Provenance 104: Watermarks

While C2PA metadata is great for proof, in practice it is often insufficient on its own, because metadata is fragile. The classic example is that C2PA metadata does not survive taking a screenshot. More generally, metadata on its own fails when:

• The metadata is removed: anyone can strip the metadata from a file. In many workflows, metadata is lost even without any intention to remove it, because the simple act of transferring files between applications drops it. For consumers, this includes exporting from iPhone or posting on Instagram; for enterprise, uploading to a DAM or using an editing tool.
• The content is changed: any time content is compressed or transcoded, even if the metadata survives, the digital signatures are invalidated. Traditional cryptographic hashes do not tolerate any change in the data, no matter how minor, so they can only authenticate pristine copies. In the near term, when perfect C2PA coverage is not expected, this is a critical issue for practical use.

For provenance to be effective, it needs to be durable. That is where watermarks and fingerprints come in. Durability is also explicitly required by regulation: the EU AI Act Article 50(2) mandates that AI-content labels be “effective, interoperable, robust and reliable” — language that only durable bindings like watermarks can satisfy.

#What Are Watermarks and Fingerprints?

Watermarking is the embedding of data into content — ideally in a way that is machine-readable but human-imperceptible, and in a way that survives common content modifications. Typically, the watermark payload contains a content identifier; the identifier is used to retrieve provenance data from the cloud; and that provenance data is used to authenticate the content.

Fingerprinting is the hashing of content — ideally in a way that enables quantitative comparisons between hashes, and in a way that permits common content modifications. Typically, the fingerprint is a type of perceptual hash; the hashes are stored in a searchable database; a pair of similar hashes is considered a match; and the difference between hashes can reveal modifications.

The C2PA provides guidance on using watermarks and fingerprints as soft bindings. In practice, the biggest difference between the two is that watermarks alter the content and fingerprints do not. Watermarks are therefore generally more reliable, but fingerprints can be computed retroactively.

#Performance

Not all watermarks and fingerprints are created equal. The main qualities to look for, in a provenance context, are:

Over the past few years, the technology has improved substantially, driven by AI techniques and increased industry interest — as showcased in the HiDDeN watermark, a deep learning approach that embeds data imperceptibly and recovers it with neural networks.

To help benchmark these new technologies, Trufo is developing the first practical benchmark — much tougher, and much more realistic, than what we have seen elsewhere. One of the evaluations, below, is based on 10,000 image groups, each consisting of one original, three modified, and three generated images. There are two goals: (1) given a modified image, the correct original is identified as the match; (2) given a generated image, no original is returned as a match.

The recent improvements are game-changing, to the extent that 2025 open-source models (DinoHash, TrustMark) are far more powerful than what was available in 2020 (pHash, IW). For example, both pHash and IW fail when an image is cropped by more than 10% or so. The main drivers are industry interest (from content provenance) and AI (raw tech improvement); with this paradigm shift, earlier solutions are almost universally outdated. Thanks to our strong research team, Trufo is the clear industry leader in both watermarks and fingerprints.

#Fuzzy Authentication

One key challenge with durable provenance is that, once content is identified, it still needs to be verified. A bad actor could forge a watermark that points content A to the provenance of content B. The solution is what we call fuzzy authentication: using a specialized fingerprint (focused on difference rather than similarity), Trufo computes a compact hash from which the original content cannot be recovered (preserving privacy) but from which detailed modification information can be inferred. In particular, the user can see (1) what parts of the content have been modified and (2) what geometric transformations were made.

In practice, Trufo combines this analysis with several other checks to validate durable provenance.

#Introducing PawPrint

PawPrint is our new line of AI-powered watermarks, available for image, audio, and video. It represents a large leap in performance over existing models across all dimensions — speed, accuracy, durability, perceptibility — and can be deployed in any business use case where digital media needs to be reliably identified. PawPrint is currently in beta testing among select enterprise partners, and will soon be available as part of our C2PA Signing API and SDK.