DEMO · DEMONSTRATION — not a customer case study · v1 · PUBLIC · HASH a68273a47b9f7202…
QUESTION
Does C2PA prove that a media file is authentic — that the depicted event happened as shown?
CONTRADICTED. C2PA is a provenance-credential system. The 2026 IACR analysis states C2PA was not designed to determine authenticity and that versions 2.2–2.4 fail claimed and essential security goals. Absence of C2PA is not evidence a file is fake.
Two independent publication groups are recorded: the IACR ePrint paper (Golaszewski et al., 2026/804) and AFP-style media practice is not used here. The paper and its HTML preprint describe the same research programme; they are one scientific origin if treated as the same paper. A second independence group is the C2PA project's own public framing that credentials describe history, not reality of the scene — recorded via the paper's characterisation of C2PA goals. This demonstration does not audit implementations.
ESTABLISHED
- A 2026 IACR ePrint paper (2026/804) exists and states that C2PA was not designed to determine authenticity and that analysed specifications fail claimed security goals.
SUPPORTED
None.
CONTRADICTED
- C2PA proves that a media file is authentic (the depicted event happened as shown).
UNKNOWN
- Whether later C2PA versions after 2.4 close the issues — not evaluated here.
- Whether any specific vendor implementation is conformant — not tested.
EVIDENCE REQUIREMENTS
- R1 · Primary source · ADDRESSED
Identify the earliest independent origin. Addressed in this demonstration from cited public records.
- R2 · Independent corroboration · ADDRESSED
A second independence group. Addressed in this demonstration from cited public records.
- R3 · Contradiction search · ADDRESSED
Negative evidence must be sought, not assumed absent. Addressed in this demonstration from cited public records.
- R4 · Provenance and unknowns · ADDRESSED
State what cannot be established. Addressed in this demonstration from cited public records.
PRIMARY EVIDENCE CARDS
EV1 · CONTRADICTS
IACR 2026/804 abstract and body claims that C2PA is not an authenticity verdict and that analysed specs fail security goals.
- WHO
- Golaszewski et al. (as published on IACR ePrint)
- WHERE
- eprint.iacr.org/2026/804
- WHEN
- Retrieved 2026-09-02
- HOW
- Read the public ePrint landing/PDF extract.
Provenance: Public academic preprint.
Unknown: Duplios did not replicate the formal-methods analysis.
Group eprint.iacr.org · PRIMARY
EVIDENCE GRAPH
Relational view. Derived items that share an origin are one independence group.
Requirements
- R1 Primary sourceCOVERED
- R2 Independent corroborationCOVERED
- R3 Contradiction searchCOVERED
- R4 Provenance and unknownsCOVERED
Evidence
- IACR 2026/804 abstract and body claims that C2PA is not an authenticity verdict and that analysed specs fail security goals.CONTRADICTSeprint.iacr.org
Sources
- Verifying Provenance of Digital Media: Security Analysis of C2PA and its ImplementationPRIMARYeprint.iacr.org
- Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short (HTML)SECONDARYeprint.iacr.org
- DERIVED_FROM · L-paper → L-arxiv · eprint.iacr.org
INDEPENDENT CORROBORATION
- Independent support branches: 0
- Independent contradict branches: 2
- Engine: At least one independent contradicting branch; no independent support remains.
LINEAGE
- L-paper · eprint.iacr.org
- L-arxiv ← L-paper · eprint.iacr.org
CONFLICTING
- C2PA-as-authenticity-verdict conflicts with the paper's statement of C2PA's purpose and with the security analysis.
MISSING EVIDENCE
- C2PA specification text quoted in full in this report
Why: Primary standard text.
How to obtain: c2pa.org specification versions 2.2–2.4.
WHAT WOULD CHANGE THIS FINDING
- A C2PA specification that explicitly claims scene authenticity AND independent analysis supporting that claim.
- This finding is about the general claim, not about one signed file.
CHALLENGES
- NONE_FILED: Demonstration compile. Challenge this finding is open.
TIMELINE
- 2026-09-02T00:00:00.000Z — Demonstration report compiled from cited public records.
- 2026-09-02T00:00:00.000Z — evaluateCase run on recorded facts. No silent rewrite.
LIMITATIONS
- DEMONSTRATION. Duplios did not perform a new cryptographic proof.
- One scientific paper plus its HTML twin is not field consensus. The PoE Standard is also not ISO.
METHODOLOGY
Duplios Proof of Evidence Standard v0.1 (Duplios methodology — not an ISO, accredited, or industry-consensus standard). A question is decomposed into evidence requirements. Sources are recorded with independence groups and lineage. Copies that share an origin are one confirmation. Contradiction is searched, not assumed absent. AI output, detector scores, missing EXIF, and missing C2PA credentials are evidence or absences — not truth. evaluateCase returns SUPPORTED, CONTRADICTED, INSUFFICIENT_EVIDENCE, or HUMAN_REVIEW_REQUIRED. UNKNOWN stays UNKNOWN. A report hash identifies the bytes of this version; it does not prove the finding is true.
AUDIT TRAIL
- standard=0.1.0
- evaluateCase.state=CONTRADICTED
- public.state=CONTRADICTED
- no_automatic_network_fetch_at_runtime
- demonstration_not_customer_case_study
- sha256=a68273a47b9f72024848de853ed5682c756f1d86c17e2805c368fe31b7cd65ed
SOURCES
- S1 · PRIMARY · IACR ePrint · group eprint.iacr.orgVerifying Provenance of Digital Media: Security Analysis of C2PA and its Implementationhttps://eprint.iacr.org/2026/804Retrieved 2026-09-02. Paper 2026/804.
- S2 · SECONDARY · arXiv HTML · group eprint.iacr.orgVerifying Provenance of Digital Media: Why the C2PA Specifications Fall Short (HTML)https://arxiv.org/html/2604.24890v1Same research programme as S1. Not a second independence group.
MEDIA NOTES
- No C2PA ≠ fake. Valid C2PA ≠ the scene happened.
ID DEMO-C2PA-AUTHENTIC · created 2026-09-02T00:00:00.000Z · requestor Public demonstration — not a customer case · confidentiality PUBLIC_DEMONSTRATION
A report hash identifies this version's bytes. It does not prove the finding is true. Corrections append a version. Silent rewrite is forbidden.