The C2PA AI disclosure pack

The C2PA content-credentials model applied to the model itself: a claim signed by a credential a relying party can check, and what the claim is about bound to it by hash.

khalm-reading-c2pa-ai-disclosure-2.2 · version 1.0.0 · 3 rules, 2 of them mandatory

The document it is written from

C2PA Technical Specification 2.2. The specification published by the Coalition for Content Provenance and Authenticity.

Three rules, reading C2PA's claim signature and hard binding for a record rather than for a media asset.

The rules

Only the mandatory rules decide a pack's finding. A recommended rule that fails is reported and does not, on its own, make a record non-compliant. Each rule's words below are the pack's own.

`c2pa-claim-signature` mandatory

The claim is signed by a credential a relying party can evaluate, not merely by whoever held a key. Checks: the record declares an attestation_level of software or stronger. Does not check: that the issuer attests at that level in fact. The level is the issuer's own claim about itself, and this rule reads only that claim; what the trust store grants the signing key is a different question, which the verifier answers (trust.attestation) before any pack is evaluated. No C2PA credential, certificate chain or conformance program is examined here.

C2PA Technical Specification 2.2, Signing a Claim, and Digital Signatures

`c2pa-hard-binding` mandatory

What the claim is about is bound to it by hash, the way a C2PA hard binding binds an asset. Checks: the training input is committed by a Merkle root over at least one input, and the root is not that of an empty tree, so a record that declares its training input not held or not disclosed fails; and a record with predecessors names the one before it by hash. Does not check: that the committed input is the content the claim describes; a record carries no c2pa.hash.data assertion of its own.

C2PA Technical Specification 2.2, Hard Bindings (the c2pa.hash.data assertion)

`c2pa-generator-identified` recommended

The model named as the generator of trained-algorithmic media is identified by more than a name. Checks: its learned state and each component carry a parseable hash and a positive size. Does not check: that any bytes hash to a declared value, since an evaluation reads the record and nothing else; or that this model produced any particular content. A record carries no c2pa.actions assertion of its own: the rule identifies the model, it does not tie it to an asset.

C2PA Technical Specification 2.2, the c2pa.actions assertion with digitalSourceType trainedAlgorithmicMedia

What this pack is not

A reference implementation of the VMR policy-pack format, not legal advice and not an official instrument. The references are this pack author's reading of the cited specification; the Coalition for Content Provenance and Authenticity has neither authored nor endorsed this pack, and this pack is not a C2PA conformance test.

Published with the standard under Apache 2.0, in the public repository. The pack itself is the normative thing: this page is a reading of it.