A Mark Is Not a Signature

Text provenance is having a moment, for a good reason. The EU AI Act requires providers of generative systems to mark synthetic output in a machine-readable form, detectable as AI-generated. A visible “Generated by AI” label does not satisfy the obligation. Something has to travel with the content.

So a lot of engineering effort is now going into marking text, most of it converging on invisible marks embedded in the text itself — characters, spacing, or statistical patterns that survive copy and paste. The work is real and some of it is elegant. What deserves more scrutiny is the language used to describe what the marks accomplish, because a mark and a signature are different objects, and the difference is not a detail.

Text has no container

Every C2PA hard binding is a hash over an asset’s bytes, with the manifest carried inside the file’s own container — a JUMBF box in a JPEG, a box structure in an MP4, a chunk in a PNG. The container is what makes embedded provenance possible.

Plain text has no container. Prose on a web page is markup that gets rendered, reflowed, extracted by a reader mode, pasted into a document, quoted in part, and chunked for retrieval. There is nowhere to put a manifest and no stable byte sequence to hash.

Worse, the operation that defines how text travels is excerpting. People quote. Aggregators summarize. Retrieval systems chunk. A hard binding over the full article says “invalid” for every one of those, because two paragraphs are not the article. The signature behaves correctly and the result is useless, because a system that reports failure during ordinary honest use trains its audience to disregard it.

So the industry reaches for a soft binding

The response has been to embed a robust, invisible mark that survives the handling a hash cannot: copy, paste, reflow, re-encoding, sometimes even print and scan.

Here is the constraint that governs everything after that point. Robustness and tamper-evidence are the same axis, at opposite ends. A mark engineered to survive modification cannot, by construction, tell you that the words were modified. A mark that breaks when the content changes is a hash with extra steps, and it breaks on the first legitimate excerpt.

You can build either. You cannot build both in the same mark, and no amount of engineering effort changes the shape of that trade — it is a property of what the mark is for, not of how well it is implemented.

What a robust mark actually is

Pick robustness, which is what nearly everyone picks, and the mark that survives is an identifier. Extracting it yields something like a reference number. The reference number means nothing on its own. Resolving it means asking whoever issued it what the number points to.

Three consequences follow, and each is worth stating out loud.

Verification becomes a lookup. For images and video, a manifest is embedded and a certificate chain does real cryptographic work at the point of verification. For plain text, there is no chain to evaluate, because there is nothing embedded to evaluate. Checking a text mark means querying a service. Whoever runs that service is the trust anchor, whether or not the marketing says so.

The mark proves nothing about the content. An identifier with no content hash cannot attest that the text around it is the text that was marked. Which raises a question that anyone shipping a text-marking product should be able to answer precisely: can the mark be extracted from a marked article and applied to different text, which then resolves as though the publisher had produced it? If the mark is a bare pointer, attribution forgery is a copy-paste operation. If instead the mark binds a content hash, the mark breaks on excerpting, and we are back at the beginning of the argument.

Stripping is easier than marking. Marks carried in characters or spacing do not survive Unicode normalization, retyping, a plain-text round trip, a Markdown conversion, or a model asked to rewrite the passage. The threat model ends up inverted: the mark survives benign handling, where nothing needed protecting, and disappears under exactly the adversarial handling it was meant to withstand. Statistical marking in generated text has a matching weakness, since paraphrase destroys the distribution the detector depends on.

None of this makes marks worthless. A robust mark is a good recovery hint. Finding a fragment and re-associating it with a record is genuinely useful, and for a regulatory disclosure duty, a machine-readable signal that output was AI-generated may be exactly what the rule requires. Those are real jobs. They are not the job a signature does.

Four words that are not synonyms

The lookup problem is easier to see after separating four ideas that get used interchangeably.

Digital integrity asks whether content has changed. Integrity is a mechanical property, answerable by a hash, and the industry has genuinely solved it. Nothing in this article disputes the integrity half.

Authenticity asks whether content is what it claims to be, from whom it claims to be. Authenticity is partly mechanical — a signature and a certificate do real work — and mostly institutional, because the question terminates in somebody having checked and somebody being accountable for the check.

Provenance is the recorded history: origin, ingredients, changes, actors. Provenance is evidence rather than a verdict.

Trust is a decision. A person or a system decides to act on content. Cryptography cannot produce that decision, and no protocol has ever produced it. Cryptography narrows what a decision has to rest on. Someone still decides.

Almost every disappointment in this field comes from a system delivering integrity and being described as though it delivered trust.

The half the industry always underbuilds

There is precedent, and the precedent is the most successful security protocol ever deployed.

SSL was designed to make commerce possible on the web, and the driving requirement was confidentiality. Credit card numbers could not travel in the clear. The protocol solved that problem so thoroughly that encrypted transport is now invisible infrastructure.

Authentication was in the protocol too. Kipp Hickman’s SSL 2.0 specification, published in February 1995, has server authentication with X.509 certificates. The mechanism was there. The thinking behind the mechanism was not, and we know that from the person who wrote the specification.

Moxie Marlinspike went looking for Hickman years later — Hickman’s last public post on the internet was in 1995 — tracked him down through former Netscape people, and asked him how the protocol came to be. Marlinspike’s account, given in SSL and the Future of Authenticity in 2011, is blunt: SSL was designed when e-commerce did not exist and transmitting a credit card number over the internet was an exotic idea, the whole protocol was designed and implemented in roughly three months under extreme pressure, and authenticity was thrown in at the end as a hand-wave.

The result is a protocol containing an authentication mechanism and no answer to the question the mechanism depends on: who issues certificates, on what evidence, and why should a browser accept them. That question got answered commercially rather than technically, and afterward — VeriSign was spun out of RSA in April 1995, roughly as the protocol reached the world, to become the authority the design had assumed would exist.

The consequences ran for twenty years. The padlock came to mean “the connection is encrypted,” which is what the protocol was good at, and users read it as “you know who this is,” which the protocol never established. Phishing sites obtained perfectly valid certificates. Extended Validation certificates arrived as an attempt to put identity back into the indicator and were quietly abandoned when browsers concluded that users could not act on the distinction. A certificate authority was compromised outright and issued fraudulent certificates for major services. Certificate Transparency exists because the trust layer needed public auditing that the original design had no place for.

None of that was incompetence. Confidentiality is a problem with a clean mathematical shape, so effort flowed there. Authenticity is a problem about institutions and accountability, and institutional problems do not yield to protocol design. The engineering went where the engineering worked.

The same split, happening again

Text provenance is repeating the division exactly.

Enormous effort is going into the mechanical half — marks that survive re-encoding, detectors that work on short passages, statistical schemes with provable properties. Genuinely hard work, and much of it good.

Almost no effort is going into the half that decides what any of it means. When a mark is extracted and resolved, some party asserts what the mark refers to. Which party? Vetted by whom, against what published criteria, auditable by whom? For SSL, those questions at least had visible answers eventually: named certificate authorities, public root programs, audit regimes, and transparency logs anyone can query. For text marking, the questions are mostly not being asked out loud, and the answer in most products is a single company’s database with no public criteria and no external audit.

Which makes the position weaker than SSL’s was in 1995, not stronger. A certificate at least carries an identity and a chain that can be inspected offline. A mark carries a number.

The recommendation is not that anyone stop building marks. Marks do a real job. The recommendation is that the industry name the trust question before shipping another detector, because a detector without a declared trust anchor is a confidence signal with nothing behind it — and confidence signals with nothing behind them are how the padlock ended up meaning less than everyone assumed.

What holds up instead

The honest architecture for text starts by giving text a container, which means signing a structured record rather than free prose.

A published article can be expressed as a canonical structured record — the headline, the body, the byline, the publication time, the media components with their own hashes. A record like that has a stable serialization, so it can carry a real manifest with a real hard binding and a real signature. The media inside it keeps its own manifests inside its own containers. What gets signed is the authoritative version of the work, and what the signature proves is that the authoritative version is intact and that a specific publisher stands behind it.

An excerpt can then carry a pointer back to that record. Resolving the pointer is a lookup, exactly as with a watermark — but the thing at the far end is an independently verifiable signed record, not a row in one company’s database, and the identity attached to it can be a publisher-controlled identifier that anyone can resolve without asking the vendor who did the signing.

Which leaves one thing that should be said clearly, because no vendor’s architecture escapes it. A loose excerpt cannot be self-proving. Take two sentences out of a signed article and no technology returns them to a state where they carry their own proof. The best available outcome is a reliable path back to a verifiable original, and honest products should describe that as what it is rather than implying the fragment itself is now trustworthy.

Canonical form is what makes structure work

The word doing the real work in that architecture is canonical, and the concept deserves unpacking, because canonicalization is the difference between a structured record that can be signed usefully and one that cannot.

Free prose has no stable byte sequence. But neither, at first glance, does structured data. The same article as structured data can be serialized a dozen ways: keys in a different order, different whitespace, a number written as 1.0 or 1, a date with or without a timezone offset, one system escaping a character another leaves alone. Every one of those is the same article. Every one of those hashes differently.

A canonicalization is a deterministic rule that turns a structure into exactly one byte sequence. Sort the keys. Fix the number format. Fix the string escaping. Settle on one encoding. Run the rule anywhere, in any language, on any implementation, and identical content produces identical bytes.

That single property is what makes signing structured content practical. A publisher signs the canonical form of an article. The article passes through a content management system, an API, a syndication feed, a database round trip, a partner’s ingestion pipeline. Every one of those may reorder keys and rewrite whitespace. None of them changes the canonical form, so the signature still verifies at the far end. The signature has become robust to reserialization without becoming robust to modification — which is exactly the distinction a watermark cannot make.

Standards exist for this and are worth naming, because choosing one beats inventing one. The JSON Canonicalization Scheme, RFC 8785, is the simple and strict option: sort object keys, fix number and string representation, produce UTF-8, and do nothing else. XML had canonical XML, and RDF has a dataset canonicalization used by some credential formats.

Where canonicalization goes wrong

The design question inside every canonicalization is one line: which variation is insignificant, and which variation is meaningful?

Draw the line too tight and signatures break on harmless reserialization, which returns you to the original problem. Draw the line too loose and content can be changed in ways that alter meaning while the canonical form stays identical — a signature that no longer covers what a reader sees.

There is a subtler failure that history has already delivered once. A canonicalization that reasons about meaning rather than shape usually has to consult something outside the document to know what the terms mean. XML canonicalization had to handle namespace declarations inherited from a document’s ancestors, and moving a signed fragment into another document could quietly change what the fragment meant. Semantic canonicalization for JSON-LD can require resolving context documents fetched from remote servers, which makes the canonical form — and therefore the signature — depend on a file somebody else controls, at a moment nobody controls.

So the practical guidance is unglamorous and firm. Prefer a canonicalization that is purely syntactic, total, and offline. Sorting keys and fixing number formats requires no network and no interpretation. If a canonicalization needs to fetch a definition to do its job, the signature has acquired a dependency that a signature should never have.

Worth noting that the current provenance standards agree. C2PA and the Creator Assertions Working Group sign exact bytes and resolve nothing at verification time. A CAWG credential is carried as the unmodified payload of a COSE signature. The strictness is deliberate, and correct.

What structure buys beyond durability

Signing a canonical record fixes reserialization. Structure also delivers two things prose cannot, and both matter more than the first.

Structure gives you addressable parts. A canonical record has named components — the headline, the body, each image, each source reference — so each part can be hashed individually under one signature. Per-component hashing is what makes a bill of materials for a published work possible, what lets a correction show precisely which part changed, and what allows one component to be withheld while everything else stays verifiable. A protected source can be removed from a published record without invalidating the rest, because the record has parts. Free prose is an undifferentiated blob, and nothing selective can be done to a blob.

Structure also carries roles. A record can state that a named person was the reporter and a different named person was the editor, each bound to the content by hash. Prose carries a byline as a line of text, indistinguishable from any other line of text.

And the honest limit, again, because the limit does not disappear. Canonicalization solves reserialization, not excerpting. A quotation is still not the document, and a canonical form does not make two borrowed paragraphs self-proving. What structure does is narrow the gap usefully: an excerpt can point at the specific component it came from, and a verifier can confirm that the component is intact within a signed record. Better than a fingerprint of the whole article that fails on any quotation, and still short of proof travelling inside the fragment. Nobody has that, and products claiming otherwise are describing a lookup.

The claim to watch

The specifications in this area are careful. They describe soft bindings as soft bindings and are explicit about what a soft binding does not establish. The gap tends to open in the layer above, where a pointer becomes “provenance that travels with your content” and a lookup becomes “anyone can verify it.”

The question worth asking of any text provenance product is narrow and answerable: when the mark is extracted, what is checked, and who has to be online and trusted for the check to mean anything? A signature answers with mathematics and a certificate chain. A mark answers with a database. Both are legitimate engineering. Only one of them is a signature.