Content Credentials: Provenance Beats Detection

Every detection technique described on this blog shares a structural weakness: it is reactive. A new generator appears, its artefacts differ, detectors lag, and the gap is exploited. Detection buys time. It does not win.

Provenance inverts the problem.

The idea

Instead of asking “does this image show signs of manipulation?”, provenance asks “can this image prove where it came from?” The C2PA specification attaches a signed manifest to a file, recording the capture device, the creating software, and every subsequent edit as a chain of assertions. Each step is cryptographically signed. Alter the pixels without updating the manifest and verification fails.

What a manifest records

• Capture — device make and model, timestamp, optionally location.
• Edits — which application performed what class of operation.
• Generation — whether an AI model was involved, and which.
• Signer identity — bound to a certificate chain.

Crucially, this is a positive claim rather than a negative inference. Verification either succeeds against a trusted signer or it does not.

Where it is already deployed

Camera manufacturers have shipped signing in professional bodies. Major editing suites write credentials through the edit chain. Several large generative-model providers attach credentials marking output as synthetic. A number of news organisations now publish with credentials intact.

The honest limitations

Absence still proves nothing. The overwhelming majority of images have no credentials and will not for years. “Unsigned” cannot mean “untrusted” without discarding most of the historical photographic record.

Screenshots defeat it. Capture a signed image with a screenshot and the manifest is gone. The pixels survive; the provenance does not.

Signing attests to the chain, not the truth. A signed photograph can still be captioned falsely, or depict a staged scene. Provenance verifies the file’s history, not the honesty of the claim built on it.

Trust is federated. A signature is only as good as the certificate authority behind it, which reproduces every hard problem in PKI — revocation, root trust, compromised signers.

What this means practically

The end state is not detection or provenance. It is both:

• Signed images — verify the chain. Fast, decisive, cheap.
• Unsigned images — fall back to forensic analysis, with all the ambiguity that entails, plus provenance investigation and contextual checks.

Our detector sits squarely in the second category, and we expect that category to shrink slowly over the coming decade without ever disappearing. Reading credentials is on our roadmap precisely because the two approaches answer different questions, and a serious verification workflow needs both.