{"course":{"slug":"motion-and-audio","title":"Motion, Sound and Music","url":"https://addaly.com/learn/motion-and-audio","level":"intermediate","track":"create"},"lesson":{"slug":"provenance-and-disclosure","title":"Provenance, watermarks and what to tell people","url":"https://addaly.com/learn/motion-and-audio/provenance-and-disclosure","position":72,"of":72,"minutes":10,"answer":"Provenance is a signed record of what cooperating tools reported doing and can be stripped by an ordinary re-encode, while detection is an inference that always trails the generators.","keyIdea":"Provenance is a signed record of what cooperating tools reported doing and can be stripped by an ordinary re-encode, while detection is an inference that always trails the generators, so an absent credential or an undetected watermark is evidence of nothing, and disclosure is a separate question from either."},"body":{"format":"markdown","text":"## Two different problems, often confused\n\n**Provenance** is a record of where a file came from and what was done to it. **Detection** is working out after the fact whether something was synthesised. They are different approaches with different reliability, and the discussion mixes them constantly.\n\nProvenance is a chain of claims made by cooperating tools. Detection is an inference made about an uncooperative artefact. Provenance can be strong and can be stripped; detection is weak and is always catching up.\n\n## Content Credentials and C2PA\n\nThe **Coalition for Content Provenance and Authenticity** publishes a specification for attaching a signed manifest to a media file. The manifest can record what captured or created the file, what edits were applied, which tools made them, and, where the creator chooses, who they are. Each step is cryptographically signed, so tampering with the record is detectable.\n\nAdoption is real and growing: several camera manufacturers, several editing applications, and several generative services now write Content Credentials. The specification is open and implementations exist.\n\nThree limits are important and are not obscure:\n\n> Figure: What a content credential proves, and what it does not. A two by two grid, rows Credential kept and No credential, columns Camera capture and Generated: Credential kept and Camera capture: Signed record; Credential kept and Generated: Signed label; No credential and Camera capture: Proves nothing; No credential and Generated: Proves nothing. A manifest attests to what cooperating tools reported doing, signed so that tampering is detectable. It does not attest that the content is true: a camera can faithfully photograph a staged scene and sign it. And because the manifest is metadata, a screenshot or an ordinary transcode removes it, so an absent credential is evidence of nothing at all.\n\n**Stripping.** The manifest is metadata. Screenshot the image, re-encode the video, or upload it to a platform that rewrites files, and it is gone. Absence of a credential means nothing at all: most files in the world have none.\n\n**Scope.** A signed manifest attests to what tools reported doing. It does not attest that the content is true. A camera can faithfully photograph a staged scene and sign it.\n\n**Trust.** The signature is only as meaningful as the certificate behind it and your reason to trust the signer.\n\nDurable content credentials (combining the manifest with an invisible watermark and a fingerprint lookup, so the record can be recovered after stripping) are being developed to address the first limit. They are a mitigation, not a fix.\n\n## Watermarking\n\nAn invisible watermark embeds a signal in the content itself: imperceptible perturbations in pixels, or in audio, that a detector can recognise. Google's SynthID and several others work on this principle, and some are now applied by default to generated output.\n\nPublished robustness figures describe survival through ordinary transformations: compression, cropping, resizing, re-recording. Those are the right tests for accidental loss. They are not tests against somebody actively trying to remove the mark, and academic work has repeatedly shown that adversarial removal is possible against most schemes.\n\nSo the honest statement is the same as for cloned voices: a detected watermark is meaningful evidence that content came from a particular generator; **an undetected watermark is not evidence of anything.**\n\n## Detection classifiers\n\nModels trained to distinguish generated from captured media perform well on the generators in their training set and degrade sharply on new ones. They also produce false positives, and a false accusation of fabrication is a serious harm in its own right.\n\nThe practical position for anybody who has to decide whether something is real: a detector's output is one weak signal among several, alongside where the file came from, who is circulating it, whether there is corroborating material, and whether the content is consistent with things that can be checked independently. Journalism's existing verification methods have not been superseded by a classifier.\n\n## Disclosure, which is a separate question\n\nWhether to tell your audience is not settled by any of the above.\n\nSome of it is law. The European Union's AI Act includes transparency obligations for certain kinds of synthetic content, with phased application. Various jurisdictions have introduced or proposed rules targeting synthetic media in elections and in advertising. Several platforms require creators to label realistic synthetic content and apply their own labels. These differ by place, by sector and by how realistic the content is, and they are changing.\n\nWhere a rule applies, follow it and check the current text rather than a summary.\n\nWhere none applies, the question is editorial and is contested. One defensible position: a generative tool used to make background music, clean up noise or interpolate frames is a production tool, and disclosing it is as unnecessary as disclosing which EQ you used. Another defensible position: audiences have an interest in knowing when a voice or a face is synthetic, because those specifically carry an implicit claim that a person did something.\n\nA workable line that most people find they can defend: **disclose when the synthesis is about a person or an event.** A synthesised voice, a face, a depiction of something that is presented as having happened. Do not clutter every credit with the tools used for ordinary production work.\n\n## What to do on your own projects\n\n- **Keep the originals.** The unprocessed capture, in a separate place, with the date. This is the most useful provenance record you will ever have and it costs storage.\n- **Keep a log.** Which tools, which versions, which prompts, which models, for anything generated. A text file in the project folder.\n- **Preserve credentials where they exist**, and know that your export settings may be discarding them.\n- **Get consent in writing** for anything involving a real person's voice or likeness, covering the scope of use: the previous lesson on cloned voices covers what that scope has to include.\n- **Say so in the credits** when a voice or a face is synthetic, whether or not you are required to.\n\n## The free path\n\nThe C2PA specification is open, and the **c2patool** command-line utility is free and open source: it reads and writes manifests, which is enough to inspect what a file carries and to attach your own. **ExifTool** reads metadata generally. **ffmpeg** is what strips it by default, so if you care about preserving credentials through a transcode, check what survives; usually it does not.\n\n## The limitation\n\nNone of this establishes truth. A perfectly signed provenance chain on a file that faithfully records a staged event is a trustworthy record of an untrustworthy thing. A stripped file with no credentials may be entirely genuine. Watermarks are removable by anyone motivated, detectors are behind the generators, and every technical measure here helps most against casual misuse and least against a determined actor.\n\nThe field is also moving faster than any description of it. Standards, platform rules and legislation will all have changed by the time this matters to you, and the only durable advice is to check the current position rather than a remembered one, and to keep your own records, which is the part that does not depend on anybody else's system continuing to work."},"check":{"question":"A newsroom receives a video with no Content Credentials and no detectable watermark. A detection classifier scores it as probably genuine. What can be concluded?","options":[{"text":"Very little: absence of a credential is the normal state of most files, watermark absence proves nothing, and the classifier is one weak signal among several.","correct":true},{"text":"That the file is probably genuine, since three independent indicators point the same way and their combination is stronger than any one of them.","correct":false,"tempting":"Treats three null or weak results as corroborating evidence; two of them carry no information in the negative direction."},{"text":"That the file has been re-encoded at some point, because a genuine capture from a modern device would carry credentials through to delivery.","correct":false,"tempting":"Assumes universal credential adoption and survival; most capture devices and pipelines write and preserve nothing."},{"text":"That the file is unlikely to have come from a major generative service, because those apply watermarks by default and a watermark that survives ordinary compression would still be detectable, so the absence narrows the origin to either a genuine capture or an open-weight model run locally.","correct":false,"tempting":"Reasons from a default that is neither universal nor robust, and treats a negative watermark result as informative when it is not."}]},"prev":{"slug":"generated-and-interpolated-frames","title":"Frames that were never photographed","url":"https://addaly.com/learn/motion-and-audio/generated-and-interpolated-frames"},"next":null,"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Provenance, watermarks and what to tell people', in Motion, Sound and Music. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/motion-and-audio/provenance-and-disclosure (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Provenance, watermarks and what to tell people","courseTitle":"Motion, Sound and Music","module":{"index":8,"slug":"machines-that-make-sound-and-motion","title":"Machines that make sound and motion"},"answer":null,"keyIdea":"Provenance is a signed record of what cooperating tools reported doing and can be stripped by an ordinary re-encode, while detection is an inference that always trails the generators, so an absent credential or an undetected watermark is evidence of nothing, and disclosure is a separate question from either.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"cols":["Camera capture","Generated"],"rows":["Credential kept","No credential"],"type":"matrix","cells":[["Signed record","Signed label"],["Proves nothing","Proves nothing"]],"title":"What a content credential proves, and what it does not","caption":"A manifest attests to what cooperating tools reported doing, signed so that tampering is detectable. It does not attest that the content is true: a camera can faithfully photograph a staged scene and sign it. And because the manifest is metadata, a screenshot or an ordinary transcode removes it, so an absent credential is evidence of nothing at all.","cellLabels":[["of tools, not truth","the generator said so"],["most files have none","a re-encode strips it"]]},"alt":"Figure: What a content credential proves, and what it does not. A two by two grid, rows Credential kept and No credential, columns Camera capture and Generated: Credential kept and Camera capture: Signed record; Credential kept and Generated: Signed label; No credential and Camera capture: Proves nothing; No credential and Generated: Proves nothing. A manifest attests to what cooperating tools reported doing, signed so that tampering is detectable. It does not attest that the content is true: a camera can faithfully photograph a staged scene and sign it. And because the manifest is metadata, a screenshot or an ordinary transcode removes it, so an absent credential is evidence of nothing at all."}},"blocks":[{"t":"h2","id":"two-different-problems-often-confused","runs":[{"text":"Two different problems, often confused"}]},{"t":"p","runs":[{"text":"Provenance","b":true},{"text":" is a record of where a file came from and what was done to it. "},{"text":"Detection","b":true},{"text":" is working out after the fact whether something was synthesised. They are different approaches with different reliability, and the discussion mixes them constantly."}]},{"t":"p","runs":[{"text":"Provenance is a chain of claims made by cooperating tools. Detection is an inference made about an uncooperative artefact. Provenance can be strong and can be stripped; detection is weak and is always catching up."}]},{"t":"h2","id":"content-credentials-and-c2pa","runs":[{"text":"Content Credentials and C2PA"}]},{"t":"p","runs":[{"text":"The "},{"text":"Coalition for Content Provenance and Authenticity","b":true},{"text":" publishes a specification for attaching a signed manifest to a media file. The manifest can record what captured or created the file, what edits were applied, which tools made them, and, where the creator chooses, who they are. Each step is cryptographically signed, so tampering with the record is detectable."}]},{"t":"p","runs":[{"text":"Adoption is real and growing: several camera manufacturers, several editing applications, and several generative services now write Content Credentials. The specification is open and implementations exist."}]},{"t":"p","runs":[{"text":"Three limits are important and are not obscure:"}]},{"t":"p","runs":[{"text":"Stripping.","b":true},{"text":" The manifest is metadata. Screenshot the image, re-encode the video, or upload it to a platform that rewrites files, and it is gone. Absence of a credential means nothing at all: most files in the world have none."}]},{"t":"p","runs":[{"text":"Scope.","b":true},{"text":" A signed manifest attests to what tools reported doing. It does not attest that the content is true. A camera can faithfully photograph a staged scene and sign it."}]},{"t":"p","runs":[{"text":"Trust.","b":true},{"text":" The signature is only as meaningful as the certificate behind it and your reason to trust the signer."}]},{"t":"p","runs":[{"text":"Durable content credentials (combining the manifest with an invisible watermark and a fingerprint lookup, so the record can be recovered after stripping) are being developed to address the first limit. They are a mitigation, not a fix."}]},{"t":"h2","id":"watermarking","runs":[{"text":"Watermarking"}]},{"t":"p","runs":[{"text":"An invisible watermark embeds a signal in the content itself: imperceptible perturbations in pixels, or in audio, that a detector can recognise. Google’s SynthID and several others work on this principle, and some are now applied by default to generated output."}]},{"t":"p","runs":[{"text":"Published robustness figures describe survival through ordinary transformations: compression, cropping, resizing, re-recording. Those are the right tests for accidental loss. They are not tests against somebody actively trying to remove the mark, and academic work has repeatedly shown that adversarial removal is possible against most schemes."}]},{"t":"p","runs":[{"text":"So the honest statement is the same as for cloned voices: a detected watermark is meaningful evidence that content came from a particular generator; "},{"text":"an undetected watermark is not evidence of anything.","b":true}]},{"t":"h2","id":"detection-classifiers","runs":[{"text":"Detection classifiers"}]},{"t":"p","runs":[{"text":"Models trained to distinguish generated from captured media perform well on the generators in their training set and degrade sharply on new ones. They also produce false positives, and a false accusation of fabrication is a serious harm in its own right."}]},{"t":"p","runs":[{"text":"The practical position for anybody who has to decide whether something is real: a detector’s output is one weak signal among several, alongside where the file came from, who is circulating it, whether there is corroborating material, and whether the content is consistent with things that can be checked independently. Journalism’s existing verification methods have not been superseded by a classifier."}]},{"t":"h2","id":"disclosure-which-is-a-separate-question","runs":[{"text":"Disclosure, which is a separate question"}]},{"t":"p","runs":[{"text":"Whether to tell your audience is not settled by any of the above."}]},{"t":"p","runs":[{"text":"Some of it is law. The European Union’s AI Act includes transparency obligations for certain kinds of synthetic content, with phased application. Various jurisdictions have introduced or proposed rules targeting synthetic media in elections and in advertising. Several platforms require creators to label realistic synthetic content and apply their own labels. These differ by place, by sector and by how realistic the content is, and they are changing."}]},{"t":"p","runs":[{"text":"Where a rule applies, follow it and check the current text rather than a summary."}]},{"t":"p","runs":[{"text":"Where none applies, the question is editorial and is contested. One defensible position: a generative tool used to make background music, clean up noise or interpolate frames is a production tool, and disclosing it is as unnecessary as disclosing which EQ you used. Another defensible position: audiences have an interest in knowing when a voice or a face is synthetic, because those specifically carry an implicit claim that a person did something."}]},{"t":"p","runs":[{"text":"A workable line that most people find they can defend: "},{"text":"disclose when the synthesis is about a person or an event.","b":true},{"text":" A synthesised voice, a face, a depiction of something that is presented as having happened. Do not clutter every credit with the tools used for ordinary production work."}]},{"t":"h2","id":"what-to-do-on-your-own-projects","runs":[{"text":"What to do on your own projects"}]},{"t":"ul","items":[[{"text":"Keep the originals.","b":true},{"text":" The unprocessed capture, in a separate place, with the date. This is the most useful provenance record you will ever have and it costs storage."}],[{"text":"Keep a log.","b":true},{"text":" Which tools, which versions, which prompts, which models, for anything generated. A text file in the project folder."}],[{"text":"Preserve credentials where they exist","b":true},{"text":", and know that your export settings may be discarding them."}],[{"text":"Get consent in writing","b":true},{"text":" for anything involving a real person’s voice or likeness, covering the scope of use: the previous lesson on cloned voices covers what that scope has to include."}],[{"text":"Say so in the credits","b":true},{"text":" when a voice or a face is synthetic, whether or not you are required to."}]]},{"t":"h2","id":"the-free-path","runs":[{"text":"The free path"}],"role":"free"},{"t":"p","runs":[{"text":"The C2PA specification is open, and the "},{"text":"c2patool","b":true},{"text":" command-line utility is free and open source: it reads and writes manifests, which is enough to inspect what a file carries and to attach your own. "},{"text":"ExifTool","b":true},{"text":" reads metadata generally. "},{"text":"ffmpeg","b":true},{"text":" is what strips it by default, so if you care about preserving credentials through a transcode, check what survives; usually it does not."}]},{"t":"h2","id":"the-limitation","runs":[{"text":"The limitation"}],"role":"limit"},{"t":"p","runs":[{"text":"None of this establishes truth. A perfectly signed provenance chain on a file that faithfully records a staged event is a trustworthy record of an untrustworthy thing. A stripped file with no credentials may be entirely genuine. Watermarks are removable by anyone motivated, detectors are behind the generators, and every technical measure here helps most against casual misuse and least against a determined actor."}]},{"t":"p","runs":[{"text":"The field is also moving faster than any description of it. Standards, platform rules and legislation will all have changed by the time this matters to you, and the only durable advice is to check the current position rather than a remembered one, and to keep your own records, which is the part that does not depend on anybody else’s system continuing to work."}]}],"check":{"question":[{"text":"A newsroom receives a video with no Content Credentials and no detectable watermark. A detection classifier scores it as probably genuine. What can be concluded?"}],"options":[{"text":[{"text":"Very little: absence of a credential is the normal state of most files, watermark absence proves nothing, and the classifier is one weak signal among several."}],"correct":true,"tempting":null},{"text":[{"text":"That the file is probably genuine, since three independent indicators point the same way and their combination is stronger than any one of them."}],"correct":false,"tempting":[{"text":"Treats three null or weak results as corroborating evidence; two of them carry no information in the negative direction."}]},{"text":[{"text":"That the file has been re-encoded at some point, because a genuine capture from a modern device would carry credentials through to delivery."}],"correct":false,"tempting":[{"text":"Assumes universal credential adoption and survival; most capture devices and pipelines write and preserve nothing."}]},{"text":[{"text":"That the file is unlikely to have come from a major generative service, because those apply watermarks by default and a watermark that survives ordinary compression would still be detectable, so the absence narrows the origin to either a genuine capture or an open-weight model run locally."}],"correct":false,"tempting":[{"text":"Reasons from a default that is neither universal nor robust, and treats a negative watermark result as informative when it is not."}]}],"order":[3,1,0,2],"why":null},"prev":{"slug":"generated-and-interpolated-frames","title":"Frames that were never photographed","minutes":10},"next":null}}