Quarterly research report

AI Media Provenance Report, 2026 Q3

A transparent comparison of the AI media provenance fixtures currently published by AICheck365, including validation state, unsigned metadata, parser versions, source licenses, and known limits.

Published · Data cutoff · Version experiments-2026-06-19-5r-6s

Executive answer

What does the current evidence show?

File-level provenance checks can produce valid, invalid, or unsigned results, and those states answer different questions. In this snapshot, a cryptographically valid C2PA claim was not automatically trusted, an AI provenance claim with an expired credential was invalid, an unsigned PNG still exposed editable generation parameters, and a valid generic MP4 signature did not establish AI origin.

These findings cover 5 experiment records and 6 tested sample instances only. They are evidence about the named fixtures, not detection-rate estimates for the platforms.

Scope

Dataset at a glance

Experiment records
5
Tested sample instances
6
Formats
JPEG, MP4, PNG
Upstream repositories
3

The report is generated from the public experiment registry. The Q3 publication synthesizes records tested through 2026-06-19; it does not claim that new platform exports were collected during Q3.

Results

Full experiment comparison

2026 Q3 report dataset: 5 records, 6 tested sample instances, cutoff 2026-06-19
Platform or fixture Format Samples Parser Test date Main finding
Adobe Firefly JPEG 1 aicheck 0.2.0 (c2pa-rs 0.82, wasm) Valid C2PA Content Credentials with digitalSourceType=trainedAlgorithmicMedia; the signature is cryptographically valid while the signing certificate is untrusted in the browser trust list.
OpenAI (ChatGPT / DALL·E) PNG 1 aicheck 0.2.0 (c2pa-rs 0.82, wasm) A C2PA claim (trainedAlgorithmicMedia) is present, but the signing certificate is expired, so validation returns Invalid: the provenance claim cannot be verified.
ComfyUI / Stable Diffusion XL PNG 1 aicheck 0.2.0 (c2pa-rs 0.82, wasm) No C2PA signature. PNG tEXt 'prompt' and 'workflow' chunks carry the full generation graph; the detector flags AI-related metadata at low confidence (unsigned).
C2PA conformance images JPEG 2 aicheck 0.2.0 (c2pa-rs 0.82, wasm) An image with no manifest reads as unsigned (no provenance); a deliberately tampered manifest fails with assertion.dataHash.mismatch and reads as invalid.
C2PA-signed MP4 (generic) MP4 1 aicheck 0.2.0 (c2pa-rs 0.82, wasm) A BMFF C2PA manifest validates (generic CreativeWork, not AI). The detector surfaces the C2PA signal; the AI-tool-name heuristic produced a spurious match against manifest bytes, which is a logged limitation.

Interpretation

Five findings supported by the fixtures

  1. Cryptographic validity and configured trust are separate.

    The Adobe Firefly JPEG fixture validated cryptographically while its signing certificate remained outside the browser-local trust list.

  2. A provenance claim can be present but unverifiable.

    The OpenAI PNG fixture carried a trainedAlgorithmicMedia claim, but an expired signing credential produced an invalid state.

  3. Unsigned generation metadata is a clue, not signed proof.

    The ComfyUI / SDXL PNG fixture had no C2PA signature but exposed editable prompt and workflow chunks.

  4. “No manifest” and “tampered manifest” must not be collapsed.

    The C2PA conformance pair separated an unsigned image from a deliberately tampered image with a content-hash mismatch.

  5. A valid C2PA manifest does not itself establish AI attribution.

    The generic signed MP4 fixture validated as a CreativeWork, while a heuristic tool-name match was explicitly recorded as spurious.

Method

How the comparison was produced

  1. Use each registry record’s named fixture source and declared license.
  2. Run the recorded browser-local WASM or container parser in the stated Chromium/Playwright preview environment.
  3. Compare expected signals with actual parser output and preserve misses.
  4. Aggregate only the published fields; do not infer platform prevalence or accuracy rates.

Parser strings represented in this snapshot:

  • aicheck 0.2.0 (c2pa-rs 0.82, wasm)

Read the broader AICheck365 methodology →

Limitations

What this report cannot support

  • No sensitivity, specificity, accuracy, or platform coverage rate can be calculated from 6 sample instances.
  • Public conformance fixtures are not a substitute for fresh exports from every production workflow.
  • Certificates, trust lists, and parser versions can change after the recorded test date.
  • PNG text chunks and other unsigned metadata are editable and commonly stripped.
  • Missing evidence does not distinguish human-made media from AI media whose evidence was never written or was removed.

Evidence provenance

Fixture sources and declared licenses

Upstream sourceExperiment recordsRegistry license text
Open repository ↗ Adobe Firefly; OpenAI (ChatGPT / DALL·E) MIT via contentauth/example-assets
Open repository ↗ ComfyUI / Stable Diffusion XL Permissive repository license via comfyanonymous/ComfyUI_examples
Open repository ↗ C2PA conformance images; C2PA-signed MP4 (generic) Apache-2.0 / MIT via contentauth/c2pa-rs fixtures

License labels above are copied from the experiment records and describe the upstream fixtures. They are not a new license grant by AICheck365.

Reproduction

How to reproduce or audit this report

  1. Download the JSON registry snapshot and confirm version experiments-2026-06-19-5r-6s from its 5 records, 6 summed sample count, and latest test date.
  2. Open an experiment note from the comparison table and retrieve its named sample and upstream fixture source.
  3. Use the linked C2PA Validator, PNG Parameter Extractor, or MP4 Metadata Inspector.
  4. Compare the actual output with the expected signals, misses, and limitations in that record.

Citation

Suggested citation

AICheck365. (2026). AI Media Provenance Report, 2026 Q3. Published 2026-07-10; data cutoff 2026-06-19. https://www.aicheck365.com/research/ai-media-provenance-report-2026-q3/

Author and publisher: AICheck365 (organization). No individual author is asserted.

References

Sources

  1. Upstream fixture repository ↗ — used by Adobe Firefly; OpenAI (ChatGPT / DALL·E); registry license text: MIT via contentauth/example-assets.
  2. Upstream fixture repository ↗ — used by ComfyUI / Stable Diffusion XL; registry license text: Permissive repository license via comfyanonymous/ComfyUI_examples.
  3. Upstream fixture repository ↗ — used by C2PA conformance images; C2PA-signed MP4 (generic); registry license text: Apache-2.0 / MIT via contentauth/c2pa-rs fixtures.
  4. AICheck365 experiment registry (JSON) — version experiments-2026-06-19-5r-6s.
  5. AICheck365 Research Center — experiment index, definitions, and record-level notes.