Attesto 3 provenance

AttestoMark Image

AttestoMark Image embeds an opaque, per-asset locator into a new PNG or JPEG and lets the tenant's Local Vault resolve that locator against an encrypted local registry. The original is preserved. The feature adds one provenance signal; it does not determine authorship, origin, ownership, or legal compliance.

Scope

This guide documents the production Class S image provider used by Local Vault. It covers the frozen ATTESTO-MARK-IMAGE-001/0.1 contract, local embed and detect behavior, key rotation, operational limits, and the exact Sprint 7 robustness baseline. AttestoMark Image is a Local Vault capability, not a browser-side watermarking API.

Architecture

Local Vault creates a random mark record and derives a 61-bit HMAC locator under the active tenant key epoch.
The deny-network Class S provider runs Adobe TrustMark Rust 0.2.2, model Q, BCH5, strength 0.95.
The provider sees one scoped image plus the opaque locator. It never receives tenant credentials, platform credentials, or registry keys.
Local Vault independently detects the result, completes the encrypted record, and creates a marked_from asset relation.
Only normalized evidence and randomized capsule commitments may leave Local Vault.

Encoder and decoder ONNX models are installed during the container build. Their sizes and SHA-256 digests are checked during build and again before runtime loading. Runtime model download and provider network access are disabled.

Embed lifecycle

Validate media type, encoded size, decoded dimensions, and pixel count.
Hash the unchanged original and reserve a collision-free encrypted registry record.
Write the signal to a new output file; the input is never modified in place.
Run an independent keyed detection pass against the completed output.
Complete the record only when the detected locator exactly matches the reservation.
Bind original digest, marked digest, provider identity, key epoch, media types, and marked_from relation into local provenance evidence.

A provider error, timeout, malformed output, registry error, digest mismatch, or independent-detection failure removes the incomplete output and aborts the reservation. None of those paths can report embedded.

Keyed detection

Detection first checks the exact image. If no valid signal is found, the provider checks bounded centered crop candidates at 3%, 5%, and 10% inset to recover the documented screenshot-like profile. A raw signal is not enough: Local Vault must resolve and decrypt the keyed registry entry and recompute the locator from its stored mark id and original asset digest. An unknown payload is not_observed; malformed or registry-inconsistent evidence is invalid.

Public TrustMark tooling can recover the opaque 61 bits. Those bits contain no tenant, filename, asset id, capsule id, source id, or mark id. They have Attesto meaning only with the tenant key and encrypted Local Vault registry.

Formats and limits

Property	Production value
Input and output	`image/png` or `image/jpeg`; output keeps the input media type.
Minimum dimensions	256 by 256 pixels.
Maximum encoded size	256 MiB.
Maximum decoded size	40,000,000 pixels and 20,000 pixels per dimension.
PNG alpha	Copied unchanged from the original after RGB embedding.
JPEG output	Quality 95.
Provider isolation	Deny-network Class S sandbox, 30-second CPU deadline, bounded 3 GiB address space.

Keys and registry

Locator derivation, registry lookup, and registry encryption use three separate 256-bit keys. Key states are active, verify_only, and revoked. Embedding uses one active epoch. Detection may use a bounded active/verify-only set; revoked epochs fail closed. One epoch is capped at 1,000,000 records. Local Vault checks locator collisions before use and requires rotation when the epoch is exhausted.

Raw locators and deterministic asset digests are not plaintext database indexes. Records are AES-256-GCM encrypted, and keyed lookup uses a separate HMAC digest. Back up key epochs and the encrypted registry together; losing either prevents meaningful historical detection.

Evidence and privacy

Public normalized evidence contains state, scheme, provider, model, error code when applicable, and the asset relation. The raw locator, model score, mark id, registry plaintext, and detector internals are C1 local data. They are excluded from platform envelopes, logs, metrics, frontend bundles, and release reports. Capsule submission carries randomized commitments rather than deterministic content identifiers.

Measured robustness

The frozen Sprint 7 corpus contains eight deterministic 768 by 512 test images and 64 total cases. The production container passed 8/8 exact detections, 8/8 JPEG quality-85 recompressions, 8/8 75% resizes, 8/8 moderate crops, 8/8 color adjustments, 8/8 metadata strips, 8/8 screenshot-like recompressions, and 8/8 nonmatching-key false-positive checks. Minimum measured PSNR was 45.665 dB. Measured p95 was 645.513 ms for embed and 516.107 ms for detect on the recorded release host.

These numbers describe only that frozen corpus, transformations, provider version, models, and release environment. They are not a universal survival rate and must be remeasured when any of those inputs change.

Operations

Keep provider binary, model files, sandbox, manifest, registry database, and key directories on protected persistent storage with their prescribed ownership and modes.
Run Local Vault provider doctor checks and the real image lifecycle canary after installation, upgrade, restore, or key rotation.
Alert on model-integrity, model-load, embed, detect, output, registry-tamper, collision, and epoch-exhaustion error codes.
Do not replace model files or the provider binary independently of a versioned Attesto release.
Retain the original asset separately; the marked output is a new asset node, never a replacement disguised as the original.

Failure modes

Result	Meaning	Operator action
`embedded`	Independent keyed detection matched the completed local record.	Keep both assets and the encrypted registry lifecycle.
`detected`	The locator resolved under an eligible key epoch and record checks passed.	Use it as one signal in the complete provenance record.
`not_observed`	No locally meaningful AttestoMark Image signal was resolved.	Do not infer human origin or absence of modification.
`invalid`	Candidate evidence conflicted with the registry or closed schema.	Preserve the asset and investigate as conflicting evidence.
Safe error code	The provider or Local Vault failed before a trustworthy result.	Fail closed, preserve logs without private data, and repair the named dependency.

Claim boundary

A successful result proves that this Local Vault resolved a keyed locator embedded by the pinned provider and bound it to its encrypted mark record and provenance capsule. It does not by itself prove who authored the image, whether AI was used, whether the content is true, who owns it, or whether a legal requirement is satisfied. Absence is not evidence of human creation. Copied signals are conflicting evidence and must be evaluated with receipts, C2PA, source bindings, asset relations, policies, and the wider Proof of Evolution.