Watermarking and Fingerprinting

making C2PA Content Credentials durable

v2025.10.23

While C2PA metadata is great for proof, in practice it is often insufficient on its own, because metadata is fragile. The classic example raised is that C2PA metadata does not survive taking a screenshot. More generally, metadata on its own fails when:

The metadata is removed: Anyone can remove the metadata from the file. Furthermore, in many workflows, metadata is removed even if there is no intention to remove it, because the simple act of transferring files between applications results in lost metadata. For consumers, this includes exporting from iPhone or posting on Instagram. For enterprise, this includes uploading to a DAM or using an editing tool.

The content is changed: any time content is compressed or transcoded, even if the metadata survives, the digital signatures are invalidated. Traditional cryptographic hashes do not tolerate any change in the data, no matter how minor, so they can only authenticate pristine copies. In the near-term, when perfect C2PA coverage is not expected, this is a critical issue for practical use.

In order for provenance to be effective, it needs to be durable. That's where watermarks and fingerprints come in. Durability is also explicitly required by regulation: the EU AI Act Article 50(2) mandates that AI-content labels be "effective, interoperable, robust and reliable" — language that only durable bindings like watermarks can satisfy.

What are Watermarks and Fingerprints?

The two main technologies used to make provenance durable are watermarks and fingerprints.

Watermarking: the embedding of data into content, ideally in a way that is machine-readable but human-imperceptible, ideally in a way that survives common content modifications.

Typically, the watermark payload contains a content identifier; this content identifier is then used to retrieve provenance data from the cloud; this provenance data is then used to authenticate the content.

Fingerprinting: the hashing of content, ideally in a way that enables quantitative comparisons between hashes, ideally in a way that permits common content modifications.

Typically, the fingerprint is a type of perceptual hash; the hashes are stored in a searchable database; a pair of similar hashes can be considered a match; the difference between hashes can reveal modifications.

The C2PA does provide guidance on using watermarks and fingerprints as soft bindings. In practice, the biggest difference between watermarks and fingerprints is that watermarks alter the content but fingerprints do not. This means that watermarks are generally more reliable, but fingerprints can be computed retroactively.

Performance

Not all watermarks and fingerprints are created equal. The main qualities to look for, in a provenance context, are:

Quality	Watermarks	Fingerprints
Support	Image, Audio, Video	Image, Audio, Video
Speed	Encoding, Decoding	Hashing, Comparing
Durability	Benign	Benign, Adversarial
Visibility	PSNR/SSIM	—

Over the past few years, the technology has improved substantially due to the introduction of AI technologies and increased industry interest, such as showcased in the HiDDeN watermark.

HiDDeN: Hiding Data With Deep Networks

A deep learning approach to invisible watermarking that embeds data into images in a way that is imperceptible to humans but recoverable by neural networks.

Read the paper →

In order to help benchmark these new technologies, Trufo is developing the first practical benchmark -- one that is much tougher but much more realistic than what we've seen elsewhere. One of the evaluations is below, and is based on 10,000 image groups, each consisting of one original, three modified, three generated. There are two goals: (1) given a modified image, the correct original image is identified as the match; (2) given a generated image, no original image is returned as a match.

The recent improvements are game-changing, to the extent that 2025 open-source (DinoHash, Trustmark) are far more powerful than what was available in 2020 (pHash, IW). For example, both pHash and IW fail when the image is cropped by more than 10% or so. The main drivers of this improvement are industry interest (from content provenance) and AI (raw tech improvement); with this paradigm shift, earlier solutions are almost universally outdated in what they provide. Thanks to our strong research team, Trufo now shines as the clear industry leader in both watermarks and fingerprints.

Fuzzy Authentication

One of the key challenges with durable provenance is that, once the content is identified, it still needs to be verified. For example, a bad actor could forge a watermark that points content A to the provenance of content B. The solution to this is what we call fuzzy authentication: by using a specialized fingerprint (focused on difference rather than on similarity), Trufo is able to compute a compact hash from which the original content cannot be recovered (thus preserving privacy) but from which detailed modification information can be inferred. In particular, the user is able to see (1) what parts of the content have been modified and (2) what geometric transformations were made.

From left to right: Trufo watermarked, inPixio modified, Trufo difference analysis.

In practice, Trufo combines this analysis with several other checks to validate durable provenance.

Introducing PawPrint

We are introducing our new line of AI-powered watermarks, PawPrint, available for image and audio and video. PawPrint represents a massive leap in performance over existing models, across all dimensions (speed, accuracy, durability, perceptibility, etc.). It can be swiftly deployed in any business use case where digital media content needs to be reliably identified. PawPrint is currently in beta testing among select enterprise partners, but will soon be available as part of our C2PA Signing API & SDK.