{"id":"51757a6f-b7ce-4675-846e-378462435f40","arxiv_id":"2411.17684","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"RealSeal proposes embedding a cryptographically signed realism score, computed from multisensory inputs, into the metadata of genuine images instead of watermarking synthetic media.","lead":"RealSeal proposes signing real photographs at capture with a machine-computed realism score derived from depth, thermal, audio, and motion sensors. The authors argue this is a more robust way to certify authenticity than watermarking synthetic media, but the paper is a blue-sky proposal with no implementation.","discovery_kind":"unclear","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper's own limitations (Section 3) concede that staged scenes with masks, body doubles, or screens can receive high realism scores; since that score is the only reality check the signature certifies, the central 'certificate of authenticity' claim is undercut by design, not just by missing…","rationale":"The reader's REJECT verdict is justified. The strongest claim is about transforming how images are trusted and circulated, and that claim depends entirely on a realism score that can reliably distinguish genuine from staged content. The reader identifies this as the weakest assumption, and I agree. The paper's Section 3 makes the problem more severe than mere lack of evaluation: it admits the realism score can be high for staged or misleading scenes. That admission is internal to the paper, so the concern is not just 'outside current consensus' or 'needs more data'; it is a mismatch between the stated guarantee (a certificate of authenticity for real content) and the acknowledged behavior of the proposed component. The cryptographic signing is sound but irrelevant to that gap, because it protects the score from tampering, not from being wrong. I also note that no implementation, dataset, or formal analysis is provided; however, the decisive issue is the admitted failure mode, not the absence of artifacts. The proposed concrete test would empirically settle whether a realistic implementation can separate the core attack class. Until then, the paper does not support its central claim. Since the reader already chose REJECT, I leave the verdict unchanged rather than proposing a different outcome.","tokens_in":9388,"tokens_out":3855,"duration_ms":36091,"concrete_test":"Build a minimal RealSeal prototype using off-the-shelf RGB, depth, thermal, and audio capture; implement the proposed multimodal scorer (or a stand-in trained on those modalities); and collect paired examples of (a) a real speaker in a live scene, (b) the same speaker's deepfake video played on a high-brightness screen, and (c) a person wearing a hyperrealistic mask, all captured under identical lighting. Report score distributions and AUROC for genuine versus staged captures. If a high-realism threshold (e.g., 90%) admits more than a small fraction of staged captures, or if AUROC is below about 0.99, the certificate-of-authenticity guarantee fails even under the paper's idealized trusted-hardware assumptions.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central mechanism is the scored-then-signed pipeline (Sections 2.2-2.3): the device computes a realism score from multimodal sensor data, bundles it with the image, and signs the bundle. The signature therefore vouches only for the bundle's integrity, not for the event's reality; any guarantee about reality must come from the realism score. The paper never defines a ground-truth 'realism' label, gives no training or evaluation, and, in Section 3, explicitly concedes that high-scoring staged content is possible via body doubles, masks, or avoiding faces, declaring it 'out of scope.' This is not a peripheral limitation: those are precisely the staged and fake media cases the introduction (Section 1) says provenance systems fail to catch. If the scorer cannot reject such scenes, a signed high score certifies only that a trusted device captured a physically plausible scene, not that the event occurred. The paper also notes benign crops and compression invalidate the signature (Section 3), creating false positives for unmarked content. The load-bearing assumption is not the cryptographic signing, which is standard; it is the existence of a context-independent realism function with enough adversarial robustness to distinguish genuine events from staged ones. No such function is specified, so the central claim that RealSeal authenticates real content is unsupported and, by the paper's own admission, does not hold for a core attack class.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes RealSeal, an authentication scheme in which a trusted device captures multisensory data (RGB, depth, audio, motion, thermal), computes a 'realism score' with a machine learning model, and cryptographically signs the image together with the score and metadata. The authors argue that this source-based attestation prevents deepfakes and staged media, and distinguishes their approach from post-hoc detectors and metadata-only provenance systems like C2PA. The manuscript describes the sensing, scoring, and signing pipeline at a conceptual level, discusses secure execution environments (secure boot, TEEs, HSMs), and concludes with a limitations section. It contains no formal model, no implementation, no datasets, no evaluation, and no comparison against existing systems.","tokens_in":9769,"tokens_out":4008,"duration_ms":35792,"significance":"If a reliable, adversarially robust realism scorer existed, source-side attestation of real content would be a meaningful complement to provenance systems. The paper's honest enumeration of limitations and its attention to hardware security are assets. However, the entire value proposition rests on an unspecified ML component, and the paper's own limitations concede that the most important attack class (staged scenes with body doubles or masks) is out of scope. As submitted, the work is a position statement rather than a validated system, and it does not provide the evidence needed to assess (let alone accept) the central claims.","major_comments":[{"comment":"The realism scoring component is described only as 'a machine learning model' and example outputs; no architecture, training data, ground-truth label definition, loss function, or evaluation is given. Since the entire authentication benefit depends on this score differing between genuine and staged scenes, the paper does not establish that the mechanism can work.","section":"Section 2.2 and Figure 1"},{"comment":"The limitations section admits that high realism scores can be obtained for staged scenes using body doubles, masks, or avoiding faces, and states this is out of scope. This is precisely the core attack scenario named in Section 1 (e.g., screening a deepfake or staging an event), so the central guarantee that RealSeal certifies real content is contradicted by the paper's own scope. A signed high score can certify only that a trusted device captured a physically plausible scene, not that the depicted event occurred.","section":"Section 3"},{"comment":"The cryptographic signature binds the image to metadata but does not attest to truth. Consequently, if the scorer is defeated, the signature gives fake content an official seal, actively worsening the misinformation problem relative to an unsigned image. The paper does not address this risk or propose a fallback.","section":"Section 2.3"},{"comment":"There is no experimental section or threat-model evaluation. For a system whose contribution is comparative trust (vs. C2PA, watermarking, deepfake detectors), the paper should at least report proof-of-concept results, attack benchmarks, or formal security properties; none are present. The absence of such evidence leaves the central claim unsupported.","section":"Sections 2-3 (overall)"}],"minor_comments":[{"comment":"There are formatting errors, including 'InINTERNATIONAL' in the ACM reference line and malformed characters in Figure 1 such as '38°53?52?N'.","section":"ACM Reference Format and Figure 1"},{"comment":"Excessive promotional language ('groundbreaking', 'revolutionizing', 'significant leap forward') is inappropriate for a technical paper and should be toned down.","section":"Throughout"},{"comment":"Several central criticisms of C2PA rely on blog posts rather than peer-reviewed evaluations; the authors should cite systematic analyses or independent evaluations where available.","section":"References [3], [4], [5], [10]"},{"comment":"The text mentions 'tactile feedback' as part of the multisensory input, but no tactile sensor is described in the sensing pipeline in Section 2.1; this should be clarified or removed.","section":"Section 3"}],"recommendation":"reject","confidential_remarks":"The manuscript is a vision/position piece rather than a completed system paper. If the venue explicitly solicits blue-sky ideas with no evaluation, this could be acceptable as a short abstract; as an archival research paper it does not meet the evidentiary bar. I would not encourage resubmission to a serious security or multimedia venue without substantial empirical validation, including defining the realism label and demonstrating robustness to the attacks the paper itself identifies."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"RealSeal is a position paper, not a research result. The idea is simple and worth stating: instead of trying to detect fakes after the fact, certify real content at capture by computing a multisensory “realism score” and signing it into the image metadata. There is no implementation, no data, no math, and no evaluation. The realism scorer is described only as “a machine learning model,” with no architecture, training set, or performance figures.\n\nWhat the paper does well: it is honest. Section 3 concedes that staged scenes with body doubles, masks, or avoiding faces can receive high realism scores, and that benign crops and compression invalidate the signature. It also does a fair job of summarizing C2PA’s weaknesses and pointing to FaceID-style depth sensing as an existence proof for at least one modality. The citation list includes independent security analyses, which is a good sign. As a research agenda, it is a reasonable strawman for the community to react to.\n\nThe soft spot is not the cryptography; the signing part is standard. It is the claim that a context-independent realism function can be built that distinguishes genuine events from staged ones with enough adversarial robustness. The stress-test note is correct: the signature vouches only for the integrity of the bundle, not for the reality of the event. If the scorer is fooled by a screen showing a politician, a signed high score certifies a physically plausible scene, not an actual event. The paper’s own limitations admit this is out of scope, but those are precisely the cases the introduction says provenance systems fail to catch. So the central claim—that RealSeal certifies authenticity—is unsupported and, by the paper’s own admission, does not hold for a core attack class.\n\nThat said, this is a 6-page workshop-style paper, not a full research submission. If it is positioned as a blue-sky proposal, the lack of evidence is less damning. The abstract’s “revolutionizing” language oversells it; the conclusion’s “blue sky” caveat is more accurate.\n\nWho is this for? Researchers working on media provenance and deepfake defenses who want a concrete proposal to argue against. It is worth a reading group slot, but I would not cite it as a result.\n\nFor peer review: I would send it to a workshop or a blue-sky track, not to a main conference as a technical paper. It deserves referee time only if the venue expects position papers; otherwise desk reject is defensible.","headline":"A blue-sky position paper that proposes an interesting combination but provides no evidence for its load-bearing realism score.","tokens_in":10154,"tokens_out":3559,"would_cite":false,"duration_ms":28303,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"RealSeal proposes certifying real images at capture with a signed realism score, shifting trust from detecting fakes to verifying real scenes at the source.","keywords":["media authentication","deepfakes","realism scoring","source watermarking","multisensory sensing","cryptographic signing","content provenance"],"falsifier":"Record a real scene with a RealSeal prototype, then play that recording back on a high-resolution screen in a room whose depth, thermal, and audio profiles match the original, and film the screen with the same camera; if the resulting realism score stays high, the multisensory criterion has been bypassed and the central claim would fail.","tokens_in":9179,"feed_emoji":"📷","tokens_out":7179,"duration_ms":58126,"temperature":0.7,"pith_summary":"The paper argues that the way to restore trust in images is not to detect manipulated or AI-generated content after the fact, but to certify genuine content at the moment of capture. It proposes a pipeline that captures a scene with multiple sensors, uses machine learning to compute a realism score per dimension and an overall credibility score, and cryptographically signs the image together with those scores. The paper's claim is that this source-based watermarking raises the bar for faking media, because an attacker would have to counterfeit a physically consistent multisensory scene rather than just pixels. This is a position paper: the argument depends on the realism scorer being able to tell genuine scenes from staged or manipulated ones.","feed_headline":"Certify real images at capture with a signed realism score","feed_subtitle":"Instead of chasing deepfakes after the fact, RealSeal would cryptographically sign how realistic a scene is the moment it's recorded.","key_machinery":"The load-bearing object is the signed realism score: a bundle containing per-modality credibility scores (3D spatial, thermal, motion, auditory), an overall credibility score, and capture metadata, hashed together with the image and signed by the device's private key. The mechanism it relies on is the sensing-scoring-signing pipeline, in which a machine-learning model aggregates depth, thermal, audio, and temporal-motion data into a single number, and a secure execution environment (secure boot, trusted execution environment, hardware security module) prevents tampering with sensors, model weights, or keys. The score is what carries the argument: if it is reliable and hard to spoof, then a signed high score certifies the scene as real.","core_discovery":"On the paper's own terms, the central discovery is that authenticity can be attached to real content at its origin instead of being inferred later. RealSeal proposes that a camera with depth, thermal, audio, and motion sensors, running a machine-learning scorer inside a secure hardware enclave, can produce a credibility score that summarizes how real the captured scene is. That score, bundled with the image and signed with a device private key, becomes a tamper-evident certificate of realism. The paper argues that faking such a certificate is qualitatively more difficult than evading today's deepfake detectors or stripping watermarks, and that this shifts the operative question from 'is this image fake?' to 'was this image certified real?'","pith_inferences":["If the realism scorer works, the same model could be used off-device as a forensic tool, meaning the machine-learning component may be reusable independently of the secure-hardware pipeline.","The proposal implicitly creates a two-tier trust system, and the paper does not address how older photos, screenshots, or content from devices without the required sensors would ever earn certification.","A practical test of the core bet would be to measure calibration: how often a staged scene with plausible physical cues receives a high signed score, rather than only whether the signature survives tampering.","The score's context-independence is likely to be the battleground: if the scorer must be continually retrained as new scene types and attacks appear, the seal is a moving target, not a fixed standard."],"forward_implications":["Unmarked or low-score images would be presumed unverified rather than presumed authentic, reversing today's default.","Platforms and newsrooms could check a signed realism score with the device's public key, without relying on a central authority.","An attacker would need to reproduce consistent depth, thermal, audio, and motion cues simultaneously, making physical staging far costlier than digital manipulation.","Benign edits such as cropping or compression would void the signature, so only untouched capture would carry certification; the paper accepts this and urges skeptical treatment of unmarked content.","The scheme could plug into existing provenance systems like C2PA, adding a credibility layer on top of origin metadata."],"supporting_citations":[{"why":"Defines the C2PA provenance architecture that RealSeal critiques and would integrate with, framing the existing approach this work responds to.","marker":"[13]"},{"why":"Supplies the depth-sensing precedent showing IR depth maps can distinguish real faces from masks, motivating the 3D sensing component.","marker":"[17]"},{"why":"Shows audio-visual synchronization cues can detect forgeries, supporting the audio dimension of the realism scorer.","marker":"[35]"},{"why":"Provides an audio-visual joint learning method for deepfake detection, supporting the multimodal fusion idea.","marker":"[59]"},{"why":"Demonstrates fusion of thermography and depth cameras, supporting the thermal dimension of the approach.","marker":"[51]"},{"why":"Offers multi-level spatial-temporal feature aggregation, underpinning the temporal and depth consistency reasoning.","marker":"[38]"},{"why":"The hash function used to bind image and metadata, making the signature tamper-evident.","marker":"[15]"},{"why":"Provides the secure enclave mechanism that protects model inference and signing, grounding the secure execution requirement.","marker":"[11]"}],"fun_headline_variants":["RealSeal signs reality at capture, not after","Secure enclave signs realism score at the source","Stop chasing deepfakes—certify real from the start","Real-time realism scores, cryptographically signed at capture","Shift media trust from detecting fakes to certifying real"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the assumption that a machine-learning model can reliably tell a genuinely captured scene from a staged or manipulated one across all lighting conditions, locations, and attack strategies, using only the sensor streams.","fun_headline_variants_meta":{"raw":{"variants":["RealSeal signs reality at capture, not after","Secure enclave signs realism score at the source","Stop chasing deepfakes—certify real from the start","Real-time realism scores, cryptographically signed at capture","Shift media trust from detecting fakes to certifying real"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00039,"raw_usage":{"total_tokens":2033,"prompt_tokens":906,"completion_tokens":1127,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":522,"completion_tokens_details":{"reasoning_tokens":1049}},"tokens_in":522,"tokens_out":1127,"duration_ms":9565,"temperature":1.0,"reasoning_tokens":1049,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:49:06.343141+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Record a real scene with a RealSeal prototype, then play that recording back on a high-resolution screen in a room whose depth, thermal, and audio profiles match the original, and film the screen with the same camera; if the resulting realism score stays high, the multisensory criterion has been bypassed and the central claim would fail.","supporting_citations":[{"cited_title":"https://c2pa.org/","cited_arxiv_id":null,"evidence_quote":"Defines the C2PA provenance architecture that RealSeal critiques and would integrate with, framing the existing approach this work responds to."},{"cited_title":"https://developer.apple.com/documentation/avfoundation/ additional_data_capture/streaming_depth_data_from_the_truedepth_camera","cited_arxiv_id":null,"evidence_quote":"Supplies the depth-sensing precedent showing IR depth maps can distinguish real faces from masks, motivating the 3D sensing component."},{"cited_title":"Lever- aging real talking faces via self-supervision for robust forgery detection","cited_arxiv_id":null,"evidence_quote":"Shows audio-visual synchronization cues can detect forgeries, supporting the audio dimension of the realism scorer."},{"cited_title":"Avoid-df: Audio-visual joint learning for detecting deepfake","cited_arxiv_id":null,"evidence_quote":"Provides an audio-visual joint learning method for deepfake detection, supporting the multimodal fusion idea."},{"cited_title":"3d thermal imaging: Fusion of thermography and depth cameras","cited_arxiv_id":null,"evidence_quote":"Demonstrates fusion of thermography and depth cameras, supporting the thermal dimension of the approach."},{"cited_title":"Multi-level spatial- temporal feature aggregation and alignment-based selective residual dense prop- agation module for hdr video reconstruction","cited_arxiv_id":null,"evidence_quote":"Offers multi-level spatial-temporal feature aggregation, underpinning the temporal and depth consistency reasoning."},{"cited_title":"https://en.wikipedia.org/wiki/SHA-2","cited_arxiv_id":null,"evidence_quote":"The hash function used to bind image and metadata, making the signature tamper-evident."},{"cited_title":"https://www.intel.com/content/dam/develop/external/us/en/ documents/overview-of-intel-sgx-enclave-637284.pdf","cited_arxiv_id":null,"evidence_quote":"Provides the secure enclave mechanism that protects model inference and signing, grounding the secure execution requirement."}],"review_version":1}