AttestoMark Video

A keyed content mark for video, composed from the image provider frame by frame and read back in runs of consecutive frames. This page states what it is measured to survive, what it is measured to lose, and what a detection does not establish.

Scope

AttestoMark Video does not introduce a second marking algorithm. It composes AttestoMark Image over selected frames: a burst of frames receives the locator at the start of every stride, and detection decodes runs of consecutive frames rather than evenly spaced single ones.

That choice is what makes detection trim-proof. A burst begins every stride, so a run of that many consecutive frames contains a marked frame whatever the trim offset. Evenly spaced single probes can stay in phase with the burst period and miss every burst, which is measured in the protocol tests rather than assumed.

Architecture

Frame extraction and reassembly use ffmpeg, which lives only in the media-enabled Local Vault image. ffmpeg costs 205 additional packages and 448 MB over the base image — measured, not estimated — and codec libraries are a historically CVE-heavy attack surface, so a deployment that never marks video does not carry them.

The marking itself runs in the same Class S sandbox as the image provider: no network, a fixed unprivileged identity, and filesystem access limited to the frame it was handed.

Embed lifecycle

The vault reserves a registry record against the digest of the unmarked video, marks the burst frames, reassembles the stream, and then independently re-detects the result before completing the record. An embed that cannot be read back is refused.

Keyed detection

Detection extracts probe runs, decodes each frame through the image provider, and resolves the locator against the encrypted registry. Only an exact resolution counts; anything else is not_observed.

Formats and limits

Container formats ffmpeg can decode and re-encode, produced as H.264 in MP4. The mark lives in the frames, so the container is incidental.

Keys and registry

A video keyset carries its own scheme identifier and lives only in the Local Vault. The registry is encrypted at rest, and neither the mark identifier nor the locator bits appear in the database file.

Evidence

One evidence schema covers every modality. There is deliberately no video-specific evidence object: a reader that had to know which modality produced a result before knowing what the result meant would be reading a different protocol per format.

Measured robustness

Eight assets and 80 cases against the real provider and real ffmpeg: transcode to H.264, bitrate reduction, 75% scaling, moderate crop, trim, frame-rate conversion to 24, audio-track removal, and short clip extraction, plus exact detection and a non-matching-key false-positive check.

8/8 everywhere except bitrate reduction at 6/8. Aggressive rate limiting removes the fine detail the frame signal lives in, which is expected and is stated rather than hidden.

These numbers describe that corpus, those transforms, this provider version and this release environment. They are not a universal survival rate.

Measured removal

A frame-burst scheme invites an obvious guess: that removing frames removes the mark. Six assets of 90 frames were attacked to find out, and the guess is wrong.

Dropping every other frame, dropping every third, halving the frame rate to 15, speeding the video up 10% and playing it backwards all leave the mark intact. The temporal structure is more robust than the frames it is made of.

What does remove it is what removes an image mark: cropping to the middle 50% of each frame, and recompressing at CRF 40 where blocking is visible. Nothing video-specific adds a new weakness, which means the claim to narrow is the image claim rather than a separate video one.

Operations

Video marking requires the media-enabled image, built with --target runtime-video. The base image carries no codec libraries and will refuse video operations rather than silently producing nothing.

Failure modes

An embed that cannot be independently re-detected is refused. A frame the provider cannot mark aborts the operation rather than producing a video with an incomplete burst. A missing codec is reported as a missing codec, not as an absent mark.

Claim boundary

A successful detection proves that this Local Vault resolved a keyed locator present in the frames it was shown, and bound it to its encrypted mark record. It does not prove that the video is the asset that was marked, who filmed it, whether it was generated, whether it depicts anything true, or who owns it. Absence of a mark is not evidence that something was not produced by this pipeline. A mark can be removed by cropping the frame or recompressing hard, which is stated above and is why detection is evidence to weigh alongside receipts, source bindings and policy rather than a verdict on its own.