On May 01 2025 18:55 Belisarius wrote:I am very sceptical that there is any way to watermark an image that can't be reverse-engineered, either by AI or just good-old-fashioned human hackery.
The fundamental issue is that if the image and its watermark are self-contained - that is, anyone receiving a copy of the image can validate it without access to the source - the validation system is public, by definition. But if the validation system is public, you have everything you need to reverse-engineer it, or for an AI to learn to fake it.
Most of the big players have signed onto a thing called
C2CA, led by Adobe, which is basically just a very detailed blob of metadata that lives alongside the image. The idea is straightforward: everything that happens to the image from creation through modification through publication is supposed to be tracked, signed, and stapled to the image. It's a good idea in theory, and its got an impressive sign-on list, from Google to Meta to OpenAI.
+ Show Spoiler +The issue is that it's just a sidecar, sent around with the image. The critical security information is there in the file, and can therefore be modified just like the file itself. Yes, there's a signing system via Adobe, Microsoft etc, but those signatures don't validate the source, they just certify that some image, and not even necessarily the
same image, was sent to Adobe by person X on date Y.
There are plenty of
examples of people transplanting certificates and hacking the dates to get a AI-generated image that reads as certified by Adobe on a date three weeks in the future, and so on. Yes, that stuff makes it a bit harder, but "a bit harder" is very underwhelming for such a big-name push on such a critical problem.
The only way to dodge the arms-race is to have a validation system that is
not self-contained. Basically you'd need the C2CA history, but with each step verified live by the actual providers using a chain of credentials and hashes embedded in the file. All the camera manufacturers would have to verify and store details of every signed photo taken with their gear, Adobe would have to verify and track the edit history for every signed file, NYT would track the photos they published, etc etc. Everyone would have to provide some kind of interface for queries.
Then when you wanted to validate an image, you'd ping NYT and Adobe and Canon with credentials embedded in the file, probably along with some kind of hash of the image as-received, and then you'd have to reconstruct the chain and check whether it still matched.
That's expensive as
hell for everyone involved. But it might work, and that's better than anything else I've seen proposed.