C2PA and content provenance for AI training data

Open an AI-generated image in a growing number of tools and you can click a small icon that unfolds its history: which model made it, when, and what edits followed. That panel is not a courtesy. It is a cryptographically signed manifest, a standard called C2PA, bound to the pixels so tightly that changing one of them breaks the seal.

C2PA was built to fight deepfakes, to let a newsroom or a viewer answer one narrow question: is this the file it claims to be? But the machinery underneath is indifferent to what the file contains. A signed manifest that travels with an asset and records who made it, on what device, and what has happened to it since works just as well wrapped around a captured robot demonstration as around a synthetic photo.

That is the argument here. The provenance problem in robot training data is usually met with a spreadsheet, a folder of PDFs, a promise. C2PA answers it with a signature. As buyers under the EU AI Act start asking sellers to prove where manipulation data came from, the gap between an assertion and a verifiable one stops being academic.

What C2PA actually is

C2PA, the Coalition for Content Provenance and Authenticity, is an open technical specification for attaching a tamper-evident record to a piece of content. Its visible surface, marketed as Content Credentials, is the little history panel. The substance is a data structure called a manifest.

A manifest is a bundle of assertions: statements like this file was captured by device X at time T, then cropped and resized. The assertions are hashed, the hash is signed with a certificate tied to the signer, and the signature is bound to a hash of the asset itself. Three properties fall out of that construction, and they are the whole point.

• Tamper-evidence. Alter a pixel, a channel, or a field, and the hash no longer matches. Verification fails loudly instead of passing a quiet lie.
• Attribution. The signature ties the record to a certificate, so a verifier can tell who stands behind the claim, not just what the claim says.
• Chaining. Each edit can add a new signed manifest that references the one before it, so the asset carries its own lineage, an ordered chain rather than a single snapshot.

None of this proves the original claim was honest. A signer can lie about where a file came from. What C2PA proves is narrower and more useful: that the record has not changed since it was signed, and that a named party signed it. That is exactly the guarantee a spreadsheet cannot give.

The same manifest, wrapped around a demonstration

Now change the container. Instead of a photo, the asset is one episode of egocentric capture: a few minutes of synchronized video, depth, hand pose, force, and proprioception, recorded while a person performs a task. Give that episode a manifest and the fields almost write themselves.

At capture, the manifest records the device and firmware, the sensor calibration in force that session, the timestamp and the clock the channels were synced to, and a reference, not the raw document, to the consent obtained from anyone in frame. Every transform after that, blurring faces, downsampling a stream, retargeting a human hand pose onto a gripper, cropping to a task window, becomes a new signed entry. The result is data lineage a buyer can verify without trusting the seller's word, because the signatures do the trusting.

This is a different thing from the label content inside an episode. Whether the annotation says pick up the blue block, or whether the calibration is accurate, is a data-quality question. Whether you can prove that field is the one recorded at capture, unaltered, by the party who claims it, is a provenance question. C2PA addresses the second. It says nothing about whether the underlying claim is good, only about whether it is intact and attributed.

A signature beats a spreadsheet

Most provenance today is a document sitting next to the data: a CSV of consent IDs, a calibration file, a README describing how the set was built. Every one of these shares a fatal property. Nothing binds it to the bytes. A cell can be edited after the fact, a calibration number rounded to look tidier, a consent row added for a subject who was never asked, and no reader can tell.

A spreadsheet asserts provenance. A signature proves it. The gap between the two is the difference between trusting the seller and verifying the seller, and diligence lives entirely inside that gap.

A signed manifest closes the gap in the only way that scales. A buyer does not have to audit the seller's honesty across a million clips; they verify a signature and a hash per clip, mechanically. If the check passes, the record is the one written at capture. If someone edited a consent field last week to paper over a hole, the check fails on that clip and only that clip. Verification replaces trust with math, the same move that made the standard useful for journalism.

What each field proves

The value shows up field by field. Each row below is a claim a manipulation-data buyer will eventually ask to see, what a signed manifest lets them confirm, and what they inherit if all they get is an editable file.

What a signed provenance manifest proves per field, and the risk when the record is an unverifiable file

Provenance field	What a signed manifest proves	Risk without a verifiable record
Consent reference	The consent record tied to each subject was present at capture and unchanged since	Consent added or edited after the fact, no way to honor a deletion request or prove lawful basis
Capture device and firmware	The episode came from the rig and build it claims	Footage from an unknown or mismatched sensor passed off as spec
Sensor calibration	The intrinsics and extrinsics logged that session are the ones delivered	Calibration silently swapped or estimated later, 3D supervision quietly wrong
Timestamp and sync	Capture time and the shared clock were recorded, not reconstructed	Reordered or backdated episodes, cross-channel offsets no one can audit
Edits and transforms	Every blur, crop, downsample, and retarget is listed in order	An undocumented edit hides a defect or a rights problem in the raw
Chain of custody	Each hand-off signed against the previous manifest, unbroken	A gap where data could have been substituted or contaminated

Read the right column as the findings of a diligence process. Each is a discount on the price, and consent is not a discount at all. It is a wall.

Why the buyer starts asking

The pressure will not come from a love of cryptography. It will come from procurement. When a robot OEM trains a system it plans to sell in Europe, the EU AI Act's Regulation (EU) 2024/1689 makes the training data's origin part of the OEM's own file. Article 10 and the governance duties around it ask for a documented account of how high-risk training data was collected and processed. That account is only as strong as what the OEM's data suppliers can hand over, so its lawyers start asking suppliers for proof, not prose.

Consent tightens the same screw from the data-protection side. Egocentric footage of hands, homes, and faces is personal data, and the European Data Protection Board treats it as such regardless of downstream use. A verifiable manifest that a consent record existed at capture, and was not manufactured later, is a far stronger position than a spreadsheet a plaintiff can call fabricated. As coverage in The Robot Report tracks humanoids moving from demos toward commercial deployment, the diligence on their training data tightens in step, and verifiable beats plausible every time.

C2PA will not arrive in robotics as a mandate with that acronym on it. It will arrive as a buyer's question that only a signature can answer, and as the quiet realization that a provenance record you can edit is a provenance record you cannot sell. The standard already exists, tested on the harder adversarial problem of a public internet full of fakes. Pointing it at the episodes that teach robots to act is less an invention than a port. The teams that do it early will be the ones whose data still verifies when someone finally checks.