C2PA test vectors, with the answer key.

What these files do not claim.

• Provenance shows who signed a file and that it has not changed since. It does not show that the content is true.
• The hidden mark is imperceptible in normal viewing, not mathematically invisible: about 40 dB PSNR on trusted-photo.jpg. Switch between it and none-photo.jpg to see it.
• A name in the registry comes from a Reconize record, not from the file. The file alone proves only that a mark is present.
• Marks made before September 21, 2026 use an older payload. The web checker confirms them only while the file still carries its credentials.

Machine-readable manifest: every file, its SHA-256, the expected verdict and the independent results are in corpus.json. Revoked and higher-assurance (IAL2) vectors are planned.

The hidden mark can be removed or copied.

It is built on Meta's open VideoSeal model, so anyone can read it, subtract it or paint it onto another picture. A researcher on the C2PA Discord removed it from these samples on October 8, 2026.

• Removing the mark breaks the Content Credentials. The result is an unsigned file, never a forgery in someone's name.
• A mark alone never names anyone: not in the app, not on this site, not in the public Soft Binding API. The picture has to match too.
• Send & Track copies (2.6 and later) carry a keyed mark. Public tools, including the reader on this site, cannot see, read or copy it.

A stripped copy can still be found by what it looks like.

• Pictures: found after re-saving, resizing, colour changes, crops, screenshots, rotation, mirroring, squeezes and stretches, and when shown inside a larger picture.
• Video: found when cropped, reframed, mirrored or screen-recorded (keypoints from the first 32 seconds).
• Audio: found after AAC and MP3 re-encoding, volume and EQ changes, trims, and small speed or pitch changes.
• Running a picture through an AI image model removed most marks. Every copy was still found.
• The overall-look fingerprint never names anyone on its own. The keypoints have to agree.
• Your browser computes the fingerprint and sends only that. The file never leaves your computer.

What we fixed on October 14, 2026 (after attacking this corpus ourselves)

• Squeezed or stretched copies: the lookup also tries the copy stretched back at four widths. Squeezed to half width and cropped: 18 of 200 test photos found before, 200 now.
• Squeezed, cropped and tilted: 104 of 200 before, 191 now.
• A picture inside a larger one (30 percent of the frame): 22 of 200 before, 119 now.
• Inverted colours: 0 of 200 before, 200 now.
• Small crops: from Reconize 2.7, signed pictures also store nine overlapping tiles. A copy that keeps a quarter of the picture: 153 of 200 before, 196 now. Earlier files get the tiles with Update Earlier Files.
• Audio sped up, slowed down or pitch-shifted by up to about 4 percent: 8 of 98 test copies before, 88 now.

Each new check was run against 5,000 COCO photos first. No unrelated photo came near the line.

False matches

• We checked 5,000 COCO photos against each other. No unrelated pair matched.
• Four pairs did: the same scene, shot seconds apart. Two near-identical photos of one place can match.

What still gets through

• A picture shrunk to a small part of a larger image (about a sixth of the frame or less).
• A crop that keeps only a small corner of the picture.
• Speed or pitch changes of more than about 5 percent.
• Video after the first 32 seconds.
• Files signed before October 2026, until their fingerprint is added.

A copy like this is not attributed to anyone.