# Generative Provenance Watermark Stripping Tooling

- **Severity:** Medium
- **Signature ID:** `7c3f1a92-4d68-4b0e-9c21-58ef0a6d3b47`
- **MITRE ATLAS:** AML.T0015 (Evade AI Model)
- **OWASP:** LLM09 (Misinformation)

## Summary

This detects an AI agent launching a command-line program whose purpose is to remove provenance markings from images or video - things like C2PA content credentials, IPTC digital-source metadata, or invisible AI-generation watermarks. It flags the attempt to erase evidence that a file was AI-generated or to strip proof of its origin.

## How the attack works

An agent spawns a subprocess to alter a media file. The rule catches three patterns: a tool whose name or arguments explicitly say 'remove watermark' or pair a provenance term (c2pa, jumbf, synthid) with a destructive verb; a metadata tool like exiftool or ffmpeg run with both a deletion flag and a provenance keyword together; or a destructive in-place wipe that deletes all metadata tags from an image or video with no backup. The goal in each case is to make AI-generated or tampered media pass as having no traceable origin.

## Why it matters

An organization loses the ability to prove where a piece of media came from or whether it was AI-generated, which undermines content authenticity claims, supports misinformation, and can hide evidence of manipulated evidence in disputes or investigations.

## What you can do

- Review flagged events manually - this rule reports rather than blocks, since it only sees command-line text and cannot confirm outcome or block downstream misuse.
- Check whether the flagged command was a legitimate privacy-scrubbing step (e.g., exiftool -all= before publishing photos) versus an attempt to hide AI-generation provenance.
- Restrict which agents or service accounts can invoke metadata/media tools like exiftool, ffmpeg, magick, or c2patool with destructive flags.
- If provenance integrity matters for your workflows, verify C2PA/IPTC manifests are intact at points where media leaves your monitored environment, since stripping done on unmonitored hosts is outside this rule's visibility.

## Known benign look-alikes

- Privacy-motivated EXIF scrubbing before publishing photographs (exiftool -all= -overwrite_original on JPEGs). This is the largest genuine benign case; branch 3 requires the destructive -overwrite_original form plus an image target precisely so that read-only inspection never fires, but a deliberate privacy wipe will still report.
- Web asset build pipelines that call "magick -strip" or "mogrify -strip" for byte-size reduction. Branch 2 additionally requires an explicit provenance keyword on the same command line, so plain optimisation calls do NOT match.
- ffmpeg transcodes using "-map_metadata -1" to drop container metadata for size or compatibility reasons. Same mitigation - a provenance keyword must also be present.
- mat2 used as intended, as a privacy anonymisation tool for documents and images shared by journalists or researchers. Branch 4 fires on this; treat as a review item, not an incident.
- Provenance research, red-team robustness testing, or C2PA conformance work that legitimately runs watermark-attack tooling. Test-harness invocations are filtered; direct research invocations are not, and are expected to be triaged as authorised.
- A repository path or artefact name containing a provenance term near an unrelated destructive verb (for example a script under a "c2pa-tools" directory that purges a cache). The 60-character proximity window keeps this rare but does not eliminate it.
- Documentation, search and help invocations (grep/rg/find/man/--help) and package installs of libraries such as invisible-watermark, all explicitly filtered.

## References

- https://attack.mitre.org/techniques/T1070/
- https://c2pa.org/specifications/specifications/2.1/index.html
- https://artificialintelligenceact.eu/article/50/

---
Source: https://www.netzilo.com/threats/generative-watermark-removal