Research background & feasibility
Context: the provenance ecosystem
Capture-time provenance is an active, standards-backed field. C2PA / Content Credentials (Adobe, Google, Sony, Microsoft; 6,000+ organizations) defines signed manifests embedded in media; the EU AI Act's transparency obligations (Art. 50, applicable from August 2026) and the near-final ISO 22144 point to it as the de facto standard. Shipping hardware already signs at capture: Google Pixel 10 (photos, keys in StrongBox), Sony's video Content Credentials on professional bodies, Leica M11-P. The 2025 Nikon Z6III incident — a researcher induced the camera to sign an AI-generated image — established the field's central lesson: the weak point is what gets signed, not the cryptography.
Why signatures alone are not enough
Social platforms re-encode uploads and strip embedded metadata, including C2PA manifests, essentially 100% of the time. A signature proves integrity, not presence: a stripped file is not "tampered", merely unsigned. Conversely, statistical watermarks alone are removable and forgeable. The literature converges on combining them — an exact cryptographic layer plus a robust watermark used as a recovery pointer ("durable credentials").
Key literature
| Work | Year | Relevance |
|---|---|---|
| VideoSeal (Meta) | 2024 | Open-source robust video watermarking, 256-bit payload — our watermark layer |
| DeepSignature | 2026 | Ed25519 signature embedded as a neural watermark |
| Signing Right Away | 2025 | Signing raw sensor output before the ISP (anti-injection) |
| ETH Zurich sensor chip (Nature Electronics) | 2026 | Signature inside the sensor die |
| VerITAS | 2024 | zk-SNARK proofs that edits of signed media were permitted ones |
| zk-Cinema | 2026 | First zero-knowledge provenance for video |
| Axis Signed Video / ONVIF Media Signing | 2021– | Per-GOP rolling signatures in SEI NAL units, deployed in production cameras |
Our feasibility results (phase 0)
Watermark robustness
A 256-bit VideoSeal payload embedded in 1080p video (imperceptible: PSNR 46.8 dB) survived simulated platform re-encodes at 100% bit accuracy (YouTube/TikTok/X ladders) and ≥94.9% in a 360p/500kbps stress case — fully recoverable with standard error correction. Real-platform round trips: actual YouTube upload/download 99.61%, WhatsApp 100%.
Bitstream signature transport
Custom SEI NAL units prepended to every access unit passed through a consumer phone's hardware H.264 encoder and MP4 muxer intact (60/60, Motorola Moto G75, Qualcomm encoder) — per-GOP signatures need no custom media stack.
On-device embedding cost
The watermark embedder (23.7M params, 28.3 GFLOPs at fp32) runs at ~1.0 s/inference on a mid-range phone CPU — about 2× short of real-time at 30fps with temporal propagation. The identified path is int8 quantization on the NPU (typically 4–8× on this SoC class); flagship NPUs are expected to be comfortably real-time. An engineering gap, not a feasibility wall.
Threat model and honest limits
- Analog hole — filming a screen produces a validly signed capture of fake content. Unsolvable by signing; mitigable with depth/IMU coherence signals, which we treat as signals, never guarantees.
- Injection before signing — virtual cameras, HDMI-to-CSI injection (exploited at scale against KYC systems). Hardware attestation and verified boot raise the bar; sensor-level signing (see literature) is where the industry is heading.
- Key compromise — hardware-backed, non-exportable per-device keys limit blast radius to one device; attestation lets the registry refuse unattested keys.
- Clock trust — capture time is device-claimed in the MVP; registration time is server-attested. RFC 3161 timestamping closes the gap.