Content Authenticity Imitative - first real camera

[carlseibert]

Hi All,

Leica introduced its M11P camera today. It has CAI capabilities. Limited to the tiny amount of metadata, apart from the Exif stuff, of course, that a camera is capable of producing. "Yeah, I made this picture. This person owns me and presumably the copyright, and I have the certificate to prove it."

But this is the opening volley, as it were. Nikon has CAI in its pipeline and Canon is said to have joined the effort as well. It's early days, but metadata progress gets real when ExifTool and in this case, Photo Mechanic, does it.

It's going to be a process. There is SO much still missing from the early efforts that it will be support, then iterate, then iterate over and over.

So, heads up!

-Carl

Oh, and am I the only person who has noticed that the Photoshop beta CAI implementation requires you to use "Export" to save out your document? And "Export" STRIPS W#$%^&* METADATA! Irony makes the world go 'round.

[greybeard]

I noticed the same announcement - the api seems limited to certain languages - presumably this will be outside the scope of exiftool

[Phil Harvey]

presumably this will be outside the scope of exiftool

ExifTool should be able to read and delete this metadata, but not write it.  The ability to read this metadata was added a couple of years ago.  But I would like to have a sample from this camera if anyone has one available.

- Phil

[greybeard]

presumably this will be outside the scope of exiftool

ExifTool should be able to read and delete this metadata, but not write it.  The ability to read this metadata was added a couple of years ago.  But I would like to have a sample from this camera if anyone has one available.

- Phil

Interesting - DPR generally has image samples when a camera is announced but today they only have it as a news item - presumably they haven't had a camera in advance for testing

[carlseibert]

Hi Phil,

Through the kindness of Leica Store Miami, I was able to make some test frames with their new M11P, both DNGs and JPEGs, with CAI signing turned on and off.

You can grab them here:  https://1drv.ms/f/s!AjNOxJboeHdZg1kdfGemyNM1c-7h?e=pURbsf

I noticed a pretty huge issue in that there doesn't seem to be any way (that I can figure out) to mark up an image with IPTC metadata and preserve its CAI signature. In order to save an image from Photoshop, you have to use the Export As... dialog. Which strips IPTC metadata. If you try to fix that by then editing the IPTC data in Photoshop, you end up with no CAI record at all. If you use Exiftool or Photo Mechanic, either before or after editing the photo in Photoshop, you end up with an "incomplete" stage in the authentication chain. Sometimes the original signature from the camera survives, sometimes it doesn't.

Since the whole idea of this thing is to re-establish trust in news media, and news photos can't be processed, or even exist, without captions and other metadata, this makes kind of a problem. Kind of a big, deal-breaking problem.

It looks to me in the C2PA docs that it should be possible to include IPTC data in an assertion. Could a metadata editor write IPTC data in the normal places, include selected fields from it into an assertion, and re-sign the whole affair?

At the very freakin' least, Adobe needs to fix the Export As... problem. Not that condemning journalists to doing metadata markup in Photoshop would be pleasant or efficient, but at least it would be POSSIBLE for them to do their jobs.

When I look at the CAI data in Exiftool, I can't quite figure out what's up with the thumbnails. Do separate thumbnails exist within the CAI metadata? Or do they just reference the existing Exif ones somehow?

I did check out Photoshop's "save CAI data to cloud" feature. If you invoke it, you get a URL that you can see in ExifTool instead of the block of CAI data. The URL opens the picture on the CAI's Verify tool. Seems to take a while to populate sometimes, but it works fine. If you just open the image on the Verify page, it works just like the URL.    https://contentcredentials.org/verify

You can't read CAI data in Photoshop. Or at least I couldn't make it happen.

The Leica camera wrote CAI data into camera-produced JPEGs but not RAWs (DNG in Leica's case). I imagine that someday we'll have to figure out how to make this process work through the RAW conversion process. But that doesn't seem all that pressing.

Note that it says "info" in the CAI and Exif copyright fields in the samples. This is an interface issue in the camera. Leica calls the field "INFO" in the camera's menu. We couldn't figure out what that meant, so we left the placeholder text to see where it turned up. Copyright, as it turned out.

My overall impression - and this could be just me not knowing what I'm doing - was that it was way too easy to break the credential chain. Breathe on a picture wrong and the signature chain breaks. It won't be super helpful if every picture turns up as untrustworthy. But that's just me. And it is early days.

-Carl

[carlseibert]

And another question. Does ExifTool decrypt and display the CAI information that it displays? Or is the data recorded in both clear text and encrypted versions?

Oh yeah, and for anyone wondering...  That M11P camera and the lens that was on it (35mm Summilux, 2023 version) were nice. Very nice.

[carlseibert]

..... Back again. Today, while TRYING to reproduce the issues I saw yesterday, I found it much more difficult to break the credential chain. Which makes me feel better about this.

I took another run at captioning a picture after exporting it from Photoshop. Today, I was able to add metadata in Photo Mechanic and while I got an "incomplete" error (appropriately, I guess), I was able to see both the current state of the image in Verify, as well as the previous, signed, states. I was able to re-sign the image again in Photoshop, but that wasn't valuable because of the Export As... nastiness - the newly added metadata was stripped off again. So I guess if you are willing to accept the image being in a "Credential Incomplete" unsigned, or at least currently unsigned, state, you could actually do useful work with the software in its current condition. "Useful work" here meaning getting a photo to the Picture Desk with CAI credentials. That's not end-to-end, but it's a start.

I also tested copyright notice durability by saving a picture's credentials to the Adobe-hosted cloud manifest in Photoshop, then "stealing" the image by copying its pixels to a blank document. When I took the "stolen" image to Verify, Verify was able to match the image to a saved credential set (I guess you would call it)in its database and show me the original camera-written Author Name ("Produced by", Verify called it.) I found it very odd that Verify shows this field and not the copyright field as recorded by the camera. But hey, small favors. It's early days.

This is interesting. The pointer to a picture's cloud manifest file is in plain-old XMP. (XMP-xmp:provenance) That seems to mean that as long as that XMP tag survives, you should be able to add metadata or do whatever (including nefarious stuff) to the image and the image and its original signature will show up in Verify. That would include its original thumbnail, so a future user should be able to at least generally confirm the truth of the image.

Overall, I'm much more confident in what I see today, compared to yesterday. But it's still concerning that when I wasn't trying to break the chain, I could snap it by looking at it sideways. On the other hand, it's reasonable to think that producing verifiable credentials will always require an opt-in and some learning curve traversing.

-Carl

[carlseibert]

Interesting - DPR generally has image samples when a camera is announced but today they only have it as a news item - presumably they haven't had a camera in advance for testing

If they had a pre-production prototype for testing, the chances are good it wouldn't have worked anyway. The demo cameras in the Leica store needed firmware updates to enable the C2PA stuff.

[Phil Harvey]

Sorry for the delay in responding, and I still don't have time to read your post thoroughly to answer your questions.  Keep in mind I'm not a CAI expert... I've never used C2PA tools myself, and only know about the mechanics of reading the metadata.

I took a first look at the samples you uploaded, and of course wasted a lot of time because I first chose the ones without C2PA metadata.   ExifTool finds the C2PA metadata in the JPEG files that have it, but not in the DNG.  I will add support to read this from the DNG, and will work with this samples a bit more to make sure everything is being extracted.

- Phil

[carlseibert]

Hi Phil,

I'm just learning this stuff from basically zero.

I now have a copy of C2PAtool and can see that the Leica does sign its DNGs. Neither Photoshop nor the CAI's Verify page shows that. The sample DNGs where the notebook says "signing on" should all have a signature.

Yesterday, Sony announced a camera with C2PA signing, to ship in February. Everybody seems to expect a Nikon and Canon in the first half of the year.

-Carl

[Phil Harvey]

Hi Carl,

I discovered that the C2PA has now provided documentation to describe how the metadata is embedded in various formats.  After reading this I have also added support for MP4/MOV, AVI/WAV and GIF formats.  I would have added support for PDF if I had a sample.  The c2patool doesn't work for PDF images.  It doesn't work for GIF either, so my GIF implementation is untested, but this was a bit simpler than PDF so it was easier to understand.

- Phil

[Phil Harvey]

C2PA may also be added to ID3 metadata (and the c2patool works for this).  I'll add read support for this as well.

- Phil

[carlseibert]

Thank you. I have no idea if this stuff will save the world or not. But it looks kind of promising.

[carlseibert]

I just posted my blog post and a video on C2PA. It's aimed at photographers, so not at the technical level of most people here.  Hopefully, it has a fair bit of information, though. It certainly has a fair portion of words.

https://www.carlseibert.com/first-camera-with-cai-content-credentials-introduced/

I hope everybody had a good New Years.

-Carl

PH Edit: Added hot link to blog post URL

[Phil Harvey]

I've just scanned quickly through the article so far, but it looks very useful and informative.

- Phil