Provenance is not truth. It is the history of custody and transformation that lets us evaluate a truth claim. A perfect chain of custody can preserve a forgery. A camera can sign a photograph of a staged scene. An authentic document can contain a lie.

What provenance can do is replace appearance with evidence. It can tell us which camera signed a file, who edited it, which model processed a passage, which version existed at a given time, and where the chain goes dark. It cannot tell us whether a witness is honest or an argument is good. That is less than truth. It is also becoming a precondition for finding it.

We often collapse that history into a label: made by a model, shot on a phone, written by a person, issued by a government. But a label is only another claim. The real question is what evidence connects the thing to the claim, who pays a cost for lying, and what would have to be compromised for that evidence to fail.

This is a deep dive in two halves. Theory asks what provenance can actually prove, why every system needs a trust anchor, and why forgery gets more valuable as verification improves. Practice follows the idea from seals and archives to digital signatures, Content Credentials, AI watermarks, and the systems we can build now.

Theory

A history, not a verdict

The word comes from the French provenir: to come from. In archives, provenance means preserving records according to their origin rather than rearranging them by subject. In art, it is the documented path of a work through studios, dealers, collectors, auctions, and museums. In law, chain of custody records who controlled a piece of evidence from collection to courtroom.

All three uses are histories. None guarantees that the object is what someone says it is.

A perfect chain of custody can preserve a forged painting. A camera can cryptographically sign a photograph of a staged scene. An authentic government document can contain a lie. Provenance answers where did this come from and what happened to it? Truth asks does this correspond to reality? The questions reinforce one another, but they are not interchangeable.

This distinction is uncomfortable because provenance feels like a technical route around judgment. It is not. Good provenance narrows the space in which judgment operates. Instead of asking whether a file simply “looks real,” we can ask whether the signer is known, whether the signature is valid, whether the record was altered, whether the device was secure, and whether there are unexplained gaps. It replaces one vague question with a chain of smaller, inspectable ones.

The four claims inside provenance

A useful provenance system makes four different claims:

  • Identity: this actor, device, or organization created or handled the object.
  • Integrity: these exact bytes have not changed since they were signed.
  • Continuity: the transformations between one signed state and the next are recorded.
  • Time: this state existed no later than a particular moment.

Each requires evidence. Identity needs keys or credentials tied to an actor. Integrity needs a cryptographic digest and signature. Continuity needs every meaningful handoff or edit to extend the chain. Time needs a trusted timestamp or an append-only public log.

Leave one out and familiar attacks return. A valid signature from an anonymous key proves that the same unknown key signed something, not who held it. A signed final image proves integrity after signing, not what happened before. A private timestamp can be backdated. A complete history stored by one interested party can be quietly rewritten.

The familiar shortcut is metadata: add fields saying human-written, AI-generated, or unedited. Unsigned metadata is a sticky note. Anyone who can copy the file can rewrite the note. Self-attestation is only slightly better. It says, “Trust this claim because the person making the claim says it is true.” That may be socially useful when reputation is at stake, but it is not durable evidence against an adversary.

Cryptography changes the question

Cryptographic signatures do not make a claim true. They make tampering detectable and move the argument to a more precise place.

If a camera signs a file with a key protected inside secure hardware, we no longer have to guess whether the bytes were modified after capture. We ask whether the manufacturer issued the key correctly, whether the hardware was compromised, whether the clock was trustworthy, and whether the scene itself was staged. The trust has not disappeared. It has become explicit, bounded, and auditable.

That is why “zero trust” is a useful direction but a misleading destination. No provenance system is literally trustless. Even a blockchain asks us to trust its cryptography, software, consensus, key custody, and the bridge between a human or sensor and its on-chain identity. The achievement is not eliminating trust. It is reducing how much hidden trust the system requires and making failures attributable.

The strongest practical provenance is therefore cryptographic, but cryptography is necessary rather than sufficient. The first signature is only as good as the binding between the key and the real-world source. Garbage signed at the source becomes authenticated garbage.

The liar adapts

Provenance is a cat-and-mouse game because verification changes the economics of deception.

When audiences trust screenshots, a fake screenshot is valuable. When platforms add verified badges, stolen accounts and look-alike handles become valuable. When cameras sign images, compromised signing keys and fake capture devices become valuable. When a provenance standard becomes widely trusted, a valid-looking false chain becomes more valuable than an unsigned file ever was.

This is not an argument against provenance. Locks create a market for lockpicks; we still use doors. It is an argument against declaring victory at the first layer. Every system needs key rotation, revocation, transparency, independent verification, and a way to communicate uncertainty. A green check with no threat model becomes a weapon for the attacker who gets one.

The asymmetry matters too. Defenders must make ordinary verification cheap enough that people use it. Attackers need only find the cheapest gap: steal one key, strip one manifest, replay one valid signature, or move the lie outside the signed frame. Provenance works when the chain is easier to inspect than to counterfeit and when a missing chain is visible without being mistaken for proof of fraud.

Facts, truth, and the profitable fake

Facts and truth are not adversaries, but systems can create incentives for fake versions of both.

A false fact is a discrete claim that can be checked: a date, a source, a transaction, a quote. A false truth is a larger frame assembled from individually defensible facts while excluding the ones that would change the conclusion. Provenance helps more with the first than the second. It can show that a clip is authentic while saying nothing about the minute removed before it. It can prove that a person wrote a statement without proving the statement was voluntary.

The benefit of fake provenance rises with the value of the decision it can unlock. A synthetic vacation photo earns attention. A synthetic voice authorizes a wire transfer. A forged medical history changes treatment. A manufactured audit trail changes who bears liability. Once provenance becomes infrastructure for access, payments, evidence, and reputation, attacking it becomes a business model.

The standard must therefore preserve negative space. It should show not only what is attested but what is unknown: who did not sign, which interval is missing, what the signature does not cover, and whether the source can still be challenged. Honest uncertainty is part of the record.

Bridge

Provenance is a claim plus a cost

Every provenance claim should force someone to pay a cost for lying.

A handwritten signature risks reputation and legal liability. A wax seal requires control of the seal. A camera signature requires the device key. A transparency log makes backdating or silent rewriting observable. The cost may be social, physical, legal, or cryptographic, but without one the claim is decoration.

This gives us a practical test: if I falsify the provenance field, what breaks? If the answer is “nothing,” the field is theater. If I must compromise hardware, steal a key, corrupt several independent witnesses, or leave contradictory evidence in a public log, the system is doing real work.

Practice

Before computers: make custody visible

Long before cryptography, societies built provenance out of scarce objects, repeated ceremony, and distributed memory.

Seals made authority physical. A signet ring or institutional stamp was hard to reproduce and visibly damaged when a container was opened. Notaries witnessed signatures and kept independent records. Mints used controlled dies, weight standards, edge lettering, and hallmarks to make substitution expensive. Merchants used bills of lading to record custody as goods moved between ports. Courts required witnesses to account for evidence from collection through trial.

Archives added a deeper insight. The principle of provenance, formalized in European archival practice in the nineteenth century, kept records grouped by the person or institution that created them. Context was part of the evidence. A letter separated from its correspondence could still contain true words, but it lost the relationships that made those words legible.

These systems were imperfect. Seals were stolen. Notaries were bribed. Pedigrees were invented. Their lasting contribution was structural: do not ask a single mark to carry the entire burden. Preserve custody, context, and independent witnesses together.

Digital signatures: evidence over appearance

Digital files destroyed the physical clues people relied on. A millionth copy is byte-for-byte identical to the first. Editing leaves no scrape, broken seal, or different ink. Cryptography restores a form of physical consequence.

A creator hashes a file, producing a short digest that changes when the file changes. They sign that digest with a private key. Anyone with the corresponding public key can verify both that the signer possessed the private key and that the signed bytes have not changed. Trusted timestamping can prove the digest existed by a certain time. Append-only transparency logs can make signatures and certificates publicly auditable and expose attempts to present different histories to different people.

The important unit is not the file alone but the signed event: this key attests that this version existed, in this context, at this time. Each editor can create a new event that points back to the prior one. Provenance becomes a graph of attestations rather than a mutable description field.

What NFTs got right — and wrong

NFTs made one part of provenance culturally visible: a public, tamper-evident sequence of control. For a token, the ledger can show which address minted it and how it moved. That is real provenance for the token.

The category error was treating token provenance as automatic provenance for the referenced object. A token often pointed to a URL or media file. The ledger could prove that an address controlled the token; it could not prove that the minter created the artwork, that the URL would keep resolving, or that the human behind the address was who they claimed to be.

The technology answered ownership of a pointer while the more important problem — trustworthy chain of custody for the media itself — remained open. The lesson is not that blockchains are useless. It is that an immutable record cannot repair a weak first claim. The oracle problem begins wherever reality enters the ledger.

Content Credentials: a better chain for media

The Coalition for Content Provenance and Authenticity, or C2PA, provides an open standard for attaching cryptographically signed provenance manifests to media. A compatible camera can record capture information. Editing software can append transformations. Publishers can add their own assertions. Content Credentials are the user-facing expression of that chain.

This is much closer to the actual problem than a plain “AI” label. It records who is making which claim about which version and lets later tools verify whether the signed material changed.

It still has limits. Credentials can be stripped. Legacy media arrives without them. A valid capture credential does not prove the scene was unstaged. A malicious but authorized device can sign a lie. Verification interfaces can flatten a nuanced chain into a misleading badge. Absence must mean “provenance unavailable,” not “fake”; presence must invite inspection, not end it.

Text watermarks: useful, brittle, and small-ball

Text watermarking usually changes a model’s token choices so that its output contains a statistical pattern detectable with a secret or published method. Unlike file metadata, the signal lives in the wording itself. That makes it capable of surviving copying, pasting, and some editing.

It also puts the signal in the easiest place to transform. Paraphrase the passage, translate it twice, mix output from several models, ask another model to rewrite it, or edit enough words by hand and the statistical evidence weakens. Short passages are hard to classify. Detectors trade false positives against false negatives. Open models have no reason to cooperate. A determined actor can generate unwatermarked text while compliant providers mark only their own users.

That does not make watermarking worthless. It may deter low-effort misuse, support aggregate research, and help cooperative platforms label untouched output. The strongest case for it is the same as spam filtering: an imperfect signal can still reduce harm at scale.

But it is not durable provenance. A rephraser can preserve meaning while obliterating the watermark. That names the structural flaw: language has no canonical byte sequence. The artifact we care about is meaning; the watermark is carried by one surface realization of it.

Detecting whether one cooperative model likely emitted one wording is a narrower problem than showing who requested it, which sources entered the process, what tools transformed it, who approved it, and what version was published. A watermark is a useful classifier. A complete provenance system is a history.

A provenance system worth building now

For media, documents, and AI-assisted work, the practical architecture is a signed chain of events:

  1. Bind identity to keys. People, organizations, devices, and services need scoped signing identities. Keep high-value keys in secure hardware. Make delegation explicit.
  2. Sign at creation. The first device or service records the original bytes, time, capture or generation context, and the policy under which it is making the claim.
  3. Attest every transformation. Editing, model calls, exports, and publication create new signed states that refer to their inputs. Preserve prompts and private source material under access controls; publish digests and the claims safe to reveal.
  4. Use append-only logs. Independent transparency logs make silent rewriting and backdating harder. They also provide an audit trail when a key is later compromised.
  5. Support revocation and challenge. Keys are stolen. Devices fail. Signers lie. A durable system records revocations and disputed claims without deleting the history.
  6. Show gaps honestly. Interfaces distinguish verified, partially verified, stripped, and unknown. They explain what a signature covers and what it cannot prove.
  7. Keep the original. Derived files and summaries point back to the highest-fidelity source. A chain that begins after the decisive transformation is an account, not provenance.

For text, this means signing the production process rather than trying to tattoo the prose. A published essay can carry attestations for origin, machine involvement, source set, human review, and final approval. The visible words remain editable and quotable. The signed version history records how they came to be.

A simple human-facing disclosure might say:

Origin: dictated by Ariel Diaz. Research and first draft: AI-assisted. Claims and sources: reviewed by Ariel Diaz. Final text: approved and cryptographically signed by Ariel Diaz. Full history available.

Today that block is still mostly social attestation. Connected to signed events, controlled keys, and an auditable log, it becomes evidence. The words are not the standard. The verifiable chain behind them is.

The standard is calibrated trust

The goal is not a world in which every object earns a green check. That would recreate the problem as an icon.

The goal is calibrated trust: enough evidence for the stakes of the decision. A meme does not need the chain of custody of a medical image. A bank instruction should not rely on the same provenance as a social post. Systems should make stronger evidence available when consequences rise, without teaching people that unsigned means false or signed means true.

Reality has always reached us through mediation: eyes, language, cameras, institutions, screens. AI did not invent that problem. It industrialized the number of plausible mediators and made their output nearly free.

Provenance is how we keep mediation from becoming amnesia. Not a verdict. Not a watermark. A history whose claims have consequences.

References

Standards and institutions

Text watermarking

Contemporary examples