Measured finding · Apache-2.0 · 17.14% watermark durability

The marking that proves content is AI-generated does not survive one ordinary save.

EU AI Act Article 50 requires generated content to be marked machine-readably — effective, interoperable, robust and reliable. It applies from 2 August 2026, with penalties up to €15M or 3% of worldwide turnover. The regime assumes the marking persists. We measured whether it does.

Across the marking corpus and its real-world transforms

17.14% watermark durability

(18 of 105 marking checks survived)

A marking is scored SURVIVED only when its binding still validates against the asset it is attached to. A marking present but whose binding no longer validates is scored DESTROYED, not SURVIVES. The identity control passes; an ordinary re-encode, resize, crop or format change does not.

click to launch eu

Measurement Lens

Measurement Lens

417 provisions · 4 axes · deterministic

never auto-resolved

Every transform, and what happened

TransformWhat it isManifest
identity (control)no modificationsurvived
JPEG re-encode q90an ordinary re-savedestroyed
JPEG re-encode q70an ordinary re-savedestroyed
JPEG re-encode q50an ordinary re-savedestroyed
resize 50%downscaledestroyed
crop 10%5% off each edgedestroyed
strip metadataremove APPn/COM — pixels bit-identicaldestroyed
format → PNGcontainer changedestroyed
format → WebPcontainer changedestroyed
screenshot-equivalentrasterise + rescale + PNGmodelled
format → HEICno encoder available hereUNMEASURED

JPEG quality is irrelevant — q90, q70 and q50 identically destroy the binding, because the manifest is metadata, not pixels. Predicted before the run: had q90 survived where q50 did not, the harness would have been measuring pixel similarity and would have been wrong.

The limits, stated first

The 17.14% is clustered, not per-cell. The independent unit is the asset, not the cell. Nine transforms of the same signed asset are not nine observations — they are one deterministic fact restated nine times. If a hard binding breaks at q90 it breaks at q50 for the identical reason. Survival is counted per marking check (18 of 105) but the intervals behind it are computed at the asset level.

The residual uncertainty is not sampling noise. A hard binding is a cryptographic hash over asset bytes, so re-running any cell reproduces the identical outcome with probability 1. The bound quantifies generalisation to unseen assets and transforms — external validity, nothing else.

One transform is modelled. Screenshot-equivalent simulates a screen capture rather than taking one. The modelling is conservative: a real screenshot discards the container entirely.

Our certificate is a private root, not on the C2PA trust list — so issuer_resolvable fails in every cell including the control. That is a property of our credential, not damage from a transform. Survival is about binding integrity, not trust-list membership.

Not tested: soft binding (watermarks) and cloud manifest recovery. Both exist precisely because embedded manifests do not survive. Named as missing rather than passed.

What this finding is not

It is not “C2PA is broken.” C2PA does exactly what it specifies.

It is not “Article 50 doesn’t work.” The Article says “as far as is technically feasible” — this measures what that phrase costs in practice.

It is not “provenance is useless.” A detached sidecar recovers the disclosure, which is what Article 50(2) asks for. It never recovers the binding.

We publish a measurement. Others draw conclusions.

The result that matters more

A manifest lifted from a completely different asset still reports signature_valid = survived. Only binding_intact catches the transplant — measured, not assumed.

So a verifier that reports “signature valid” without reporting the binding is telling you almost nothing. If you are buying a provenance product, that is the question to ask it.

Reproduce it: python3 provbench.py --selftest then python3 provbench.py. Harness Apache-2.0; every figure — including the 17.14% durability (18 of 105) — recomputable from results/provbench.json.

ProvBench measured status

17.14%
watermark durability — present-but-invalid markings scored DESTROYED, not SURVIVES
measured
18 / 105
marking checks that survived across the corpus and its transforms
measured
signed
every manifest verdict is Ed25519-signed and OpenTimestamps-anchored, verifiable offline
measured

source: ProvBench manifest-survival corpus (results/provbench.json), 2026-08

FAQs

Frequently asked questions

Content provenance — what is measured, what is still open.

What is content provenance measurement?

Testing whether content carries verifiable origin information — signed manifests, C2PA-style credentials — and whether those markers survive real-world transformations such as re-encoding, cropping and re-upload.

What are the current measured results?

17.14% watermark durability: 18 of 105 marking checks survived across the corpus. A marking present but whose binding no longer validates is scored DESTROYED, not SURVIVES — embedded C2PA bindings do not survive an ordinary re-save, and a detached sidecar recovers the disclosure but never the binding. We publish the count and the method.

Does a provenance marker prove content is true?

No. Provenance shows where content came from and whether it was altered — not whether its claims are accurate. Our records measure the marker, not the truth of the content.

Why does provenance matter for the EU AI Act?

Article 50 requires AI-generated content to be labelled in a machine-readable way. Provenance measurement tells you whether your labelling actually survives contact with the real internet.