Provenance versus detection: two different ways to answer "is this real?"

This page is part of the deepfake detection hub. It explains why the checking a face video page puts provenance first and a detector score last, and it rests on the Content Credentials (C2PA) page for the detail of the standard.

01What does provenance verify?

Provenance is a record, made at capture or edit time, of what happened to a file. The C2PA specification, the open standard behind Content Credentials, defines statements about an asset called assertions, bundles them into a claim, signs the claim, and binds the three into a manifest that travels with the file (C2PA specification 2.5). The manifest "is signed with the private key of the software or hardware that performed the operations", so verifying it means checking a signature against a certificate, the same operation a browser performs for a website.

What is verified is therefore narrow and exact. A valid manifest establishes that a named signer made the listed assertions about this exact file, because a hard binding, "one or more cryptographic hashes that uniquely identifies either the entire asset or a portion thereof", ties the claim to the bytes. If the bytes changed after signing, the hash no longer matches and the manifest fails. There is no probability in the result; the signature checks or it does not, and the specification states that the trust decision rests on "the identity of the signer associated with the cryptographic signing key".

02What does detection infer?

A detector never sees a record. It sees the content and returns a score, trained on a set of real and manipulated examples to find the traces a manipulation left behind. The how deepfake detection works page of this section describes the cue families; what matters here is the kind of answer that comes out. A score is a probability, calibrated, if at all, on the detector's own test set, and its meaning is tied to that set's generators, compression and footage.

The published figures show how far that meaning stretches. Deepfake-Eval-2024 collected fakes from 88 websites in 2024 and reported that open-source detectors lost about 50 percent of their AUC for video, 48 percent for audio and 45 percent for images against their original benchmarks; the best off-the-shelf open-source video model, GenConViT, fell from 0.96 to 0.63, and two others, FTCN and Styleflow, scored 0.50 and 0.51, at chance (arXiv 2503.02857). Commercial video models ranged from 0.64 to 0.79. The in-the-wild page of this section carries every one of those rows with its conditions, and the audio detection scores page shows the same gap for speech.

03Why does the evidence ladder put provenance first?

Because the two answers are of different kinds. A verified manifest is a fact about the file's history with a known author; a detector score is an estimate whose error rate depends on conditions the person holding the file usually cannot know. On a clip from the internet the generator is unknown and the platform has re-encoded it, which is exactly the setting in which the 2024 figures were measured, so the score's own error bars are the widest just when it is needed most.

Human judgement sits on the detection side of the ladder too. Nightingale and Farid showed 315 participants StyleGAN2 faces and matched real photographs and measured 48.2 percent accuracy, below the 50 percent of chance; training and feedback raised a second group to 59.0 percent (PNAS 2022). The human or AI page of this section covers the studies. A person inspecting pixels is doing detection without a benchmark.

04What can provenance not do?

Provenance answers the question it was built for and no other. The C2PA Explainer states that Content Credentials "do not provide value judgments about whether a given set of provenance data is 'true'" and that "provenance information alone cannot tell you whether the digital content is true, accurate or factual" (C2PA Explainer 2.2). A signed manifest on a generated video is a correct record of a generated video: the specification's own example is a manifest whose first action is c2pa.created with the source type trainedAlgorithmicMedia.

The larger limit is absence. A manifest can be removed when a platform strips metadata, and "if an asset is cropped using a non-Content Credentials aware tool, the provenance data may not be updated". A file with no manifest is therefore the common case, and the Explainer warns against treating it as suspicious by default: the intention is not "a two-tier media ecosystem where assets without Content Credentials are universally less trusted". When the manifest is missing, provenance returns no answer at all, and the question passes down the ladder to context, corroboration and, last, a detector.

05When does detection earn its place?

Detection is the only tool that works on a file with no history, which is most files. Its place on the ladder is last because of what the published numbers say about its reliability on unseen material, not because it has no use. On a curated benchmark the same detectors are strong: GenConViT scored 0.96 on the data it was built for, and fine-tuning it on part of Deepfake-Eval-2024 raised its in-the-wild AUC from 0.63 to 0.82, a different protocol the authors report separately.

The two routes also combine. FinCEN's November 2024 alert to banks, covered with the other recorded deepfake scam cases, lists both a reverse image search against galleries of generated faces and a flag from "commercial or open-source deepfake detection software" among its red flags, and adds that "no single red flag is necessarily indicative of illicit or suspicious activity". That is the right reading of a detector score: one signal, weighted by its known error rate, never a verdict on its own.

06How to read the two answers together

A verified manifest from a known signer settles where the file came from and what was declared about it; it does not settle whether what the file shows is true. A detector score estimates whether the content was manipulated; the estimate holds for the detector's test conditions and degrades, by the 2024 measurements, to between chance and 0.79 AUC on circulating fakes. Neither answers the other's question, and a page that reports one should say which. The same distinction holds for a face match: a deep learning face recognition score is also an inference from pixels, reported at a fixed false accept rate, not a record.

The practical order follows from that. Check for a manifest first, because a valid one is the strongest evidence available and an invalid one is decisive. If there is none, look for the original and for corroboration of the event from a second source. Run a detector last, and read its output with the published in-the-wild figures beside it.