Measured finding · Apache-2.0 · 17.14% watermark durability
The marking that proves content is AI-generated does not survive one ordinary save.
EU AI Act Article 50 requires generated content to be marked machine-readably — effective, interoperable, robust and reliable. It applies from 2 August 2026, with penalties up to €15M or 3% of worldwide turnover. The regime assumes the marking persists. We measured whether it does.
Across the marking corpus and its real-world transforms
17.14% watermark durability
(18 of 105 marking checks survived)
A marking is scored SURVIVED only when its binding still validates against the asset it is attached to. A marking present but whose binding no longer validates is scored DESTROYED, not SURVIVES. The identity control passes; an ordinary re-encode, resize, crop or format change does not.
click to launch eu
Measurement Lens
417 provisions · 4 axes · deterministic
Every transform, and what happened
| Transform | What it is | Manifest |
|---|---|---|
| identity (control) | no modification | survived |
| JPEG re-encode q90 | an ordinary re-save | destroyed |
| JPEG re-encode q70 | an ordinary re-save | destroyed |
| JPEG re-encode q50 | an ordinary re-save | destroyed |
| resize 50% | downscale | destroyed |
| crop 10% | 5% off each edge | destroyed |
| strip metadata | remove APPn/COM — pixels bit-identical | destroyed |
| format → PNG | container change | destroyed |
| format → WebP | container change | destroyed |
| screenshot-equivalent | rasterise + rescale + PNG | modelled |
| format → HEIC | no encoder available here | UNMEASURED |
JPEG quality is irrelevant — q90, q70 and q50 identically destroy the binding, because the manifest is metadata, not pixels. Predicted before the run: had q90 survived where q50 did not, the harness would have been measuring pixel similarity and would have been wrong.
The limits, stated first
The 17.14% is clustered, not per-cell. The independent unit is the asset, not the cell. Nine transforms of the same signed asset are not nine observations — they are one deterministic fact restated nine times. If a hard binding breaks at q90 it breaks at q50 for the identical reason. Survival is counted per marking check (18 of 105) but the intervals behind it are computed at the asset level.
The residual uncertainty is not sampling noise. A hard binding is a cryptographic hash over asset bytes, so re-running any cell reproduces the identical outcome with probability 1. The bound quantifies generalisation to unseen assets and transforms — external validity, nothing else.
One transform is modelled. Screenshot-equivalent simulates a screen capture rather than taking one. The modelling is conservative: a real screenshot discards the container entirely.
Our certificate is a private root, not on the C2PA trust list — so issuer_resolvable fails in every cell including the control. That is a property of our credential, not damage from a transform. Survival is about binding integrity, not trust-list membership.
Not tested: soft binding (watermarks) and cloud manifest recovery. Both exist precisely because embedded manifests do not survive. Named as missing rather than passed.
What this finding is not
It is not “C2PA is broken.” C2PA does exactly what it specifies.
It is not “Article 50 doesn’t work.” The Article says “as far as is technically feasible” — this measures what that phrase costs in practice.
It is not “provenance is useless.” A detached sidecar recovers the disclosure, which is what Article 50(2) asks for. It never recovers the binding.
We publish a measurement. Others draw conclusions.
The result that matters more
A manifest lifted from a completely different asset still reports signature_valid = survived. Only binding_intact catches the transplant — measured, not assumed.
So a verifier that reports “signature valid” without reporting the binding is telling you almost nothing. If you are buying a provenance product, that is the question to ask it.
Reproduce it: python3 provbench.py --selftest then python3 provbench.py. Harness Apache-2.0; every figure — including the 17.14% durability (18 of 105) — recomputable from results/provbench.json.
ProvBench measured status
source: ProvBench manifest-survival corpus (results/provbench.json), 2026-08
Frequently asked questions
Content provenance — what is measured, what is still open.
What is content provenance measurement?
Testing whether content carries verifiable origin information — signed manifests, C2PA-style credentials — and whether those markers survive real-world transformations such as re-encoding, cropping and re-upload.
What are the current measured results?
17.14% watermark durability: 18 of 105 marking checks survived across the corpus. A marking present but whose binding no longer validates is scored DESTROYED, not SURVIVES — embedded C2PA bindings do not survive an ordinary re-save, and a detached sidecar recovers the disclosure but never the binding. We publish the count and the method.
Does a provenance marker prove content is true?
No. Provenance shows where content came from and whether it was altered — not whether its claims are accurate. Our records measure the marker, not the truth of the content.
Why does provenance matter for the EU AI Act?
Article 50 requires AI-generated content to be labelled in a machine-readable way. Provenance measurement tells you whether your labelling actually survives contact with the real internet.