Authenticated Contradictions from Desynchronized Provenance and Watermarking

arXiv:2603.02378 · cs.CR, cs.CV, cs.MM, eess.IV · Submitted 2026-03-02 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: We're looking at the paper: "Authenticated Contradictions from Desynchronized Provenance and Watermarking".

Elias: Here's the gist of the paper. The gist: This work formalizes and empirically demonstrates that a digital asset can carry both a cryptographically valid C2PA manifest asserting human authorship and an invisible watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation.

Nadia: Integrity Clash Formalization The paper introduces the Integrity Clash, which is defined as a condition where "a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation" (Page 1).

Elias: This clash arises because the two verification layers are technically independent; "neither conditions on the output of the other" (Page 1).

Nadia: The authors construct "metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification" (Page 1).

Title and authors: Nadia: So, we're looking at this paper called "Authenticated Contradictions from Desynchronized Provenance and Watermarking." It’s about a specific problem where you have two different ways to check if something is real, and they don't talk to each other.

Elias: Right, it focuses on the idea that C2PA manifests for human authorship and invisible watermarks identifying AI generation can both be valid when they are checked by themselves, but together they create a contradiction.

Nadia: Exactly. The core thing here is what they call the Integrity Clash, which happens when an asset has a valid C2PA manifest saying a human made it, while the pixels have an AI watermark saying it’s fake, and both checks pass separately.

Elias: They show how you can build these things using standard editing pipelines just by leaving out one small piece of metadata that the current C2PA spec allows.

Priya: So what they're showing us is that this clash isn't just some abstract theory; it’s a real thing happening in workflows where people are making edits to content.

Nadia: Right. They construct these specific metadata washing workflows that produce these authenticated fakes without needing any kind of cryptographic break, just by omitting one assertion field allowed by the current C2PA specification.

Elias: And then they show how this leads directly into a conflict matrix over two binary dimensions: whether there's a valid C2PA manifest and whether an AI-origin watermark is detected.

Nadia: That matrix splits things into four quadrants, and Q4b is the specific state they call the "Authenticated Fake," where the manifest omits AI disclosure while the watermark still detects synthetic origin.

Elias: It’s interesting because this isn't just one failure mode; it’s a systematic way to create something that passes both isolated tests but is fundamentally misleading when you look at them together.

Priya: From what I see, it really highlights how fragile these two verification layers are if they aren't explicitly designed to talk to each other.

Nadia: And the authors propose a solution by suggesting a cross-layer audit protocol that jointly evaluates both the C2PA metadata and the watermark signal at the same time.

Elias: They define this protocol as something that detects these contradictions that single-layer verification workflows simply cannot find on their own.

Priya: So, they're not just looking at one signal; they’re building a system to look for the specific contradiction between what the metadata says and what the pixels are actually doing.

Nadia: They tested this using five hundred synthetic images made with Stable-Diffusion-XL-Base-one point zero, and they used Pixel Seal for watermarking, embedding a fixed two hundred fifty-six-bit payload without changing the generative model itself.

Elias: And they use self-signed ECDSA P256 certificates for the C2PA signing, meaning the vulnerability under investigation isn't actually in forging those certificates, but in how that metadata interacts with the watermark detection.

Priya: The paper notes that Zhao et al. proved that a broad class of invisible image watermarks can be removed using generative AI regeneration while keeping high perceptual quality, which makes this part of the research very relevant right now.

Title and authors: Nadia: That's true; they show that watermarks can be weakened under determined attackers, but they also confirm that under standard editorial workflows, these watermarks remain persistent enough to produce detectable cross-layer inconsistencies with co-existing metadata.

Elias: The empirical validation confirms that the Integrity Clash is reproducible under realistic conditions using their "Misleading Manifest" pipeline as the main example of this state.

Priya: And they report that when they used their proposed cross-layer audit protocol, it achieved perfect classification reported here, with Q4b being the positive class having a true positive rate of one point zero zero zero and a false positive rate of zero point zero zero zero across all tested conditions.

Nadia: It really demonstrates that the gap between these verification layers is unnecessary and technically straightforward to close, which is a big point for how we think about content security moving forward.

Elias: It implies that no deployed workflow, to our knowledge, jointly evaluates both outputs for consistency, and any serious content authenticity ecosystem needs to move from trusting either layer in isolation to auditing the gap between them.

Priya: I just want to point out a limitation: they used only one watermarking method called Pixel Seal forty-six, which might not represent all the watermarking schemes actually deployed in the real world <ref:2603.02378#pg2>.

Nadia: And another thing is that their self-signed certificate caused the Content Credentials Verify tool to flag the issuer as unrecognized, so that’s a caveat on how you'd actually deploy this specific setup right now.

Elias: Looking ahead, they suggest extending this cross-layer audit to video and audio modalities, and they also mention exploring extending C2PA specifications to require signing applications to inspect data for pre-existing watermark signals before issuing a manifest.

Priya: That idea about requiring the signing application to check for watermarks before it issues the manifest seems like a practical way to close that semantic gap at the point of signing.

Nadia: And I think those ideas are really important because they suggest we need to move beyond just trusting one layer and start checking how those layers contradict each other in real-time.

Elias: So, to wrap up on this paper, "Authenticated Contradictions from Desynchronized Provenance and Watermarking," the main point is that you can get a valid human authorship claim from C2PA and an AI watermark at the same time, but they conflict when you check them together.

Priya: It confirms that these two verification layers aren't just complementary defenses, but they need to be integrated into one system to be reliable.

Nadia: And the solution proposed is a minimal cross-layer audit protocol that jointly evaluates both signals to catch those contradictions perfectly, which is a very concrete way to address this technical gap.

Elias: So if you're driving, cooking, or walking and you’ve got content with both metadata and an AI signal attached, you need to check both things against each other before you trust what either one says about its origin.

The paper's summary: Nadia: So, we're talking about how this paper formalizes that Integrity Clash—that specific situation where you have both a valid human authorship claim from C2PA and an AI origin watermark on the same digital asset, and they pass their individual checks but contradict each other.

Elias: Right. It’s not just one failure mode; it's a systematic way to create something that passes both isolated tests but is fundamentally misleading when you look at them together.

Priya: What they’re showing us is how these two verification layers are technically independent, and that independence lets people build workflows, even standard editing ones, that produce these authenticated fakes without needing any kind of cryptographic break.

Nadia: Exactly. They construct these specific metadata washing workflows that produce these authenticated fakes by just omitting one small assertion field allowed by the current C2PA specification.

Elias: And then they map this out using a conflict matrix over two dimensions: whether there's a valid C2PA manifest and whether an AI origin watermark is detected.

Priya: That matrix spits things into four quadrants, and Q4b is the specific state they call the "Authenticated Fake," where the manifest omits AI disclosure while the watermark still detects synthetic origin.

Nadia: It’s interesting because this isn't just some abstract theory; it’s a reproducible phenomenon using five hundred synthetic images made with Stable-Diffusion-XL-Base-one point zero, where they use Pixel Seal for watermarking without modifying the generative model itself.

Elias: The empirical validation confirms that this Integrity Clash happens under realistic conditions, and when they run their proposed cross-layer audit protocol—which jointly evaluates both signals—it achieved perfect classification reported here.

Priya: Perfect accuracy across all tested conditions, with the Q4b state being the positive class having a true positive rate of one point zero zero zero and a false positive rate of zero point zero zero zero, which shows that this contradiction is perfectly detectable when you look at both signals together.

Nadia: It really demonstrates that the gap between these two verification layers is unnecessary and technically straightforward to close with just one joint evaluation protocol.

Priya: I do have a couple of caveats though. They used only one watermarking method called Pixel Seal, which might not represent all the watermarking schemes actually deployed in the real world.

Nadia: And they also flag that their self-signed certificate caused the Content Credentials Verify tool to flag the issuer as unrecognized, so that’s a bit of a hurdle for immediate deployment.

Elias: Looking ahead, they suggest extending this cross-layer audit to video and audio modalities, and they also mention exploring C2PA specs where signing applications would have to inspect data for pre-existing watermark signals before issuing a manifest.

Priya: That idea about requiring the signing application to check for watermarks before it issues the manifest sounds like a practical way to close that semantic gap at the point of signing.

Nadia: I think those ideas are really important because they suggest we need to move beyond just trusting one layer and start checking how those layers contradict each other in real time.

The paper's improvements: Tom: So, we're looking at how the authors suggest fixing what they found—how to move from detecting contradictions to actually preventing them in real systems.

Nadia: They propose a few things: first, integrating this cross-layer audit protocol into actual CI/CD pipelines so it acts like a semantic consistency gate that catches that Authenticated Fake state before deployment.

Elias: That makes sense for exploitation—if we can automate the check, we can stop these fakes from ever getting deployed cheaply.

Priya: And they also suggest augmenting the provenance manifest itself by making signing applications inspect data for pre-existing watermark signals and then propagate that origin information into the new manifest.

Nadia: So if a signing app checks for watermarks first, it can fix that semantic gap at the point of creation rather than just trying to catch it later.

Elias: That addresses the root cause, which is what they call closing the "semantic gap at the point of signing," making it harder to create these assets in the first place.

Priya: From a measurement standpoint, that sounds like a necessary step because right now we're just measuring two separate things and hoping they align later.

Nadia: And then there's this idea for future work: extending this cross-layer audit to video and audio modalities, or even extending the C2PA specification itself.

Elias: They mentioned requiring signing applications to inspect data for pre-existing watermark signals before they issue a manifest, which is a big step toward making provenance inherently aware of synthetic generation.

Priya: That kind of requirement moves us closer to having verifiable metadata that isn't just a statement, but something that has been checked against the asset itself.

Nadia: It shifts the focus from just checking if a claim is true to verifying if the claim is consistent with the physical evidence on the data.

Elias: So, we're moving toward systems where provenance and content origin are tightly coupled, instead of being two separate checks that can fail independently.

Priya: It sounds like they’re trying to build a more integrated verification layer rather than just adding another check on top of the existing ones.

Nadia: Exactly. We’ve seen how powerful that cross-layer audit protocol is when it works, and the next logical step is making those kinds of checks mandatory in the infrastructure itself.

Conclusion: Nadia: So we're wrapping up this look at "Authenticated Contradictions from Desynchronized Provenance and Watermarking," which boils down to how two independent checks—human authorship and AI origin—can coexist in a misleading way if you don't check them together.

Elias: It’s a formal demonstration that the gap between those two verification layers isn't unnecessary, and it shows how easily you can close that gap with just one joint audit protocol.

Priya: What this really means for us is that we can stop trusting either layer in isolation and start auditing the contradiction itself to get a clearer picture of what’s actually on the asset.

Nadia: Right, so it’s not about picking one signal over the other; it’s about making sure they align before you decide what your content is actually trustworthy.

Elias: That's right. The core finding is that this clash is reproducible under realistic conditions, specifically with their "Misleading Manifest" pipeline as the primary example of that state.

Priya: I just want to reiterate what the data shows: when they used their proposed cross-layer audit protocol, Q4b achieved perfect classification, with a true positive rate of one point zero zero zero and a false positive rate of zero point zero zero zero.

Nadia: So for someone listening who doesn't work in security or cryptography, it just means that if you’re dealing with content that has both provenance and AI signals, you need to check both simultaneously before trusting what either one tells you about the source.

Elias: Exactly. It changes how we think about infrastructure because no deployed workflow is currently checking both outputs for consistency, so we have to start auditing that gap.

Priya: I just want to say that while they showed this with one watermarking method, like Pixel Seal, it’s a good baseline for what’s possible in terms of contradiction detection.

Nadia: And yeah, the limitation is that their self-signed certificate caused some issues with the verification tool itself, which shows us that deployment needs to be careful about how you set up those cryptographic layers.

Elias: Moving forward, they pointed toward extending this audit protocol to video and audio, and even suggesting that signing applications should have to inspect data for pre-existing watermark signals before issuing a manifest.

Priya: That idea about requiring the signing application to check for watermarks before it issues a manifest seems like a practical way to close that semantic gap at the point of creation.

Nadia: So, if you’re looking at how content authenticity ecosystems need to evolve, this paper on "Authenticated Contradictions from Desynchronized Provenance and Watermarking" shows us exactly where the next layer of defense needs to be built.

Alexander Nemecek, Hengzhi He, Guang Cheng, Erman Ayday

Case Western Reserve University · University of California, Los Angeles

cs.CR, cs.CV, cs.MM, eess.IV

Submitted: 2026-03-02

Updated: 2026-10-17

Comments: Accepted at CVPR 2026 Workshop Authenticity & Provenance in the Age of AI (APAI)

Code: https://github.com/ANCP2021/integrit

Project page: https://facebookresearch.github.io/meta-seal

License: http://creativecommons.org/licenses/by/4.0/

The gist: The gist: This work formalizes and empirically demonstrates that a digital asset can carry both a cryptographically valid C2PA manifest asserting human authorship and an invisible watermark

Key concepts

Integrity Clash: This occurs when a digital file simultaneously possesses a cryptographically valid document asserting human creation and an invisible watermark revealing it was made by AI. The clash arises because these two verification systems check each other independently, allowing contradictory claims to coexist in the same file without either system flagging the other.
Conflict Matrix: A system used to categorize digital assets based on two binary factors: whether a valid C2PA manifest exists and whether an AI watermark is detected. This matrix defines four states, including 'Q4b' (Authenticated Fake), which is the central conflict where the manifest omits AI disclosure while the watermark detects synthetic origin.
Cross-Layer Audit Protocol: A proposed method that jointly evaluates C2PA metadata and watermark signals to detect contradictions that single-layer verification misses. This protocol classifies assets based on both signals, achieving perfect accuracy in identifying the 'Authenticated Fake' state (Q4b) by looking for inconsistencies between the two independent checks.

Terminology

Provenance — 3× in this paper · explained in 5 episodes
Verification — 3× in this paper · explained in 2 episodes
Accuracy — 1× in this paper · explained in 1 episode

Summary

The gist: This work formalizes and empirically demonstrates that a digital asset can carry both a cryptographically valid C2PA manifest asserting human authorship and an invisible watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation.

Integrity Clash Formalization

The paper introduces the Integrity Clash, which is defined as a condition where "a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation (Page 1). This clash arises because the two verification layers are technically independent; neither conditions on the output of the other (Page 1). The authors construct metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification" (Page 1). This demonstrates that an AI-generated image can emerge with a valid provenance manifest while still containing a watermark identifying it as synthetically generated (Page 1).

Conflict Matrix and States

To systematize these relationships, the authors define a conflict matrix over two binary dimensions: whether a valid C2PA manifest is present, and whether an AI-origin watermark is detected (Page 3). This yields four quadrants: Q1 Silent Zone (neither signal present), Q2 Fragile Provenance (M absent or invalid; W detects an AI watermark), Q3 Authenticated Content (M valid; W does not detect a watermark), and Q4 Dual Signal, which contains the central conflict. The Authenticated Fake state is specifically identified as Q4b, where the manifest omits AI disclosure while the watermark detects synthetic origin (Page 3).

Methodology for Instantiation

The research instantiates these states using a controlled experimental design involving 500 synthetic images generated by Stable-Diffusion-XL-Base-1.0 (Page 4). Watermarking is performed using Pixel Seal, a post-hoc learned encoder-decoder framework that embeds a fixed 256-bit payload into each image as a post-processing step without modifying the underlying generative model (Page 4). Watermark detection uses a threshold of 0.75 for bit accuracy to determine if the signal is present (Page 4). C2PA signing involves attaching manifests using self-signed ECDSA P-256 certificates, where the vulnerability under investigation is semantic omission, not certificate forgery (Page 4).

Cross-Layer Audit Protocol

The authors propose a cross-layer audit protocol to detect the Q4b state, which is invisible to single-layer verification workflows (Page 4). This protocol jointly evaluates C2PA metadata and watermark signals, detecting contradictions that single-layer verification cannot identify by design (Page 4). The classification logic is defined as follows:

If neither a valid manifest nor a detectable watermark is present, the image is classified as Q1 (Silent Zone) (Page 4).
If no valid manifest is present but a watermark is detected, the image is classified as Q2 (Fragile Provenance) (Page 4).
If both a valid manifest and a detected watermark are present, the classification depends on the manifest content: Q4a (Verified Synthetic) if it discloses AI generation, and Q4b (Authenticated Fake) if it does not (Page 4).

Empirical Validation

The evaluation confirms that the Integrity Clash is reproducible under realistic conditions. The Misleading Manifest pipeline, where a valid C2PA manifest asserts only a human editing action while simultaneously carrying a watermark identifying them as synthetically generated, is the primary example of this state (Page 5). The cross-layer audit protocol achieved perfect classification reported here, with Q4b being the positive class having TPR=1.000 and FPR=0.000 across all tested conditions (Page 7). This demonstrates that the gap between these verification layers is unnecessary and technically straightforward to close (Page 1).

Implications for Infrastructure

The results imply that no deployed workflow, to our knowledge, jointly evaluates both outputs for consistency (Page 8). The authors conclude that any serious content authenticity ecosystem must move from trusting either layer in isolation to auditing the gap between them (Page 8). The protocol requires no infrastructure beyond what already exists in isolation, a C2PA manifest verifier and a watermark detector (Page 7).

Limitations and Future Directions

Limitations include using only one watermarking method, Pixel Seal [46], which may not be representative of all deployed schemes (Page 8). Furthermore, the self-signed certificate caused the Content Credentials Verify tool to flag the issuer as unrecognized (Page 8). Future work should extend this cross-layer audit to video and audio modalities and explore extending C2PA specifications to require signing applications inspect data for pre-existing watermark signals before issuing a manifest (Page 8).

Conclusion

This work formalizes and empirically demonstrates the Integrity Clash: a condition in which a cryptographically valid C2PA manifest and a detected AI-origin watermark coexist on the same asset with contradictory provenance claims, passing all deployed verification checks in isolation (Page 7). A minimal cross-layer audit protocol that jointly evaluates both signals detects these contradictions with perfect accuracy across all tested conditions (Page 7). This confirms that the gap between the two verification layers is unnecessary and technically straightforward to close (Page 1). The findings suggest that any serious content authenticity ecosystem must move from trusting either layer in isolation to auditing the gap between them (Page 8).

reference:2603.

Improvements for AI systems

textbfCross-Layer Audit Protocol Integration in CI/CD Pipelines: A Semantic Consistency Gate. This protocol can be integrated into automated content pipelines to jointly evaluate C2PA metadata and watermark detection status, achieving 100% classification accuracy across conflict matrix states, thereby detecting the Authenticated Fake state (Q4b) that single-layer verification misses.
textbfProvenance Manifest Augmentation: Mandatory AI Disclosure Fields. The system can be improved by requiring signing applications to inspect data for pre-existing watermark signals and propagate prior origin information into the new manifest, effectively closing the semantic gap at the point of signing.
textbfAdaptive Forensic Signal Integration: Multi-Signal Consistency Checks. Future agent-based forensic pipelines can be designed to incorporate independent evidence from passive methods like frequency-domain analysis or learned AI generation classifiers, treating them as supplementary inputs to strengthen detection when a primary layer is absent or degraded.

Abstract

Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the Integrity Clash, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation. We construct metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification. To close this gap, we propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images spanning four conflict-matrix states and three realistic perturbation conditions. Our results demonstrate that the gap between these verification layers is unnecessary and technically straightforward to close.