Generative Provenance Watermark Stripping Tooling
This detects an AI agent launching a command-line program whose purpose is to remove provenance markings from images or video - things like C2PA content credentials, IPTC digital-source metadata, or invisible AI-generation watermarks. It flags the attempt to erase evidence that a file was AI-generated or to strip proof of its origin.
How the attack works
An agent spawns a subprocess to alter a media file. The rule catches three patterns: a tool whose name or arguments explicitly say 'remove watermark' or pair a provenance term (c2pa, jumbf, synthid) with a destructive verb; a metadata tool like exiftool or ffmpeg run with both a deletion flag and a provenance keyword together; or a destructive in-place wipe that deletes all metadata tags from an image or video with no backup. The goal in each case is to make AI-generated or tampered media pass as having no traceable origin.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c3f1a92-4d68-4b0e-9c21-58ef0a6d3b47
- Severity
- Medium
Why it matters
An organization loses the ability to prove where a piece of media came from or whether it was AI-generated, which undermines content authenticity claims, supports misinformation, and can hide evidence of manipulated evidence in disputes or investigations.
What you can do
- →Review flagged events manually - this rule reports rather than blocks, since it only sees command-line text and cannot confirm outcome or block downstream misuse.
- →Check whether the flagged command was a legitimate privacy-scrubbing step (e.g., exiftool -all= before publishing photos) versus an attempt to hide AI-generation provenance.
- →Restrict which agents or service accounts can invoke metadata/media tools like exiftool, ffmpeg, magick, or c2patool with destructive flags.
- →If provenance integrity matters for your workflows, verify C2PA/IPTC manifests are intact at points where media leaves your monitored environment, since stripping done on unmonitored hosts is outside this rule's visibility.
Known benign look-alikes
- Privacy-motivated EXIF scrubbing before publishing photographs (exiftool -all= -overwrite_original on JPEGs). This is the largest genuine benign case; branch 3 requires the destructive -overwrite_original form plus an image target precisely so that read-only inspection never fires, but a deliberate privacy wipe will still report.
- Web asset build pipelines that call "magick -strip" or "mogrify -strip" for byte-size reduction. Branch 2 additionally requires an explicit provenance keyword on the same command line, so plain optimisation calls do NOT match.
- ffmpeg transcodes using "-map_metadata -1" to drop container metadata for size or compatibility reasons. Same mitigation - a provenance keyword must also be present.
- mat2 used as intended, as a privacy anonymisation tool for documents and images shared by journalists or researchers. Branch 4 fires on this; treat as a review item, not an incident.
- Provenance research, red-team robustness testing, or C2PA conformance work that legitimately runs watermark-attack tooling. Test-harness invocations are filtered; direct research invocations are not, and are expected to be triaged as authorised.
- A repository path or artefact name containing a provenance term near an unrelated destructive verb (for example a script under a "c2pa-tools" directory that purges a cache). The 60-character proximity window keeps this rare but does not eliminate it.
- Documentation, search and help invocations (grep/rg/find/man/--help) and package installs of libraries such as invisible-watermark, all explicitly filtered.