Product technical documentation
In-Band Signed Metadata for AI-Generated or Manipulated Content
How DeepID Guardian Tools writes cryptographically signed, tamper-evident C2PA Content Credentials into image, video, and audio files — and how anyone holding a marked file can verify them.
Version
1.0 · current
Date
29 July 2026
Product
DeepID Guardian Tools dm-guardian-tools
Audience
Integration partners, auditors, regulators
Standards referenced
C2PA / Content Credentials · EU AI Act Art. 50(2) · Code of Practice on Transparency, Section 1
01
Purpose and scope
DeepID Guardian Tools analyses media for signs of artificial generation or manipulation, and then writes the result back into the file as a cryptographically signed C2PA manifest. This document describes that marking capability.
The marking uses C2PA Content Credentials: signed manifests embedded inside the media file (hard binding / in-band), rather than held only in an external database. A marked file therefore carries its own provenance record wherever it travels — including through systems that know nothing about Deep Media.
Design requirements for the mark
Attached in-band, inside the asset itself · digitally signed · time-stamped · tamper-evident, so that alteration is detectable · carrying a machine-readable indication of whether the content has been artificially generated or manipulated.
The intended readers are integration partners, auditors, and regulators who need to establish what the mark contains and satisfy themselves that it is genuine. Accordingly, this document describes:
How the marking is produced and attached
How the metadata indicates AI generation / manipulation
How the signature provides tamper-evidence
How third parties can verify the marking
Which file formats are supported
Where the implementation can be inspected
02
Relationship to the EU AI Act and the Code of Practice
Marking obligations for AI-generated content arise under Article 50(2) of the EU AI Act, and the Code of Practice on Transparency of AI-Generated Content sets out mandatory marking measures under its Section 1. The table below maps each requirement of that section to the corresponding property of the implementation described in this document.
Code requirement (Section 1)
Deep Media implementation
Sub-measure 1.1.1 — Record in metadata whether content is AI-generated or manipulated
Yes. A C2PA custom assertion (com.deepid.detection.v1) and a C2PA action (com.deepid.detection.analyzed) record a machine-readable verdict (score, bucket / confidence class) for artificial generation or manipulation, together with modality and analysis timestamp.
Metadata must be digitally signed
Yes. Manifests are signed with ECDSA P-256 / SHA-256 (ES256) using an X.509 end-entity certificate conforming to the C2PA Certificate Profile (c2pa-kp-claimSigning and documentSigning EKUs).
Metadata must be time-stamped where time information is available
Yes. Each assertion includes an ISO-8601 UTC analyzed_at / action when timestamp. Optional RFC 3161 trusted timestamping is supported via C2PA_TSA_URL.
Metadata must be attached in a secure and tamper-evident manner
Yes. C2PA hard binding embeds the signed manifest store in-band in the asset. Any modification of the media bytes or the manifest invalidates the cryptographic binding under standard C2PA validation.
Encouraged use of established standards
Yes. Implementation is based on the open C2PA specification via the official c2pa-python / c2pa-rs SDK.
Detection and marking are distinct capabilities
Deep Media operates forensic classifiers for deepfake and GenAI detection; under the Code these constitute an optional transparency aid rather than a marking measure. The capability documented here is distinct from them. After — or in the course of — analysis, Guardian Tools writes a machine-readable, cryptographically signed, in-band mark into the content file itself.
Detection determines what is recorded; the mark is what persists with the asset. The two should not be read as the same capability.
03
Technical overview
3.1 Architecture
The marking pipeline runs as a single pass over the submitted asset:
Stage
Operation
01 · Input
Media received by upload, cloud storage reference, or HTTPS URL.
02 · Detection
DeepID detection services analyse the asset across image, video, and audio modalities.
03 · Verdict
Normalized result set: { success, score, bucket, results }.
04 · Manifest
C2PA Builder (c2pa-python / c2pa-rs) constructs the manifest — actions plus the DeepID assertion — and signs it with the ES256 claim-signing certificate chain.
05 · Embed
The signed manifest store is written into the original media bytes.
06 · Output
The same media container is returned, now carrying in-band C2PA Content Credentials.
3.2 API surface (verifiable)
Endpoint (production base URL of the Guardian Tools service):
http
POST /deepfake/detect
Authorization: Bearer <token>
Content-Type: application/json
Request fields (relevant):
Field
Value
Meaning
modality
image | tti | cgi | audio | video | ttv | face-video
Detection modality
s3Location / webLocation / multipart file
media reference
Content to analyse and mark
response_mode
c2pa
Return the marked media file instead of JSON scores
When response_mode is c2pa, the HTTP response body is the binary media with Content Credentials embedded. Response headers additionally expose the verdict for convenience (X-DeepID-Score, X-DeepID-Bucket, X-DeepID-Modality), but the authoritative machine-readable mark is inside the file.
curl · example request
curl -H “Authorization: Bearer $TOKEN” \
-H “Content-Type: application/json” \
-d ‘{
“s3Location”: “gs://example-bucket/asset.jpg”,
“modality”: “image”,
“response_mode”: “c2pa”
}’ \
-o asset-deepid-c2pa.jpg \
https://tools.deepid.app/deepfake/detect
Implementation entry points (source-verifiable):
Component
Path
Detect + C2PA response mode
routes/realtime.py
Manifest construction & signing
routes/c2pa_embed.py
Certificate / PKI generation
routes/c2pa/generate_pki.py
Runtime signing chain
routes/c2pa/es256_certs.pem + es256_private.key
04
In-band signed metadata: what is written into the file
4.1 Claim generator
Each manifest identifies the claim generator as DeepID Guardian Tools (configurable via C2PA_CLAIM_GENERATOR / C2PA_CLAIM_GENERATOR_VERSION).
4.2 C2PA action (processing / marking event)
Label: c2pa.actions — action type: com.deepid.detection.analyzed. Fields include:
softwareAgent.name / version — DeepID Guardian Tools
description — human-readable summary including modality, score, and verdict bucket
when — UTC timestamp of the marking / analysis event
4.3 DeepID assertion — AI generation / manipulation indicator
Label: com.deepid.detection.v1 (reverse-DNS custom assertion).
Field
Type
Role in the mark
vendor
string
“DeepID”
product
string
Claim generator product name
schema_version
string
Assertion schema version (“1.0”)
modality
string
Content type analysed (image, video, audio, …)
success
boolean
Whether analysis completed
score
number
Machine-readable likelihood / confidence of artificial generation or manipulation
bucket
string
Discrete verdict class used by DeepID (e.g. likely_genai, probable_genai, possible_genai, probable_real, likely_real, or modality-specific verdicts such as CGI)
analyzed_at
string (ISO-8601)
Time-stamp of the analysis / marking
results
object
Size-sanitized supporting detail (embeddings / large frame dumps stripped)
How this indicates artificially generated or manipulated content
The score and bucket fields are the machine-readable record of whether the content is assessed as AI-generated or manipulated. Deployers and downstream systems can treat genAI / deepfake buckets (and/or a configured score threshold) as the affirmative mark required by Sub-measure 1.1.1. The assertion remains attached to the asset as signed in-band metadata regardless of any separate UI presentation.
4.4 Binding model (tamper-evidence)
Guardian Tools uses C2PA hard binding:
A cryptographic hash of the asset content is bound into the signed claim.
The signed manifest store is embedded in the media container (JPEG, PNG, MP4, etc.).
Validators recomputing the content hash and verifying the COSE signature detect pixel / sample alteration, stripping or substitution of the manifest, and claim forgery without the private key.
Hard binding is what makes the mark “secure and tamper-evident” in the sense the Code requires. Soft bindings such as watermarks and fingerprints are a complementary layer, addressed separately in Section 8, and are not a prerequisite for the signed-metadata layer described here.
05
Cryptographic signing profile
Property
Implementation
Signature algorithm
ECDSA with SHA-256 over P-256 (ES256)
Certificate form
X.509 v3
Chain
End-entity (leaf) ← Intermediate CA ← Root CA (full chain supplied in x5chain / PEM)
Leaf Basic Constraints
CA:FALSE
Leaf Key Usage
digitalSignature (critical)
Leaf Extended Key Usage
c2pa-kp-claimSigning (1.3.6.1.4.1.62558.2.1) and id-kp-documentSigning (1.3.6.1.5.5.7.3.36)
Organization (O)
DeepID (displayed by Content Credentials inspectors that surface organisation name)
Private key handling
Leaf private key held server-side; not exposed to API clients. Optional override via C2PA_CERT_PATH / C2PA_KEY_PATH for production HSM / managed secrets.
Optional TSA
RFC 3161 via C2PA_TSA_URL
Trust note (transparency)
Public Content Credentials validators recognise signatures as trusted when the root is on the C2PA Trust List (or an equivalent configured trust store). Deep Media ships a private root for operational signing and can substitute a Trust List CA chain without changing the embedding pipeline.
Cryptographic tamper-evidence of the in-band mark does not depend on public-list membership; trust-list membership affects who is recognised as a trusted signer, not whether the metadata is signed and bound.
06
Supported content formats (in-band embedding)
Guardian Tools embeds C2PA manifests for formats supported by c2pa-rs write paths, including:
Images
JPEG
PNG
WebP
GIF
TIFF
HEIC/HEIF
AVIF
Video
MP4
QuickTime (MOV)
AVI
Audio
MP3
M4A
WAV
FLAC
Unsupported containers for C2PA download mode are rejected with HTTP 400 rather than silently omitting the mark.
07
Independent verification procedure
Any third party can verify that a file produced with response_mode=c2pa carries in-band signed metadata.
1. Open-source C2PA tooling — e.g. c2patool, Content Authenticity Initiative open-source SDKs:
bash
c2patool asset-deepid-c2pa.jpg
Expected: a readable manifest listing claim generator DeepID Guardian Tools, action com.deepid.detection.analyzed, and assertion com.deepid.detection.v1 containing score / bucket.
2. Content Credentials inspectors — open the file in a Content Credentials inspector (or equivalent) and inspect provenance.
3. Source review on request — the implementation is not held in a public repository. Deep Media provides the relevant modules to reviewers on request, or walks through them on a call: routes/c2pa_embed.py, functions build_manifest_definition and embed_detection_c2pa; and routes/realtime.py, the response_mode == “c2pa” path.
4. Tamper test — modify one pixel / sample of a marked file and re-validate; the C2PA hard binding validation fails, demonstrating tamper-evidence.
08
Scope relative to other Code measures
Measure
Status in this documentation
1.1.1 Digitally signed metadata (mandatory layer)
Implemented — documented above
1.1.2 Imperceptible watermarking
Not claimed in this document, which covers the signed-metadata layer only. Watermarking can be combined as a second layer under the Code’s multi-layer approach.
1.1.3 Fingerprinting / logging (optional)
Available as complementary Deep Media detection / logging capabilities; not relied upon here to satisfy mandatory marking.
Section 2 deployer labelling
Out of scope of this technical marking document (human-visible labels are a separate deployer obligation).
Where the Code contemplates in-band signed tamper-evident metadata and/or watermarking, this document covers the former: C2PA hard-bound Content Credentials that record whether content is artificially generated or manipulated. The layers are complementary and can be deployed together.
09
Summary
DeepID Guardian Tools provides the technical means to mark AI-generated and manipulated content in line with the mandatory marking measures of Section 1 of the Code of Practice:
Property
Basis
In-band
Signed C2PA manifests are embedded in the media file.
Digitally signed
ES256 with a C2PA-profile X.509 certificate chain.
Tamper-evident
Hard binding to content hashes; alteration invalidates the claim.
Indicates AI generation / manipulation
Machine-readable score and bucket (plus modality and timestamp) in assertion com.deepid.detection.v1.
Publicly verifiable
Open standard (C2PA), inspectable assertion schema, standard verification tools, and source review on request.
Sample marked assets, full certificate chain details, and a live verification walkthrough are available on request. Requests and technical questions can be directed to the contact below.
10
Contact
Organisation
Deep Media
Product
DeepID Guardian Tools
Source review
Implementation modules or a live walkthrough, on request
Previous
Response modes
Next
Independent verification