Content Authenticity for Multimodal Generative AI: Provenance, Watermarking, Disclosure, Detection

Identity statement: content authenticity is the set of practices that let a viewer, listener, or downstream system determine whether a piece of media — an image, audio clip, or video — was generated by AI, and, where it was, trace it back to its origin. [GROUND TRUTH] (Sources/nca-genm/domain-7-trustworthy-ai.md): the practices are "provenance/watermarking and content credentials to mark AI-generated media," "disclosure that content is synthetic," and "detection of manipulated or fabricated content."

Three controls, and they are not redundant with one another — each catches a failure the other two do not.

Each row's "misses" column is the reason all three exist together rather than one substituting for the others: watermarking survives re-sharing but requires the original creator to have added it and requires a downstream party to check for it; disclosure is immediate and requires no technical check but only works at the point of first presentation and can be stripped when content is re-shared without it; detection works even when the other two failed or were never applied, but is an arms race against increasingly good generation and increasingly deliberate evasion.

L1 — The intuition: a hallucination is a false claim; a deepfake is not a claim at all until someone presents it as one

A hallucinated sentence asserts something — a date, a statistic, a quote — and the assertion is checkable against a source, which is exactly the mechanism M7-05's grounding and citation controls exploit. A generated image of a person doing something they never did asserts nothing on its own; an image is not a proposition with a truth value the way a sentence is. The harm only activates once the image is presented as a real photograph, a video is presented as real footage, or a cloned voice is presented as an authentic recording. This is why the mitigation shape differs completely: grounding an image generator in "retrieved real photographs" the way RAG grounds a language model in retrieved text does not make the output non-deceptive, because the deception (if any) was never in whether the image matches a retrieved source — it is in whether the image is presented as something it is not.

L2 — The mechanism: the four controls target four different points in a media item's life

At creation. Provenance and watermarking happen here, embedding a signal into the media the moment it is generated — before it has been shared, re-encoded, or separated from any metadata. [GROUND TRUTH] (Sources/nca-genm/domain-7-trustworthy-ai.md) notes this connects directly to production diffusion tooling: "NVIDIA's diffusion training explicitly covers content authenticity and how to build trustworthy models," meaning provenance is treated as a property to build into the generation pipeline itself, not an afterthought bolted on post-generation.

At first presentation. Disclosure happens here — the interface where a user first encounters the media states plainly that it is AI-generated. This is the multimodal analogue of the non-technical-language transparency requirement that governs how a system explains a decision: the disclosure has to be visible and understandable to the person actually looking at or listening to the content, not buried in a technical metadata field nobody without special tooling will ever open.

At any point after creation, including re-distribution. Detection happens here, and it is the only one of the three controls that works without depending on the original creator having done anything cooperative at all. A detection tool analyzes the media's own statistical properties — artifacts characteristic of a generation process, inconsistencies a real capture would not have — to flag likely synthetic or manipulated content, regardless of whether a watermark was ever added or a disclosure was ever shown.

Across the whole lifecycle. None of the three controls, alone, covers every case, which is why they function as a set rather than as alternatives. A system that only watermarks is defeated by anyone who strips the watermark before re-sharing. A system that only discloses at first presentation is defeated the moment content is re-shared without that context attached. A system that only detects after the fact is always one generation-model improvement behind whatever it was trained to catch.

L3 — The exam-relevant edge case: treating content authenticity as a text-hallucination issue is the domain's named trap

[GROUND TRUTH] (Sources/nca-genm/domain-7-trustworthy-ai.md) names this directly as a common exam trap: "Treating content authenticity as only a text/hallucination issue — for multimodal models it centrally covers synthetic images/audio/video and their provenance." A question that describes a deepfake or a fabricated video and offers "add citations" or "ground the output in retrieved sources" as the fix is testing exactly this trap: those are the correct mitigations for a false textual claim, and they do not apply to a synthetic image or video, because the harm in a deepfake is not an unsupported factual claim, it is an undisclosed, unmarked piece of fabricated media. The correct answer for a content-authenticity question is provenance, watermarking, disclosure, or detection — never a hallucination-ladder rung borrowed from the text domain.

A constructed scenario, invented for teaching. A company offers a service that generates short promotional videos from a text script and a small set of reference product images, using a text-to-image diffusion pipeline extended across frames plus a voice-synthesis narrator.

The incident that prompts the review. A generated video, downloaded and re-shared by a user on a social platform with no attribution to the generation service, is picked up by a news outlet and briefly reported as genuine promotional footage before someone notices visual artifacts characteristic of AI generation.

Auditing against the three controls, one at a time.

Provenance and watermarking. The service's export pipeline embeds a visible logo watermark in the corner of the video during the in-app preview, but the final downloaded export — the version users actually distribute — strips the watermark by default, because the product team assumed users wanted a "clean" export for their own branding. Finding: provenance failed at the export step, which is exactly the point in the media's life where it stops being under the service's control. The fix is to embed an imperceptible, cryptographically signed content-credential in the video file itself — following the model of a content-credentials standard that survives typical re-encoding — rather than relying on a visible watermark a user can trivially crop or that the export pipeline strips.

Disclosure. The in-app preview screen states "AI-generated preview" above the video, but the exported file itself carries no disclosure once it leaves the app — the disclosure lived entirely in the interface, not in anything that travels with the media. Finding: disclosure failed to survive the export boundary. The fix is to embed a disclosure statement in the video's own visible frame (a persistent, unremovable caption or intro card), not only in the surrounding app interface, so that disclosure travels with the file the way provenance should.

Detection. The news outlet's staff noticed artifacts themselves, without any detection tool — a lucky catch rather than a designed control. Finding: no detection capability exists at all, either offered by the service to downstream parties who want to verify a suspicious video, or run proactively by the service on its own outputs before they are exported. The fix is to publish a verification tool or API that lets any party check a video against the service's own signed content-credential, giving anyone who encounters a video claiming to be one of the service's outputs a way to confirm or refute that claim independent of the visible watermark.

Second worked example, briefer: the misconception this exposes. A different team on the same project proposes, as a shortcut, "just run our existing hallucination-detection pipeline on the video's auto-generated caption text" — treating the video's accompanying caption as the thing needing a truth check, the way M7-05's grounding and citation controls check a language model's factual claims. This misses the point entirely: even a video whose caption text is perfectly accurate can still be an undisclosed, unwatermarked deepfake if the video itself was never marked as synthetic. The caption's factual accuracy and the video's content-authenticity status are two completely independent properties, and fixing one does nothing for the other — which is the concrete, worked-through version of the domain's own named trap from section 2's L3.

Constructed illustration, invented for teaching — not a measured incident from any real service.

Media lifecycle for the generated video:
  Creation      -> Provenance/watermarking      [FAILED: stripped at export]
  Presentation  -> Disclosure                    [FAILED: did not survive export]
  Post-hoc       -> Detection                     [MISSING: no tool existed at all]

Three controls, three independent failure points, three independent fixes:
  Embed a signed content-credential that survives re-encoding.
  Embed disclosure in the media itself, not only in the surrounding interface.
  Publish a verification tool independent of the visible watermark.

None of the three failures would have been caught by a hallucination-style fact-check on
the video's caption text, because none of the three controls is about whether a claim is
true — they are about whether the media discloses what it is.

⭐ THE EARNED INSIGHT Provenance, disclosure, and detection fail independently, at different points in a media item's life, which means passing an audit on one tells you nothing about the other two. The ad-generation service's in-app disclosure was genuinely present and genuinely effective — right up until the export boundary, at which point it simply stopped existing, and nothing about having built it well in the app caught that it had vanished entirely three steps later.

Every row above traces to one of the three controls from section 1 failing at a specific, nameable boundary.

Trustworthy AI is Domain 7 at 5% weight, and this lesson serves the multimodal-specific portion of objectives 7.1 and 7.3 [GROUND TRUTH] (Sources/nca-genm/domain-7-trustworthy-ai.md) — describing the ethical principles of trustworthy AI and how technologies improve trustworthiness, applied specifically to the concern the domain names as having no analogue on the text-only sibling exam. The domain's own scope note calls this out directly: know NVIDIA's stated principles and the multimodal-specific concern of content authenticity, as two things to know, not one folded into the other.

Question phrasings to expect:

1. "Content authenticity for multimodal generative AI centers on which set of practices?" — provenance, watermarking, disclosure, and detection of synthetic media, not hallucination mitigation.
2. "A team proposes adding citations to reduce the risk of a generated video being mistaken for real footage. What is wrong with this proposal?" — citations address false textual claims; a deepfake's harm is undisclosed synthetic media, which citations do nothing to fix.
3. "Why is content authenticity treated as a distinctly multimodal concern rather than a general trustworthy-AI principle?" — because it addresses realistic synthetic images, audio, and video specifically, a risk that does not exist in the same form for a text-only system.
4. "A watermark is present in a preview but absent from the exported file a user downloads. What control failed?" — provenance, at the export/distribution boundary.

What the distractors typically look like

The reliable trap is exactly the one the source material names: offering a text-hallucination control (citations, grounding, low-temperature decoding) as the fix for a content-authenticity scenario. A second trap offers only one of the three controls (usually watermarking, the most familiar) as if it were sufficient on its own, when the correct answer requires recognizing that provenance, disclosure, and detection fail independently and are needed together.

Content authenticity is the set of practices — provenance and watermarking, disclosure, and detection — that let anyone encountering a piece of AI-generated media determine that it is synthetic and, where possible, trace it back to its origin. It is the trust concern specific to models that generate realistic images, audio, and video, because a fabricated photograph, cloned voice, or synthetic video can mislead in a way that has no equivalent in a text-only system, where the corresponding harm (a false claim) is addressed instead by hallucination mitigation.

Because a watermark can be stripped, cropped, or lost through re-encoding, and once it is gone the media carries no trace of its own synthetic origin. Watermarking works at creation time and depends on the creator having embedded it and on nobody removing it before the media circulates — a real but incomplete guarantee. Disclosure supplements it by stating synthetic origin at the point of presentation, and detection supplements both by analyzing media after the fact independent of anything the creator did, which is why the domain treats all three as necessary together rather than any one of them as sufficient alone.

• Three controls, independent of one another: provenance/watermarking (at creation), disclosure (at presentation), and detection (after the fact, regardless of creator cooperation).
• A deepfake asserts nothing until presented as real — unlike a hallucinated sentence, which is a false claim from the moment it is generated. This is why hallucination controls do not transfer to content-authenticity scenarios.
• Each control fails at a different boundary. The worked example's watermark failed at export, disclosure failed to survive the same export, and detection did not exist at all — three independent gaps, not one.
• Treating content authenticity as a text-hallucination issue is the domain's named trap — citations and grounding fix false claims, not undisclosed synthetic media.
• Build all three controls together, because none of them alone survives every real-world circumstance a piece of generated media passes through.

Next: M7-05 closes this module by bringing hallucination and content authenticity together into one artifact: a checklist that maps each trustworthy-AI principle this module has covered to a concrete control, extended specifically for a system that can fabricate images, audio, and video rather than only text.