Kate Kaye

Data & privacy research. Investigative journo. Music. Forest walks. Ospreys. #LFGM kate at worldprivacyforum dot org

[Kate Kaye @KateKayeReports]

Got provenance problems? @OpenAI's Verify tool labels this photo taken w C2PA-enabled @Google phone as "Content Credentials NOT detected." This is a serious backwards incompatibility / retroactive invalidation problem playing out in real world. It will affect everyday people.

[Kate Kaye @KateKayeReports]

@sherifhanna @n8fr8 Interesting - thanks for sharing

[Kate Kaye @KateKayeReports]

Got provenance problems? @OpenAI's Verify tool labels this photo taken w C2PA-enabled @Google phone as "Content Credentials NOT detected." This is a serious backwards incompatibility / retroactive invalidation problem playing out in real world. It will affect everyday people.

[Kate Kaye @KateKayeReports]

@sherifhanna @IPTC The scuttlebutt even from orgs w people dedicated to C2PA is that the conformance program is a slog. This post reaffirms that.

[Kate Kaye @KateKayeReports]

@sherifhanna @n8fr8 While I do think it's relevant information and I have a primary source that has confirmed this to me, I don't want to imply any ulterior motives, so I'll delete that post. Maybe you might delete this one also so they are not discussed based on anything that is not public.

[Kate Kaye @KateKayeReports]

@sherifhanna The phone implementation automatically enables generation of C2PA metadata without opt in (as C2PA guidance recommends) and without opt out. Also there are no features enabling redaction for the average user. Those are the two ways C2PA specs enable privacy.

[Kate Kaye @KateKayeReports]

@sherifhanna https://t.co/erT7I0l9Ui

[Kate Kaye @KateKayeReports]

@sherifhanna C2PA Harms Modelling states "use of C2PA-enabled tools ...may result in human rights violations...possibility of malicious actors, including potentially state actors, to misuse or abuse the system to enable mechanisms of surveillance, including via legislative approaches."

[Kate Kaye @KateKayeReports]

@sherifhanna @IPTC No, that earlier suggestion holds true. The conformance program is a barrier. So are rapidly shifting C2PA technical specs versions. Small orgs even with dedicated people have trouble keeping up.

[Kate Kaye @KateKayeReports]

The reason I ask this is bc @privacyforum's C2PA research is centered on data use and privacy. There are serious privacy & surveillance implications which is why I've spent 2.5+ years researching the C2PA and related JPEG Trust frameworks.

Our report: https://t.co/9KnckatbK1

[Kate Kaye @KateKayeReports]

While I have @sherifhanna's attention regarding impacts on vulnerable communities-why does @Google Pixel 10 C2PA implementation disregard recs of orgs that fought for C2PA harms modeling guidance to ensure privacy via opt-in only? No way for everyday Pixel users to redact either.

[Sherif ☥ Ϣⲉⲣⲏϥ @sherifhanna]

@KateKayeReports I come from a vulnerable ethnic minority, and in 2018 as the first GAN-based video gen research was gaining traction, I imagined a very real scenario where a deepfake of a Coptic clergyman saying something incendiary about Islam would result in the slaughter of my people.

[Kate Kaye @KateKayeReports]

There is C2PA metadata here though. @IPTC's verifier sees it, noting it was signed by @OpenAI. It tells me the sig is invalid I assume bc the cert is expired (?) What happens to people/cos reproducing GPT images they worked on just a few months ago? I guess they're not trusted?

[Kate Kaye @KateKayeReports]

Appreciate @sherifhanna engaging re: spread of inaccurate & misleading C2PA 'trust' signals. Today I just tested a freshly re-generated @ChatGPTapp image w @OpenAI's verifier: "No OpenAI Signals Detected." I'll show C2 signals are there..

Try it yourself: https://t.co/poKXBay0ot

[Kate Kaye @KateKayeReports]

Got provenance problems? @OpenAI's Verify tool labels this photo taken w C2PA-enabled @Google phone as "Content Credentials NOT detected." This is a serious backwards incompatibility / retroactive invalidation problem playing out in real world. It will affect everyday people.

[Kate Kaye @KateKayeReports]

A conforming verifier, Adobe Content Authenticity Inspect, concludes, "No Content Credentials found" when I test today the @ChatGPT image generated today.

Seems like the most direct and basic of tests, no?

What gives?

[Kate Kaye @KateKayeReports]

@sherifhanna @IPTC Haves/have nots Q is about impacts of C2 trust model on those who can’t afford/don’t want ‘conforming’ devices, software or buy tools that don’t update certs. How does zero trust w/o ‘receipts' affect have nots when governmnts use C2PA to validate trustworthiness of their media?

[Kate Kaye @KateKayeReports]

@GiorgioPatrini @OpenAI @C2PA_org @ChatGPTapp @LinkedIn @sensityai BTW is sensityai doing the conformance program or have you?

[Kate Kaye @KateKayeReports]

Another example of @OpenAI @C2PA_org verify tool creating INACCURATE "trust" signals. I created this AI image using @ChatGPTapp on 3.24.26. GPT added C2PA data that @LinkedIn recognized that day (see comment). Today, OpenAI's tool does not detect the C2PA signals IT generated!

[Kate Kaye @KateKayeReports]

Got provenance problems? @OpenAI's Verify tool labels this photo taken w C2PA-enabled @Google phone as "Content Credentials NOT detected." This is a serious backwards incompatibility / retroactive invalidation problem playing out in real world. It will affect everyday people.

[Kate Kaye @KateKayeReports]

@GiorgioPatrini @OpenAI @C2PA_org @ChatGPTapp @LinkedIn @sensityai One of the best known AI deployers in the world has built something that ONLY recognizes its own narrow set of C2PA signals; this is one of key problems. Already the way C2PA is designed is to 'trust' ONLY when it recognizes its OWN signals & this takes it to another extreme.

[Kate Kaye @KateKayeReports]

@sherifhanna @IPTC When I tested the OpenAI-created gator image in March in IPTC verifier it indicated that the cert was 'untrusted' (expired?) - If one of the world's biggest AI cos & its partners can't keep up how can the little guys? Who are the haves and have nots of c2pa validated media?

[Kate Kaye @KateKayeReports]

@sherifhanna @IPTC Yes, the verifiers incorrectly say image has been tampered with. Image used for these tests is one I downloaded directly from OpenAI & never touched otherwise. I just tested a new download using the same prompt link & OpenAI doesn't see the C2PA metadata. https://t.co/poKXBay0ot

[Kate Kaye @KateKayeReports]

@sherifhanna @IPTC Here's the link to the original prompt and image - Not sure if you can see this - ? https://t.co/poKXBay0ot

I grabbed the image just now from this link. OpenAI doesn't see its own C2PA signals & Proofmode says the image has been tampered with but all I did was download it.

[Kate Kaye @KateKayeReports]

sorry - I actually used OpenAI Sora to create the gator in a tree image.