C2PA Soft-Binding with PawPrint Watermarks

In order for content provenance to be durable, a C2PA soft-binding mechanism is needed. Otherwise, the metadata is easily lost (e.g. stripped for privacy reasons on platform upload) and the hard binding breaks on any modification (since it is a cryptographic hash). As one of the pioneers of this type of robust authentication, Trufo provides the technology — watermarks, fingerprints, and cloud services — required for C2PA soft-binding functionality. The watermarking API is now available for self-serve users with the release of v1.1.0 of trufo-py.

#How to Add Watermarks with Trufo

For those using Trufo’s managed C2PA signing service:

from trufo import sign_c2pa
from trufo.util.credentials import TrufoApiKey, load_api_key

api_key = load_api_key(TrufoApiKey.C2PA_SIGN_PROD)

signed_bytes = sign_c2pa(
    api_key,
    media_bytes,
    actions=[
        ["watermark", {}],  # bare action == {"effort_policy": "require"}
    ],
)

For those making their own Generator Products:

from trufo import bind_watermark_test, bind_commit_test

# 1. Trufo embeds the mark and opens a record
result = bind_watermark_test(api_key, media_bytes)

# 2. sign result.media with YOUR certificate; the manifest must declare the
#    mark: a c2pa.soft-binding assertion (alg "ai.trufo.pawprint.watermark",
#    value = result.wid) paired with a c2pa.watermarked.bound action
signed_bytes = my_signer(result.media, wid=result.wid)

# 3. the commit verifies the declaration and completes the record
bind_commit_test(api_key, result.cid, signed_bytes)

You will need the corresponding API key: c2pa-sign-prod or watermark-prod for encoding, respectively, and content-recover-prod for decoding. If you use the local processing version of the SDK, you will need to install the following package, which has pytorch dependencies:

pip install "trufo[local-full]"

The presence of the watermark is indicated in the C2PA manifest with a c2pa.soft-binding assertion. Trufo’s PawPrint watermark is a registered soft-binding algorithm, with the algorithm identifier ai.trufo.pawprint.watermark.

#How Does Soft-Binding Work?

There are two main types of C2PA soft binding mechanisms: watermarks and fingerprints. A watermark is a payload embedded into the content, using steganography. This payload typically contains an identifier that maps to the remote manifest. A fingerprint, on the other hand, is a perceptual hash designed for matching content. Recovery is through searching a database of known fingerprints.

Learn more: Watermarks · Fingerprints · C2PA Soft-Binding

#Things to Consider before Adding a Watermark

First things first, the watermark does change the content itself, which means that it is important that the watermark does not compromise the quality of the content. PawPrint, like most SotA watermarks now, is trained with a variety of perceptibility constraints, including weighted PSNR, LPIPS features, and adversarial discriminator feedback.

#Compliance

The EU AI Act and California SB 942 both require watermarking (or some other durable method, but watermarking is typically the simplest one) for AI-generated or AI-modified content as part of their transparency requirements. If your content workflow includes operating a generative AI model, you will need to comply.

#Durability

The watermark needs to survive distribution, even when metadata does not. Here are some common edits that PawPrint survives:

For more details, see here.

The watermark should also be resistant to removal, though this is generally acknowledged to be impossible to prevent. Because the C2PA manifest carries value (in provenance), typically the incentive is to keep the watermark and not to remove it. For example, a user sending an image over Slack probably does not want to strip the provenance away; in this case metadata is lost and the watermark survives.