Soft Redaction of Image Provenance via Zero-Knowledge Proofs

John Collomosse; Muhammad Awan

REVIEW 3 major objections 4 minor 37 references

Soft Redaction of Image Provenance via Zero-Knowledge Proofs

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Soft redaction replaces sensitive C2PA assertions with zero-knowledge proofs of distance predicates, hiding location, face, and fingerprint values while keeping verification sub-second.

desk verdict First real ZKP-for-C2PA prototype with believable engineering, but the proof statements don't bind the hidden witness to the original assertion, so the security claims need an explicit threat model. read the letter →

arxiv 2608.07063 v1 pith:EHP2FAXS submitted 2026-08-07 cs.CR cs.AI

Muhammad Awan , John Collomosse This is my paper · ORCID

classification cs.CRcs.AI

keywords contentprovenanceC2PAzero-knowledgeproofssoftredactiondistancepredicatesbiometricembeddingsperceptualhashesPLONK

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Provenance records strengthen trust in images but can expose private details about where and how they were made. The paper proposes soft redaction: instead of deleting a sensitive C2PA assertion, replace it with a zero-knowledge proof that the hidden value satisfies a chosen distance predicate. It shows this for GPS coordinates (proximity to a public reference point), for facial-biometric embeddings (likeness matching without disclosing the registered face template), and for perceptual hashes (anti-spoofing in watermark-based provenance recovery). The result is that a verifier can check a property in milliseconds while never seeing the underlying value. The cost is proof generation on the order of seconds on commodity hardware, which the paper argues is acceptable for interactive or offline use.

What carries the argument

The load-bearing object is the soft-redaction tuple and the $\ell^2$ distance predicate $\|v - v_{\mathrm{ref}}\|_2 \le R$, arithmetised as a PLONK circuit of exactly $2D + 23$ constraints: $D$ squarings, a 21-bit range check, and $D+2$ wiring constraints. For GPS, the Haversine distance is reformulated as a comparison on the intermediate accumulator $a = \sin^2(\Delta\phi/2) + \cos\phi_1 \cos\phi_2 \sin^2(\Delta\lambda/2)$, with sine and cosine replaced by degree-5 Chebyshev polynomials in fixed-point arithmetic. A single universal PLONK setup serves all circuits up to a size bound, which keeps verification at roughly 250 ms and proof size at 768 bytes regardless of dimension. The C2PA assertion hash supplies the cryptographic anchor between the original camera-signed value and the later proof.

What would settle it

Generate a soft-redacted biometric or fingerprint proof after replacing the private witness with any different vector that is also within radius $R$ of the public query; because the PLONK circuit checks only the squared-distance predicate and contains no commitment or hash-binding check, the proof will verify, demonstrating that the proven value is not actually bound to the original signed assertion.

Watch

Extended reading notes

Core claim

The central discovery is that C2PA's existing hard-redaction mechanism, which keeps the assertion's hash in the signed claim while removing the value, can be turned into a soft-redaction mechanism by attaching a zero-knowledge proof of a predicate over the hidden value. For distance predicates, the paper defines soft redaction as a tuple $(C = \mathrm{commit}(V,r), \theta, \pi)$ proving $\exists V, r : C = \mathrm{commit}(V,r) \land P(V;\theta)$, and implements the predicate $\|v - v_{\mathrm{ref}}\|_2 \le R$. Location proximity uses a degree-5 Chebyshev approximation of the Haversine formula inside a PLONK circuit; the same $\ell^2$ circuit, parameterized by dimension $D$, handles biometric embeddings and perceptual hashes. On standard benchmarks (LFW for faces, MIRFLICKR-25k for fingerprints), proofs over $D=512$ embeddings generate in roughly 6.5 to 6.8 seconds and verify in about 320 to 340 ms, with constant 768-byte proof size.

Load-bearing premise

The scheme assumes that the person generating the proof uses the exact value from the original signed C2PA record as the hidden witness, because the proof circuit does not itself check that the hidden value is committed or hashed to that assertion.

Editorial extensions

If this is right

C2PA manifests can support soft redaction today, without modifying the standard, by storing the proof as a custom assertion in an update manifest.
A photojournalist can prove an image was taken within a specified radius of a public reference point without revealing exact GPS coordinates; the degree-5 Chebyshev circuit has p99 error of 36 m at city scale and generates a proof in about 0.64 s.
A personality-rights registry can prove that an image's face embedding matches a registered private template without releasing the template; recognition accuracy at EER thresholds is preserved for ArcFace, FaceNet, AdaFace, and ElasticFace.
Watermark-based provenance recovery can reject spoofed manifests while keeping the reference fingerprint hidden; over MIRFLICKR-25k, the SSCD descriptor rejected all 2,000 transplanted-watermark attacks.
Verification remains sub-second, about 250 to 340 ms, and proof size stays constant at 768 bytes across descriptors from 128 to 2048 dimensions, so the bottleneck is proof generation rather than consumer-side verification.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the circuit does not bind the hidden witness to a commitment or to the original C2PA assertion hash, soft redaction as described proves the distance predicate but not that the true signed value satisfies it; adding a commitment or hash check inside the circuit would close that gap.
The same distance-predicate construction could be applied to other low-dimensional provenance fields, such as timestamps with an interval predicate, but low-entropy fields must be paired with query limits; otherwise adaptive distance queries can narrow a hidden GPS coordinate to a small region, an attack the paper notes in its limitations.
A practical deployment would likely need a standardized C2PA ZKP assertion type and policy objects that declare which predicates are allowed before publishers and platforms could interoperate at scale.
Soft-redacted perceptual hashes could support privacy-preserving duplicate and near-duplicate detection across platforms, since a platform could check whether an unwatermarked image matches a hidden fingerprint without learning the fingerprint itself.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The short version: this is the first paper I've seen that actually builds ZKPs into C2PA provenance for "soft redaction," and the engineering is mostly believable. But the security story has a load-bearing gap: the implemented proof statements don't bind the hidden witness to the original assertion. The abstract and conclusion claim you can replace a sensitive assertion with a ZKP "without weakening the chain of trust," but the proofs as written only show that some secret value is within distance R of a public query. Nothing connects that secret to the value that was originally signed into the manifest.

What's genuinely new: applying ZKPs to C2PA assertions is a legitimate first, and the Chebyshev-approximated Haversine circuit for GPS proximity is a nice piece of work. The l2 circuit for biometric/fingerprint distance is simple and well-characterized; the constraint counts, proof sizes, and timings are internally consistent and plausible. The comparison of Bulletproofs/Groth16/PLONK on the same predicate is the right way to make that choice. The paper also flags the adaptive-query leakage problem in its limitations section, which is honest.

The soft spots: the binding gap is real and central. Section 4.1's proof is `exists q: ||q-v||^2 <= R^2`; Section 5.1's is `exists phi_ref: ||phi_q - phi_ref||^2 <= R^2`. No commitment to the witness, no check against the assertion hash that remains in the signed claim. A malicious prover (or a compromised recovery service) can pick any witness within the radius and pass the check. For anti-spoofing, that means a transplanted watermark would pass if the prover is untrusted. The paper implicitly assumes an honest prover but never says so. That's not fatal to the idea—adding a commitment or explicitly scoping the trust model would fix it—but as written the security claims are overstated. Also, the fingerprint thresholds are calibrated on the same data they're evaluated on (1.2x max benign distance), and no code or data is released. Those are minor relative to the binding issue.

Bottom line: it's a solid concept prototype, worth a serious referee, but it needs a major revision to clarify the threat model and either bind the witness or state the honest-prover assumption. I'd point a student working on provenance or ZKP applications to it. I wouldn't cite it directly in my own work until the binding question is resolved.

Referee Report

3 major / 4 minor

Summary. The paper proposes 'soft redaction' for C2PA image-provenance manifests: instead of removing a sensitive assertion, the manifest carries a zero-knowledge proof that the hidden assertion value satisfies a public predicate. The authors define soft redaction with a commitment to the hidden value, then implement three distance-predicate instantiations: (i) GPS proximity using a Chebyshev approximation of Haversine distance in a PLONK circuit; (ii) L2 proximity over facial biometric embeddings for personality-rights enforcement; and (iii) L2 proximity over perceptual fingerprints for anti-spoofing in watermark-based provenance recovery. They report empirical constraint counts, proof sizes, and proof/verification timings on commodity hardware, and evaluate biometric accuracy on LFW and anti-spoofing performance on MIRFLICKR-25k with four fingerprint descriptors.

Significance. If the security claims hold, the paper would make a useful contribution to a genuine problem: provenance transparency versus privacy in C2PA-style content credentials. The paper's concrete strengths are its careful engineering evaluation (circom constraint counts, PLONK vs. Groth16 vs. Bulletproofs comparisons, reproducible dataset choices), the analytic constraint formula 2D+23 for the L2 circuit, and the breadth of use cases. However, the central security claim depends on a binding between the hidden witness and the original signed assertion, and that binding is absent from the implemented circuits. With that gap fixed, the paper could be a solid systems-and-applied-cryptography contribution; without it, the anti-spoofing and personality-rights guarantees are not properties of the proofs as specified.

major comments (3)

[Section 5.1 and Definition 1] The implemented proof statement, π: ∃φ_ref: ||φ_q − φ_ref||_2^2 ≤ R^2, omits the commitment C=commit(V,r) that Definition 1 requires, and the C2PA assertion hash H_a is never checked inside the arithmetic circuit. A hash appearing in the signed claim is not a constraint in the R1CS; the verifier of π never learns whether the witness is the original reference fingerprint. Consequently, for any query image with fingerprint φ_q, a prover can set φ_ref=φ_q (or any vector within radius R) and produce an accepting proof. This makes the anti-spoofing claim in Section 5.2 vacuous: a transplanted watermark on an arbitrary image will pass the ZKP check, so the recovered manifest would be accepted despite the spoof. The protocol must either include a commitment-opening or hash-preimage check inside the circuit, or the paper must explicitly adopt an honest-prover trust model and substantially weaken the stated security guarantees.
[Section 4.1] The biometric circuit proves ∃q: ||q−v||_2^2 ≤ R^2 with q private and (v,R^2) public, but it does not bind q to the registered descriptor stored in the personality-rights registry. A third party can choose v to be its own image embedding and set q=v, producing a valid proof that the image 'matches' the registered descriptor without knowing the registered value. This breaks the claimed personality-rights enforcement, because the proof does not demonstrate any relation to the rights-holder's enrolled biometric template. The circuit needs to verify that q opens a commitment published in the registry (or that q is the preimage of a hash in the signed manifest), matching Definition 1; alternatively, the paper must state that the prover is assumed honest, which would contradict the stated adversarial scenarios.
[Section 3.1] The same binding gap applies to the location proof-of-concept. Definition 1 defines soft redaction as a tuple (C,θ,π) with C=commit(V,r) and a proof of ∃V,r: C=commit(V,r) ∧ P(V;θ), but the described Haversine circuit proves only a predicate over the hidden coordinate and a public threshold; no commitment or assertion hash is part of the circuit statement. Even if location is assumed to originate from a trusted camera-signed assertion, the paper claims that soft redaction is anchored through C2PA's existing signing and redaction mechanisms, and the manuscript does not explain how that anchoring is verified by the ZKP verifier. The authors should clarify whether the commitment condition of Definition 1 is intended to be realized in the implementations, and if so, where; if not, the definition and the protocol descriptions need to be aligned.

minor comments (4)

[Section 4.1] The text states that 'D=128 offers sub-second proving', but the measured value at D=128 in Figure 1 is 0.96s, which is just above one second; consider saying 'approximately one second' or reporting the actual timing.
[Figure 1] The caption contains a typo: 'practiality' should be 'practicality'.
[Table 3] The 'Proofs OK' column reports 5/5 for each model, but only five same-person pairs are proved per model; this sample is too small to demonstrate correctness of the ZKP circuit across the threshold range, though the constraint-level check by circom is reassuring.
[Section 5.2] The decision threshold R is set as 1.2× the maximum observed benign distance, which is a data-dependent and potentially threshold-sensitive choice; the paper should report sensitivity of the anti-spoofing results to this multiplier.

Circularity Check

0 steps flagged · score 1.0 of 10

No material circularity: the distance-proof circuits and Chebyshev approximation are self-contained and independently testable; the paper's self-citations are peripheral, and the commitment-binding gap is a security limitation rather than a circular derivation.

full rationale

The central derivation chain is arithmetic and measured, not definitional. In Section 3.1, the geodesic predicate d <= R is reformulated exactly as a <= sin^2(R/(2R_earth)) using the Haversine identity, and the only approximation is a degree-d Chebyshev fit of sin/cos whose p99 error is empirically tabulated over random coordinate pairs; the error is absorbed into the acceptance threshold. This is a standard quantified approximation, not a circular definition. In Section 4.1, the L2 predicate is computed directly as sum_i (q_i^(int) - v_i^(int))^2 <= R^2 S^2, with no fitted parameter inside the circuit; the threshold R is an external application choice, and Table 3's R* values are measured EER operating points on LFW, not predictions generated by the ZKP. Section 5 reuses the same circuit unchanged; the anti-spoofing threshold R = 1.2x the maximum observed benign L2 distance is an evaluation calibration, not a fitted quantity later renamed as a result. The paper does cite the authors' prior work (ZOETROPE [14], SimProv [4,5], ARCHANGEL [15], and the three-pillar pipeline [16]), but these are used as components, datasets, or design context; the proof-construction claims and timing measurements do not reduce to those citations. There is a genuine gap between Definition 1's commitment-based statement (C = commit(V,r) appears in the proof predicate) and the implemented statements, e.g. Section 5.1's pi: exists phi_ref: ||phi_q - phi_ref||^2 <= R^2 with no hash or commitment check binding the witness to the original C2PA assertion. That is a security/trust-model deficiency, not circularity: the circuit does not assume the conclusion it is used to claim. The Limitations section also candidly flags adaptive-query leakage, again a threat-model issue rather than a circular step. Accordingly, no circular step meets the evidentiary bar for a 6+ score; the score of 1 reflects only the presence of non-load-bearing self-citations.

Assumptions & free parameters 4 free parameters · 6 assumptions · 0 invented entities

The scheme's trusted inputs include hand-chosen Chebyshev coefficients and quantization scale, data-fitted thresholds, and two unstated security assumptions: the assertion hash binds the proof to the original value, and the prover is honest. The l2 circuit itself is simple and contributes no free parameters beyond these.

free parameters (4)

Chebyshev coefficients for sine and cosine (degree 5) = not reported; degree-5 approximation over [-pi/2, pi/2]
Fitted to minimize approximation error for the Haversine circuit; p99 error reported in Table 1.
Quantization scale S = 1000
Chosen by hand to balance fixed-point precision and circuit size; affects threshold R^2 S^2 and range-check bit width.
Biometric threshold R* per model = 1.306 (ArcFace), 1.115 (FaceNet), 1.282 (AdaFace), 1.290 (ElasticFace-Arc), 1.298 (ElasticFace-Cos)
Set to each model's empirical EER threshold on LFW; used as public input l2sq_thresh in the ZKP.
Fingerprint threshold R per descriptor = 1.028 (RN18), 1.040 (DINO), 0.385 (SimProv), 1.086 (SSCD)
Set to 1.2x maximum observed benign l2 distance on the same 1000 MIRFLICKR images; benign acceptance is guaranteed by construction.

assumptions (6)

standard math Haversine distance predicate equivalence: d <= R iff a <= sin^2(R/(2R_earth))
Used in Section 3.1 to avoid computing arcsin in-circuit; valid for the relevant range of R.
domain assumption Chebyshev approximation error can be absorbed into the acceptance threshold without breaking the distance predicate for all inputs
The paper states error epsilon_d is absorbed into the threshold, but no formal bound guarantees no false accepts or rejects over the full input range.
ad hoc to paper C2PA assertion hash Ha provides a binding between the original assertion and the attached proof
The paper asserts this in Section 3, but the proof statements in Sections 4.1 and 5.1 do not reference Ha or any commitment, so the binding is not established by the described circuits.
ad hoc to paper The prover is honest and uses the true registered or signed witness when generating proofs
The protocols only prove existence of some witness within R; without an honest-prover assumption the anti-spoofing and personality-rights claims do not follow.
domain assumption Face recognition embeddings are unit-normalized and identity matching is equivalent to l2 distance thresholding
Relied on in Section 4; this is standard for ArcFace, FaceNet, AdaFace, and ElasticFace, but it is an empirical property, not a theorem.
standard math PLONK proof system is sound under its standard assumptions
Adopted in Section 3.2; standard cryptographic assumption for the SNARK.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Soft Redaction of Image Provenance via Zero-Knowledge Proofs." pith.science (2026). https://pith.science/paper/EHP2FAXS

@misc{pith2026260807063,
  author       = {Pith},
  title        = {Pith review of: Soft Redaction of Image Provenance via Zero-Knowledge Proofs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EHP2FAXS}},
  note         = {Machine review of arXiv:2608.07063}
}

read the original abstract

Content provenance standards, such as C2PA, are increasingly used to attach signed records of origin, editing history, and rights to digital images. However, provenance transparency can conflict with privacy -- assertions that strengthen trust in an image may also reveal sensitive information about the creator or capture context. We propose soft redaction for image provenance: a mechanism that replaces sensitive provenance assertions with zero-knowledge proofs (ZKPs) of selected properties over hidden data. Our work focuses on distance proofs. We first show how location assertions can support proofs of proximity to a public reference point, using Chebyshev polynomial approximations within the ZKP proof circuit. We then extend the approach to L2 distance proofs over biometric embeddings, enabling privacy-preserving claims related to likeness to help enforce personality rights with images. Finally, we apply the same distance-proof construction to perceptual hashes (visual fingerprints), supporting an anti-spoofing use case in watermark-based recovery of stripped provenance metadata. Our results demonstrate that ZKPs over image provenance can provide practical soft-redaction capabilities, compatible with C2PA, that may be constructed in seconds and verified in milliseconds.

Figures

Figures reproduced from arXiv: 2608.07063 by the authors.

**Figure 1.** Exploring the practiality of ZKP using PLONK. Proof constraint count (exact formula 2D + 23, left axis) and measured prove time (right axis; N = 5 proofs per point, PLONK, M3 Max CPU) as a function of embedding dimension D. D ≤ 512: pot12; D = 1024: pot13; D = 2048: pot14. Prove time grows super-linearly as each SRS tier doubling multiplies MSM cost (≈3× per tier on M3 Max CPU). The vertical dashed line marks the D … view at source ↗

**Figure 2.** Left: Detection Error Trade-off (DET) curves for the five face recognition models evaluated on LFW. The false accept rate (FAR) is the percentage of different-person pairs incorrectly accepted as a match. The false reject rate (FRR) is the percentage of same-person pairs incorrectly rejected. The equal-error rate (EER) is where FAR and FRR become equal. Right: Proof of concept personality rights implementation show… view at source ↗

**Figure 3.** ℓ2 distance distributions for four descriptors (RN18-IN, DINO, SimProv, SSCD) across 5,000 benign transforms (blue) and 2,000 transplant attacks (red) on 1,000 MIRFLICKR-25k reference images. Dashed orange line: decision threshold R. Descriptors ordered left-to-right by training specificity. verification [4], extended to use global-average pooling over local spatial features [5]. SSCD [33] (512D) is a ResNet-50 tr… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

37 extracted references · 36 canonical work pages

[1]

In: CVPR Workshop on Media Forensics (CVPRW), 2023 (2023)

Balan, K., Agarwal, S., Jenni, S., Parsons, A., Gilbert, A., Collomosse, J.: EK- ILA: Synthetic Media Provenance and Attribution for Generative Art. In: CVPR Workshop on Media Forensics (CVPRW), 2023 (2023)

work page 2023
[2]

In: Conference on Visual Media Production (CVMP), 2023 (2023)

Balan, K., Black, A., Jenni, S., Gilbert, A., Parsons, A., Collomosse, J.: DEC- ORAIT - DECentralized Opt-in/out Registry for AI Training. In: Conference on Visual Media Production (CVMP), 2023 (2023)

work page 2023
[3]

In: International Conference on AI and the Digital Economy (CADE), 2025 (2025)

Balan, K., Gilbert, A., Collomosse, J.: Content ARCs: Decentralized Content Rights in the Age of Generative AI. In: International Conference on AI and the Digital Economy (CADE), 2025 (2025)

work page 2025
[4]

In: CVPR Workshop on Media Forensics (CVPRW), 2021 (2021)

Black, A., Bui, T., Jin, H., Swaminathan, V., Collomosse, J.: Deep Image Com- parator: Learning to Visualize Editorial Change. In: CVPR Workshop on Media Forensics (CVPRW), 2021 (2021)

work page 2021
[5]

SImProv: Scalable Image Provenance Framework for Robust Content Attribution

Black, A., Bui, T., Jenni, S., Zhang, Z., Swaminanthan, V., Collomosse, J.: SImProv: Scalable image provenance framework for robust content attribution. arXiv:2206.14245 (2022)

work page Pith review arXiv 2022
[6]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)

Boutros, F., Damer, N., Kirchbuchner, F., Kuijper, A.: ElasticFace: Elastic Margin Loss for Deep Face Recognition. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). pp. 1389–1398 (2022)

work page 2022
[7]

In: IEEE International Conference on Computer Vision (ICCV) (2025)

Bui, T., Agarwal, S., Collomosse, J.: TrustMark: Robust watermarking and water- mark removal for arbitrary resolution images. In: IEEE International Conference on Computer Vision (ICCV) (2025)

work page 2025
[8]

IEEE Transactions on Multimedia (2020)

Bui, T., Cooper, D., Collomosse, J., Bell, M., Green, A., Sheridan, J., Higgins, J., Das, A., Keller, J., Thereaux, O.: Tamper-proofing video with hierarchical atten- tion autoencoder hashing on blockchain. IEEE Transactions on Multimedia (2020)

work page 2020

Show all 37 references

[9]

In: CVPR Work- shops (Computer Vision, AI and Blockchain) (2019)

Bui, T., Cooper, D., Collomosse, J., Bell, M., Green, A., Sheridan, J., Higgins, J., Das, A., Keller, J., Thereaux, O., Brown, A.: ARCHANGEL: Tamper-proofing video archives using temporal content hashes on the blockchain. In: CVPR Work- shops (Computer Vision, AI and Blockchai...

2019
[10]

In: IEEE Symposium on Security and Privacy (S&P)

Bünz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., Maxwell, G.: Bulletproofs: Short Proofs for Confidential Transactions and More. In: IEEE Symposium on Security and Privacy (S&P). pp. 315–334 (2018)

2018
[11]

In: IEEE/CVF In- ternational Conference on Computer Vision (ICCV)

Caron, M., Touvron, H., Misra, I., Jégou, H., Mairal, J., Bojanowski, P., Joulin, A.: Emerging properties in self-supervised vision transformers. In: IEEE/CVF In- ternational Conference on Computer Vision (ICCV). pp. 9630–9640 (2021)

2021
[12]

In: ACM European Conference on Com- puter Systems (EuroSys) (2024)

Chen, B.J., Waiwitlikhit, S., Stoica, I., Kang, D.: ZKML: An optimizing system for ML inference in zero-knowledge proofs. In: ACM European Conference on Com- puter Systems (EuroSys) (2024)

2024
[13]

Coalition for Content Provenance and Authenticity: C2PA Technical Specification (2026), version 2.4,https://spec.c2pa.org/specifications/specifications/ 2.4/index.html

2026
[14]

IEEE Computer Graphics and Applications (2026)

Collomosse, J., Balan, K., Awan, M., Agarwal, S., Hurwitz, N., Parsons, A.: ZOETROPE: A decentralized framework for licensing visual content for generative AI. IEEE Computer Graphics and Applications (2026)

2026
[15]

In: ACM DocEng (2018)

Collomosse, J., Bui, T., Brown, A., Sheridan, J., Green, A., Bell, M., Fawcett, J., Higgins, J., Thereaux, O.: ARCHANGEL: Trusted archives of digital public documents. In: ACM DocEng (2018)

2018
[16]

IEEE Computer Graphics and Applications (2024)

Collomosse, J., Parsons, A.: To Authenticity, and Beyond! Building Safe and Fair Generative AI upon the Three Pillars of Provenance. IEEE Computer Graphics and Applications (2024)

2024
[17]

In: IEEE Symposium on Security and Privacy (S&P) (2025), iACR ePrint 2024/1066 16 M

Datta, T., Chen, B., Boneh, D.: VerITAS: Verifying image transformations at scale. In: IEEE Symposium on Security and Privacy (S&P) (2025), iACR ePrint 2024/1066 16 M. Awan and J. Collomosse

2025
[18]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Deng, J., Guo, J., Xue, N., Zafeiriou, S.: ArcFace: Additive Angular Margin Loss for Deep Face Recognition. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 4690–4699 (2019)

2019
[19]

In: Proceedings of the 12th ACM Multimedia Systems Con- ference (MMSys) (2021)

England, P., Malvar, H.S., Horvitz, E., Stokes, J.W.: AMP: Authentication of media via provenance. In: Proceedings of the 12th ACM Multimedia Systems Con- ference (MMSys) (2021)

2021
[20]

arXiv:2404.14983 (2024)

Ernstberger, J., Zhang, C., Ciprian, L., Jovanovic, P., Steinhorst, S.: Zero- knowledge location privacy via accurate floating-point SNARKs. arXiv:2404.14983 (2024)

2024 arXiv
[21]

Cryptology ePrint Archive, Report 2019/953 (2019)

Gabizon, A., Williamson, Z.J., Ciobanu, O.: PLONK: Permutations over Lagrange- bases for Oecumenical Noninteractive arguments of Knowledge. Cryptology ePrint Archive, Report 2019/953 (2019)

2019
[22]

arXiv:1502.04015 (2015)

Gipp, B., Meuschke, N., Gernandt, A.: Decentralized trusted timestamping using the crypto currency Bitcoin. arXiv:1502.04015 (2015)

2015 arXiv
[23]

IACR ePrint 2026/641 (2026)

Greiner, G., Mowery, T., Soni, P.: HyperVerITAS: Verifying image transformations at scale on boolean hypercubes. IACR ePrint 2026/641 (2026)

2026
[24]

In: Advances in Cryptology – EUROCRYPT

Groth, J.: On the Size of Pairing-Based Non-interactive Arguments. In: Advances in Cryptology – EUROCRYPT. pp. 305–326 (2016)

2016
[25]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 770–778 (2016)

2016
[26]

GitHub,https://github.com/archangel-dlt/angels-wings(2019)

Higgins, J.: Angel’s Wings: ARCHANGEL photo authenticity browser extension. GitHub,https://github.com/archangel-dlt/angels-wings(2019)

2019
[27]

Huang, G.B., Ramesh, M., Berg, T., Learned-Miller, E.: Labeled Faces in the Wild: A Database for Studying Face Recognition in Unconstrained Environments. Tech. Rep. 07-49, University of Massachusetts, Amherst (2007)

2007
[28]

ACM International Conference on Multimedia Information Retrieval (MIR) (2008)

Huiskes, M.J., Lew, M.S.: The MIR Flickr retrieval evaluation. ACM International Conference on Multimedia Information Retrieval (MIR) (2008)

2008
[29]

arXiv:2211.04775 (2022)

Kang, D., Hashimoto, T., Stoica, I., Sun, Y.: ZK-IMG: Attested images via zero- knowledge proofs to fight disinformation. arXiv:2211.04775 (2022)

2022 arXiv
[30]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Kim, M., Jain, A.K., Liu, X.: AdaFace: Quality Adaptive Margin for Face Recog- nition. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 18739–18749 (2022)

2022
[31]

In: IEEE Symposium on Security and Privacy (S&P)

Naveh, A., Tromer, E.: PhotoProof: Cryptographic image authentication for any set of permissible transformations. In: IEEE Symposium on Security and Privacy (S&P). pp. 255–271 (2016)

2016
[32]

In: Advances in Cryptology – EUROCRYPT

Paillier, P.: Public-Key Cryptosystems Based on Composite Degree Residuosity Classes. In: Advances in Cryptology – EUROCRYPT. pp. 223–238 (1999)

1999
[33]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Pizzi, E., Cole, E., Bhatt, U., Rossler, A., Kim, S., Szegedy, C., Joulin, A., Schwing, A.G., Beaumont, R.: A Self-Supervised Descriptor for Image Copy Detection. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 14532–14542 (2022)

2022
[34]

Rivadeneira, J.: C2PA Content Credentials and the Surveillance Risk: Adversarial Scenarios and Governance Gaps in the Content Provenance Ecosystem (2026), WITNESS.org,https://library.witness.org/product/c2pa-privacy/

2026
[35]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

Schroff, F., Kalenichenko, D., Philbin, J.: FaceNet: A Unified Embedding for Face Recognition and Clustering. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 815–823 (2015)

2015
[36]

SSRN (2025)

Thakur, A.: Safeguarding Identity: A Comparative Analysis of Law for Personality Rights in The United States & India. SSRN (2025)

2025
[37]

Foundations and Trends in Privacy and Security, Now Publishers (2022)

Thaler, J.: Proofs, Arguments, and Zero-Knowledge. Foundations and Trends in Privacy and Security, Now Publishers (2022)

2022

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

In: CVPR Workshop on Media Forensics (CVPRW), 2023 (2023)

Balan, K., Agarwal, S., Jenni, S., Parsons, A., Gilbert, A., Collomosse, J.: EK- ILA: Synthetic Media Provenance and Attribution for Generative Art. In: CVPR Workshop on Media Forensics (CVPRW), 2023 (2023)

work page 2023

[2] [2]

In: Conference on Visual Media Production (CVMP), 2023 (2023)

Balan, K., Black, A., Jenni, S., Gilbert, A., Parsons, A., Collomosse, J.: DEC- ORAIT - DECentralized Opt-in/out Registry for AI Training. In: Conference on Visual Media Production (CVMP), 2023 (2023)

work page 2023

[3] [3]

In: International Conference on AI and the Digital Economy (CADE), 2025 (2025)

Balan, K., Gilbert, A., Collomosse, J.: Content ARCs: Decentralized Content Rights in the Age of Generative AI. In: International Conference on AI and the Digital Economy (CADE), 2025 (2025)

work page 2025

[4] [4]

In: CVPR Workshop on Media Forensics (CVPRW), 2021 (2021)

Black, A., Bui, T., Jin, H., Swaminathan, V., Collomosse, J.: Deep Image Com- parator: Learning to Visualize Editorial Change. In: CVPR Workshop on Media Forensics (CVPRW), 2021 (2021)

work page 2021

[5] [5]

SImProv: Scalable Image Provenance Framework for Robust Content Attribution

Black, A., Bui, T., Jenni, S., Zhang, Z., Swaminanthan, V., Collomosse, J.: SImProv: Scalable image provenance framework for robust content attribution. arXiv:2206.14245 (2022)

work page Pith review arXiv 2022

[6] [6]

In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW)

Boutros, F., Damer, N., Kirchbuchner, F., Kuijper, A.: ElasticFace: Elastic Margin Loss for Deep Face Recognition. In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). pp. 1389–1398 (2022)

work page 2022

[7] [7]

In: IEEE International Conference on Computer Vision (ICCV) (2025)

Bui, T., Agarwal, S., Collomosse, J.: TrustMark: Robust watermarking and water- mark removal for arbitrary resolution images. In: IEEE International Conference on Computer Vision (ICCV) (2025)

work page 2025

[8] [8]

IEEE Transactions on Multimedia (2020)

Bui, T., Cooper, D., Collomosse, J., Bell, M., Green, A., Sheridan, J., Higgins, J., Das, A., Keller, J., Thereaux, O.: Tamper-proofing video with hierarchical atten- tion autoencoder hashing on blockchain. IEEE Transactions on Multimedia (2020)

work page 2020