Trustworthy synthetic visual media: Evidence across the media lifecycle

• Detection can estimate synthetic origin from a file, but generally cannot establish authorship or permission; watermarks and signed provenance preserve production links only when maintained.Rights mechanisms address whether protected material or identity was used with authorization and what response the evidence can support.Source: SUMMARY · p. 1
• Reported detector performance declines across changes in generators, subject matter, and acquisition channels, while proactive signals can fail outside their designed workflows.Source: SUMMARY · p. 1
• A claim-centered framework evaluates methods by the question they answer, the evidence available to a verifier, and the conditions under which the answer remains valid.Source: SUMMARY · p. 1
• Trustworthy systems attach claims to the relevant asset parts, expose uncertainty and shared dependencies, and allow decisions to change when better evidence appears.Source: SUMMARY · p. 1

INTRODUCTION

• A realistic appearance cannot answer which parts were altered, where a version came from, whether depicted people consented, or what action evidence justifies.Observers can be near chance distinguishing GAN-synthesized from real faces and may judge synthetic faces as more trustworthy.1Source: INTRODUCTION · p. 2
• Detectors, watermarks, provenance records, and rights mechanisms address different claims, and cropping, recompression, editing, and republication weaken their evidence links differently.2–8Source: INTRODUCTION · p. 2
• Unlike method-centered surveys, this review treats bounded claims as its unit of analysis and connects verification to production history and authorized use while keeping them distinct.9–19Source: INTRODUCTION · p. 2

Scope of this review

• The review focuses on synthetic images and videos, includes audio or interactive media when relevant to visual claims, and excludes text-only detection and legal interpretation beyond technical records.It directly compares quantitative results only when sources, metrics, and protocols align sufficiently; otherwise, it keeps results separate.Source: Scope of this review · p. 2

From generation capability to evidence demand

• Image generation and editing have expanded into audiovisual video, three-dimensional media, and interactive worlds, broadening the conditions verification must cover.Generation is embedded in workflows, and assets may mix captured and synthetic material or be attributable to a model despite unauthorized use.Source: From generation capability to evidence… · pp. 3–4, Figure 2 · p. 4

Media assets and production histories

• The asset x comprises observable payload, attached or recoverable records, and review context, while Hx records production and circulation operations; synthetic status depends on whether generation materially changes the property a task evaluates.An edit can alter the answer to one claim while leaving another, such as depicted identity, unchanged.Source: Media assets and production histories · pp. 4–5

A claim-centered evidence framework

• A claim-centered framework starts with a bounded proposition and interprets signals under a verification setting, requiring explicit inferences before assessment and proportionate action.A detector score may prioritize review without supporting public accusation; a valid manifest can support chain-of-custody without proving the depicted event.Source: A claim-centered evidence framework · p. 5

Evidence roles across the lifecycle

• Detection, provenance, rights and accountability, and operational evaluation address different lifecycle roles; combined assessments should expose dependencies and disagreements among signals.Known source does not settle permission, and a signed history may omit the event under dispute.Source: Evidence roles across the lifecycle · p. 5

Evidence availability and survival

• Signal durability measures recoverability after transformations drawn from the relevant distribution path, conditional on prior detectability, while verification setting σ captures access, trust, asset path, and claim prevalence.Survival alone is insufficient if an issuer is untrusted, a claim is ambiguous, or false positives are excessive for the expected prevalence.Source: Evidence availability and survival · pp. 5, 7

Principles for trustworthy evidence

• The framework evaluates evidence through claim specificity, survival, independence, and decision proportionality.These principles distinguish the claim being made, the signal’s persistence, shared assumptions or failures, and the fit between evidence strength and consequences.Source: Principles for trustworthy evidence · p. 7

DETECTING SYNTHETIC CONTENT FROM MEDIA

• Detection estimates synthetic origin from received-file cues calibrated on represented forms, but neither a positive nor negative result establishes source, authorship, permission, or authenticity.A negative result does not rule out an unseen generator; a positive result says little about source or intent.Source: DETECTING SYNTHETIC CONTENT FROM MEDIA · p. 7, What passive detection can establish · p. 10

Artifacts, reconstruction, and learned cues

• Detector cues progressed from synthesis artifacts to reconstruction and inversion, then to local forensic evidence combined with broader representations, but each remains pipeline- or dataset-sensitive.Higher-level representations can transfer across some generator families while still relying on content or style shortcuts.Source: Artifacts, reconstruction, and learned… · p. 8

Generalization is the central detection problem

• Generalization spans generator, domain, and acquisition shifts; newer benchmarks broaden them, while method work targets unseen generators, editing history, and repeated reposting.NTIRE 2026 combines outputs from 42 generators with 36 transformations; text-rich benchmarks also reveal layout sensitivity and degradation after JPEG compression. Table 1 groups comparisons by transfer setting and shared protocol.Source: Generalization is the central… · p. 8
• 98.2% accuracy on ForenSynths falls to 76.7% on GenImage for FatFormer; SAFE falls from 88.4% accuracy across unseen models to 58.6% across domains, and AIDE from 90.8% to 67.0%.The three table blocks compare cross-generator transfer, model and domain transfer, and performance after sharing or re-digitization.Source: Table 1 · p. 9, Generalization is the central… · p. 9
• Synthetic-origin values apply only to tested verification settings; deployment should prioritize calibration and abstention over the highest clean-test score.The sharpest drops occur when the setting changes what reaches the detector, and these results do not recover a source or operation history.Source: Generalization is the central… · p. 9

Temporal evidence in video

• 89.1% AUC on image-to-video outputs falls to 61.2% on closed-source generators for I3D, while TimeSformer moves from 75.5% to 86.5%.Across video studies, results depend strongly on test construction; the AEGIS hard split also shows limited transfer after in-domain fine-tuning.Source: Temporal evidence in video · p. 10
• Video rankings are unstable across duration, task, frame sampling, real-video choice, and generator access; source attribution remains bounded by training candidates.Evaluation needs interval-level ground truth and a video-level decision rule, with separate results for face manipulation, partial editing, and fully generated scenes.Source: Temporal evidence in video · p. 10

What passive detection can establish

• With 1% prevalence, 90% TPR, and 1% FPR, only about 48% of flagged items are expected to be synthetic, making balanced-test accuracy a poor deployment guide.Calibration at a sufficiently low false-positive rate and withholding uncertain cases for review are relevant operational considerations.Source: What passive detection can establish · p. 10

PRESERVING ORIGIN AND TRANSFORMATION HISTORY

• Provenance can document origin, transformation, or continuity, but only for recorded relationships and when verifiers can reach and trust the relevant keys, issuers, or services.A watermark may reconnect an asset to a richer remote record, while a manifest may disappear during screenshots or transcoding.Source: PRESERVING ORIGIN AND TRANSFORMATION… · p. 11, Signed records and evidence continuity · p. 13

Post-hoc watermarks and the robustness tradeoff

• Post-hoc watermarks mark content without changing the generator, but quality, message capacity, and durability cannot all be maximized together.Compression survival does not guarantee survival after semantic regeneration; evaluation should follow the expected workflow and verify that the recovered message identifies an issuer and clear claim.Source: Post-hoc watermarks and the robustness… · p. 11

Watermarks integrated into generation

• Generation-integrated watermarks can mark participating services’ outputs, yet coverage depends on deployment and an absent mark is inconclusive outside the participating ecosystem.A marked reference image may enable removal or mimicry of autoregressive watermarks without model parameters or secret keys.Source: Watermarks integrated into generation · p. 11
• GenPTW reports 0.969–0.994 bit accuracy across UltraEdit under its own 64-bit protocol, while no reported method combines broad generator coverage, efficient verification, and durable recovery across the represented workflows.VINE-R’s TPR falls to 36.3% after image-to-video conversion; under visual paraphrasing, WAM reports 0.56–0.63 detection probability and PECCAVI 0.85–0.90.Source: Watermarks integrated into generation · p. 12, Table 2 · p. 12

Attribution at model, service, and user levels

• Model fingerprints and service records can narrow attribution to a generator family or deployment, but neither identifies the person who published the asset.Technical attribution should stop at the narrowest level justified by the evidence; institutions must connect technical links to conduct before assigning responsibility.Source: Attribution at model, service, and… · p. 13

Signed records and evidence continuity

• Signed provenance verifies that protected assertions have not changed since signing, but cannot reveal unrecorded events or establish that a depicted scene is true.Watermarks and manifests are most useful when they connect to, rather than duplicate, a richer history that can be inspected and challenged.Source: Signed records and evidence continuity · p. 13

PROTECTING CREATORS, IDENTITY, AND ACCOUNTABILITY

• An output may raise distinct claims about dataset inclusion, model influence, reproduction, and authorization, so evidence for one relationship should not stand in for another.Such evidence usually supports investigation, notice, or review; stronger sanctions require a reproducible connection to the disputed relationship and a route for response.Source: PROTECTING CREATORS, IDENTITY, AND… · p. 13

Rights claims and evidentiary requirements

• A rights claim should specify the actor or affected party, operation, protected resource, pipeline stage, and institutional context.Technical tests are more persuasive when administrative records connect results to a known resource and time, and licenses must apply to the operation examined.Source: Rights claims and evidentiary… · p. 14

Training data authorization and evidence of use

• Training-data audits are easier when datasets retain material origins and collection terms; membership tests do not establish authorization or downstream influence.Test reliability changes when few examples are marked or a model is adapted, and sample inclusion does not by itself show material influence or reappearance in outputs.Source: Training data authorization and… · p. 14

Protecting creative work, style, and likeness

• Creator-facing defenses target identity, style, or model behavior, but their effectiveness is conditional on the anticipated pipeline and cannot be pooled across different measures.Providers may purify inputs or replace encoders, and routine processing can weaken perturbations; protection is more durable when paired with records that support later verification and remedy.Source: Protecting creative work, style, and… · pp. 14–15

Model ownership, service attribution, and user accountability

• Model fingerprints and signatures can indicate descent from a protected model, but merging, distillation, and fine-tuning make lineage harder to recover.Service records and user-specific marks do not identify a person with certainty because accounts can be shared or compromised and publishers may differ from generators.Source: Model ownership, service attribution,… · p. 15

From technical signals to rights decisions

• Technical evidence can connect an output to a protected resource but does not decide the dispute; a watermark match may support investigation or notice.A rights record should include the claimant, relationship tested, method, relevant permissions, known error sources, and a response procedure.Source: From technical signals to rights… · p. 15
• DWBench shows that high sample-level TPR at 10% marking does not ensure dataset-level verification at 2% participation or with multiple claimants.Creator-facing methods test disruption, while ownership methods test later identification; results require explicit access assumptions, false-positive control, and independent verification.Source: From technical signals to rights… · p. 16, Table 3 · p. 16

From preference to remedy

• A lifecycle rights system links a resource’s preference or license to later records and technical tests, but no link alone establishes the full claim.A strong technical match cannot identify a rightsholder without a claimant record, and a license matters only if it applies to the disputed use.Source: From preference to remedy · p. 17

EVALUATING EVIDENCE IN REAL-WORLD PIPELINES

• Across Tables 1–3, payload evidence changes with generator, subject, or acquisition channel; proactive evidence can disappear outside its workflow; and rights evidence weakens with few samples or many claimants.Calling these distinct failure sources “robustness” obscures what an evaluation needs to vary.Source: EVALUATING EVIDENCE IN REAL-WORLD… · p. 17

Distribution shifts that alter evidence

• Distribution-shift evaluations should keep individual environments visible, reporting the mean, worst environment, and dispersion rather than allowing easy conditions to mask deployment-breaking failures.Benchmarks should control content, encoding, and processing histories, with separate ground truth for different video operations and explicit treatment of duration, motion, frames, tasks, and audio.Source: Distribution shifts that alter evidence · p. 18

Routine processing and adaptive attacks

• Routine processing estimates survival along an expected route, whereas adaptive attacks reflect an operation selected with knowledge of the verifier.Security evaluation should state attacker knowledge, query access, compute, and registry or account control, and assess the full verification path rather than only the signal.Source: Routine processing and adaptive attacks · p. 18

Calibration for the intended decision

• A detector’s threshold must be tied to the action it triggers, with calibration at practical low false-positive rates and abstention when evidence is insufficient.Accuracy or area under the curve may conceal excess false allegations in low-prevalence settings; attribution also faces uncertainty when the true source is absent from the candidate set.Source: Calibration for the intended decision · pp. 18–19

Longitudinal evaluation from creation to contest

• Longitudinal evaluation should test whether records remain reachable and interpretable after transformations, key revocation, or issuer-status changes, and whether valid counterevidence updates decisions.A deployment benchmark follows an asset through a realistic workflow, reveals evidence reviewers would normally receive, and measures calibration, record reachability, review cost, and appropriate reversal; Figure 5 summarizes the protocol.Source: Longitudinal evaluation from creation… · p. 19, Figure 5 · p. 19

INTEGRATING EVIDENCE ACROSS THE MEDIA LIFECYCLE

• Integration preserves which claim each signal supports, where it applies, and what shared dependency could make signals fail together.Payload detectors, watermarks, and signed records may address different facts and should not be averaged as repeated measurements of one fact.Source: INTEGRATING EVIDENCE ACROSS THE MEDIA… · p. 19

Claim-centered case structure

• A claim graph links observations and records to assessed propositions and possible actions, while distinguishing support, contradiction, and shared dependence.It prevents evidence for synthetic origin, service attribution, or record authenticity from being mistaken for evidence of another claim.Source: Claim-centered case structure · p. 20

Dependence and localization

• Corroboration is weaker when signals share a training source, issuer, or vulnerability, and evidence should stay bound to the region, interval, or modality it describes.Payload and signed-service signals may observe different pipeline parts, while two same-source detectors may repeat one failure mode.Source: Dependence and localization · p. 20

Uncertainty and credential status over time

• Cases must distinguish evidence never issued, evidence lost in circulation, invalid evidence, and conflicting assertions, while preserving credential and result histories over time.A revoked key may indicate later compromise without invalidating every earlier asset; a missing credential is not equivalent to a stripped signal.Source: Uncertainty and credential status over… · p. 20

Proportionate and revisable decisions

• Evidence thresholds should rise with decision consequences, and records should expose uncertainty and policy while allowing affected parties to submit counterevidence.Public attribution calls for the strongest corroboration; a system must be able to explain why a decision is retained or reversed.Source: Proportionate and revisable decisions · pp. 20–21

Worked cases across the lifecycle

• Worked cases keep origin, service attribution, and rights claims separate, with the response limited to relationships the evidence actually supports.Newsroom records can support capture origin while leaving a caption unresolved; service matching does not establish publication rights, and unstable dataset audits cannot carry an identity dispute alone.Source: Worked cases across the lifecycle · p. 21

DISCUSSION AND RESEARCH AGENDA

• Passive detectors, proactive methods, and rights mechanisms fail at different evidence-chain bottlenecks, so no single robustness measure captures them all.The respective constraints are changed observable signals, broken participation, binding, or record access, and limited protected material or model access.Source: DISCUSSION AND RESEARCH AGENDA · p. 21

Synthetic status as a weak endpoint

• Binary origin estimates remain useful when history is unavailable, but detection should investigate which operation materially changed the decision-relevant media component.Benchmarks can distinguish full synthesis, local generation, semantic editing, and harmless computational assistance, attaching results to affected regions or intervals.Source: Synthetic status as a weak endpoint · p. 22

Continuity beyond signal robustness

• Signal recovery after transformation does not ensure that the signal still supports the same claim about the same component.Benchmarks should follow transformation trajectories and track when payload bindings, remote records, or credentials stop supporting their original propositions; video and interactive media require stateful, component-aware continuity.Source: Continuity beyond signal robustness · p. 22

Why more signals do not always add trust

• More signals do not necessarily add trust when they share infrastructure, and dependence can create concentration risk or limit independent review.Reports can name shared sources and authorities, stress-test a compromised dependency, and account for whether creators, journalists, or courts can reproduce a result.Source: Why more signals do not always add trust · p. 22

Contestability as a technical property

• Trustworthy verification must retain enough state to explain an initial decision and revisit it when new records or counterevidence emerge.Evaluation can measure whether valid counterevidence changes claims, explanations, and actions, as well as the time and cost of independent review; privacy safeguards must limit disclosure and retention.Source: Contestability as a technical property · pp. 22–23

A measurable research program

• A lifecycle testbed can measure claim calibration, continuity, dependency-adjusted corroboration, reversal correctness, and access cost across changing evidence conditions.Longer-term infrastructure should preserve justified claims through change, acknowledge broken connections, support independent review, and avoid turning attribution into routine surveillance.Source: A measurable research program · p. 23

CONCLUSIONS

• Detection, provenance, and rights mechanisms address different points in the lifecycle rather than competing to produce one universal authenticity score.Detection remains useful when only the payload survives; recorded provenance can preserve a stronger production connection, while rights mechanisms address implications for affected people.Source: CONCLUSIONS · p. 23
• Clean accuracy is a poor guide to evidentiary value when detector performance changes with synthesis or acquisition conditions, records may be unreachable, and rights audits face access limits.The review's framework, tables, and lifecycle protocol describe the conditions under which results can be interpreted.Source: CONCLUSIONS · p. 23
• Future infrastructure should bind each claim to the relevant component and moment, keep dependencies and disagreements visible, and support revision when stronger evidence appears.It should preserve evidence as media changes without extending narrow results to entire assets or turning attribution into routine surveillance.Source: CONCLUSIONS · pp. 23–24