Two carriers
Published ; updated
We embedded known TrustMark payloads in six generated images, saved each as PNG and JPEG, added a C2PA record and removed that record with Declawd. The matching decoder recovered the exact payload in ten of the twelve marked files before signing and the same ten after removal. All twelve cleaned files were byte-identical to their marked versions from before C2PA was added.
Two places
TrustMark changes image pixels to carry a payload. The C2PA manifest occupies a separate part of the file and can include a reference to that payload. Our test used Adobe's TrustMark Q model, BCH_4 encoding and a public 68-bit identifier for each file. The C2PA assertion named the algorithm and identifier. Removing its embedded store left the marked image bytes intact.
The plan, generated inputs, runner, model hashes and Python wheel lock were committed before the first encoding attempt. Each file received one attempt. The decoder used the matching Q model with fixed settings, without rotation search or the optional bounding-box detector.
Four states
Scroll horizontally to see all columns
| State | Embedded C2PA stores | Exact TrustMark payloads |
|---|---|---|
| Unmarked source | 0/12 | 0/12 |
| Marked image | 0/12 | 10/12 |
| Marked and C2PA-signed | 12/12 | 10/12 |
| C2PA-cleaned | 0/12 | 10/12 |
Exact recovery required a positive decoder result, all 68 expected bits and the expected schema. The independent c2patool 0.27.12 validator reported matching content bindings and validated claim signatures for all twelve signed files. It reported the development signing credential as untrusted in each case. After cleaning, it reported no claim in every file. Store presence, content binding, signature validation and issuer trust remain separate facts.
The misses
Both coloured-tile images were decoder misses before C2PA was added. They were still misses after removal. We retained them in the result and made no further encoding attempt. The other five scenes were a gradient, deterministic noise, a drawn outdoor scene, circles in a portrait frame and a generated texture. Each decoded in both file formats at every marked stage.
None of the twelve unmarked originals produced a decoder detection. Twelve generated controls supply no population false-positive estimate. This result concerns these images and the selected model and decoder settings. It supplies no measurement of SynthID, text watermarks, production vendor detectors or remote manifest recovery.
Retained bytes
Declawd reported that the embedded C2PA store was absent and that compressed image data and non-C2PA bytes were unchanged. The saved files independently confirm the result: every cleaned file exactly matches its marked input from before signing. Decoded RGB hashes also match across signing and removal for all twelve cases. JPEG encoding changed pixels when the marked JPEG was saved, before C2PA was added.
The pixel watermark remained recoverable in every case where it had decoded before signing. Removing an embedded C2PA record therefore leaves a separate carrier to inspect. The earlier C2PA walkthrough follows one signed image through changes to its pixels, manifest and signature. This experiment adds a selected pixel watermark to that distinction.
Reproduce
The registration records the inputs and procedure. The full results contain all twelve cases and 48 decoder observations. The published evidence also includes each image state, 48 raw validator reports, twelve cleaning reports, model hashes and the locked runtime. The reproduction guide explains a fresh run and a separate check of the saved evidence.
The current CLI downloads package the merged C2PA changes. The browser checker and text cleaner retain their registered scoring contracts and operate separately from this image experiment.