One Writable Word Produced a Confident False Accusation

This is not a case about whether a difficult image fooled a detector. It is a case about whether a person could choose the evidence that a verification system would use against them.

The base specimen was a genuine photograph from TRST's permanent vehicle-damage test set. For the adversarial test, the visual content remained unchanged. We wrote values into ordinary EXIF and XMP fields — fields that any file author can edit — and then isolated the metadata provider so no AI classifier or other evidence family could influence the result.

The decisive string was simple: Software = Midjourney v6.

Before the correction, that one declaration moved the image's origin assessment from camera-capture characteristics to synthetic generation supported. The synthetic-generation dimension then reported strong supporting evidence with High confidence.

The defect went deeper than one overweighted field. Adding a second writable declaration made the corroboration gate count two "independent" families:

They were not independent. They were two strings chosen by the same author, stored in the same unsigned file, with no signature, capture binding, or chain of custody. The system had mistaken two field names for two sources.

Corroboration is supposed to make a false accusation harder. Here it did the opposite: an attacker could manufacture the corroboration needed for a more confident verdict.

The same weakness ran in both directions. A fabricated Make and Model could make synthetic pixels look like a camera-origin file. In the measured laundering test, all 12 AI-generated images carrying forged camera metadata were presented as camera-origin before the correction.

This is the evidence-qualification problem at the center of DAI v2. A system may read a text field perfectly and still have no basis for trusting what the field says. Confidence that a string is present is not confidence that the string is true.

TRST did not delete the metadata. A tool name can still be useful workflow context. It simply cannot carry authority it does not possess.

Unsigned AI declarations now collapse into one self-declared file metadata source and contribute no independent corroboration family. Unsigned tool and camera names are weak observations, not strong origin evidence. In the report, the fields remain visible and carry a literal notice:

A cryptographically validated declaration is treated differently. A signed C2PA assertion from a trusted issuer can count as an authenticated provenance family because its source and integrity have been evaluated. That distinction is the difference between reading a claim and verifying who made it.

The permanent adversarial class contains genuine photographs with an AI tool tag, a fabricated camera identity, or both, plus known AI-generated images with a fabricated camera identity.

Before the correction, 24 of 24 genuine photographs carrying AI-bearing forged metadata received a public AI accusation. After the correction, 0 of 24 did. Across all 36 genuine forged-metadata variants, the false-accusation count moved from 24 to 0.

In the opposite direction, forged camera identity moved 12 of 12 known AI-generated images to a camera-origin presentation before the correction. The corrected system produced 0 camera-origin headlines across 37 synthetic specimens carrying forged camera metadata.

The observation did not disappear. The unsupported conclusion did.

This test establishes a narrow result: unsigned metadata no longer creates the measured public accusations on this adversarial class. It does not prove that every metadata attack has been anticipated, that every AI-generated image will be detected, or that absence of a tool name supports authentic capture.

It also does not authenticate the base photograph's real-world circumstances. Ground truth for this test is the known source class and the unchanged visual content. The test evaluates the path from writable metadata to a public verdict, not every claim someone might attach to the scene.

Evidence does not become independent because software stores it twice. And a value does not become trustworthy because it appears in a forensic report.

The public-interest obligation is not to appear infallible. It is to make a failure reproducible, preserve it in the permanent corpus, correct the rule that allowed it, and publish the boundary of what the correction actually proved.