Search papers, labs, and topics across Lattice.
The paper identifies and formalizes the "Integrity Clash," a vulnerability where C2PA provenance metadata asserts human authorship while a watermark identifies the same digital asset as AI-generated, with both signals passing independent verification. They demonstrate this vulnerability by constructing metadata washing workflows that exploit semantic omissions in the C2PA specification, creating authenticated contradictions. To address this, they propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy in detecting these conflicts.
You can create cryptographically "authentic" AI-generated fakes that fool current content authentication systems by exploiting a loophole in the C2PA standard.
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the $\textit{Integrity Clash}$, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation. We construct metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification. To close this gap, we propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images spanning four conflict-matrix states and three realistic perturbation conditions. Our results demonstrate that the gap between these verification layers is unnecessary and technically straightforward to close.
