AttestoMark Audio

A keyed content mark for audio, embedded and detected entirely inside the customer's Local Vault. This page states what it is measured to survive, what it is measured to lose, and what a detection does not establish.

Scope

AttestoMark Audio embeds a 61-bit locator into 16-bit PCM audio using a patchwork transform over FFT bands. The locator is not the payload a reader cares about: it is an index into an encrypted registry the Local Vault holds, and the registry is what carries the mark identity, the keyset, and the digests of the original and marked assets.

The provider accepts audio/wav only. Converting between containers is a transform applied around the provider rather than inside it, which is why the base Local Vault image carries audio while video needs the media-enabled image and its codec libraries.

Architecture

The provider is a Class S binary: it runs under the setuid provider sandbox with no network, a fixed unprivileged identity, filesystem access limited to its own binary, the asset and one output file, and resource limits on processes, address space and output size. It sees the audio and nothing else, and it returns a normalized evidence object plus a private locator sidecar that never reaches the platform.

The sandbox has been attacked rather than only configured. Thirteen escape attempts were run against the shipped binary installed setuid root, and none succeeded; a control arm running each attempt without the sandbox shows nine of them are refused by the sandbox rather than by the environment around it.

Embed lifecycle

The vault reserves a registry record against the digest of the unmarked asset, derives the locator as an HMAC over the keyset identifier, the mark identifier and that digest, and asks the provider to embed it. The output is then independently re-detected before the record is completed: an embed that cannot be read back is refused and the reservation is aborted, so a registry never holds a record for a mark nobody could find.

Keyed detection

Detection tries each keyset epoch still eligible to verify, newest first, and only an exact registry resolution counts. A locator that resolves to nothing is reported as not_observed rather than as a failure, because a file with no mark is a normal file.

A registration that has been reserved but never embedded is deliberately not disclosed by detection. It would otherwise resolve and report a mark for content nothing ever marked.

Formats and limits

16-bit PCM WAV, up to 256 MB and 600 seconds. Longer or larger assets are refused rather than truncated.

Keys and registry

A keyset carries a locator key, a lookup key and a registry key, and lives only in the Local Vault. The registry is encrypted at rest: the mark identifier and the locator bits do not appear in the database file, which the container canary verifies by searching the bytes.

Evidence

The provider's own result is what reaches the capsule. The vault does not rebuild it: an evidence object assembled beside a provider run would report a state whether or not the run produced it.

Measured robustness

Eight assets, ten seconds each, ten cases per asset, measured against the real provider under the real sandbox with real ffmpeg. Every transform round-trips back to WAV, because what a distributed file goes through is an encode and a later decode, and a mark that only survives untouched samples has survived nothing.

8/8 for MP3 at 192 kbit/s and 128 kbit/s, AAC at 128 kbit/s, resampling to 22050 Hz and to 48000 Hz, loudness normalisation, 15% gain reduction, exact detection, and the non-matching-key false-positive check. Head trimming measured 6/8: removing 0.35 s shifts the analysis windows the patchwork signal is aligned to, and two assets lost it.

These numbers describe that corpus, those transforms, this provider version and this release environment. They are not a universal survival rate and must be remeasured when any of those change.

Measured removal

Robustness measures survival under transforms an honest pipeline performs. Removal is the other question, and it has its own corpus: transforms whose only purpose is to destroy the mark, each stated with what it costs a listener rather than in decibels, because no decibel figure means anything to a person.

A 5% time stretch and a 3% pitch shift each remove the mark from every asset. Both are audible and neither ruins the recording, which makes them materially cheaper than recompression to 8 kbit/s at 16 kHz — the only other attack to remove it outright, and one that leaves the audio barely intelligible.

Filtering results depend on the recording. Across three runs, lowpass filtering measured anywhere from 25% to 100% survival over eight assets, so no per-attack rate is claimed for it. What is claimed is the shape: no filter and no mild recompression removed the mark from every asset.

So audio mark survival is claimed for codec conversion, resampling, normalisation, gain and filtering, and it is not claimed for anything that moves the timeline.

Operations

The provider ships in the Local Vault image, installed root-owned and non-writable under the provider root with a manifest pinning its binary digest. A contract inspects the built artifact rather than the Dockerfile: every pinned checksum is recomputed from the binary it pins, and every manifest is loaded through the vault's own loader, so a manifest the vault would refuse fails the build instead of the first customer.

Failure modes

An embed that cannot be independently re-detected is refused. An asset over the size or duration limit is refused. A provider that exceeds its sandbox limits is killed and the run reports a failure rather than a partial result. None of these produce a mark record.

Claim boundary

A successful detection proves that this Local Vault resolved a keyed locator present in the audio it was shown, and bound it to its encrypted mark record. It does not prove that the audio is the asset that was marked, who recorded it, whether it was generated, whether it is true, or who owns it. Absence of a mark is not evidence that something was not produced by this pipeline. A mark can be removed by moving the timeline, which is stated above and is why detection is evidence to weigh alongside receipts, source bindings and policy rather than a verdict on its own.