Provenance, Disclosure, and the Mechanical Turk
What Content Credentials actually record, what the standard itself says it cannot guarantee, and the 1770 automaton that gave hidden human labour its name.
Date
Category
Writer
The demonstration always began the same way. Wolfgang von Kempelen would open the doors of the cabinet one at a time, hold a candle inside so the audience could see through, slide out the drawer, and let everybody satisfy themselves that there was nothing in there but clockwork. Then he closed the doors and the figure in the turban played chess, and usually won.
Kempelen first presented the machine in 1770 at Schönbrunn Palace, to impress the Empress Maria Theresa. It was a fraud in the specific sense that matters here: every individual thing the audience was shown was true. The cabinet really did contain that clockwork. The doors really did open. The deception was in the sequencing, and in what was never shown at all, which was a person.
How the cabinet actually worked
The operator sat inside on a sliding seat and moved as the doors were opened, so that each compartment was empty at the moment it was displayed. A pegboard inside connected to the Turk's left arm through a pantograph, and the chessboard above had a magnet in each piece so the hidden player could follow the game without seeing it. Candle smoke was vented through tubes that ran up into the turban.
Edgar Allan Poe published an analysis in the Southern Literary Messenger in April 1836, under the title "Maelzel's Chess-Player", by which time Johann Nepomuk Mälzel had bought the machine (in 1805, after Kempelen's death in 1804) and was touring it in America. Poe's conclusion is stated without hedging: "It is quite certain that the operations of the Automaton are regulated by mind, and by nothing else." His best argument is still my favourite piece of reasoning about machines: "The Automaton does not invariably win the game." A real machine, he argued, would.
Two corrections to the story as it is usually told. First, Poe did not expose the Turk in any operational sense. He reasoned publicly about it, and he was right, but the machine went on touring. The detailed explanation of the mechanism was published in 1857 by Silas Mitchell, son of the Turk's last owner, in The Chess Monthly, three years after the machine was destroyed in a fire that spread from the National Theatre to the Philadelphia Museum on 5 July 1854. Second, the widely repeated anecdote about Frederick the Great buying the secret from Kempelen appears to be apocryphal: the Wikipedia account of the machine, which is where most retellings come from, flags it as having no evidence behind it, and the identities of the operators during Kempelen's own tours are simply not known.
I raise the corrections because this is an article about provenance, and provenance is exactly the discipline of not repeating a plausible story you have not checked.
What C2PA actually records
The Coalition for Content Provenance and Authenticity describes itself as providing "an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content". Its steering committee, as listed on its own site, includes Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. The consumer-facing brand for the output is Content Credentials, which C2PA likens to "a nutrition label for digital content".
The vocabulary in version 2.1 of the specification, dated September 2024, is precise and worth learning properly, because almost every journalistic description of this technology gets one layer of it wrong.
The trust model is the part people skip. The specification states it plainly: "the basis of making trust decisions in C2PA, our trust model, is the identity of the signer associated with the cryptographic signing key." Everything else is machinery around that single fact. A Content Credential does not tell you the image is honest. It tells you that a particular key signed a particular set of statements, and that neither the statements nor the bytes have changed since.
What it cannot guarantee, in the standard's own words
This is the section I wish every newsroom explainer quoted. The C2PA Explainer says:
"Content Credentials do not provide value judgments about whether a given set of provenance data is 'true', but instead merely whether the provenance information can be verified as associated with the underlying asset, well-formed, and free from tampering."
And, more directly:
"Provenance information can help establish the truth about the origin, history and authenticity of digital content, but provenance information alone cannot tell you whether the digital content is true, accurate or factual."
The Security Considerations document is equally candid about the obvious attack: "C2PA does not offer any protection against the complete removal of C2PA manifests from assets." It also states that C2PA "does not specify confidentiality properties for assets, provenance model primitives, private address books, or cryptographic secrets" and "does not specify Digital Rights Management (DRM) technology".
So the failure modes, in plain language:
Strip it. A manifest is data attached to a file. Remove the data and there is no cryptographic recourse. The standard says so.
Screenshot it. A screenshot is a new asset captured by a different process. The hard binding is a hash of the original bytes, and those bytes are gone. Nothing carries over unless a soft binding survives the resampling.
Re-encode it. Same problem. Change the bytes and the hard binding no longer validates.
Redact it. The specification includes redaction as a legitimate feature, "permanently removing information" by "removing assertions". The redaction itself becomes part of the record, which is good design, but the removed content is gone.
Sign a lie. Nothing in the cryptography checks whether the assertions correspond to reality. A validly signed manifest asserting that a synthetic image was captured on a camera is a validly signed manifest.
The answer to stripping is Durable Content Credentials, which the Content Authenticity Initiative's open source documentation defines as "a concept that helps content provenance to persist across content platforms by using C2PA manifest data in conjunction with: Invisible watermarks, actively inserted into the content. Content fingerprints, passively computed from the content." If the manifest is removed, the watermark or fingerprint can be used to look up a stored copy in a database. That is a real mitigation and it is also, note, a lookup service rather than a proof. It shifts the trust from mathematics to an index someone operates.
The quieter layer: IPTC
Long before any of this, photographs carried IPTC metadata, and they still do. The IPTC Photo Metadata Standard, version 2025.1, released on 26 November 2025, defines a property called Digital Source Type in its Extension schema. The values come from an IPTC NewsCodes controlled vocabulary whose scheme dates back to 1 January 2008 and whose terms were most recently modified on 23 October 2024. The relevant ones are exact:
Term | IPTC definition |
|---|---|
digitalCapture | "The media was captured from a real-life source using a digital camera or digital recording device" |
algorithmicMedia | "Media created purely by an algorithm not based on any sampled training data, e.g. an image created by software using a mathematical formula" |
trainedAlgorithmicMedia | "Digital media created algorithmically using an Artificial Intelligence model trained on captured content" |
compositeWithTrainedAlgorithmicMedia | "Augmentation, correction or enhancement using a Generative AI model, such as with inpainting or outpainting operations" |
Note the fourth one. It is the category almost all real studio work falls into, and it is the category that neither marketing departments nor critics have a comfortable word for. A photograph that was shot on a camera and then had a background extended by a model is not a generated image and it is not an unretouched photograph. IPTC has had a term for it since before most people were arguing about it.
IPTC metadata is not signed and is trivially removable. That is a weakness against an adversary and an advantage for a studio, because it costs nothing to write and is read by tools that will never implement C2PA.
Where adoption actually stands
Honest answer: further along in governance than in the wild.
The C2PA conformance programme exists as a formal governance process for certifying generator products, validator products and certification authorities against the Content Credentials specification, the Certificate Policy and the security requirements. It launched in mid-2025 alongside the official C2PA Trust List, which replaced the earlier Interim Trust List. As of 1 January 2026, the Interim Trust List was frozen to new entries, with existing certificates remaining valid until they expire and implementers encouraged onto the 2.x specification series.
The Content Authenticity Initiative, which is the Adobe-led community around the same technology, states on its members page that it has over 5,000 members, without giving a date for that figure.
What I have not been able to verify, and so will not assert, is what proportion of images on any major platform currently carry an intact manifest, or how many end users have ever opened one. My own observation from handling client files is that credentials survive an export pipeline roughly as often as colour profiles do, which is to say: when someone has specifically made it their job.
What a studio should disclose, and to whom
The provenance standard answers a machine question: can this file's history be verified. Disclosure is a different question, a human one, and no standard answers it. Here is the division we work to.
Audience | What they need to know | Why |
|---|---|---|
The client, in the contract | Every tool category used, whether any third-party model was trained on licensed data, who holds rights in the output, what was licensed and what was generated | They are indemnifying somebody. They cannot do that on a vibe. |
The client, in the handover | Which specific assets are synthetic, composite or captured, with the IPTC Digital Source Type set on each | They will reuse these files for years without us |
The public, on the work | Whether a depicted person, place or event is real | This is the only disclosure the audience is actually harmed by not having |
The public, in the colophon | The process at a level of detail we would be comfortable defending | Credit for collaborators, and a record that ages well |
Collaborators and subjects | Whether their likeness, voice or work entered a model, and on what terms | Consent is not transitive and not retroactive |
Nobody in particular | Which specific tools, at which specific settings, produced which specific frame | This is craft, not ethics. Keep it in the studio log. |
The distinction in the last two rows is the one I argue about most. There is a school of thought that any use of a generative tool must be labelled on the face of the work. I do not think that survives contact with the IPTC vocabulary. If "compositeWithTrainedAlgorithmicMedia" covers content-aware fill, and content-aware fill has been in ordinary retouching for over a decade, then a rule requiring disclosure of all such use is a rule requiring a label on essentially every commercial image made since about 2010. A rule that applies to everything communicates nothing.
The rule that does work is narrower and has a test: disclose where a reasonable viewer would change their belief about the world if they knew. A synthetic person in a testimonial: disclose. A synthetic building in an architectural render of an unbuilt building: nobody thought it was a photograph, and the render already announces itself. A sky replaced in a product shot: that is retouching, and it has been retouching since before any of this.
Why the automaton is still the right metaphor
Amazon's crowdsourcing marketplace, named after Kempelen's machine, describes itself on its own site as "a crowdsourcing marketplace that makes it easier for individuals and businesses to outsource their processes and jobs to a distributed workforce who can perform these tasks virtually". The name is the joke: a service that looks automated and is people.
The clearest documented case in recent generative work is Billy Perrigo's investigation for Time, published on 18 January 2023, headlined "Exclusive: OpenAI Used Kenyan Workers on Less Than $2 Per Hour to Make ChatGPT Less Toxic". Workers employed in Kenya by the San Francisco firm Sama labelled text describing violence, hate speech and sexual abuse so that safety systems could be trained on it, reviewing between 150 and 250 passages per nine-hour shift. They were paid between $1.32 and $2.00 an hour after tax. OpenAI paid Sama $12.50 an hour for the work. Sama ended the engagement in February 2022.
That is the cabinet. Everything shown is true, and there is a person inside.
Which brings the two halves of this together. A Content Credential is a good and useful thing, and what it records is narrow: a key, a set of assertions, a hash. It cannot tell you whether a claim is true, it does not survive a screenshot, and it says nothing whatsoever about who was in the room. Disclosure is the part that covers the rest, and it is not a technical problem. It is a decision about which parts of the cabinet you open, in what order, and whether you mention the seat.
Sources
C2PA, "C2PA Specifications, version 2.1", September 2024. Definitions of manifest, claim, assertion, claim signature, hard binding, soft binding and ingredient, and the trust model statement. spec.c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html
C2PA, "Content Credentials Explainer", version 1.4. Statements on goals and on what provenance can and cannot establish, and on redaction. spec.c2pa.org/specifications/specifications/1.4/explainer/Explainer.html
C2PA, "Security Considerations", version 1.4. Statement that C2PA offers no protection against complete removal of manifests, and the scope exclusions. spec.c2pa.org/specifications/specifications/1.4/security/Security_Considerations.html
C2PA, "Conformance Program". Launch, Trust List, and the freezing of the Interim Trust List as of 1 January 2026. c2pa.org/conformance
Coalition for Content Provenance and Authenticity, home page, including steering committee membership and the "nutrition label" description. c2pa.org
Content Authenticity Initiative, "Durable Content Credentials", open source documentation. opensource.contentauthenticity.org/docs/durable-cr
Content Authenticity Initiative, "Our Members". contentauthenticity.org/our-members
IPTC, "Digital Source Type" NewsCodes controlled vocabulary, scheme created 1 January 2008, terms last modified 23 October 2024. cv.iptc.org/newscodes/digitalsourcetype
IPTC, "IPTC Photo Metadata Standard 2025.1", revision 1, released 26 November 2025. iptc.org/std/photometadata/specification/IPTC-PhotoMetadata-2025.1.html
Edgar Allan Poe, "Maelzel's Chess-Player", Southern Literary Messenger, volume 2, April 1836, pages 318–326. eapoe.org/works/essays/maelzel.htm
"Mechanical Turk", Wikipedia. Used for the construction and operating mechanism, ownership history, the 1854 fire, Silas Mitchell's 1857 account in The Chess Monthly, and for its own flagging of the Frederick the Great anecdote as unevidenced. en.wikipedia.org/wiki/Mechanical_Turk
Amazon Mechanical Turk, service description. mturk.com
Billy Perrigo, "Exclusive: OpenAI Used Kenyan Workers on Less Than $2 Per Hour to Make ChatGPT Less Toxic", Time, 18 January 2023. time.com/6247678/openai-chatgpt-kenya-workers
Related reading
Latest Articles.
© Moc Mallen Studio
Thoughts, ideas, and perspectives on design, simplicity, and creative process.
