{"id":"b95976dc-4571-41f7-b2e9-4ca34bdeb5c6","arxiv_id":"2608.07063","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Zero-knowledge proofs enable soft redaction of image provenance assertions by proving distance predicates over hidden location, biometric, and perceptual-hash data without disclosing the values.","lead":"This paper proposes replacing sensitive metadata in image provenance records with zero-knowledge proofs that verify selected properties without revealing the underlying data. It shows this works for location proximity, face similarity, and perceptual fingerprint matching, with proofs generated in seconds and verified in milliseconds.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The distance-proof circuits in Section 4.1 and Section 5.1 prove existence of some witness within radius R but do not bind the witness to the original C2PA assertion value or to a commitment, so a malicious prover can use any nearby descriptor and the trust-preservation/anti-spoofing claims are…","rationale":"The reader's weakest assumption exactly identifies the binding gap, and I agree with it. The paper's central claim is that soft redaction can resolve the provenance-privacy tension without weakening the chain of trust; that requires the proof to be about the same value that was originally signed. The current protocol does not achieve this. Definition 1 includes a commitment, but the implemented circuits use bare existence statements. The absence of a commitment or hash check is not a performance or accuracy issue; it changes the semantics of the proof. A proof of exists phi_ref: d^2(phi_q, phi_ref) <= R^2 is satisfiable by any phi_ref in the ball around phi_q, so it cannot authenticate that the recovered manifest corresponds to the query image. The paper's evaluation measures proving and verification times and recognition error, but not whether a dishonest prover can forge; because the circuit is not binding, the forgery is trivial. This is a strong correctness concern, but it is also readily fixable: add a commitment to the witness and bind that commitment to the C2PA assertion hash inside the proof statement, or explicitly adopt and justify an honest-prover trust model for every use case. The biometric and fingerprint sections should then be re-evaluated under the binding version. The Limitations paragraph discusses low-entropy query leakage through repeated adaptive queries but does not mention the witness-binding issue, so the gap is not acknowledged. I therefore agree with the reader's conditional verdict; no change is needed.","tokens_in":12315,"tokens_out":5498,"duration_ms":47965,"concrete_test":"Modify the Section 5.1 circuit to add the original reference fingerprint's hash H_a as a public input and a constraint hash(phi_ref)=H_a inside the circuit, for example by hashing the quantised witness with SHA-256. Then take a C2PA manifest with reference phi_ref, a query phi_q with ||phi_ref - phi_q||^2 <= R^2, and a second witness phi' != phi_ref with ||phi' - phi_q||^2 <= R^2. Generate proofs using phi_ref and using phi'. If the existing circuit accepts both, it is not binding to the original assertion; only the version with the hash constraint should reject the phi' proof. Repeating the same test on Section 4.1 with a public commitment to q would settle whether the biometric claim is binding.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Definition 1 (Section 3) defines soft redaction with a commitment C=commit(V,r) and a proof of exists V,r: C=commit(V,r) and P(V;theta)=true. However, the implemented biometric and fingerprint protocols do not carry this commitment into the proof statement. Section 4.1's statement is pi: exists q: ||q-v||_2^2 <= R^2 with q private and (v,R^2) public; Section 5.1's statement is pi: exists phi_ref: ||phi_q - phi_ref||_2^2 <= R^2. Neither statement includes C, nor does either check that the witness equals the preimage of the original assertion hash H_a that remains in the signed C2PA claim. The assertion-hash mechanism is invoked in Section 5.1 as retaining a cryptographic binding, but a hash in the signed claim is not a constraint in the arithmetic circuit; the verifier of pi never learns whether the witness is the original value. Without this binding, the proof is vacuous: for any public query v, a prover can choose any witness within radius R (for example phi_ref = phi_q) and generate an accepting proof. In the anti-spoofing scenario this means a spoofed watermark recovery passes for arbitrary images, and in the personality-rights scenario a third party can forge a likeness match without knowing the registered descriptor. The paper does not state an honest-prover trust model; if one is assumed, the anti-spoofing guarantee is still not a property of the proof itself.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes 'soft redaction' for C2PA image-provenance manifests: instead of removing a sensitive assertion, the manifest carries a zero-knowledge proof that the hidden assertion value satisfies a public predicate. The authors define soft redaction with a commitment to the hidden value, then implement three distance-predicate instantiations: (i) GPS proximity using a Chebyshev approximation of Haversine distance in a PLONK circuit; (ii) L2 proximity over facial biometric embeddings for personality-rights enforcement; and (iii) L2 proximity over perceptual fingerprints for anti-spoofing in watermark-based provenance recovery. They report empirical constraint counts, proof sizes, and proof/verification timings on commodity hardware, and evaluate biometric accuracy on LFW and anti-spoofing performance on MIRFLICKR-25k with four fingerprint descriptors.","tokens_in":12697,"tokens_out":3921,"duration_ms":37590,"significance":"If the security claims hold, the paper would make a useful contribution to a genuine problem: provenance transparency versus privacy in C2PA-style content credentials. The paper's concrete strengths are its careful engineering evaluation (circom constraint counts, PLONK vs. Groth16 vs. Bulletproofs comparisons, reproducible dataset choices), the analytic constraint formula 2D+23 for the L2 circuit, and the breadth of use cases. However, the central security claim depends on a binding between the hidden witness and the original signed assertion, and that binding is absent from the implemented circuits. With that gap fixed, the paper could be a solid systems-and-applied-cryptography contribution; without it, the anti-spoofing and personality-rights guarantees are not properties of the proofs as specified.","major_comments":[{"comment":"The implemented proof statement, π: ∃φ_ref: ||φ_q − φ_ref||_2^2 ≤ R^2, omits the commitment C=commit(V,r) that Definition 1 requires, and the C2PA assertion hash H_a is never checked inside the arithmetic circuit. A hash appearing in the signed claim is not a constraint in the R1CS; the verifier of π never learns whether the witness is the original reference fingerprint. Consequently, for any query image with fingerprint φ_q, a prover can set φ_ref=φ_q (or any vector within radius R) and produce an accepting proof. This makes the anti-spoofing claim in Section 5.2 vacuous: a transplanted watermark on an arbitrary image will pass the ZKP check, so the recovered manifest would be accepted despite the spoof. The protocol must either include a commitment-opening or hash-preimage check inside the circuit, or the paper must explicitly adopt an honest-prover trust model and substantially weaken the stated security guarantees.","section":"Section 5.1 and Definition 1"},{"comment":"The biometric circuit proves ∃q: ||q−v||_2^2 ≤ R^2 with q private and (v,R^2) public, but it does not bind q to the registered descriptor stored in the personality-rights registry. A third party can choose v to be its own image embedding and set q=v, producing a valid proof that the image 'matches' the registered descriptor without knowing the registered value. This breaks the claimed personality-rights enforcement, because the proof does not demonstrate any relation to the rights-holder's enrolled biometric template. The circuit needs to verify that q opens a commitment published in the registry (or that q is the preimage of a hash in the signed manifest), matching Definition 1; alternatively, the paper must state that the prover is assumed honest, which would contradict the stated adversarial scenarios.","section":"Section 4.1"},{"comment":"The same binding gap applies to the location proof-of-concept. Definition 1 defines soft redaction as a tuple (C,θ,π) with C=commit(V,r) and a proof of ∃V,r: C=commit(V,r) ∧ P(V;θ), but the described Haversine circuit proves only a predicate over the hidden coordinate and a public threshold; no commitment or assertion hash is part of the circuit statement. Even if location is assumed to originate from a trusted camera-signed assertion, the paper claims that soft redaction is anchored through C2PA's existing signing and redaction mechanisms, and the manuscript does not explain how that anchoring is verified by the ZKP verifier. The authors should clarify whether the commitment condition of Definition 1 is intended to be realized in the implementations, and if so, where; if not, the definition and the protocol descriptions need to be aligned.","section":"Section 3.1"}],"minor_comments":[{"comment":"The text states that 'D=128 offers sub-second proving', but the measured value at D=128 in Figure 1 is 0.96s, which is just above one second; consider saying 'approximately one second' or reporting the actual timing.","section":"Section 4.1"},{"comment":"The caption contains a typo: 'practiality' should be 'practicality'.","section":"Figure 1"},{"comment":"The 'Proofs OK' column reports 5/5 for each model, but only five same-person pairs are proved per model; this sample is too small to demonstrate correctness of the ZKP circuit across the threshold range, though the constraint-level check by circom is reassuring.","section":"Table 3"},{"comment":"The decision threshold R is set as 1.2× the maximum observed benign distance, which is a data-dependent and potentially threshold-sensitive choice; the paper should report sensitivity of the anti-spoofing results to this multiplier.","section":"Section 5.2"}],"recommendation":"major_revision","confidential_remarks":"The paper's engineering work is solid, but the central security claim needs a load-bearing fix: the implemented circuits do not bind the witness to the signed assertion or a published commitment. This is fixable within the manuscript's scope by adding a commitment/hash check to the circuits or by explicitly reframing the contribution as feasibility under an honest-prover model. I would not reject on novelty grounds; the missing binding is the decisive issue."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this is the first paper I've seen that actually builds ZKPs into C2PA provenance for \"soft redaction,\" and the engineering is mostly believable. But the security story has a load-bearing gap: the implemented proof statements don't bind the hidden witness to the original assertion. The abstract and conclusion claim you can replace a sensitive assertion with a ZKP \"without weakening the chain of trust,\" but the proofs as written only show that some secret value is within distance R of a public query. Nothing connects that secret to the value that was originally signed into the manifest.\n\nWhat's genuinely new: applying ZKPs to C2PA assertions is a legitimate first, and the Chebyshev-approximated Haversine circuit for GPS proximity is a nice piece of work. The l2 circuit for biometric/fingerprint distance is simple and well-characterized; the constraint counts, proof sizes, and timings are internally consistent and plausible. The comparison of Bulletproofs/Groth16/PLONK on the same predicate is the right way to make that choice. The paper also flags the adaptive-query leakage problem in its limitations section, which is honest.\n\nThe soft spots: the binding gap is real and central. Section 4.1's proof is `exists q: ||q-v||^2 <= R^2`; Section 5.1's is `exists phi_ref: ||phi_q - phi_ref||^2 <= R^2`. No commitment to the witness, no check against the assertion hash that remains in the signed claim. A malicious prover (or a compromised recovery service) can pick any witness within the radius and pass the check. For anti-spoofing, that means a transplanted watermark would pass if the prover is untrusted. The paper implicitly assumes an honest prover but never says so. That's not fatal to the idea—adding a commitment or explicitly scoping the trust model would fix it—but as written the security claims are overstated. Also, the fingerprint thresholds are calibrated on the same data they're evaluated on (1.2x max benign distance), and no code or data is released. Those are minor relative to the binding issue.\n\nBottom line: it's a solid concept prototype, worth a serious referee, but it needs a major revision to clarify the threat model and either bind the witness or state the honest-prover assumption. I'd point a student working on provenance or ZKP applications to it. I wouldn't cite it directly in my own work until the binding question is resolved.","headline":"First real ZKP-for-C2PA prototype with believable engineering, but the proof statements don't bind the hidden witness to the original assertion, so the security claims need an explicit threat model.","tokens_in":13196,"tokens_out":4409,"would_cite":false,"duration_ms":37425,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Soft redaction replaces sensitive C2PA assertions with zero-knowledge proofs of distance predicates, hiding location, face, and fingerprint values while keeping verification sub-second.","keywords":["content provenance","C2PA","zero-knowledge proofs","soft redaction","distance predicates","biometric embeddings","perceptual hashes","PLONK"],"falsifier":"Generate a soft-redacted biometric or fingerprint proof after replacing the private witness with any different vector that is also within radius $R$ of the public query; because the PLONK circuit checks only the squared-distance predicate and contains no commitment or hash-binding check, the proof will verify, demonstrating that the proven value is not actually bound to the original signed assertion.","tokens_in":12102,"feed_emoji":"🔐","tokens_out":8093,"duration_ms":66648,"temperature":0.7,"pith_summary":"Provenance records strengthen trust in images but can expose private details about where and how they were made. The paper proposes soft redaction: instead of deleting a sensitive C2PA assertion, replace it with a zero-knowledge proof that the hidden value satisfies a chosen distance predicate. It shows this for GPS coordinates (proximity to a public reference point), for facial-biometric embeddings (likeness matching without disclosing the registered face template), and for perceptual hashes (anti-spoofing in watermark-based provenance recovery). The result is that a verifier can check a property in milliseconds while never seeing the underlying value. The cost is proof generation on the order of seconds on commodity hardware, which the paper argues is acceptable for interactive or offline use.","feed_headline":"Sensitive C2PA assertions become verifiable distance proofs","feed_subtitle":"Location, face, and fingerprint values stay hidden while proofs verify in under a second.","key_machinery":"The load-bearing object is the soft-redaction tuple and the $\\ell^2$ distance predicate $\\|v - v_{\\mathrm{ref}}\\|_2 \\le R$, arithmetised as a PLONK circuit of exactly $2D + 23$ constraints: $D$ squarings, a 21-bit range check, and $D+2$ wiring constraints. For GPS, the Haversine distance is reformulated as a comparison on the intermediate accumulator $a = \\sin^2(\\Delta\\phi/2) + \\cos\\phi_1 \\cos\\phi_2 \\sin^2(\\Delta\\lambda/2)$, with sine and cosine replaced by degree-5 Chebyshev polynomials in fixed-point arithmetic. A single universal PLONK setup serves all circuits up to a size bound, which keeps verification at roughly 250 ms and proof size at 768 bytes regardless of dimension. The C2PA assertion hash supplies the cryptographic anchor between the original camera-signed value and the later proof.","core_discovery":"The central discovery is that C2PA's existing hard-redaction mechanism, which keeps the assertion's hash in the signed claim while removing the value, can be turned into a soft-redaction mechanism by attaching a zero-knowledge proof of a predicate over the hidden value. For distance predicates, the paper defines soft redaction as a tuple $(C = \\mathrm{commit}(V,r), \\theta, \\pi)$ proving $\\exists V, r : C = \\mathrm{commit}(V,r) \\land P(V;\\theta)$, and implements the predicate $\\|v - v_{\\mathrm{ref}}\\|_2 \\le R$. Location proximity uses a degree-5 Chebyshev approximation of the Haversine formula inside a PLONK circuit; the same $\\ell^2$ circuit, parameterized by dimension $D$, handles biometric embeddings and perceptual hashes. On standard benchmarks (LFW for faces, MIRFLICKR-25k for fingerprints), proofs over $D=512$ embeddings generate in roughly 6.5 to 6.8 seconds and verify in about 320 to 340 ms, with constant 768-byte proof size.","pith_inferences":["Because the circuit does not bind the hidden witness to a commitment or to the original C2PA assertion hash, soft redaction as described proves the distance predicate but not that the true signed value satisfies it; adding a commitment or hash check inside the circuit would close that gap.","The same distance-predicate construction could be applied to other low-dimensional provenance fields, such as timestamps with an interval predicate, but low-entropy fields must be paired with query limits; otherwise adaptive distance queries can narrow a hidden GPS coordinate to a small region, an attack the paper notes in its limitations.","A practical deployment would likely need a standardized C2PA ZKP assertion type and policy objects that declare which predicates are allowed before publishers and platforms could interoperate at scale.","Soft-redacted perceptual hashes could support privacy-preserving duplicate and near-duplicate detection across platforms, since a platform could check whether an unwatermarked image matches a hidden fingerprint without learning the fingerprint itself."],"forward_implications":["C2PA manifests can support soft redaction today, without modifying the standard, by storing the proof as a custom assertion in an update manifest.","A photojournalist can prove an image was taken within a specified radius of a public reference point without revealing exact GPS coordinates; the degree-5 Chebyshev circuit has p99 error of 36 m at city scale and generates a proof in about 0.64 s.","A personality-rights registry can prove that an image's face embedding matches a registered private template without releasing the template; recognition accuracy at EER thresholds is preserved for ArcFace, FaceNet, AdaFace, and ElasticFace.","Watermark-based provenance recovery can reject spoofed manifests while keeping the reference fingerprint hidden; over MIRFLICKR-25k, the SSCD descriptor rejected all 2,000 transplanted-watermark attacks.","Verification remains sub-second, about 250 to 340 ms, and proof size stays constant at 768 bytes across descriptors from 128 to 2048 dimensions, so the bottleneck is proof generation rather than consumer-side verification."],"supporting_citations":[{"why":"Defines C2PA manifests, assertions, and the hard-redaction hash mechanism that soft redaction extends.","marker":"[13]"},{"why":"Provides the PLONK proving system with universal setup and constant-size proofs used for all circuits in the paper.","marker":"[21]"},{"why":"Groth16 is the baseline with smallest proofs but per-circuit trusted setup, included in the comparison that justifies PLONK.","marker":"[24]"},{"why":"Describes the three-pillar provenance recovery pipeline whose anti-spoofing fingerprint check motivates Section 5.","marker":"[16]"},{"why":"ArcFace is a face recognition embedding model used in the biometric likeness-proof evaluation on LFW.","marker":"[18]"},{"why":"FaceNet is another face embedding model evaluated in the biometric comparison experiments.","marker":"[35]"},{"why":"SSCD is the self-supervised copy-detection descriptor that achieves perfect attack rejection in the fingerprint experiments.","marker":"[33]"},{"why":"TrustMark is the invisible watermark used to embed identifiers in the ZOETROPE pipeline for the fingerprint recovery experiments.","marker":"[7]"},{"why":"MIRFLICKR-25k supplies the 1,000 images and benign/attack pairs used to evaluate fingerprint anti-spoofing.","marker":"[28]"},{"why":"LFW provides the 6,000 same-person and different-person face pairs used for biometric recognition evaluation.","marker":"[27]"}],"fun_headline_variants":["Zero-knowledge proofs hide image provenance details","C2PA provenance gets privacy-preserving distance checks","Prove image proximity without revealing the data","Soft redaction: verifiable claims over hidden provenance","ZKPs turn sensitive assertions into verifiable distances"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme assumes that the person generating the proof uses the exact value from the original signed C2PA record as the hidden witness, because the proof circuit does not itself check that the hidden value is committed or hashed to that assertion.","fun_headline_variants_meta":{"raw":{"variants":["Zero-knowledge proofs hide image provenance details","C2PA provenance gets privacy-preserving distance checks","Prove image proximity without revealing the data","Soft redaction: verifiable claims over hidden provenance","ZKPs turn sensitive assertions into verifiable distances"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00059,"raw_usage":{"total_tokens":2781,"prompt_tokens":969,"completion_tokens":1812,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":585,"completion_tokens_details":{"reasoning_tokens":1755}},"tokens_in":585,"tokens_out":1812,"duration_ms":12161,"temperature":1.0,"reasoning_tokens":1755,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:29:54.381761+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate a soft-redacted biometric or fingerprint proof after replacing the private witness with any different vector that is also within radius $R$ of the public query; because the PLONK circuit checks only the squared-distance predicate and contains no commitment or hash-binding check, the proof will verify, demonstrating that the proven value is not actually bound to the original signed assertion.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines C2PA manifests, assertions, and the hard-redaction hash mechanism that soft redaction extends."},{"cited_title":"Cryptology ePrint Archive, Report 2019/953 (2019)","cited_arxiv_id":null,"evidence_quote":"Provides the PLONK proving system with universal setup and constant-size proofs used for all circuits in the paper."},{"cited_title":"In: Advances in Cryptology – EUROCRYPT","cited_arxiv_id":null,"evidence_quote":"Groth16 is the baseline with smallest proofs but per-circuit trusted setup, included in the comparison that justifies PLONK."},{"cited_title":"IEEE Computer Graphics and Applications (2024)","cited_arxiv_id":null,"evidence_quote":"Describes the three-pillar provenance recovery pipeline whose anti-spoofing fingerprint check motivates Section 5."},{"cited_title":"In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","cited_arxiv_id":null,"evidence_quote":"ArcFace is a face recognition embedding model used in the biometric likeness-proof evaluation on LFW."},{"cited_title":"In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","cited_arxiv_id":null,"evidence_quote":"FaceNet is another face embedding model evaluated in the biometric comparison experiments."},{"cited_title":"In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","cited_arxiv_id":null,"evidence_quote":"SSCD is the self-supervised copy-detection descriptor that achieves perfect attack rejection in the fingerprint experiments."},{"cited_title":"In: IEEE International Conference on Computer Vision (ICCV) (2025)","cited_arxiv_id":null,"evidence_quote":"TrustMark is the invisible watermark used to embed identifiers in the ZOETROPE pipeline for the fingerprint recovery experiments."},{"cited_title":"ACM International Conference on Multimedia Information Retrieval (MIR) (2008)","cited_arxiv_id":null,"evidence_quote":"MIRFLICKR-25k supplies the 1,000 images and benign/attack pairs used to evaluate fingerprint anti-spoofing."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"LFW provides the 6,000 same-person and different-person face pairs used for biometric recognition evaluation."}],"review_version":1}