Disclosure, AI-Generated Content, and Provenance

Labels speak to the reader, detectors guess, and signed provenance carries a claim about origin. None of the three says the content is true.

A visible label works without special software. It can also be vague, hidden or removed. It has to be timed and presented accessibly, and it works best when tailored to interpretation risk. A watermark or detector operates at scale. It returns false positives and false negatives, it degrades under transformation, and it should never be sole proof. Signed provenance supports chain-of-custody evidence. But its metadata may arrive already stripped, it depends on issuer trust and key security, and it says nothing about whether the scene is real.

The middle column is the one where the failure has been counted. Seven widely used GPT detectors were run over 91 human-written TOEFL essays and 88 US eighth-grade essays. The average false-positive rate on the TOEFL essays was 61.3%. The eighth-grade essays were classified near-perfectly. A 2023 paper in Patterns records how far the agreement went: “All detectors unanimously identified 19.8% of the human-written TOEFL essays as AI authored, and at least one detector flagged 97.8% of TOEFL essays as AI generated.” The errors are not sprayed evenly across writers. They concentrate on non-native English writers. The cost of a detector run is paid by a particular group of people.

Watermarks fail differently, and on purpose. A regeneration attack adds Gaussian noise to an image's latent representation, then reconstructs the image with a generative model. A 2024 NeurIPS paper measured what that does: “For the resilient watermark scheme RivaGAN, our regeneration attacks successfully remove 98% of the invisible watermarks while maintaining a PSNR above 30 compared to the original images.” The paper does not stop at the measurement. It proves the attack defeats any watermark that perturbs the image within a limited L2 range, whether or not that watermark has yet been invented. “Can degrade under transformation” is a proof, not a caveat.

Disclosure states what was generated. Materiality states whether that matters. Provenance records the history, detection covers the cases where the record is gone, and remedy handles the ones that already spread.

Creation disclosure states whether content was generated, transformed, translated, or edited with AI. Materiality explains whether identity, event, speech, or evidence was significantly changed. Provenance records source, tool, credentials, and transformation history. Detection and verification supply signals and channels when metadata are missing or disputed. Remedy and enforcement cover correction, removal, appeal, attribution, and incident response.

The five stages are not interchangeable. The later ones are not spare capacity for the earlier ones. Detection exists because provenance is routinely gone by the time a file reaches a reader. Remedy exists because content spreads before any of the first four stages is consulted.

A disclosure should tell the reader what role AI played, how materially the content was altered, where the material came from, and what all that changes about how to read it. Provenance records origin and transformation history. It does not certify truth, consent, legality, or harmlessness. Materiality carries most of that weight. Without it the same four words get attached to a color correction and to a fabricated quotation.

Controls can include user-facing labels, machine-readable markers, watermarking, signed provenance, content credentials, detection tools, platform policy, and verification channels. That list looks like a designer's menu. In at least one jurisdiction it is not. China wrote the split into law. The Measures for Labeling AI-Generated Synthetic Content were issued on 7 March 2025 by the Cyberspace Administration of China with three other ministries, and have been in force since 1 September 2025. Article 3 defines explicit labels — text, sound or graphics a user can plainly perceive — and implicit labels, technical marks carried in the file data. Article 5 tells the implicit layer what it has to carry: the content's attribute information, the provider's name or code, and a content number. Article 10 then protects the mark itself: “任何组织和个人不得恶意删除、篡改、伪造、隐匿本办法规定的生成合成内容标识，不得为他人实施上述恶意行为提供工具或者服务，不得通过不正当标识手段损害他人合法权益。”

So the visible layer and the machine-readable layer are two obligations, addressed to two audiences. Named fields on one side, an unlawful act on the other. How well each control holds up still varies under editing, screenshotting, recompression, adversarial removal, and missing metadata. And a screenshot defeats every machine-readable item on the list at once. No malice, nobody deleting anything. What is left is the wording a human can read. That is why the wording has to be built to carry the load, not to announce that a tool was involved.

The defect of a label keyed to how content was made, rather than to what it does, has been adjudicated at platform scale. A looped seven-second clip of President Biden stayed up. The rule it had been judged under was dismantled in the same decision. On 5 February 2024 the Meta Oversight Board upheld the decision to leave the clip online, in case 2023-029-FB-UA. The Manipulated Media policy covered only video, only AI-generated or AI-altered content, and only people appearing to say words they did not say. The Board's verdict on that scope: “In its current form, the Manipulated Media policy fails to clearly specify the harms it is seeking to prevent, and the scope of its prohibitions is incoherent in both policy and technical terms.”

The recommendation is the part worth copying. The Board proposed that Meta stop removing manipulated media where nothing else is violated, and attach a label instead: the content is significantly altered and could mislead. Materiality and consequence in the label, not the production method. Meta answered on 5 April 2024. Labelling would begin in May 2024, and removals under the manipulated video policy alone would stop in July 2024.

Classify the transformation first. What counts as material, and therefore what has to be disclosed, depends on that answer.

Step 1 classifies the transformation: generation, restoration, editing, dubbing, translation, or personalization. Step 2 assesses materiality and risk — identity, evidence, public interest, deception, vulnerability. Step 3 chooses layered signals: visible labels, metadata, provenance, watermarking, verification channels. Step 4 tests persistence and comprehension across transformations, platforms, accessibility, and audience interpretation. Step 5 operates remedy: correct, remove, attribute, appeal, notify, and learn from incidents.

Step 4 is where this lesson's numbers belong, because both halves of it have been measured by other people already. Persistence: 98% of invisible RivaGAN watermarks removed by a regeneration attack while PSNR stayed above 30, and metadata detached by any process that touches the file. Comprehension: two preregistered experiments over 7,579 respondents, in which every label cut belief and the ones that merely reported AI involvement barely moved engagement. A team that skips step 4 is not missing a formality. It is declining to find out which of those two results applies to its own workflow.

Step 1 is not a formality either. The Manipulated Media policy classified by production method and was held incoherent for it. The class it keyed on was not the class that carried the harm. A label written before the transformation is classified is a label written before anyone knows what it has to say.

Labels and provenance are signals about origin. They survive some transformations and not others, so persistence and comprehension are both measurable — and, in this lesson, measured. Seven detectors averaged a 61.3% false-positive rate on 91 human-written TOEFL essays, a cost borne by non-native English writers. A regeneration attack removed 98% of invisible watermarks, with a proof that covers schemes not yet built. Every label tested cut belief across 7,579 respondents, while the process-based wording left engagement roughly untouched. Four signals agencies stated that Content Credentials supply contextual information about authenticity and not a verdict on truth. Article 50(4) obliges the deployer to disclose, Article 50(2) obliges the provider to mark, and Article 99(4)(g) prices a breach of either at up to EUR 15 000 000 or 3 % of total worldwide annual turnover.

None of those figures decides anything by itself. Decide which stripping, false-positive, or comprehension result would force the reviewer to redesign, restrict, remedy, or retire the system. Write that threshold down before the next measurement arrives. A number without a pre-committed threshold is an observation, not a decision.