2026-06-19 · JPEG · 2 samples

C2PA conformance images

An image with no manifest reads as unsigned (no provenance); a deliberately tampered manifest fails with assertion.dataHash.mismatch and reads as invalid.

Answer

What did this experiment find?

An image with no manifest reads as unsigned (no provenance); a deliberately tampered manifest fails with assertion.dataHash.mismatch and reads as invalid.

This result applies to the 2 documented samples tested on with aicheck 0.2.0 (c2pa-rs 0.82, wasm). It should not be generalized to every file exported by C2PA conformance images.

Experiment Summary

PlatformC2PA conformance images
Tested at2026-06-19
Research page updated2026-07-10
Sample count2
File formatJPEG
Parser versionaicheck 0.2.0 (c2pa-rs 0.82, wasm)
Browser/systemBrowser-local WASM parser in Chromium/Playwright local preview; aicheck 0.2.0; c2pa-rs 0.82.
Source/licenseApache-2.0 / MIT via contentauth/c2pa-rs fixtures

Provenance of this research record

Source, license, and authorship

Fixture source
Open the upstream fixture repository ↗
Declared license
Apache-2.0 / MIT via contentauth/c2pa-rs fixtures
Research operator
AICheck365, an organization; no individual author is claimed.
Environment
Browser-local WASM parser in Chromium/Playwright local preview; aicheck 0.2.0; c2pa-rs 0.82.

Expected Signals

  • No-manifest fixture returns unsigned
  • Tampered fixture returns invalid
  • Tampered fixture surfaces content hash mismatch

Actual Signals

  • No-manifest sample: unsigned
  • Tampered sample: invalid
  • Validation issue includes a mismatch/signature problem

Misses

  • No AI-platform attribution is expected for these conformance fixtures.

Limitations

  • The pair validates state separation, not platform-specific AI attribution.
  • Exact validation code wording can change across c2pa-rs versions.

Reproducible Steps

Run the test locally with C2PA Validator. The file remains in the browser.

  1. Open the C2PA Validator.
  2. Upload /samples/screenshot-no-metadata.jpg and confirm unsigned/no manifest.
  3. Upload /samples/tampered-signature.jpg and confirm invalid/tamper summary.
  4. Compare both status summaries before opening raw JSON.

Sample Provenance

Image with no provenance metadata

Source
C2PA Rust SDK conformance fixtures (contentauth/c2pa-rs, Apache-2.0 / MIT)
Format
JPEG
Test date

Open the tested sample file →

  • No origin signals were found. This is not proof of human creation.
  • Evidence may have been removed earlier in the file's distribution chain.

Tampered C2PA signature (content hash mismatch)

Source
C2PA Rust SDK conformance fixtures (contentauth/c2pa-rs, Apache-2.0 / MIT)
Format
JPEG
Test date

Open the tested sample file →

  • A C2PA manifest is present but the asset hash does not match (assertion.dataHash.mismatch) and the certificate is untrusted.
  • The provenance claim is therefore invalid (evidence state D).

Related Tools and Platform Guides

References

Sources

  1. Upstream fixture repository ↗ — Apache-2.0 / MIT via contentauth/c2pa-rs fixtures.
  2. Image with no provenance metadata — C2PA Rust SDK conformance fixtures (contentauth/c2pa-rs, Apache-2.0 / MIT).
  3. Tampered C2PA signature (content hash mismatch) — C2PA Rust SDK conformance fixtures (contentauth/c2pa-rs, Apache-2.0 / MIT).
  4. AICheck365 experiment registry (JSON) — record ID c2pa-conformance-images-2026-06, tested 2026-06-19.