Projects / 09
Document Provenance Research
Defensive research into document provenance and forensic verification, covering metadata, C2PA content credentials and detection of AI-generated documents.
Overview
We investigate how the origin and integrity of a document can be verified by a recipient. The recipient's position is the one that interests us: given a file and no trustworthy account of where it came from, what can be established about it, and with what confidence?
The work spans three areas that are usually treated separately — document metadata and its internal consistency, cryptographically signed provenance in the form of C2PA content credentials, and statistical characteristics that distinguish documents produced by different processes. Each is partial on its own.
The intended users are verifiers: investigators, reviewers and defenders who receive documents and must decide how much weight to place on them.
The problem
Document provenance is weak by default. Most formats carry metadata that is unsigned and freely editable, so a metadata field is an assertion by whoever last wrote the file rather than evidence about its origin.
Generative models have made plausible documents inexpensive to produce at volume. That does not create a new category of forgery, but it changes the economics of one, and the review processes that receive these documents were designed around an older cost assumption.
Signed provenance improves the situation where it exists, but coverage is the limiting factor: an absent content credential means very little, since most legitimate documents do not carry one either. Verification therefore has to work with partial signals and be honest about their weight.
Architecture
The research separates inspection into independent layers so that each produces a finding with its own confidence, and no single layer is treated as a verdict.
- Metadata inspection
- Reading document metadata and structural properties, and checking them for internal consistency — verification of what a file asserts about itself.
- Content credentials
- Validating C2PA credentials where they are present: checking signatures, verifying the signing chain and reading the declared assertion history.
- Statistical characteristics
- Studying measurable properties of document populations that differ by production process, as one weak signal among several rather than as a determination.
- Forensic inspection
- Structured examination of a document's internal structure to detect inconsistencies between its parts, recorded so the reasoning can be reviewed.
Findings are reported as evidence with stated confidence and stated limits, never as a binary authenticity judgement. A tool that outputs a verdict invites reliance the underlying signals cannot support.
Security model
The document under inspection is untrusted input in every sense. It is treated as potentially malformed, potentially malicious as a file, and potentially crafted to mislead an analyser, so inspection runs in isolation and never renders or executes content.
- Trusted
- The verification logic and the trust anchors used to validate signing chains for content credentials.
- Untrusted
- The document, all of its metadata, and every assertion it contains that is not covered by a valid signature.
- Explicitly not claimed
- That absence of a signal indicates absence of a problem. An unsigned document, or one with no distinguishing statistical characteristics, is simply a document about which less can be said.
The threat model is a document presented as evidence to a reviewer. The research position is that verification should raise the cost and the detectability of misrepresentation, and should never be presented as proof of authenticity.
Current status
This is active research. Metadata inspection and content credential validation are the better-understood parts; the statistical work is early and its results are not stable enough to publish as findings.
No detection accuracy figures are published, because a figure produced on documents we assembled ourselves would say more about our test set than about the method.
Limitations
One limitation is coverage of signed provenance. C2PA verification only helps where credentials are present, and in most real document flows they are not, so the strongest technique applies to the smallest share of cases.
A second is that statistical characteristics are unstable over time. Properties that distinguish document populations today may not hold as generation tools change, so any method resting on them has a short shelf life and must be revalidated.
A third is base rates. In a population where the great majority of documents are legitimate, even a low false positive rate produces mostly false accusations, which is a serious harm when the subject is a person's document.
Roadmap
- Define a finding format that reports confidence and limits explicitly rather than a verdict.
- Extend C2PA validation coverage and document precisely what a valid credential does and does not establish.
- Study base rate effects and how findings should be presented to reviewers to avoid over-reliance.
- Establish a revalidation cadence for any statistical signal, given that such signals decay.
- Publish the defensive scope and its boundaries alongside any technical output.
Detail
Topics
- provenance
- C2PA
- content credentials
- digital forensics
- document verification
- AI-generated content