | Provenance is a network good: the information content of a missing credential rises with adoption, so individual business cases are weak while collective returns are strong, and the assurance carried by a credential differs according to whether it was recovered by hard or soft binding. | Author’s analysis over C10.01 to C10.03. Analysis | No adoption percentages are asserted; credible cross-sector prevalence figures for credentials in circulating media do not appear to exist. |
| C11.01 | EU AI Act Article 50 applies from 2 August 2026: providers must mark AI-generated output machine-readably and deployers must disclose deepfakes, with an exemption for AI-generated text on matters of public interest that has had human editorial review and a person assuming responsibility. The Digital Omnibus on AI, Regulation (EU) 2026/1744 (OJ 24 July 2026, in force 27 July 2026), did not defer Article 50 but deferred Annex III high-risk obligations to 2 December 2027 and Annex I sectoral ones to 2 August 2028. | Regulation texts and European Commission guidance. Established | Dates and scope as published in late 2026 and subject to change. Not legal advice; national implementation and enforcement practice vary. |
| C11.02 | The TAKE IT DOWN Act, signed 19 May 2025, makes it unlawful knowingly to publish via an interactive computer service an intimate visual depiction or a “digital forgery” of an identifiable individual. Platform notice-and-takedown obligations took effect 19 May 2026, requiring removal of properly reported imagery and known identical copies within 48 hours; the FTC has sent warning letters to 15 major platforms. | Statute, Congressional Research Service LSB11314, and FTC business guidance (May 2026). Established | US federal only. No data is offered on removal compliance rates or on over-removal of lawful material. |
| C11.03 | Proposed FRE 707 on machine-generated evidence was published for comment August 2025, heard January 2026, comments closed 16 February 2026; on 7 May 2026 the Advisory Committee voted to withdraw the published version and study a revised draft, and in June 2026 the Standing Committee sent it back. Proposed Rule 901(c), permitting a court to require further authentication where a party credibly claims AI fabrication, remains a study item. No rule is in force and no effective date is set. | Advisory Committee on Evidence Rules proceedings and contemporaneous practitioner reporting. Established | US federal rulemaking only; state courts differ. Status as of late 2026 and expected to change. |
| C11.04 | The defensible function of a machine-readable marking duty is to manufacture the provenance adoption that makes an absent credential informative, rather than to warn viewers; and enforcement outcomes are governed by the reachability and solvency of the target rather than by the severity of the penalty. | Author’s analysis over C2.03, C10.04, C11.01 and C11.02. Analysis | No cited instrument states this as legislative intent. The reachability claim rests on two documented cases and would benefit from systematic collection data, which does not appear to exist. |
Open items carried forward
Every claim that was open pending a later chapter has now been discharged. Zero-shot sample length (C1.07) was pinned by C5.01 in Chapter 5; detector generalisation (C1.03) was pinned by C6.01 and C6.02 in Chapter 6. Two Emerging claims remain, and neither can be improved by further reading, which is why they are marked rather than scheduled. C2.03, the payment status of the New Hampshire penalties, is reporting at a point in time and may change; Chapter 11 returns to it, where the gap between a penalty ordered and a penalty collected is the point rather than a footnote. C3.02 is the most-cited voice-fraud case in the literature and rests on an insurer’s account of a claim against an unnamed company; it is retained for its historical place and will not be strengthened, because the source cannot be improved. Both are flagged here rather than quietly asserted.
Return to the book contents.