Soft Redaction of Image Provenance via Zero-Knowledge Proofs

This paper proposes a mechanism for soft redaction of image provenance metadata using zero-knowledge proofs (ZKPs), addressing a fundamental tension in the C2PA (Coalition for Content Provenance and Authenticity) standard: assertions that strengthen trust in an image may also reveal sensitive information about the creator or capture context.

Problem and Motivation. The C2PA standard attaches cryptographically signed provenance assertions (recording origin, editing history, rights) to digital images. However, provenance transparency can conflict with privacy. While C2PA supports hard redaction (removing assertions entirely), this can also weaken the evidentiary value of the provenance record. The authors propose soft redaction: replacing an assertion with a verifiable claim about its value rather than the value itself.

Definition of Soft Redaction. A soft redaction of assertion a = (V, H a) is formally defined as the tuple (C, θ, π) where C = commit(V, r), θ are public parameters of predicate P, and π is a zero-knowledge proof that ∃ V, r: C = commit(V, r) ∧ P (V; θ) = ⊤. The original assertion is hard-redacted while its hash remains in the signed claim, providing a cryptographic binding between the original camera-signed assertion and the subsequently attached proof. The workflow: read the assertion value, generate a ZKP that it satisfies predicate P, hard-redact the original assertion retaining its hash, and attach the ZKP as a new assertion in a subsequent C2PA update manifest.

ZKP Algorithm Choice. The authors compared Bulletproofs, Groth16, and PLONK on the same predicate. PLONK was adopted because it provides a universal structured reference string (SRS), allowing a single setup to support all circuits within a size bound while maintaining constant verification time (220 ms) and a fixed proof size of 768 B. Groth16 had faster proving (0.29 s) but required a new trusted setup per predicate; Bulletproofs had O(n) verification scaling. We adopt PLONK throughout.

Contribution 1: Location Privacy. For GPS coordinates, instead of evaluating the Haversine formula directly, the predicate d ≤ R is reformulated as a comparison over the intermediate accumulator a = sin2(Δϕ/2) + cos ϕ1 cos ϕ2 sin2(Δλ/2) ≤ a* = sin2(R/2R⊕). The trigonometric functions are approximated with degree-d Chebyshev polynomials fitted over [−π/2, π/2], with approximation error ϵd absorbed into the acceptance threshold. All computation uses integer fixed-point arithmetic. A degree-5 Chebyshev approximation was selected as the best trade-off: Degree-5 Chebyshev polynomials provide the best practical compromise between circuit complexity and approximation accuracy, with p99 errors of only 36 m, 214 m, 1.1 km and 7.6 km respectively for city, regional, national, and continental scales. The Chebyshev-5 circuit compiles to 334 constraints, with proof generation of 0.64 s on average and verification of only 222 ms on a MacBook M3 Max.

Contribution 2: Likeness Provenance (Biometric Soft Redaction). For personality rights enforcement, the paper proposes that "a rights-holder registers a protected biometric descriptor of their likeness q ∈ R D... A third party wishing to use an image runs the same biometric model over that image to obtain an image-derived descriptor v ∈ R D, and must determine whether v matches the registered descriptor q. The proof establishes π: ∃ q: ∥q − v∥22 ≤ R2 where q is the hidden registered descriptor and (v, R2) are public. The verifier does not learn the descriptor itself. The circuit quantises embedding components at scale S = 1,000 and computes a sum of squared differences. For D=128, the circuit has 279 constraints: 128 squarings, 21 range-check bits, and 130 identity constraints. Constraint count grows as exactly 2D + 23. Notably, the l2 circuit requires fewer constraints than the country-scale Haversine circuit of Section 3.1 (279 vs. 334) despite operating in 128 dimensions. This is because L2 distance is a degree-2 polynomial, whereas geodesic distance required trigonometric approximation."

Biometric Evaluation. Five models were evaluated on LFW (6,000 pre-formed pairs): ArcFace, FaceNet, AdaFace, ElasticFace-Arc, ElasticFace-Cos, all producing D=512 embeddings (1,047 constraints, pot12 SRS). Results: FaceNet achieved the best accuracy of 98.82% at EER 1.18% with threshold R* = 1.115; ArcFace achieved 95.12% accuracy; AdaFace 89.78%; ElasticFace variants ≈92.6%. Prove times at D=512 were ≈6.7 s per proof across all models; verify time ≈320 ms. All 5/5 proofs verified OK for each model. The recognition threshold R determines both the biometric false-accept rate and the size of the set of descriptors that can satisfy the distance predicate, and can be adjusted without recompiling the circuit.

Contribution 3: Fingerprint-Based Recovery (Anti-Spoofing). The same l2 circuit is applied to perceptual fingerprints used in watermark-based recovery pipelines. When C2PA metadata is stripped by content platforms, a pipeline uses an invisible watermark identifier and a ledger to recover the signed manifest, with a visual fingerprint stored inside that manifest performs an anti-spoofing check to confirm that the retrieved manifest genuinely belongs to the query image. Storing the reference fingerprint in plaintext is problematic because "the fingerprint descriptor may be a proprietary signal whose exact values are commercially sensitive, and could be used to reverse-engineer the fingerprinting model or craft adversarial images that pass the anti-spoofing check. The ZKP converts this into a privacy-preserving challenge-response protocol where the verifier learns only whether the anti-spoofing predicate holds, not the value of the reference fingerprint."

Fingerprint Evaluation on MIRFLICKR-25k. The authors evaluated four descriptors across 1,000 images with 5,000 benign transforms (JPEG q=75/q=50, 5% crop, ±10% brightness/contrast) and 2,000 watermark-transplant attack pairs. Attack rejection increases sharply with training specificity: ResNet18-ImageNet rejected only 20.9% of attacks (FR1 = 0.35); SimProv rejected 73.6% (FR1 = 0.85); DINO ViT-S/8 rejected 99.7% (FR1 = 1.00); SSCD achieved perfect rejection (FR1 = 1.00). The paper notes DINO's strong performance despite no copy-detection training: the patch-level self-attention mechanism of ViT creates instance discriminative features that generalise well to this task. Prove times: SimProv (D=256, ≈2.3 s), DINO (D=384, ≈2.9 s), RN18/SSCD (D=512, ≈6.3 s). PLONK proof size (768 bytes) and verify time (≈250 ms) remain constant across all dimensions.

Scaling Characteristics. Prove time grows super-linearly with dimension (0.44 s at D=32, 0.96 s at D=128, 6.28 s at D=512, 87 s at D=2048), with Each SRS tier doubling roughly triples prove time. Verify time remains approximately constant at ≈250 ms across all D, since it is determined by the PLONK verifier equation count rather than circuit size. Thus D = 128 offers sub-second proving for low-dimensional descriptors, while D = 512 remains practical for interactive or offline rights checks on commodity hardware.

Conclusion and Limitations. The paper concludes that ZKPs can extend media provenance from a binary choice between disclosure and redaction toward selective, verifiable disclosure of provenance properties, with sub-second verification and proof sizes fitting practical workflows. The main cost is proof generation: low-dimensional predicates are suitable for interactive use, while higher-dimensional visual descriptors may require offline or service-side proving. Limitations acknowledged: Our prototypes focus on distance predicates and do not yet address richer policies such as set membership, temporal constraints, or compound rights expressions. The authors also note a threat for low-entropy assertions: "a ZKP does not by itself prevent leakage through repeated adaptive queries: if a service allowed arbitrary proximity predicates over a hidden GPS coordinate, an adversary could issue a sequence of location guesses and progressively narrow the possible capture region. They note These attacks are less practical for high-dimensional visual feature embeddings, where the search space is too large. Finally, they suggest Future standardisation of a dedicated ZKP assertion type could nevertheless be a useful step toward interoperability" within C2PA.

Improved AI systems can selectively verify provenance and likeness without revealing sensitive raw data, using zero-knowledge proofs integrated into C2PA-style pipelines.

• Privacy-preserving location verification: The AI system can prove that an image was captured within a given radius (city, regional, national, or continental scale) without disclosing exact GPS coordinates. Using the Chebyshev-5 circuit, it achieves 334 constraints, 0.64 s proving, 222 ms verification, and p99 distance errors of 36 m / 214 m / 1.1 km / 7.6 km at the respective scales.

• Privacy-preserving biometric likeness checks: The system can verify that an image subject matches a protected biometric descriptor (e.g., FaceNet, ArcFace, AdaFace) without revealing the registered template. With D=512 embeddings, it compiles to 1,047 constraints, proves in 6.7 s, verifies in 320 ms, and can achieve 98.82% accuracy / 1.18% EER using FaceNet at threshold R* = 1.115.

• Secure anti-spoofing for watermark recovery: The AI system can validate that a recovered C2PA manifest belongs to a query image using perceptual fingerprints, without exposing the reference fingerprint. With SSCD or DINO descriptors, it rejects 100% / 99.7% of watermark-transplant attacks, respectively, while keeping the proprietary fingerprint signal hidden.

• Universal and scalable ZKP verification: The system can support any similarity or distance predicate using PLONK with a universal structured reference string, so one setup covers all circuits within a size bound. Verification time stays constant at ~250 ms and proof size at 768 bytes, independent of descriptor dimensionality.

• Efficient embedding-distance circuits: The system can prove L2 distance with exactly 2D + 23 constraints, enabling sub-second proving at D=128 and practical interactive use up to D=512, while retaining tunable thresholds without circuit recompilation.

• Adaptive-query leakage mitigation: The improved system can guard against repeated proximity-query attacks on low-entropy data (e.g., GPS) by enforcing query rate limits, requiring authenticated requests, tracking cumulative information disclosure, or steering users toward high-dimensional visual embeddings where such attacks are infeasible.

• Interoperable provenance assertions: The system can emit dedicated ZKP assertion types in C2PA manifests, allowing different platforms to verify redacted provenance claims without trusting the redacting party, while keeping original cryptographic hash bindings intact.