Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering

Zheng Gao; Xiaoyu Li; Zhicheng Bao; Yang Song; Jiaojiao Jiang

cs.CROct 6, 2026

Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering

Authors: Zheng Gao, Xiaoyu Li, Zhicheng Bao, Yang Song, Jiaojiao Jiang

Organizations: UNSW Sydney

Abstract

AI systems create images and videos with image/video generation models or by writing code and graphics descriptions that are then rendered. These routes can produce similar visible artifacts but expose different representations, intervention points, and provenance evidence. We develop a production-centered framework that compares detection and watermarking across both routes. An explicit verification specification distinguishes passive inference, message recovery, and authenticated provenance. We organize image, video, source-code, and rendering-aware watermarks by production stage. We examine the different requirements of generated images and video, plots and SVG, programmable video, and agent-composed workflows. Documented Claude, OpenAI, and rendering-tool interfaces connect the framework to concrete systems. We pose ten scoped research questions on identifiability, observability, fair comparison across stages, recoverable payload, reconstruction, synchronization, composition, hybrid local contribution, and private production-event authentication. The result is a conceptual research agenda grounded in published methods, inspected interfaces, and elementary boundary examples. It reports no experiments and claims no new theorems; its appendix results are elementary calculations, and documentation and source inspection establish interfaces, not empirical robustness.

Figures & tables

Figure 2: What reaches the verifier depends on the production map. Different descriptions can coincide under a fixed renderer, while an intervention that changes the output can transmit a mark. In the figure, $R$ is the renderer, $z$ the environment, and $P_{0}$ and $P_{1}$ are two descriptions (Appendix A ). The source snippets and rendering apparatus are schematic; the left panel stipulates equal renders rather than demonstrating them by execution. Pixels, source or latent state, metadata, and authenticated records are distinct possible observations.

Figure 3: Image watermarking changes different objects. Initial noise, an adapted decoder, and raster pixels are distinct intervention points [ 28 , 34 , 21 ] . Spatial extraction can return localized messages [ 22 ] . Eye icons indicate the received images. The text specifies the keys, models, or extractors that each method requires. Teal traces identify conceptual carriers, not measured image residuals.

Panel of Figure 4 — Figure 4: Selected visual outputs and their production workflows. The panels show workflow variety, not a controlled quality or watermark comparison. Labels follow source records, not visual appearance. (a) A frame from Google's Veo 3.1 preview [ 50 ] . (b) A frame of still loading at 01:11.44, reported by its creator as Claude code-rendered [ 51 ] . The upper-left platform mark is retouched for display. Incorporated asset origins are not established here. (c) A travel-map animation credited to @JNYBGR [ 52 ] . (d) Dilum Sanjaya's X video, with the frame obtained from Remotion's gallery [ 53 , 54 ] . (e) An illustrative diagram produced for this article with an image-generation tool. (f) An illustrative diagram produced for this article as LLM-authored SVG; the SVG source is retained.

Figure 5: Three different transformation interfaces. Editing received pixels, rendering a marked asset again, and exporting available clean source grant different access. Asset-mark persistence depends on the channel. The bottom path bypasses an optional output-only marking step under the stated clean-source access; it does not establish general erasure of upstream marks.

Figure 6: One composition supports several evidence questions. A generated background, programmed chart, and human annotation enter a shared visual artifact. Asset identity, retained visible contribution, and an export event are different possible targets. Their icons indicate evidence categories, not verified facts about the illustrated example or complete authorship.

Part	Results	Serves
Appendix A : observation boundaries	Definition A.1 ; Propositions A.2 , A.3 and A.5 ; Lemma A.4 ; Remark A.6 ; Corollary A.7 ; Example A.8 .	Sections 2 and 6 ; Question 1
Appendix B : rendering, task preservation, payload	Definitions B.1 and B.9 ; Remarks B.2 , B.8 and B.11 ; Corollary B.3 ; Examples B.4 and B.6 ; Propositions B.5 and B.10 ; Lemma B.7 .	Sections 2 and 6 ; Questions 2 to 5
Appendix C : temporal search and editing	Definitions C.1 , C.4 and C.10 ; Examples C.2 , C.3 , C.7 , C.8 and C.9 ; Proposition C.5 ; Lemma C.11 ; Remarks C.6 and C.12 .	Sections 2 and 6.4 ; Questions 7 and 8

Table 1: Roadmap of the appendices.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Location	Image/video generation	Code-based rendering
Request / text	Conditions or generated textual content	Prompt, code tokens, identifiers, literals
Representation	Noise, latent states, model parameters	Program, component graph, scene parameters, assets
Emission stage	Decoder or generated-frame intervention	Renderer or captured-frame intervention
Final pixels	Pixels, transforms, codec-aware representation	The same output-level possibilities as for image/video generation
Side information	Signed manifests, service records, disclosed states	Signed manifests, source identity, execution receipts

Appendix

Table 2: Candidate locations. Section 3 maps its five stages to these rows. A location is not a security guarantee: each row needs a specified carrier, observation, attacker, and assertion.

Symbol	Meaning	Where
$\mathcal{G}=(\mathcal{N},\mathcal{E}),\;\operatorname{pa}(v)$	Production graph (nodes, edges); parents of node $v$	Section 2.2
$Y_{v},\;F_{v},\;Z_{v}$	Artifact, node map, and randomness at node $v$	Section 2.2
$x,\;\mu_{x}$	Task instance; joint law of the additional inputs $Z=(Z_{v})_{v}$	Section 2.2
$S,\;s,\;\mathcal{S}$	Production state (random, realized); set of allowed states	Section 2.2 , Appendix B
$O(S),\;o$	Verifier’s observation; realized value	Section 2.2 , Appendix A
$\mathfrak{C}$	Verification specification $(\mathfrak{P},\mathcal{I},O,\mathcal{A},U,\chi,\mathcal{Q}_{0})$	Section 2.2

Appendix

Table 3: Principal notation. Symbols local to one proof or example are defined where they occur and omitted here. Some letters, such as

b

d

x

V

W

X

Y

\mu

, and

K

, also have local meanings there.

Family	Examples	Observation boundary
Video-asset marks	RivaGAN, DVMark, ItoV, Video Seal [ 23 , 24 , 25 , 9 ]	Marked frames are the received signal; this does not establish source authorship.
Video noise interventions	VideoShield, VideoMark [ 31 , 32 ]	Corresponding inversion paths and keys are auxiliary access.
Video decoder / model interventions	LVMark, Video Signature, SPDMark [ 35 , 36 , 37 ]	Learned emission changes differ from marking source tokens.
Graphical video payload	Safe-Sora [ 75 ]	A graphical message is the payload; abstract screening alone does not fix every embedding-stage detail.
Stage inheritance	LoT-Pass [ 45 ]	A marked input image passes through image-to-video generation; persistence needs its own channel model.
Localized / image neighbors	TrustMark, Watermark Anything [ 21 , 22 ]	Raster-image recovery and localization precede additional temporal questions.

Appendix

Table 4: Mechanism map for the compared production workflows, with an observation boundary for each family; the accompanying notes record exact versions and reading depth.

Explore similar work

Verifiable Provenance and Watermarking for Generative AI: An Evidentiary Framework for International Operational Law and Domestic Courts
May 20, 2026Gustav Olaf Yunus Laitinen-Fredriksson Lundström-Imanov, Nurana AbdullayevaWatermarking Generative Artificial Intelligence
Department of Military Studies, Försvarshögskolan (Swedish Defence University), Drottning Kristinas väg 37, 115 93 Stockholm, Sweden · School of Law, ADA University, Ahmadbey Aghaoghlu Street 61, Baku AZ1008, Azerbaijan
Attribute-based Undetectable Watermarking for Generative AI Models
Aug 4, 2026Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel +1Watermarks Ai-Generated Content Detection
Carnegie Mellon University Pittsburgh, PA, USA · Independent Researcher · University of Southern California Los Angeles, CA, USA +1
Watermarks Without Verification: AI Text Watermarking After the EU AI Act
Sep 10, 2026Alexander Nemecek, Vipin Chaudhary, Erman AydayAi-Generated Content Detection Watermarks
Case Western Reserve University

May 20, 2026, cs.CRJ/K move · Enter open · S save

Verifiable Provenance and Watermarking for Generative AI: An Evidentiary Framework for International Operational Law and Domestic Courts

Gustav Olaf Yunus Laitinen-Fredriksson Lundström-Imanov, Nurana Abdullayeva

Department of Military Studies, Försvarshögskolan (Swedish Defence University), Drottning Kristinas väg 37, 115 93 Stockholm, Sweden · School of Law, ADA University, Ahmadbey Aghaoghlu Street 61, Baku AZ1008, Azerbaijan

Watermarking Generative Artificial Intelligence Laundering Legal Domain

Open paper AskPDF arXiv

Generative artificial intelligence now synthesizes photorealistic imagery, audio, and video at a cost that defeats traditional forensic intuition. The legal consequences span three regimes studied so far in isolation: international operational law, domestic procedure, and product regulation. This article presents a unified evidentiary framework that maps cryptographic content provenance, robust statistical watermarking, and zero knowledge attestation to the proof requirements of each regime. We define a five tier threat model spanning naive regeneration, adversarial laundering, cross model regeneration, active watermark removal, and insider provenance forgery. We release a public benchmark of 12000 generated items across image, audio, and video modalities under six laundering pipelines for 72000 evaluation samples. We evaluate four representative schemes and report true positive rate at fixed false positive rate, robustness area under the curve, computational overhead, and a regime conditioned legal sufficiency score. We translate empirical detection bounds into legal sufficiency thresholds for command decisions under the law of armed conflict, for criminal and civil admissibility under domestic procedure, and for persistence audits under the European Union Artificial Intelligence Act and analogous regimes. The result is a reproducible reference pipeline, a public benchmark, and model annexes that lawyers, engineers, and operators can deploy together.

Abstract

Explore similar work

Verifiable Provenance and Watermarking for Generative AI: An Evidentiary Framework for International Operational Law and Domestic Courts

Attribute-based Undetectable Watermarking for Generative AI Models

Watermarks Without Verification: AI Text Watermarking After the EU AI Act