Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering

1 Introduction

• Viewers may lack source, intermediate state, and execution records, while similar visuals can arise from generated media, rendered code, or hybrid workflows.The workflow may be coordinated by a human or an agent.Source: §1 · p. 3, §1.1 · p. 3

1.1 From production choices to observable evidence

• A raster snapshot, an inspectable HTML or SVG description, and an MP4 expose different evidence; the output format alone does not identify the production route.The comparison concerns operations, not exclusive model families: assistants can author code, and programs can include generated assets.Source: §1.1 · p. 3, §1.2 · p. 3

1.2 Three challenges for detection and watermarking

• Passive inference, watermark detection or message recovery, and authentication make distinct claims; robustness comparisons also depend on access, permissions, and allowed transformations.A recovery claim must declare the accessible state and allowed transformations.Source: §1.2 · pp. 3–4

1.3 A production-centered framework

• The verification specification links production, encoder access, verifier observation, attacker policy, task preservation, the assertion, and unmarked observation laws.The framework also calls for key-generation, issuance-query, and verifier-permission assumptions.Source: §1.3 · p. 4

1.4 Scope and organization

• The article connects published methods, inspected workflows, and elementary examples to ten scoped questions; it reports no experiments or new theorems.Documentation and source inspection establish interfaces, not empirical robustness or measured watermark performance.Source: §1.4 · p. 4

2.1 Production operations and observation interfaces

• Image/video generation and code-based rendering are operations that workflows can combine, and the same production can expose source, assets, previews, pixels, files, and credentials.The mapping among these artifacts can depend on fonts, resources, viewport, frame rate, and runtime.Source: §2.1 · p. 5

2.2 A production model and verification specification

• The production model represents a workflow as a finite directed acyclic graph with node maps and input laws, while the verification specification declares observations, interventions, permissions, and task preservation.A claimed record of the production state is not automatically an authenticated execution record.Source: §2.2 · pp. 5–6

2.3 Passive inference, message recovery, and authentication

• Passive inference estimates a production label, watermark verification detects a mark or recovers its message, and authentication checks an issuer-bound assertion under declared trust assumptions.Recovering a message alone does not establish an authenticated production-event assertion.Source: §2.3 · pp. 6–7

2.4 Information can disappear without every watermark disappearing

• If equally likely source messages leave the full observation unchanged and provide no message-correlated side information, no decoder can outperform a 1/N constant guess.This is a conditional boundary, not a claim of universal watermark erasure; source inspection may still distinguish descriptions, and visible interventions can transmit information.Source: §2.4 · pp. 7–8

2.5 Scope of evidence

• The article’s evidence base combines published mechanisms, inspected interfaces, and conditioned mathematical examples; its mechanism map records precedents rather than security guarantees.Some newer methods received abstract screening, while selected central methods were read in technical detail.Source: §2.5 · pp. 8–9

3.1 Output pixels: a common baseline

• Output-pixel marking offers a shared baseline across generated and code-rendered media, but a mark on exported pixels does not by itself identify the route that produced them.Processing exported pixels differs from making a fresh export from accessible upstream material.Source: §3.1 · pp. 9–10

3.2 Generation states, models, and decoders

• Generation-state methods intervene in noise, model decoders, or parameters, with image and video designs differing in inversion, alignment, and temporal handling.The verification procedures may require compatible models, auxiliary information, or temporal matching; “blind extraction” does not imply model- or key-free access.Source: §3.2 · p. 10

3.3 Executable and declarative source

• Source watermarking encodes information in tokens or source transformations, but a pixel-only verifier may not see source changes that preserve the rendered output.Visible source interventions instead need to preserve task-critical values, meaning, or animation events.Source: §3.3 · pp. 10–11

3.4 Assets and representations designed for rendering

• Rendering-aware marks can pass from modified assets or representations into rendered views, but downstream operations determine whether a marked contribution remains observable.A provenance assertion should name the marked contribution and the operations allowed downstream.Source: §3.4 · pp. 11–12

3.5 Execution, rendering, and export

• A renderer can modify emitted pixels or produce a receipt or credential, but evidence that it processed an artifact does not alone establish authorship, asset history, or model use.A caller’s ability to export through another renderer belongs in the attacker model.Source: §3.5 · p. 12

3.6 What the stages imply together

• Comparisons should follow the signal through the observed path and declare the marked object, verifier observation, allowed transformations, visual changes, and assertion.Source inspection, retained-asset identification, and signed export records provide complementary evidence, but none establishes complete authorship.Source: §3.6 · p. 12

4.1 Image and video generation

• Image and video studies should specify intended use, audio, verifier access, the assertion under test, and which changes preserve the task.Video additionally requires continuity, event order, and timing.Source: §4.1 · p. 13
• Passive synthetic-video detection, message recovery, and claims about visible contribution or issuer association are distinct verification targets.A full clip permits frame aggregation, unlike a screenshot; narrated video adds an audio channel, while LAVA's evaluated offset selection uses an oracle.Source: §4.1 · p. 13

4.2 Plots, educational visuals, and SVG

• For explanatory plots, moving a data point, changing an axis label, or shifting a highlighted event can alter the lesson despite visual attractiveness.Perceptual similarity alone does not define success; a task may instead allow background-pattern or line-decoration changes while fixing values, units, labels, and correspondence.Source: §4.2 · p. 13
• Source-visible and pixel-only verifiers observe different evidence: an SVG comment mark may vanish in a screenshot, while a rendered-color mark can reach pixels.Re-exporting a marked description differs from recreating a graphic from numerical data; a fresh render from unmarked source bypasses a raster postprocessing mark. Figure 4 shows workflow variety, not a controlled quality or watermark comparison.Source: §4.2 · pp. 13, 15, Figure 4 · p. 14

4.3 Programmable video

• Programmable-video studies must distinguish clip retiming from source editing and rerendering, while declaring permitted changes to frame rate, duration, trajectories, captions, and synchronization.Clean-source export can bypass output-only marking, whereas rerendering a marked texture may retain its signal; neither establishes a general robustness advantage for programs.Source: §4.3 · p. 15, Figure 5 · p. 15

4.4 Agent-composed hybrid media

• An LLM agent can coordinate generated assets, authored code, and rendering as operations within one workflow rather than as an exclusive production route.Remotion's Prompt to Video template combines generated scripts, images, and voiceover.Source: §4.4 · p. 16
• A recovered background mark concerns that contribution, not authorship of the curve, annotations, or whole lesson; cropping, occlusion, and transitions change what remains observable.Recipients may receive pixels, assets, or production records, so evidence must specify covered contributions and unobserved events.Source: §4.4 · p. 16, Figure 6 · p. 16

5.1 Claude Code and server-side Remotion rendering

• Claude Code can supply code while Remotion separately compiles and renders it; source, dependencies, resources, inputs, and configuration affect execution.A stored source version alone does not establish the configuration used for an export, and inspected repository observations do not establish which invocation produced a delivered file.Source: §5.1 · p. 17

5.2 Browser and cloud rendering change the trust boundary

• Browser and Lambda backends change execution and observation boundaries, so evidence from one component must be related to the other chunks and final export.A successful browser preview does not establish exportability through that backend.Source: §5.2 · p. 17

5.3 Static graphics expose multiple kinds of artifact

• OpenAI documents code execution that produces graph images separately from image generation, while downloaded visual descriptions, interactive displays, and screenshots expose different states.The SVG document tree differs from the rendering tree, and the consulted Artifacts page does not establish a general MP4-export promise.Source: §5.3 · pp. 17–18

5.4 Generated assets inside authored compositions

• Mixed workflows require evidence linking asset identity, retained contribution, and export scope, because recorded ancestry alone does not establish visibility.Remotion's Prompt to Video combines generated scripts, images, and voiceover in an authored composition.Source: §5.4 · p. 18

5.5 Upstream marking and downstream credentials

• C2PA soft bindings can help locate retained manifests after metadata loss, but complement rather than replace signed assertions and do not imply source-code marks survive external rendering.Comparisons should account for matching accuracy, authorized production-event relations, repository access, and privacy.Source: §5.5 · p. 18

5.6 Permissions are part of the verification specification

• A verification specification should separately state source visibility, clean assets, issuance queries, and verifier access when comparing services, editable programs, and compositions.Deployment also determines who can inspect source, invoke rendering, retain logs, and issue evidence.Source: §5.6 · p. 18

6.1 Identifiability and downstream observability

• Route inference should compare declared production distributions under common scene content, explicit nuisance policies, and a required non-abstention rate, rather than product names alone.The proposed deliverable is a uniform criterion or bound, with both distinguishable and indistinguishable cases.Source: §6.1 · pp. 19–20
• Downstream observability asks which task-preserving interventions remain distinguishable after the declared map and edits, with recovery tested across unknown scene states.The bar-animation case varies timing while fixing values and labels; comparisons to image/video models must declare their decoding map and reachable interventions.Source: §6.1 · p. 20

6.2 Vector descriptions and raster exports

• For vector sources, the agenda asks which line, color, or timing messages survive rasterization uniformly across renderer environments and quantizers.It calls for a bounded grammar, rendering-preserving canonicalization, and a structural condition or payload bound, with a counterexample when the condition fails.Source: §6.2 · pp. 20–21

6.3 Fair comparison, payload limits, and reconstruction

• Questions 4–5 call for stage-matched comparisons under common tasks, attacks, verifier assumptions, and budgets, alongside payload bounds and constructions for reachable outputs.Zero-error recovery requires disjoint observation sets across unknown states and attacks; counting all quantized videos is only a loose upper bound.Source: §6.3 · pp. 21–22
• Question 6 asks which declared reconstruction access and cost can reduce message recovery while preserving the task, without assuming a universal hierarchy of access types.Clean-asset replacement, source reconstruction, and image-access attacks such as SHIFT are distinct comparisons.Source: §6.3 · p. 22

6.4 Temporal synchronization and composed edits

• Questions 7–8 separate synchronization from composed-edit robustness: they seek calibrated whole-search error bounds and composition conditions under a finite, original-clip cost budget.The agenda distinguishes retained-sample count from maximum gap and requires probabilistic composition bounds conditional on relevant histories or intermediate states.Source: §6.4 · pp. 22–23

6.5 Local contributions in hybrid production graphs

• For hybrid production, Question 9 seeks visibility and asset-separation conditions for localized recovery, while allowing abstention when identical patches leave attribution ambiguous.The first case is a lossless opaque two-layer baseline, later extended to a bounded edit family and observation channel.Source: §6.5 · pp. 23–24

6.6 Authentication, privacy, and deployment trust

• Question 10 asks whether credentials can jointly provide honest acceptance, bounded false acceptance outside an authorized relation, and privacy relative to the received artifact.It distinguishes association with an authorized production event from proof of a new export or the copy’s causal history.Source: §6.6 · p. 24

• Provenance analysis needs a verification specification linking intervention, observation, allowed changes, and the assertion under test.Source: §7 · p. 25
• Source recovery may not survive rasterization, rerendering may not remove an asset mark, and contribution evidence may not establish a complete history.Source: §7 · p. 25
• The research agenda prioritizes observable carriers, recoverable payload under task constraints, and bounded authentication.Source: §7 · p. 25

Appendices RETHINKING VISUAL PROVENANCE

• The appendix results are standard facts or direct calculations with stated hypotheses, included to make boundary examples checkable.Source: Appendices RETHINKING VISUAL PROVENANCE · p. 29
• The appendices claim no new theorems, and their numerical examples are not empirical results.Source: Appendices RETHINKING VISUAL PROVENANCE · p. 29
• Table 1 provides a roadmap of the appendices.Source: Table 1 · p. 29, Appendices RETHINKING VISUAL PROVENANCE · p. 29

The finite classification experiment

• The experiment compares two production-label laws on a finite observation alphabet, with equal prior labels and a randomized classifier.Source: The finite classification experiment · p. 29
• The optimal equal-prior classification error is (1 − TV(f0, f1))/2, reaching 1/2 for identical laws and 0 for disjoint supports.Source: The finite classification experiment · pp. 29–30
• The formula does not estimate the distributions or guarantee an optimal learned detector, and mechanism differences alone imply no positive separation bound.Source: The finite classification experiment · p. 30
• Applying the same stochastic channel to both laws cannot increase their total variation or reduce optimal equal-prior error.Source: The finite classification experiment · p. 30
• The contraction result assumes shared processing; label-dependent processing could introduce its own signal.Source: The finite classification experiment · p. 30
• The optimal-error bound concerns ideal classification, not a particular implementation; preprocessing can help a practical classifier without adding information.Source: The finite classification experiment · p. 30

A source mark must pass through execution

• If the verifier’s inputs are independent of the message, decoder success cannot exceed the prior probability of the most likely message.Source: A source mark must pass through… · p. 31
• When a deterministic renderer produces identical pixels for every encoded message, pixel-and-key decoding succeeds with probability at most 1/N for a uniform message.Source: A source mark must pass through… · p. 31
• A stochastic downstream channel has the same limit when its output law is identical across messages, unless verifier side information reveals the selected message.Source: A source mark must pass through… · p. 31
• Whether a source edit is invisible depends on the specified renderer or decoder, so code syntax alone does not identify a watermark carrier.Source: A source mark must pass through… · pp. 31–32
• Blind detection must withhold clean frames and scene coordinates, or recovery may rely on privileged side information rather than the observation.Source: A source mark must pass through… · p. 32

Conditional equality is not marginal equality

• Equal conditional rendering kernels do not determine whether marginal human and LLM video laws coincide; author sampling can keep them distinguishable or collapse them.Source: Conditional equality is not marginal… · p. 32

Render fibers and three preservation requirements

• Task preservation, program semantics, and exact render equality are distinct requirements; agreement at one environment does not establish uniform equivalence across allowed environments.A finite test suite establishes equivalence only if it exhausts the allowed environments or is complete for the declared semantics.Source: Render fibers and three preservation… · p. 33

Applying the exact-equality obstruction

• When all messages produce the same rendered observation, a pixel-only decoder cannot exceed the prior probability of the most likely message.This obstruction does not cover message-bearing environments, correlated side information, marked pixels, metadata or execution traces, or random renderers without equal conditional observation laws.Source: Applying the exact-equality obstruction · p. 34

Visible freedom and nuisance variation

• Task-preserving visible changes need not be reachable by a specified encoder, and local linear cancellation applies only under its stated nuisance permissions and model conditions.The local model is a conceptual guide, not a security theorem or an established empirical approximation; nonlinear decoding, quantization, or visibility changes can invalidate it.Source: Applying the exact-equality obstruction · p. 35, Visible freedom and nuisance variation · pp. 36–37

Comparing intervention stages without hiding access

• A video-only encoder cannot reproduce every upstream marking rule when identical baseline videos require different marked outputs.This is an equality conflict, not evidence of a payload or robustness advantage; optimized feasible schemes must be compared to establish an advantage.Source: Comparing intervention stages without… · pp. 35–36

Source and raster verifiers

• Under a known, evaluable rendering channel with independent sampleable noise, a source verifier can match any raster decoder’s conditional success and abstention probabilities.The result depends on the verifier knowing the channel and its noise law, and on the source containing every channel input except the noise.Source: Source and raster verifiers · p. 36

Payload bounds need a finite observation model

• The model fixes finite quantized observations, a distortion ball, allowed production states, a task predicate, and a finite message set.Audio, metadata, variable duration, or additional precision require separate finite budgets if included.Source: Payload bounds need a finite… · p. 37
• For a finite q-level observation alphabet with n components, zero-error payload is at most n log2 q bits, and distinct messages require disjoint reachable observation sets across production states.The bound holds before attacks and also applies when a production route further restricts the outputs it can reach.Source: Payload bounds need a finite… · p. 38
• Worst-case guarantees require success across every allowed case, whereas average-case guarantees depend on named distributions and can conceal rare cases with zero success.The example has average success 9/10 but worst-case success 0.Source: Payload bounds need a finite… · p. 38
• Recoverable payload does not establish reliable association with a production event, because false alarms and acceptance of transplanted marked assets require separate models.The finite observation model is a starting discipline, not a complete watermark specification.Source: Payload bounds need a finite… · p. 38

The clock belongs to a representation

• Latent-frame, animation-timeline, and encoded-file clocks need not advance together, so the verifier’s observation must declare the carrier’s clock.A renderer may resample an analytic trajectory, while an editor may interpolate already sampled frames; these operations can affect motion differently.Source: The clock belongs to a representation · p. 39
• A deletion-only channel selects an increasing subsequence of original frames, while duplicated or inserted frames and interpolation require different channel models.Calling these different operations one “time warp” can conceal distinct transformations.Source: The clock belongs to a representation · p. 39
• A periodic carrier can make clips with different origins indistinguishable: deleting the first or last eight frames yields the same 40 scalars in the example.A four-frame origin difference instead negates the 44-term sequences; the example stipulates an ideal scalar measurement and makes no reliability claim for arbitrary video.Source: The clock belongs to a representation · p. 39
• Subsampling can erase distinctions between carriers, and repeated information cannot resolve origins separated by a carrier period without side information or a restricted candidate set.Ruling out the subsampling example requires restricting carrier frequencies or sampling changes, rather than asking a detector to recover erased information.Source: The clock belongs to a representation · p. 40

A synchronization search is also a statistical search

• A search over offsets, ratios, windows, or keys must calibrate the whole procedure; each of L valid tests at threshold α/L bounds false alarms by α under the declared null.The tests need not be independent, but validity must hold for every candidate under the same null law.Source: A synchronization search is also a… · p. 40
• Selecting a candidate after observing data can make individually valid tests misleading: in the example, choosing ℓ=Y reports 1/L with probability one.The full family must remain in the calibration even if alternatives are discarded after selection.Source: A synchronization search is also a… · p. 41

Editing budgets accumulate and change the question

• Repeated edits can exceed a per-step budget: two maximal quarter-crops of a 64-frame clip leave 36 frames, deleting 7/16 of the original.Composed edits act on changed inputs, need not preserve standalone recovery guarantees, and can change the null distribution used for calibration.Source: Editing budgets accumulate and change… · p. 42
• Swapping the first two measurements keeps the plain sum at 7 but changes the ordered-code sum from 7 to −1.Order-free recovery and claims about a particular issuer-emitted frame sequence are distinct targets.Source: Editing budgets accumulate and change… · p. 42

A first channel calculation

• A first channel calculation lists allowed edits, retained carrier values, and candidate alignments, then checks whether different messages can yield the same observation.The suggested starting case allows one deletion at an unknown location and no interpolation; construction and robust decoding remain research questions.Source: A first channel calculation · pp. 42–43

Candidate locations

• Table 2 maps five production stages to candidate locations, but each location still needs a specified carrier, observation, attacker, and assertion.The glossary distinguishes the verifier’s observation from side information and defines authentication as checking an issuer-bound content or event assertion under declared trust assumptions.Source: Table 2 · p. 43, Glossary · p. 44

E Scoped Mechanism Map

• Table 4 pairs mechanism families with observation boundaries and records exact versions and reading depth; its entries are precedents, not security guarantees.The map includes abstract-screened methods, whose complete threat models and proofs were not independently audited.Source: Table 4 · p. 46, E Scoped Mechanism Map · p. 46
• SIGMark, FlowMark, and COVER are listed as recent video-watermark variants, but the article imports no unreviewed security claims from them.Their primary abstracts are retained in the source notes.Source: E Scoped Mechanism Map · p. 46
• Passive synthetic-video detection and code or semantic-text marking address different tasks or artifacts, so their success criteria do not automatically transfer to LLM-authored drawings or programs.The cited examples are GenVidBench and UNITE for specified detection populations, and CodeMark and SemaMark for dataset-use and semantic-text marking.Source: E Scoped Mechanism Map · p. 46