Research background & feasibility

Context: the provenance ecosystem

Capture-time provenance is an active, standards-backed field. C2PA / Content Credentials (Adobe, Google, Sony, Microsoft; 6,000+ organizations) defines signed manifests embedded in media; the EU AI Act's transparency obligations (Art. 50, applicable from August 2026) and the near-final ISO 22144 point to it as the de facto standard. Shipping hardware already signs at capture: Google Pixel 10 (photos, keys in StrongBox), Sony's video Content Credentials on professional bodies, Leica M11-P. The 2025 Nikon Z6III incident — a researcher induced the camera to sign an AI-generated image — established the field's central lesson: the weak point is what gets signed, not the cryptography.

Why signatures alone are not enough

Social platforms re-encode uploads and strip embedded metadata, including C2PA manifests, essentially 100% of the time. A signature proves integrity, not presence: a stripped file is not "tampered", merely unsigned. Conversely, statistical watermarks alone are removable and forgeable. The literature converges on combining them — an exact cryptographic layer plus a robust watermark used as a recovery pointer ("durable credentials").

Key literature

Our feasibility results (lab)

Watermark robustness

A 256-bit VideoSeal payload embedded in 1080p video (measured PSNR 46.8 dB) survived simulated re-encode ladders (1080p down to a 360p/500kbps stress case) at 100% to ≥94.9% bit accuracy — lab numbers, labeled as such. Real-platform round trips: actual YouTube upload/download 99.61% bit accuracy, WhatsApp 100% (early prototype), and the shipped system's live results below.

Bitstream signature transport

Custom SEI NAL units prepended to every access unit passed through a consumer phone's hardware H.264 encoder and MP4 muxer intact (60/60, Motorola Moto G75, Qualcomm encoder) — per-GOP signatures need no custom media stack. This transport now ships in production: every video carries independent per-GOP signatures (see the architecture).

Content checksum (explored, not shipped)

We prototyped a 104-bit truncated PDQ hash inside the watermark payload: it separated benign sharing from semantic edits with no overlap in our tests (re-encodes moved it 0–3 bits, splices/inpainting/crops 8–60), and BCH(255,131) recovered the exact payload across the whole transcode ladder with zero silent miscorrections in 31k trials. We set it aside: comparing the copy against the verified original is simpler to explain, stronger evidence, and frees the whole payload for a 128-bit random capture id. The BCH layer survived into the shipped payload; the PDQ implementations remain in spikes/. Data: spikes/results/ in the repo.

Live end-to-end results (shipped system)

Real captures (Motorola moto g75, TEE-backed key) pushed through real platforms and verified with the production verifier:

• Photo → WhatsApp (3072×4096 → 1536×2048, 8× smaller): the 128-bit capture id decoded exactly; BCH repaired 16 of its 18 correctable bits — recovered by the verifier's native-resolution retry.
• Photo → Instagram (1440×1920, returned as HEIC): id decoded exactly, at the correction limit (all 18 repairable bits used). The 1:1 square crop (25% of the frame lost) exceeds the budget even after the aspect-restore rescue — a measured boundary; posts keeping the frame decode.
• Photo → Telegram (photo mode): the harshest measured photo pipeline (960×1280 + heavy recompression) — the mark is NOT recovered. Sent as a file, Telegram delivers the exact bytes and the full seal verifies. Published as a failure case on the experiments page.
• Video → WhatsApp / Telegram / Instagram (478×850 to 720×1280 re-encodes): mark id recovered at 80% / 85% / 87% signal agreement.
• Video → YouTube Shorts (re-encoded to AV1): mark id recovered at 82%.
• Video edited on Instagram (caption + sticker overlays): id still recovered at 82% — the verifier flags origin, the side-by-side comparison exposes the additions.
• Lossless trim (-c copy, seal stripped): 4 of 5 surviving GOPs verify via their bitstream signatures; mark at 97%.

Two production lessons surfaced by these tests. (1) The video channel flips 20–25% of decoded bits systematically — flat across 24→200 sampled frames and all scan scales — so video carries a 24-bit id in the 8× repetition format rather than the 128-bit BCH payload (the information-theoretic ceiling at that error rate is ~48 bits). (2) int8 dynamic quantization of the browser detector doubled raw bit errors versus fp32 (74/256 vs 32 on the WhatsApp video) and was replaced by an fp16 export that tracks fp32 within a few bits.

On-device embedding cost

The watermark embedder (23.7M params, 28.3 GFLOPs at fp32) runs at ~1.0 s/inference on a mid-range phone CPU — about 2× short of real-time at 30fps with temporal propagation. The identified path is int8 quantization on the NPU (typically 4–8× on this SoC class); flagship NPUs are expected to be comfortably real-time. An engineering gap, not a feasibility wall.

Threat model and limitations

• Analog hole — filming a screen produces a validly signed capture of fake content. Unsolvable by signing; mitigable with depth/IMU coherence signals, which we treat as signals, never guarantees.
• Injection before signing — virtual cameras, HDMI-to-CSI injection (exploited at scale against KYC systems). Hardware attestation and verified boot raise the bar; sensor-level signing (see literature) is where the industry is heading.
• Key compromise — hardware-backed, non-exportable per-device keys limit blast radius to one device; the attestation chain travels inside every proof, so verifiers can weigh unattested keys accordingly.
• Clock trust — the device clock is self-claimed, so the proof carries an RFC 3161 token from a public timestamp authority (fetched at capture when online, verified client-side against a pinned chain): a third party attests the file existed no later than that moment. Offline captures remain device-claimed.
• Mark forgery — the watermark model is open source, so the mark (and the capture id it carries: 256 bits cannot hold a signature) is forgeable by construction. This is why mark-only recovery is an origin claim, and the side-by-side comparison with the verified original is evidence for human judgement — never authentication by itself. The only cryptographic proof is the signed trailer.