Durable Content Credentials: three layers

"This file has Content Credentials" is not a claim. It is a category, and the category contains three mechanisms that prove three different things, fail against three different attacks, and get collapsed into one green tick by almost every interface that displays them.

Durable Content Credentials is the name for using all three together: a manifest, an invisible watermark, and a perceptual fingerprint. The reason to layer them is not redundancy — each keeps working precisely where the others stop. The reason to understand them separately is that the layer which survived determines what you are entitled to say.

Layer 1: the manifest

The manifest is the signed record. It carries assertions about what produced the asset and what was done to it, and it is attached by a hard binding — a hash over the asset's own bytes, included in the signature.

What it proves when it validates. That this exact byte sequence has not changed since signing, that a specific signer produced the assertions, and what those assertions say. That is a strong, precise claim.

What it does not prove. That the assertions are true. A signature establishes who signed, not whether they were honest, which is why a trust list and a conformance programme sit underneath the whole arrangement. It also says nothing about any other copy of the content — the claim is scoped to these bytes and no others.

What defeats it. Any change to the bytes: a re-encode, a screenshot, a format conversion, an edit in a tool that does not rewrite the manifest, or a platform's ingest transcode. That is design rather than weakness, since a hash tolerating changes would not be evidence of anything. What C2PA actually records covers the contents. The practical consequence is that this layer goes first, and it goes early.

Layer 2: the invisible watermark

A watermark is a soft binding and it is active: something is deliberately embedded into the content itself, in the pixels or the audio, rather than in the container or the metadata. Because it lives in the content, it survives operations that rewrite everything around it. Recompression, format changes and platform transcodes generally do not remove it, which is the whole point of choosing it as the second layer.

What it proves. That this content carries a mark, and that the mark resolves to a record. When the manifest is long gone, a surviving watermark is what lets a validator find the provenance data again.

What it does not prove, and this is the subtle part. It does not prove the content is unmodified. A watermark is designed to survive transformation, which means it survives exactly the transformations a manifest exists to detect. Alter a credentialled image substantially and the watermark may still sit there pointing at the original record. The two layers are not weaker and stronger versions of each other. They answer opposite questions: the manifest asks has this changed, the watermark asks where did this come from. A system reporting both as "verified" has thrown away the distinction that matters.

What defeats it. Heavy cropping, aggressive transforms, and deliberate adversarial removal. Durability is a property of a specific implementation rather than of watermarking as an idea, which is why how invisible watermarking works and where it stops is worth reading before assuming any particular scheme holds. And note the watermark in this sense is not a visible logo burned into a corner. Those are different objects with different consequences for your output.

Layer 3: the perceptual fingerprint

A fingerprint is also a soft binding, but a passive one: nothing is embedded in the content at all. A perceptual hash is computed from the content and stored in a database. Recovery is a lookup — compute the fingerprint of the file in front of you, search for a close match.

What it proves. That this content is perceptually similar enough to a recorded asset to match it. That is a genuinely useful claim and a genuinely weaker one than the other two.

What it does not prove. Byte identity, obviously. But also nothing at all in the absence of a reachable database containing the asset. This layer has an external dependency the other two do not: the manifest and the watermark travel with the file, while the fingerprint is only re-derivable from it. The record lives somewhere else, and if that somewhere is offline, private, or simply does not contain your asset, the layer contributes nothing.

What defeats it. Heavy crop, again. An unreachable or incomplete database. And near-duplicate ambiguity, since a perceptual match is a similarity judgement rather than an equality test.

What each layer lets you say

	Manifest	Invisible watermark	Perceptual fingerprint
Lives in	Signed metadata, hash-bound to bytes	The pixels or audio	An external database
Survives a re-encode	No	Usually	Usually
Survives a screenshot	No	Depends on implementation	Often
Survives a heavy crop	No	Often not	Often not
Needs a network lookup	No	To resolve the record, yes	Always
Answers	Has this changed since signing?	Where did this come from?	Does this resemble something on record?
Fails silently	No — validation reports a break	Yes	Yes

Read the last two rows together. The manifest is the only layer that tells you loudly when it has failed. The other two return "no match," which is indistinguishable from "no mark was ever applied" and from "the database is down." Absence of a soft-binding match is not evidence of anything, and treating it as evidence that content is unmarked or organic is the most common analytical error in this area.

Here are three statements about the same asset at three different states, each of which is honest and only one of which most people would write:

• Manifest intact. "This file is byte-identical to the one signed by us on 12 August, and the signed history says it was generated by model X and edited in tool Y."
• Manifest gone, watermark matched. "This content carries our mark and resolves to a record we published. We cannot say from the mark alone whether it has been altered since."
• Only a fingerprint match. "This content is perceptually close to an asset in our records. Alteration, re-framing and re-purposing are all consistent with that match."

The second and third sentences are what you can usually say about anything that has actually been distributed, because the manifest does not survive the trip. If your compliance documentation, your client deliverable, or your public-facing "verified" badge implies the first sentence when the evidence supports the third, that is the defect. It is a much more common defect than any technical failure of the layers themselves.

Worth stating plainly for anyone assembling in Versely: there are no watermarks on any plan, a deliberate output-quality decision, which means a Versely-assembled file has no Versely-originated soft binding to lose. Whatever provenance it carries came from upstream, and tracing it is the same exercise as through any other editing pipeline. Better to know that in advance than during an audit.

Where this leaves compliance

Layering is the right answer and it is not a complete one. All three mechanisms can be defeated together by a determined re-capture: photograph a screen, and the manifest is gone, the watermark is degraded past recovery in many implementations, and the fingerprint is fighting a perceptual transformation. Nothing in this stack is a defence against a motivated adversary, and no serious document about it claims otherwise.

What the stack is good for is the ordinary case: honest content moving through honest pipelines that were not built with provenance in mind. That covers the overwhelming majority of files, and it is the case the obligations landing in 2026 are aimed at. Article 50 of the EU AI Act applied on 2 August 2026 and California's marking obligation under SB 942 as amended by AB 853 landed the same day, with detection-tool and platform duties following. The Commission's stated position has been that no single technique meets the machine-readable marking standard on its own, which restates exactly the argument above.

So: layer them, know which one survived, and write down the claim that layer supports rather than the claim the badge implies. The human-readable side of the same obligation, a plain sentence a viewer can read, is a synthetic media disclosure question and is not solved by any of these three.

FAQ

If watermarks survive better, why keep the manifest?

Because it is the only layer that proves the content is unaltered, and that is the claim with the most value when it holds. It is also the only layer that carries a readable history — what tool, what actions, in what order. The watermark points at a record. The manifest is the record, bound to the file.

Does a failed match mean the content is not AI?

No, and this is the error worth engineering against. A negative result from a soft binding means the mark was not found, which covers "never applied," "removed," "degraded past detection" and "the lookup failed." None of those is a finding about the content. What AI detection and labelling can actually establish is the broader treatment.

Do I need all three layers?

You do not get to choose all three unilaterally — the fingerprint layer depends on a database somebody operates, and the watermark depends on your generating tools applying one. What you can choose is to know which layers a given asset carries before you make a claim about it, and to stop describing a file as "verified" when the only surviving evidence is a perceptual match.

Does a platform label mean one of these layers was read?

Sometimes, and sometimes not. An AI content label can also fire from a platform's own classifiers or from your self-disclosure at posting, neither of which involves any of these three mechanisms. A label is evidence that some signal fired, not evidence that provenance data survived to the platform.