Watermarks and Fingerprints as Soft Bindings for Content Provenance: An Open-Licence Benchmark for Images, Audio and Video

Seyedmahdi Kazempourradi; Ramtin Mojtahedi; Behrang Mohseni

cs.CVOct 2, 2026

Watermarks and Fingerprints as Soft Bindings for Content Provenance: An Open-Licence Benchmark for Images, Audio and Video

Authors: Seyedmahdi Kazempourradi, Ramtin Mojtahedi, Behrang Mohseni

Organizations: Original Pictures Technologies, Inc., Delaware, USA

Abstract

Content-provenance standards such as C2PA let a platform recover a stripped manifest through a soft binding: an invisible watermark read from the content, or a fingerprint looked up in a registry. We benchmarked both families under one protocol, restricted to openly available models whose licences we audited, on public media, with false-match rates calibrated on held-out negatives and source-level bootstrap intervals for performance estimates. For watermarking we evaluated 25 image, 7 audio and 7 video configurations from 12 methods on perceptual quality, robustness, false positives and cost; for fingerprinting, 35 methods on registries of up to 98,985 images, partial edits and adversarial attacks. PixelSeal gave the best balance for image and video watermarks and AudioSeal for audio, but the error-correcting detector of every TrustMark variant fired on 5.9 to 15.3% of unmarked images, so a verifier should test the expected payload. Among fingerprints, copy detectors trained on non-commercial data detected up to 75.5% of transformed images at a pair-level false-match rate of $10^{-7}$ and DINOv2, the best permissively licensed method, 65.0%; near-copies in a product catalogue dominated the false matches, and no detection improvement from geometric verification was observed under a matched calibration false-binding constraint in the evaluated image pipelines. On the same attacked copies the two families failed differently: the union of watermark and fingerprint successes covered 69% of image copies; fingerprints covered more audio queries, whereas expected-key watermark verification covered more video queries. Embedding a watermark moved the ISCC code of 62.0% of images past its match threshold, and platform-dependent colour conversion changed watermark bits between x86 and ARM hosts.

Figures & tables

Panel of Figure 1 — Figure 1: Benchmark protocol. Each of the 25 image, 7 audio and 7 video configurations embeds a seeded payload into every item. Quality is measured on the marked item; robustness on the decoder output after each transformation; false positives on unmarked items under the untouched condition and three benign transformations; latency and cost on a fixed GPU and CPU host. A configuration qualifies for ranking only if its licence, gate robustness and false-positive evidence all pass.

Modality	Method	Bits	Code	Weights
Image	TrustMark B, C, P, Q [ 4 ]	100	MIT	MIT
Image	PixelSeal [ 6 ]	256	MIT	MIT
Image, video	Video Seal 1.0 [ 35 ]	256	MIT	MIT
Image, video	ChunkySeal [ 31 ]	1024	MIT	MIT
Image	WAM [ 30 ]	32	MIT	MIT a
Image	DWT-DCT, DWT-DCT-SVD [ 24 ]	64	MIT	n/a

Table 1: Methods, payload sizes and licences.

Panel of Figure 2 — Figure 2: Benchmark protocol. 35 fingerprinting methods are applied to registered assets and distractors (registry) and to queries derived from registered assets (positives) or from never-registered media (negatives) under 79 transformations and six kinds of partial edit. Thresholds are fixed on half of the negatives and evaluated on the other half. The same queries also drive the localization, security and watermark-complementarity measurements.

Modality	Method	Class	Code licence	Weights / data	Bits	Time (ms)
Image	PDQ	Perceptual hash	BSD (ThreatExchange); pdqhash binding	n/a	256	31 CPU
	PDQ (dihedral)	Perceptual hash	BSD (ThreatExchange); pdqhash binding	n/a	256	31 CPU
	aHash	Perceptual hash	BSD-2-Clause (imagehash)	n/a	64.0	4.3 CPU
	dHash	Perceptual hash	BSD-2-Clause (imagehash)	n/a	64.0	4.4 CPU
	pHash	Perceptual hash	BSD-2-Clause (imagehash)	n/a	64.0	5.2 CPU
	pHash-256	Perceptual hash	BSD-2-Clause (imagehash)	n/a	256	5.6 CPU

Table 2: Methods, licences, stored size and extraction time. Bits: stored bits per registered asset (float descriptors count 32 bits per dimension; time-based systems report the mean over the registered items). Time: per image (1024 px), per second of audio or per 5 s clip.

Configuration	Q	PSNR	SSIM	LPIPS	FLIP	CVVDP	JPEG 75 bit acc.		Blind	GPU	Cost	Comb.
		(dB) $\uparrow$	$\uparrow$	$\downarrow$	$\downarrow$	$\uparrow$	pooled	worst set	FPR $\downarrow$	(ms/MP)	($/k MP)	$\uparrow$
PixelSeal (0.15) $\star$	✓	48.3	0.9969	0.0012	0.024	9.93	0.988	0.980	n/a	9.13	0.0026	0.95
PixelSeal (0.2)	✓	45.9	0.9952	0.0020	0.030	9.88	0.998	0.996	n/a	9.13	0.0026	0.90
Video Seal (0.2) $\mathsf{C}$ $\mathsf{S}$	✓	44.8	0.9953	0.0021	0.034	9.82	0.997	0.996	n/a	8.79	0.0025	0.90
PixelSeal (0.4)	✓	40.1	0.9863	0.0077	0.051	9.57	0.999	0.999	n/a	9.13	0.0026	0.79
Video Seal (0.4)	✓	38.9	0.9856	0.0082	0.058	9.39	1.000	0.999	n/a	8.79	0.0025	0.79

Table 3: Image watermarking on 85 images (24 Kodak, 25 DIV2K, 28 CLIC, 8 16-bit HDR). Means over images (FLIP: 60 images without DIV2K; CVVDP: 32 Kodak and HDR images); bit accuracy after JPEG at quality 75, pooled and on the worst content subset.

Figure 3: Image watermarking trade-offs. (a) Perceptual error (FLIP, lower is better) against bit accuracy after JPEG 75 on the worst content subset; lines join strength settings of one network, darker shades are stronger settings, and open markers are reference-only methods. The dashed line is the 0.95 gate. (b) GPU embedding time against FLIP. (c) Combined score of the qualifying configurations with equal weights (filled) and quality-weighted (open). The ringed configuration has the highest combined score. Values are in Table 3 .

Modality	Configuration	Bits	ECC	Bit acc.	$\geq k$ (gate)	Exact (gate)	Exact (mean)
Image	PixelSeal (0.15)	256	none	0.988	1.000	0.318	0.254
Image	PixelSeal (0.2)	256	none	0.998	1.000	0.765	0.590
Image	Video Seal (0.2)	256	none	0.997	1.000	0.659	0.506
Image	PixelSeal (0.4)	256	none	0.999	1.000	0.871	0.771
Image	Video Seal (0.4)	256	none	1.000	1.000	0.906	0.745
Image	WAM (1)	32	none	0.994	0.976	0.918	0.828

Table 4: Exact payload recovery. Bit acc.: share of payload bits recovered at the gate transformation (JPEG 75, MP3 128 kb/s, H.264 CRF 23). Exact: share of items whose decoded payload equals the embedded one, at the gate and averaged over all transformations. For TrustMark exact recovery is after BCH decoding; no other method has an error-correcting layer, so exact recovery requires every bit.

\geq k

: share of items whose decoded bits match the embedded payload in at least

k

n

positions, the expected-payload decision of Table 8 (– where no such

k

exists).

Figure 4: Image robustness: mean bit accuracy of every configuration (rows) after every transformation (columns), from 0.5 (chance, white) to 1 (dark blue). † Reference-only methods. The full values are in the aggregated results (Data and Code Availability).

Figure 5: Visual comparison on a 256 $\times$ 256 crop of Kodak image 5. Top: watermarked crop. Middle: residual (marked minus original) amplified 20 times around mid-grey. Bottom: FLIP error map (0 to 0.3). Strengths are those of Table 3 .

Configuration	Q	SNR	SI-SNR	PESQ		STOI	$\|\Delta$ LUFS $\|$	MP3 128k bit acc.		Blind	GPU	Cost	Comb.
		(dB) $\uparrow$	(dB) $\uparrow$	speech $\uparrow$	music	$\uparrow$	$\downarrow$	pooled	worst set	FPR $\downarrow$	(ms/s)	($/kh)	$\uparrow$
AudioSeal base (1) $\mathsf{C}$ $\mathsf{S}$ $\star$	✓	27.3	27.0	4.44	4.23	0.9967	0.013	0.997	0.979	0.000	4.90	4.9	0.98
AudioSeal streaming (0.5)	✓	32.9	32.7	4.55	4.56	0.9999	0.004	0.996	0.988	0.000	5.83	5.9	0.91
AudioSeal streaming (1)	✓	26.9	26.6	4.39	4.45	0.9998	0.018	0.997	0.989	0.000	5.83	5.9	0.90
AudioSeal streaming (1.1)	✓	26.0	25.8	4.36	4.43	0.9997	0.025	0.996	0.988	0.000	5.83	5.9	0.90
WavMark	✓	36.3	35.9	4.15	4.36	0.9932	0.008	1.000	1.000	0.000	33.5	34	0.37

Table 5: Audio watermarking on 138 inputs: 46 source clips (40 LibriSpeech utterances, 6 music excerpts), each rendered at 16, 44.1 and 48 kHz. Means over inputs. PESQ is a speech model: the primary PESQ is the mean over the 120 speech inputs, and music PESQ (18 inputs) is shown for reference only. Bit accuracy after MP3 at 128 kb/s.

Figure 6: Audio watermarking. (a) Wideband PESQ on the speech inputs against bit accuracy after MP3 at 128 kb/s on the worst subset (source and sample rate). (b) GPU embedding time against SI-SNR. (c) Combined score of qualifying configurations. (d) Mean bit accuracy after each transformation; Perth is omitted because it carries no payload. † Reference only. Values are in Table 5 .

	MP3 128k bit acc.			AAC 64k bit acc.			All codecs bit acc.		All codecs exact
Configuration	Pub.	Al.	Un.	Pub.	Al.	Un.	Al.	Un.	Al.	Un.
AudioSeal base (1)	0.997	0.997	0.999	0.998	0.998	0.999	0.997	0.999	0.978	0.986
AudioSeal streaming (0.5)	0.996	0.996	1.000	0.996	0.995	0.998	0.996	0.999	0.983	0.990
AudioSeal streaming (1.1)	0.996	0.997	1.000	0.997	0.996	1.000	0.997	1.000	0.993	1.000
AudioSeal streaming (1)	0.997	0.997	1.000	0.995	0.995	1.000	0.997	1.000	0.993	1.000
WavMark	1.000	1.000	1.000	1.000	1.000	1.000	1.000	1.000	1.000	1.000

Table 6: Audio decoding after codec round trips with and without alignment to the original. Pub.: the published bit accuracy (Table 5 , aligned, benchmark host). Al./Un.: re-run on one host, decoded after cross-correlation alignment to the original (the benchmark protocol) or from the codec output cut to the original length with no offset search. All: the six MP3 and AAC settings pooled; exact: all payload bits correct.

Figure 7: Where the audio watermarks put their energy. Top row: spectrograms of the first 6 s of one speech clip (LibriSpeech, band-limited to 8 kHz by its source) and one music clip, both at 44.1 kHz. Other rows: spectrogram of the residual (marked minus original) for each model at the strength of Table 5 , on the same decibel scale relative to the original’s peak. SilentCipher is omitted because its reference environment was not available when these clips were re-embedded.

Configuration	Q	PSNR	SSIM	LPIPS	FLIP	VMAF	H.264 CRF 23 bit acc.		GPU	fps	Cost	Comb.
		(dB) $\uparrow$	$\uparrow$	$\downarrow$	$\downarrow$	$\uparrow$	pooled	worst clip	(ms/MP)	1080p	($/k MP)	$\uparrow$
PixelSeal (0.4) $\mathsf{C}$ $\mathsf{S}$ $\star$	✓	40.1	0.9674	0.0130	0.054	86.0	0.999	0.992	15.4	31.3	0.0043	1.00
Video Seal (0.4)	✓	40.3	0.9886	0.0131	0.055	82.1	1.000	1.000	16.3	29.7	0.0045	0.96
Video Seal (0.7)	✓	35.5	0.9710	0.0361	0.083	66.6	0.997	0.992	16.3	29.7	0.0045	0.91
ChunkySeal (0.2)	–	44.5	0.9734	0.0151	0.048	96.4	0.891	0.652	23.7	20.4	0.0066	–
PixelSeal (0.2)	–	46.0	0.9869	0.0035	0.031	95.5	0.984	0.949	15.4	31.3	0.0043	–

Table 7: Video watermarking on six 2.5-s 1080p clips. Bit accuracy after H.264 at CRF 23, pooled and on the worst clip.

Figure 8: Video watermarking. (a) VMAF against bit accuracy after H.264 at CRF 23 on the worst clip. (b) Bit accuracy after H.264 at CRF 23 for each clip (points) and the mean over clips (bars); defaults fail on one clip each. (c) Combined score of qualifying configurations. (d) Mean bit accuracy after each transformation. Values are in Table 7 .

Figure 9: Video residuals on one 1080p frame of aspen after video-mode embedding (frame 12 of 24). Top: 320 $\times$ 320 crop of the watermarked frame. Middle: residual amplified 20 times around mid-grey. Bottom: FLIP error map (0 to 0.3).

Network	Theoretical		Own payload			Random payloads		Blind detector			Evidence
	$k/n$	$P_{\mathrm{FM}}$	trials	sources	95% upper	trials	max	trials	sources	95% upper
Image
ChunkySeal	589/1024	$8.3\times 10^{-7}$	0/340	0/85	0.042	0/17000	566	none			analytic
InvisMark †	74/100	$8.3\times 10^{-7}$	0/340	0/85	0.042	0/17000	70	none			analytic
PixelSeal	167/256	$6.2\times 10^{-7}$	0/340	0/85	0.042	0/17000	158	none			analytic
RivaGAN †	30/32	$1.2\times 10^{-7}$	0/240	0/60	0.060	0/12000	26	none			analytic

Table 8: False positives on unmarked content. Theoretical: the per-key false-match probability

P_{\mathrm{FM}}

of an expected-payload test that requires

k

n

bits to match, if unmarked content decodes to independent fair bits. Own payload: false matches against the payload recorded for the item, the check a verifier makes. Random payloads: the same decodes compared with unrelated payloads, which tests agreement with payloads the content was never marked with, conditional on these decodes. Blind detector: false detections of the model’s own detector.

Figure 10: False positives on unmarked content. (a) Blind false-positive rate per network with the unmarked source as the unit (a source counts if the detector fired on any of its transforms or renderings) and exact two-sided 95% intervals; networks with no false detection are shown by their upper bound. The dashed line is the

10^{-3}

target. (b) TrustMark’s blind false-positive rate per image subset, per image. (c) Number of bits in unmarked PixelSeal decodes that match an expected 256-bit payload, against the binomial distribution for independent fair bits and the decision threshold

k

Modality	Network	Configs	Any Q	GPU (ms/unit)	CPU (ms/unit)	GPU $	CPU $	Cheaper
Image	InvisMark †	1	no	8.73	–	0.0024	–	GPU
Image	Video Seal $\mathsf{C}$ $\mathsf{S}$	3	yes	8.79	544	0.0025	0.026	GPU
Image	PixelSeal $\star$	5	yes	9.13	1104	0.0026	0.053	GPU
Image	WAM	2	yes	19.1	361	0.0053	0.017	GPU
Image	TrustMark-P	3	yes	45.1	273	0.013	0.013	GPU
Image	TrustMark-B	1	yes	55.7	278	0.016	0.013	CPU

Table 9: Embedding cost and speed per network. Unit: one megapixel (image, video) or one second of audio. Cost in USD per 1,000 units for image and video, and per 1,000 hours for audio, at on-demand prices (g5.xlarge

1.006/h, m6a.xlarge

0.1728/h, us-east-1, effective 2026-09-01).

Figure 11: Estimated embedding cost per network on GPU (filled circles) and CPU (open squares), at on-demand prices. (a) Images, USD per 1,000 megapixels. (b) Audio, USD per 1,000 hours. (c) Video, USD per 1,000 megapixels of 1080p frames (GPU only). Networks are sorted by their cheaper option. Values are in Table 9 .

Decoded file	Same host	x86-64 vs arm64	Bit flips	Bit strings	YUV equal	RGB equal
	max $\|\Delta\ell\|$	max $\|\Delta\ell\|$		distinct
aspen, strength 0.4, CRF 18	0.00096	0.459	0	1	yes	no
aspen, strength 0.4, CRF 22	0.00090	0.889	0	1	yes	no
aspen, strength 1.1, CRF 18	0.00068	0.346	2	2	yes	no
aspen, strength 1.1, CRF 22	0.00076	0.440	0	1	yes	no
controlled burn, strength 0.4, CRF 18	0.0016	0.306	0	1	yes	no

Table 10: Cross-device determinism of watermark decoding.

\Delta\ell

: difference in detector logits between decodes of the same file.

Figure 12: Largest difference in detector logits between decodes of the same file on one host (open circles; CPU with one and four threads, and CUDA or MPS) and across an x86-64 and an arm64 host (filled circles). Crosses mark files for which at least one raw bit changed across hosts. Labels give the clip, Video Seal strength and H.264 CRF.

Modality	A	B	Metric	$n$	median(A $-$ B)	$p_{\mathrm{Holm}}$
Image	PixelSeal (0.15)	TrustMark-P (0.8)	FLIP	60	0.0019	0.062
Image	PixelSeal (0.15)	Video Seal (0.2)	FLIP	60	-0.0099	$<$ 0.001
Image	PixelSeal (0.15)	TrustMark-Q (1.2)	FLIP	60	-0.0212	$<$ 0.001
Audio	AudioSeal base (1)	AudioSeal streaming (0.5)	PESQ (speech)	40	-0.1072	$<$ 0.001
Video	PixelSeal (0.4)	Video Seal (0.4)	VMAF	6	3.6629	0.062

Table 11: Planned paired comparisons (two-sided Wilcoxon signed-rank on per-source values, Holm-adjusted over the five tests). Audio inputs of one clip are averaged first, so

n

counts clips; audio PESQ is on speech.

Figure 13: Recall@1 of every image method under every transformation, on the ABO registry of 98,985 images. Rows are grouped by family (compression, scaling, cropping, geometry, photometric, overlay, chains). Method names are coloured by class; † marks reference-tier methods.

Method	R@1	$\mu$ AP	TPR q,1%	TPR ${}_{p,10^{-7}}$	Hard FB	DISC21 $\mu$ AP
PDQ	0.579	0.520	0.495	0.495 [0.48, 0.50]	0.000	0.295
PDQ (dihedral)	0.623	0.569	0.549	0.546 [0.54, 0.55]	0.000	0.367
aHash	0.503	0.189	0.000	0.000 [0.00, 0.00]	0.000	0.027
dHash	0.560	0.356	0.313	0.000 [0.00, 0.00]	0.000	0.195
pHash	0.563	0.469	0.373	0.373 [0.00, 0.38]	0.000	0.240
pHash-256	0.589	0.520	0.494	0.492 [0.48, 0.50]	0.001	0.302

Table 12: Image retrieval over all attacks (ABO; registry of registered originals and distractors). TPR counts a query only if its top-1 is the true asset and the score passes a threshold fixed on held-out calibration negatives: query-level FPR 1% at this registry size, or pair-level FPR

10^{-7}

(95% interval from a bootstrap over sources, which redraws the calibration negatives and so the threshold). Hard: rate at which another photograph of a registered product binds to that product at the 1% threshold.

Figure 14: (a) Recall@1 against the share of each side kept by a centred crop. (b) Mean Recall@1 over each transformation family for eight representative methods.

Figure 15: (a) Detection at pair-level FPR

10^{-7}

against stored size per asset. (b) Against extraction time per 1024-pixel image (learned methods on one A10G GPU in batches of 64, hashes on one CPU thread; measured on an idle host). (c)

\mu

AP on ABO against

\mu

AP on the DISC21 subset.

A	B	TPR A	TPR B	A $-$ B [95% CI]	sources	$p_{\mathrm{Holm}}$
SSCD R50	DINOv2-S	0.712	0.612	0.100 [0.084, 0.115]	2,000	$<10^{-3}$
DINOv2-S	DINOv2-S LSH-256	0.612	0.519	0.093 [0.066, 0.106]	2,000	$<10^{-3}$
PDQ	ISCC Image-64	0.495	0.427	0.068 [0.058, 0.175]	2,000	$<10^{-3}$
PDQ	PDQ (dihedral)	0.495	0.546	-0.051 [-0.055, -0.050]	2,000	$<10^{-3}$
ISCC Image-64	ISCC Image-256	0.427	0.458	-0.032 [-0.136, -0.020]	2,000	$<10^{-3}$
SSCD R50	ISC21 1st	0.712	0.755	-0.043 [-0.056, -0.029]	2,000	$<10^{-3}$

Table 13: Planned paired comparisons on the same image queries at pair-level FPR

10^{-7}

. The unit is the registered source with all its transformed queries:

p_{\mathrm{Holm}}

from a sign-flip test on per-source differences in detections (Holm-adjusted over the eight comparisons); the interval of the TPR difference is a bootstrap over sources that also redraws the calibration negatives.

Figure 16: (a) Score distributions: best score of a never-registered query (grey) and score of an attacked query to its true asset (colour), pooled over all transformations; dashed line: threshold at pair-level FPR

10^{-7}

. (b) Rate at which another photograph of a registered product binds to that product at the 1% threshold.

	Any (primary)		Two of three		None
Method	TPR q,1%	TPR ${}_{p,10^{-7}}$	TPR q,1%	TPR ${}_{p,10^{-7}}$	TPR q,1%	TPR ${}_{p,10^{-7}}$
PDQ	0.495	0.495	0.476	0.471	0.214	0.214
PDQ (dihedral)	0.549	0.546	0.523	0.523	0.223	0.223
pHash-256	0.494	0.492	0.476	0.472	0.000	0.000
ISCC Image-256	0.466	0.458	0.448	0.448	0.211	0.000
DINOv2-S	0.625	0.612	0.546	0.544	0.194	0.192

Table 14: Sensitivity of the image operating points to the treatment of catalogue duplicates. Any : the rule fixed in advance (a pair counts as a duplicate if PDQ, SSCD or DINOv2-B says so); two : two of the three must agree; none : no cleanup, so recoloured or re-mounted versions of a registered design count as false matches. R@1 changes by at most a few points; the calibrated TPR does not.

Method	Retrieval threshold	$k$	TPR	FB	FB rate
DINOv2-S	pair $10^{-7}$	–	0.612	180	0.0067
	query 1%	9 (matched)	0.609 [0.60, 0.61]	124	0.0046
	query 1%	12 ( $k=12$ )	0.604 [0.60, 0.61]	104	0.0039
	query 1%	278 (zero cal.)	0.206 [0.20, 0.22]	0	0.0000
	pair $10^{-4}$	266 (matched)	0.268 [0.25, 0.28]	146	0.0054
	pair $10^{-4}$	12 ( $k=12$ )	0.793 [0.79, 0.80]	4,390	0.1637

Table 15: Second-stage verification of image matches. The top-1 candidate is accepted only if its retrieval score passes a threshold and SIFT+RANSAC finds at least

k

geometric inliers between the query and the stored original. Both thresholds are fixed on the calibration negatives: matched, the smallest

k

whose calibration false bindings do not exceed those of retrieval alone at pair-level

10^{-7}

; zero cal., the smallest

k

no calibration negative reaches; and the localization track’s

k=12

. FB: false bindings among the 26,820 held-out never-registered queries. TPR interval: bootstrap over sources.

Figure 17: (a) Detection of attacked image queries against the pair-level false-positive rate at which the threshold is set. (b) Expected number of false matches per query as a function of registry size for fixed pair-level rates.

Figure 18: (a) Recall@1 of each audio method under each transformation (1,000 registered items, 6,350 in the index). (b) Detection against the pair-level false-positive rate; unresolved targets are omitted.

Method	R@1	$\mu$ AP	TPR q,1%	FPR q (test)	TPR ${}_{p,10^{-6}}$	Music 10 s exc.	Speech 10 s exc.	Pitch +2	Re-record
Chromaprint	0.805	0.817	0.704 [0.68, 0.72]	0.016 [0.00, 0.04]	0.688 [0.66, 0.71]	1.000	1.000	0.006	0.451
audfprint	0.851	0.851	0.660 [0.53, 0.74]	0.008 [0.00, 0.03]	0.599 [0.46, 0.72]	0.982	1.000	0.071	0.852
ISCC Audio-64	0.662	0.581	0.409 [0.21, 0.41]	0.017 [0.00, 0.03]	0.212 [0.00, 0.41]	0.247	0.657	0.004	0.183
ISCC Audio-256	0.749	0.658	0.454 [0.31, 0.51]	0.019 [0.00, 0.04]	0.321 [0.24, 0.47]	0.555	0.882	0.006	0.342
CLAP	0.707	0.446	0.386 [0.33, 0.45]	0.017 [0.01, 0.04]	0.328 [0.27, 0.41]	0.957	0.725	0.910	0.228
NMFP †	0.905	0.937	0.862 [0.82, 0.88]	0.018 [0.00, 0.04]	0.846 [0.79, 0.88]	1.000	1.000	0.057	1.000

Table 16: Audio retrieval over all attacks, and Recall@1 under selected attacks. TPR q,1% : detection at the threshold set for a 1% query-level false-match rate on the calibration negatives; FPR q (test): the rate that threshold actually gave on the held-out negatives. TPR

{}_{p,10^{-6}}

: the strictest pair-level target that 4053 calibration queries against 6350 references resolve; stricter targets are not reported. Intervals: 95% bootstrap over sources.

Figure 19: (a) Recall@1 of each video method under each transformation (120 registered clips, 443 in the index). (b) Detection against the pair-level false-positive rate; unresolved targets are omitted.

Method	R@1	$\mu$ AP	TPR q,1%	FPR q (test)	TPR ${}_{p,10^{-4}}$	Crop 50%	PiP	Inserted	Screen rec.
vPDQ	0.628	0.617	0.577 [0.56, 0.59]	0.032 [0.00, 0.08]	0.609 [0.57, 0.62]	0.000	0.000	0.342	0.000
TMK+PDQF	0.778	0.723	0.631 [0.61, 0.66]	0.066 [0.00, 0.16]	0.635 [0.63, 0.70]	0.017	0.000	0.583	0.992
ISCC Video-64	0.731	0.700	0.620 [0.61, 0.65]	0.062 [0.00, 0.16]	0.634 [0.62, 0.66]	0.025	0.000	0.333	0.817
ISCC Video-256	0.801	0.749	0.652 [0.63, 0.67]	0.068 [0.00, 0.17]	0.664 [0.66, 0.69]	0.108	0.008	0.575	0.958
DINOv2-S frames	0.872	0.691	0.437 [0.41, 0.58]	0.062 [0.01, 0.15]	0.523 [0.45, 0.63]	0.592	0.125	0.525	0.817
DINOv2-S mean	0.947	0.831	0.547 [0.51, 0.73]	0.032 [0.00, 0.16]	0.653 [0.56, 0.77]	0.917	0.200	0.958	0.950

Table 17: Video retrieval over all attacks, and Recall@1 under selected attacks. TPR q,1% : detection at the threshold set for a 1% query-level false-match rate on the calibration negatives; FPR q (test): the rate that threshold actually gave on the held-out negatives. TPR

{}_{p,10^{-4}}

: the strictest pair-level target that 500 calibration queries against 443 references resolve; stricter targets are not reported. Intervals: 95% bootstrap over sources.

	SIFT + RANSAC			DISK + LightGlue
Map	AUC	F1	best F1	AUC	F1	best F1
Pixel difference	0.944	0.75	0.83	0.942	0.72	0.82
SSIM	0.927	0.57	0.74	0.924	0.59	0.71
LPIPS	0.975	0.64	0.79	0.973	0.61	0.78
DINOv2 patches	0.958	0.53	0.70	0.952	0.52	0.69
PDQ tiles	0.866	0.04	0.50	0.866	0.02	0.49

Table 18: Localization of partial edits against the registered original (oracle retrieval; evaluation half of the sources). F1 at the threshold fixed for a 1% pixel false-positive rate on unedited, post-processed originals; best F1 chooses the threshold per map with hindsight.

Figure 20: (a) Examples of each edit type: registered original, edited query, ground-truth region, and three difference maps after SIFT alignment. (b) Pixel F1 at the calibrated threshold against the edited area, per map. (c) Share of edited queries whose original is retrieved above the query-level 1% threshold, against edited area, for the eight representative methods of Fig. 14 .

Figure 21: Inverting stored fingerprints. (a) Registered images (top) and thumbnails reconstructed from their descriptors by a decoder trained on distractor descriptors; bottom rows: the keyed 256-bit projection decoded by an attacker with the right and with a wrong key. (b) Share of reconstructions that retrieve their own original among the 5,000 registered images (95% Clopper–Pearson intervals); dashed: chance.

Figure 22: Adversarial robustness on 100 registered ABO images per setting. (a) Evasion by white-box PGD (learned descriptors) and surrogate-gradient PGD (DCT hashes) against the

L_{\infty}

budget, judged by the real extractor at pair-level FPR

10^{-7}

. (b) Evasion by perturbations crafted on a DINOv2-S, SSCD-R50 and OpenCLIP ensemble at a budget of 8 grey levels, judged at the pair-level

10^{-6}

threshold the attack ran against; n/a: the method has no reachable operating point. (c) Targeted forgery: share of unrelated images that become their target’s top match above the

10^{-6}

threshold.

Figure 23: Share of binary image codes that differ between an x86/A10G host and an arm64/M5 Pro laptop on byte-identical inputs. Float descriptors differ only in rounding (

1-\cos\leq 2\times 10^{-4}

Watermark	Fingerprint	WM	FP	Both	Either	Drift
TrustMark-Q	DINOv2-S	0.62	0.61	0.55	0.69	0.06
	DINOv2-S LSH-256	0.62	0.51	0.47	0.66	0.21
	ISC21 1st †	0.62	0.76	0.60	0.78	0.09
	ISCC Image-64	0.62	0.47	0.43	0.66	0.62
	PDQ	0.62	0.49	0.47	0.64	0.00
	SSCD R50 †	0.62	0.68	0.58	0.72	0.18

Table 19: Watermark and fingerprint on the same attacked copies of watermarked assets, pooled over transformations. WM: exact-key recovery for TrustMark and AudioSeal, but expected-key verification for Video Seal; the latter does not establish unique registry identification. FP: correct fingerprint identification at a threshold calibrated to pair-level FPR

10^{-7}

for images or query-level FPR 1% for audio and video; achieved held-out rates are reported separately. Both and Either are the intersection and union of these success criteria, not measured cascade accuracy. Drift: share of watermarked assets whose own fingerprint falls below the threshold against the unmarked original.

Figure 24: Share of attacked copies satisfying only the watermark criterion (blue), only the fingerprint criterion (orange), or both (grey), per transformation. Watermark success means exact-key recovery for images and audio, and expected-key verification for video; the video panel does not measure unique registry identification. (a) Images: TrustMark-Q and DINOv2-S, with the fingerprint threshold calibrated to pair-level FPR

10^{-7}

. (b) Audio: AudioSeal and Chromaprint. (c) Video: Video Seal and the ISCC Video-Code. Audio and video fingerprint thresholds are calibrated to query-level FPR 1%; achieved held-out rates are reported separately.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Modality	Configuration	$n$	Metric 1	Metric 2	Metric 3
Image	PixelSeal (0.1)	85	51.6 [51.1, 52.1]	0.0006 [0.0005, 0.0007]	0.0158 [0.0146, 0.0171] ( $n$ =60)
Image	Video Seal (0.1)	85	50.5 [50.1, 51.0]	0.0006 [0.0006, 0.0007]	0.0184 [0.0170, 0.0199] ( $n$ =60)
Image	PixelSeal (0.125)	85	49.8 [49.3, 50.2]	0.0009 [0.0008, 0.0010]	0.0200 [0.0186, 0.0214] ( $n$ =60)
Image	InvisMark	85	50.1 [49.6, 50.6]	0.0017 [0.0015, 0.0019]	0.0219 [0.0202, 0.0237] ( $n$ =60)
Image	PixelSeal (0.15)	85	48.3 [47.8, 48.7]	0.0012 [0.0011, 0.0014]	0.0238 [0.0223, 0.0253] ( $n$ =60)
Image	TrustMark-P (0.8)	85	50.5 [50.3, 50.8]	0.0017 [0.0014, 0.0020]	0.0220 [0.0215, 0.0226] ( $n$ =60)

Appendix

Table 20: Quality means with bootstrap 95% confidence intervals (10,000 resamples of sources). Columns: image PSNR (dB), LPIPS, FLIP; audio SI-SNR (dB), PESQ on speech, STOI; video PSNR (dB), LPIPS, VMAF.

Mod.	Method	R@1	TPR q,1%	FPR q,1% (test)	TPR ${}_{p,10^{-7}}$	$n_{+}$ (sources)	$n_{-}$ (sources)
image	PDQ	0.579 [0.58, 0.58]	0.495 [0.49, 0.50]	0.010 [0.01, 0.02]	0.495 [0.48, 0.50]	72,000 (2,000)	26,820 (745)
image	PDQ (dihedral)	0.623 [0.62, 0.63]	0.549 [0.54, 0.55]	0.011 [0.00, 0.02]	0.546 [0.54, 0.55]	72,000 (2,000)	26,820 (745)
image	aHash	0.503 [0.50, 0.51]	0.000 [0.00, 0.00]	0.000 [0.00, 0.00]	0.000 [0.00, 0.00]	72,000 (2,000)	26,820 (745)
image	dHash	0.560 [0.56, 0.56]	0.313 [0.00, 0.32]	0.011 [0.00, 0.01]	0.000 [0.00, 0.00]	72,000 (2,000)	26,820 (745)
image	pHash	0.563 [0.56, 0.57]	0.373 [0.37, 0.38]	0.003 [0.00, 0.01]	0.373 [0.00, 0.38]	72,000 (2,000)	26,820 (745)
image	pHash-256	0.589 [0.59, 0.59]	0.494 [0.49, 0.50]	0.013 [0.01, 0.02]	0.492 [0.48, 0.50]	72,000 (2,000)	26,820 (745)

Appendix

Table 21: Pooled results with 95% intervals from a bootstrap over sources: registered sources are drawn with all their transformed queries, and calibration and held-out negative sources likewise, with the threshold recomputed in every replicate. FPR q : share of held-out never-registered queries whose best score passes the query-level 1% threshold (out-of-sample check of the calibration). TPR

{}_{p,10^{-7}}

is not resolved by the audio and video calibration sets (–).

Explore similar work

Authenticated Contradictions from Desynchronized Provenance and Watermarking
Mar 2, 2026Alexander Nemecek, Hengzhi He, Guang Cheng +1Data Provenance Digital Forensics
Case Western Reserve University · University of California, Los Angeles
Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence
Aug 10, 2026Shruti Agarwal, Vishal Asnani, John CollomosseRobust Watermarking
Adobe Research, San Jose CA 95110, USA · University of Surrey, Guildford GU2 7XH, UK
The Forensic Cost of Watermark Removal: From Dedicated Attacks to Image Editing
Apr 28, 2026Gautier Evennou, Ewa KijakWatermark Removal Digital Image Forensics
IMATAG · IRISA, Univ. Rennes, INRIA, CNRS

Mar 2, 2026J/K move · Enter open · S save

Authenticated Contradictions from Desynchronized Provenance and Watermarking

Alexander Nemecek, Hengzhi He, Guang Cheng, Erman Ayday

Case Western Reserve University · University of California, Los Angeles

Data Provenance Digital Forensics

Open paper AskPDF arXiv

Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the

\textit{Integrity Clash}

, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation. We construct metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification. To close this gap, we propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images spanning four conflict-matrix states and three realistic perturbation conditions. Our results demonstrate that the gap between these verification layers is unnecessary and technically straightforward to close.

Abstract

Explore similar work

Authenticated Contradictions from Desynchronized Provenance and Watermarking

Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence

The Forensic Cost of Watermark Removal: From Dedicated Attacks to Image Editing