Anti-ForensicsRendering Digital Investigations Irrelevant
Reference Library · Investigation notes

Provenance, detector scores, and the limits of an origin claim

Distinguish a recorded history from a statistical signal and from proof of authenticity.

Materially reviewed · Original editorial guide

2 minute read · Source-based editorial synthesis
On this page
  1. Separate the object from the claim about it
  2. Ask what a provenance check verifies
  3. Treat a detector as a method requiring validation
  4. Look beyond the media object

A recorded history, a cryptographic check, and a detector output address different parts of an origin question. Preserve them as separate observations. Neither the absence of provenance information nor a high detector score alone establishes that media was generated by AI.

Separate the object from the claim about it

Preserve the received bytes and record how they arrived. Keep any available original, export, manifest, related application record, and transformation history. A screenshot of a file and the source file are different objects. A platform may strip metadata or produce a derivative; document the actual collection rather than assuming it is the original.

Ask what a provenance check verifies

A validation result may support an association between signed assertions and an object under a particular trust configuration. It does not automatically establish that every asserted event occurred or that the depicted scene was real. Identify the assertion, the binding, the signer or trust decision, and the verifier's reported limitations. The C2PA specification collection is an original technical reference; record the exact specification and implementation used in an examination.

Treat a detector as a method requiring validation

Record the detector version, input preparation, settings, and output. Test its applicability to the media type, transformations, and source conditions relevant to the question. A score cannot safely become a probability that a particular person created the object without a supported model for that claim. Explain false positives, false negatives, and out-of-scope inputs in the report.

Look beyond the media object

Application history, preserved conversations, source exports, and independently produced service records may support a workflow reconstruction. Those sources also have retention, access, and authenticity limits. The Synthetic Forensics evaluation guide provides a project-authored layered reading path; it is not independent validation of a detector or a case.