# Nothing checks your provenance manifest against your AI watermark.

A team is building a content-authenticity pipeline, and it has two standards-grade tools to build it from. The first is C2PA Content Credentials: a cryptographically signed manifest that travels with an image or video and records its provenance — who created it, with what software, through what edits. The second is AI watermarking: an imperceptible signal embedded into the pixels of anything a generative model produces, which a detector can later read to report "this was AI-generated." The team deploys both. Every asset its systems handle gets a signed C2PA manifest; every asset its generative models produce gets a watermark; and a validator at the consuming end checks both. Two independent guarantees of authenticity. Defense in depth.

The two layers do their jobs. The C2PA validator confirms the manifest is a valid, signed, untampered manifest. The watermark detector confirms a watermark is present and reads what it encodes. What no part of the pipeline does is compare the two. The manifest makes a claim about how the asset was made. The watermark makes a claim about how the asset was made. Nothing checks those two claims against each other.

So an asset can carry a cryptographically valid C2PA manifest that says a human made it and an AI watermark that says a machine made it — and every validator in the pipeline passes it, because each validator only ever checks its own layer.

"Two layers of authenticity" and "two layers that agree" are different claims, and the gap between them is the subject of this post.

This post is about what a C2PA manifest and an AI watermark each actually assert, why no deployed validator compares the two, how cleanly the resulting contradiction can be built out of entirely legitimate tools, and what a content-authenticity pipeline has to add to close the gap.

## Two true statements, one of them false

Start with what each layer asserts, because the loose word in "the asset is authentic" is doing all the damage.

A C2PA manifest is a set of assertions plus a cryptographic signature. Be exact about what the signature proves: it proves the manifest has not been altered since it was signed, and it identifies the signer. It does not prove the assertions are true. A signed manifest asserting "edited by a human in a named application" is a proof that someone holding a valid certificate _said_ that — not a proof that it happened. And a manifest can be silent: it can simply omit an assertion. A manifest that records a human editing action and includes no assertion about AI origin is a perfectly valid manifest that reads as human-authored — because the absence of an AI-origin claim is exactly what genuinely human-authored content also looks like.

A watermark is the other layer. A detector reads an embedded signal and reports "AI-generated, from this model family." That, too, is internally valid in its own terms.

Each layer is sound about itself, and nothing in either layer is computed from the other. A pipeline that runs both validators and sees both pass has confirmed two things: the manifest is intact and signed, and a watermark is present and readable. It has not confirmed a third thing — that the asset's provenance story is internally consistent — because that check is not part of either layer, and not part of the validator that runs them. The two statements can both be valid and still contradict, and "both validators passed" is blind to the contradiction by construction.

## The contradiction, built

The reason this is a post and not a thought experiment is that the contradiction has been built, at scale, and measured.

[_Authenticated Contradictions from Desynchronized Provenance and Watermarking_](https://arxiv.org/abs/2603.02378) (arXiv 2603.02378) constructs it directly. The authors generate 500 images with a standard diffusion model and give each one both layers: a cryptographically valid C2PA manifest that asserts only a human editing action, and a watermark identifying the image as synthetically generated. All 500 carry that contradiction — a valid "a human did this" manifest on an image a watermark correctly flags as machine-made.

The part that should worry a team building such a pipeline is how little the attack requires. The paper reports that producing the contradiction "reduces to the omission of a single assertion field" — leaving out the field that would have declared the digital source type as AI-generated. No cryptography is broken. No certificate authority is compromised. The manifest is signed with a legitimate certificate by an entity entitled to sign it. The contradiction is not an exploit of C2PA; it is a consequence of C2PA's semantic gap — the manifest is allowed to be silent about AI origin, and a validator reads silence as human authorship. Across a 3,500-image evaluation spanning several conflict states, the contradiction goes undetected by validators that check each layer in isolation, which is every deployed validator.

## Each layer is weak on its own

A team might hope the layers are at least individually strong, so that one carries the other. They are not, and the honest version of this post says so.

[_Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short_](https://arxiv.org/abs/2604.24890) (arXiv 2604.24890) is a security analysis of the provenance layer alone, and it finds the layer failing its own goals. A camera-manufacturer certificate that had been revoked was still reported as producing valid signatures by a major inspection tool months later. The same image was labeled valid by one validator and invalid by another. Timestamps can be altered without detection, because nothing in the signed data references the timestamp. Some C2PA-signed media became unverifiable within months even though the file never changed. The paper notes the most recent specification version did not address its concerns.

[_WMCopier_](https://arxiv.org/abs/2503.22330) (arXiv 2503.22330) does the same for the watermark layer: invisible watermarks can be forged onto arbitrary images — the paper forges watermarks at a high success rate onto images the watermark's owner never produced, deceiving both open-source schemes and a commercial watermark system, with image quality preserved. A watermark being "present" is therefore not proof of AI origin either; it can be forged onto a real photograph. [_SoK: Watermarking for AI-Generated Content_](https://arxiv.org/abs/2411.18479) (arXiv 2411.18479) is the systematization of those threat models — removal and forgery — and the reference for treating watermarking as a layer with its own attack surface, not a guarantee.

So the situation is worse than "the layers do not cross-check." Neither layer is self-sufficient. A pipeline that leans on C2PA alone leans on a layer that carries revoked certificates as valid; a pipeline that leans on watermarking alone leans on a layer that can be forged onto anything. The cross-check is needed precisely because each layer, alone, has a break.

## Soft binding is real, and it is not a cross-check

A careful reader will object here, correctly, that C2PA and watermarking are not entirely strangers — and the objection has to be answered, because it is where an overstated version of this post would lose its credibility.

C2PA does connect to watermarking, through a mechanism called soft binding. C2PA's Soft Binding API uses an invisible watermark or a content fingerprint as a way to _re-find_ a manifest when the manifest's metadata has been stripped from a file — the basis of what C2PA calls a Durable Content Credential. And the connection is not theoretical: [_SynthID-Image_](https://arxiv.org/abs/2510.09263) (arXiv 2510.09263), Google's image-watermarking system, reports having watermarked over ten billion images and states that the authors "expect watermarking to be deployed alongside a metadata-based standard like C2PA." The two layers are not architecturally ignorant of each other, and any honest treatment has to say so.

But look exactly at what soft binding does. It uses the watermark as a lookup key: given an asset whose manifest metadata is gone, the watermark or fingerprint lets a system retrieve the manifest. It is an identity-recovery mechanism. It answers "which manifest belongs to this asset." It does not answer "does this manifest's authorship claim contradict the watermark's origin verdict" — and it is not designed to. Run soft binding on the contradiction images from the keystone paper, and it works perfectly: it recovers the human-authorship manifest for an image whose watermark says AI-generated, and reports success. The recovery succeeds; the contradiction stands.

That is the precise thesis, corrected from the overstated one. It is not that provenance and watermarking never interact — they do, for manifest recovery. It is that no deployed validator cross-checks the two layers' _claims_. The gap is a claim-consistency gap, and soft binding sits next to it without filling it.

## What the numbers do not say

Three honest qualifications, because the version of this argument that overstates loses the reader who knows the field.

First, "never cross-check" — the blunt version — is too strong, and the section above is the correction: soft binding is a real, deployed interaction between the layers. The accurate claim is narrower and still serious: the interaction is identity recovery, and claim-consistency checking is absent from deployed validators.

Second, the gap is fixable, and the keystone paper says so. The same authors who build the contradiction propose a cross-layer audit and report it detecting the authenticated contradictions at 100% accuracy across their 3,500-image set. This is not an unfixable flaw in the standards; it is a missing check with a demonstrated fix. A team should read this post as "add the check," not "the standards are hopeless."

Third, the contradiction is built entirely from legitimate tools — a valid certificate, a standard watermarking system, a manifest that omits an optional field. Nothing here is a cryptographic break of C2PA, and the post should not be read as one. The vulnerability is semantic: two layers, each sound, never asked to agree.

## Building content authenticity that cross-checks

The fix is not a new standard. It is a check the pipeline does not currently run.

**Stop reading "both validators passed" as "the asset is consistent."** Two passing validators confirm that the manifest is intact and a watermark is present. They do not confirm the two layers tell the same story. Write down, explicitly, what your pipeline's "valid" actually asserts — and that it does not yet assert consistency.

**Add an explicit cross-layer audit.** Extract the manifest's origin claim — including the meaning of its silence, an omitted AI-origin assertion — and extract the watermark's origin verdict, and compare them. Flag any asset where a manifest implying human authorship carries an AI watermark, or the reverse. This is the check the keystone paper implements and validates; it is a component to build, not a standard to wait for.

**Use soft binding for what it is, and add claim-consistency separately.** Soft binding recovers a manifest from a watermark; keep using it for that. It is not a consistency check, so do not let its presence in the pipeline stand in for one. Recovery and agreement are two functions, and you need both.

**Treat each layer as non-self-sufficient.** A C2PA manifest can carry a revoked certificate as valid and a watermark can be forged onto a real photograph, so neither layer alone is authentication — a point this blog has made about [text watermarks as provenance](/blog/watermarks-dont-survive-paraphrase/). Design the pipeline so a decision rests on the layers agreeing, not on either one passing.

**Know — and document — what a passing validator asserts.** The credibility of a content-authenticity claim depends on the claim being precise. "This asset is authentic" is not what your validators check. "This manifest is signed and intact, a watermark is present, and the two agree on origin" is — once you have added the third clause. Until then, say the smaller true thing, the same discipline a [model-weights provenance](/blog/weights-provenance/) claim demands.

## The checklist

Before you call a content-authenticity pipeline trustworthy:

- [ ] What a "valid" result asserts is written down precisely — and it is acknowledged that two passing validators do not assert cross-layer consistency.
- [ ] A cross-layer audit compares the manifest's origin claim, including the meaning of an omitted AI-origin assertion, against the watermark's origin verdict.
- [ ] Assets whose manifest and watermark contradict each other on origin are flagged, not passed.
- [ ] Soft binding is used for manifest recovery and is not mistaken for a claim-consistency check.
- [ ] Each layer is treated as non-self-sufficient — certificate revocation and validator disagreement for C2PA, forgery and removal for watermarking are in the threat model.
- [ ] Decisions rest on the layers agreeing, not on either layer alone passing.
- [ ] Public authenticity claims state the precise property the pipeline verifies, not the broad word "authentic."

## Reading list

- [_Authenticated Contradictions from Desynchronized Provenance and Watermarking_](https://arxiv.org/abs/2603.02378) (arXiv 2603.02378) — 500 images each carry a cryptographically valid C2PA manifest asserting human editing and a watermark identifying them as synthetic; the attack reduces to omitting one assertion field, and a proposed cross-layer audit detects the contradiction at 100% accuracy across 3,500 images.
- [_Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short_](https://arxiv.org/abs/2604.24890) (arXiv 2604.24890) — a security analysis finding the provenance layer failing its own goals: a revoked certificate still reported valid, validators disagreeing on the same image, forgeable timestamps, and signed media becoming unverifiable within months.
- [_WMCopier: Forging Invisible Image Watermarks on Arbitrary Images_](https://arxiv.org/abs/2503.22330) (arXiv 2503.22330) — invisible watermarks can be forged onto arbitrary images, deceiving open-source schemes and a commercial watermark system with image quality preserved, so a watermark being present is not proof of AI origin.
- [_SoK: Watermarking for AI-Generated Content_](https://arxiv.org/abs/2411.18479) (arXiv 2411.18479) — the systematization of watermarking threat models, removal and forgery, and the reference for treating the watermark layer as an attack surface rather than a guarantee.
- [_SynthID-Image: Image watermarking at internet scale_](https://arxiv.org/abs/2510.09263) (arXiv 2510.09263) — a watermarking system deployed on over ten billion images whose authors expect it to be deployed alongside a metadata standard like C2PA — evidence the layers are meant to coexist, which is exactly why their claims must be reconciled.

The team built defense in depth and got two depths that never face each other. The C2PA validator looks down at the manifest and reports it sound; the watermark detector looks down at the pixels and reports a watermark present; and an asset whose manifest says "human" and whose watermark says "machine" walks through both, because neither validator was ever asked the one question that catches it — do these two layers agree. Soft binding will even helpfully reunite that asset with its contradicting manifest and call it a success. The layers are not broken. They were just never introduced. Introduce them: extract both origin claims, compare them, and flag the asset where they disagree. The check is small, it is published, and until a pipeline runs it, "both validators passed" is not the sentence anyone thinks it is.