Provenance, watermarks and what to tell people

Two different problems, often confused

Provenance is a record of where a file came from and what was done to it. Detection is working out after the fact whether something was synthesised. They are different approaches with different reliability, and the discussion mixes them constantly.

Provenance is a chain of claims made by cooperating tools. Detection is an inference made about an uncooperative artefact. Provenance can be strong and can be stripped; detection is weak and is always catching up.

Content Credentials and C2PA

The Coalition for Content Provenance and Authenticity publishes a specification for attaching a signed manifest to a media file. The manifest can record what captured or created the file, what edits were applied, which tools made them, and, where the creator chooses, who they are. Each step is cryptographically signed, so tampering with the record is detectable.

Adoption is real and growing: several camera manufacturers, several editing applications, and several generative services now write Content Credentials. The specification is open and implementations exist.

Three limits are important and are not obscure:

Stripping. The manifest is metadata. Screenshot the image, re-encode the video, or upload it to a platform that rewrites files, and it is gone. Absence of a credential means nothing at all: most files in the world have none.

Scope. A signed manifest attests to what tools reported doing. It does not attest that the content is true. A camera can faithfully photograph a staged scene and sign it.

Trust. The signature is only as meaningful as the certificate behind it and your reason to trust the signer.

Durable content credentials (combining the manifest with an invisible watermark and a fingerprint lookup, so the record can be recovered after stripping) are being developed to address the first limit. They are a mitigation, not a fix.

Watermarking

An invisible watermark embeds a signal in the content itself: imperceptible perturbations in pixels, or in audio, that a detector can recognise. Google’s SynthID and several others work on this principle, and some are now applied by default to generated output.

Published robustness figures describe survival through ordinary transformations: compression, cropping, resizing, re-recording. Those are the right tests for accidental loss. They are not tests against somebody actively trying to remove the mark, and academic work has repeatedly shown that adversarial removal is possible against most schemes.

So the honest statement is the same as for cloned voices: a detected watermark is meaningful evidence that content came from a particular generator; an undetected watermark is not evidence of anything.

Detection classifiers

Models trained to distinguish generated from captured media perform well on the generators in their training set and degrade sharply on new ones. They also produce false positives, and a false accusation of fabrication is a serious harm in its own right.

The practical position for anybody who has to decide whether something is real: a detector’s output is one weak signal among several, alongside where the file came from, who is circulating it, whether there is corroborating material, and whether the content is consistent with things that can be checked independently. Journalism’s existing verification methods have not been superseded by a classifier.

Disclosure, which is a separate question

Whether to tell your audience is not settled by any of the above.

Some of it is law. The European Union’s AI Act includes transparency obligations for certain kinds of synthetic content, with phased application. Various jurisdictions have introduced or proposed rules targeting synthetic media in elections and in advertising. Several platforms require creators to label realistic synthetic content and apply their own labels. These differ by place, by sector and by how realistic the content is, and they are changing.

Where a rule applies, follow it and check the current text rather than a summary.

Where none applies, the question is editorial and is contested. One defensible position: a generative tool used to make background music, clean up noise or interpolate frames is a production tool, and disclosing it is as unnecessary as disclosing which EQ you used. Another defensible position: audiences have an interest in knowing when a voice or a face is synthetic, because those specifically carry an implicit claim that a person did something.

A workable line that most people find they can defend: disclose when the synthesis is about a person or an event. A synthesised voice, a face, a depiction of something that is presented as having happened. Do not clutter every credit with the tools used for ordinary production work.

What to do on your own projects

• Keep the originals. The unprocessed capture, in a separate place, with the date. This is the most useful provenance record you will ever have and it costs storage.
• Keep a log. Which tools, which versions, which prompts, which models, for anything generated. A text file in the project folder.
• Preserve credentials where they exist, and know that your export settings may be discarding them.
• Get consent in writing for anything involving a real person’s voice or likeness, covering the scope of use: the previous lesson on cloned voices covers what that scope has to include.
• Say so in the credits when a voice or a face is synthetic, whether or not you are required to.

The free path

The C2PA specification is open, and the c2patool command-line utility is free and open source: it reads and writes manifests, which is enough to inspect what a file carries and to attach your own. ExifTool reads metadata generally. ffmpeg is what strips it by default, so if you care about preserving credentials through a transcode, check what survives; usually it does not.

The limitation

None of this establishes truth. A perfectly signed provenance chain on a file that faithfully records a staged event is a trustworthy record of an untrustworthy thing. A stripped file with no credentials may be entirely genuine. Watermarks are removable by anyone motivated, detectors are behind the generators, and every technical measure here helps most against casual misuse and least against a determined actor.

The field is also moving faster than any description of it. Standards, platform rules and legislation will all have changed by the time this matters to you, and the only durable advice is to check the current position rather than a remembered one, and to keep your own records, which is the part that does not depend on anybody else’s system continuing to work.