菜单
Review AI-generated content pipelines for deepfake detection gaps, provenance chain failures, C2PA implementation correctness, synthetic media attribution, and trust signal spoofing that undermines content authenticity verification.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Review agentic AI systems for long-term memory store poisoning, vector DB manipulation, cross-session instruction injection, and stale memory exploitation that persists attacker influence across agent sessions.
Review AI agent systems for agent impersonation, capability escalation, missing agent identity primitives, and authorization failures that allow agents to act beyond their granted permissions or impersonate other agents or human users.
Review organizational defenses against AI-assisted spearphishing, voice cloning, synthetic identity fraud, deepfake executive impersonation, and AI-accelerated reconnaissance that dramatically lowers the barrier to highly targeted social engineering attacks.
Review AI browser agents for DOM injection attacks, credential harvesting via web automation, malicious web content that hijacks agent actions, session cookie theft, and phishing sites engineered to exploit browser-controlling AI agents.
Review upstream dataset integrity controls, HuggingFace repository risks, dataset versioning, dependency pinning, and third-party dataset provenance to prevent malicious data from entering training or RAG pipelines.
Review AI agent systems for approval step circumvention, human-in-the-loop bypass patterns, deferred confirmation exploitation, and social engineering techniques that cause human reviewers to approve malicious agent actions.
| name | ai-content-authenticity |
| description | Review AI-generated content pipelines for deepfake detection gaps, provenance chain failures, C2PA implementation correctness, synthetic media attribution, and trust signal spoofing that undermines content authenticity verification. |
| last_reviewed | "2026-04-30T00:00:00.000Z" |
Provenance without verification is a story, not a proof. Anyone can claim an image is unmodified; only cryptographic provenance can demonstrate it.
As AI-generated synthetic media becomes indistinguishable from authentic content at a perceptual level, the authenticity verification burden shifts entirely to provenance infrastructure. Detection models degrade; adversarial fine-tuning evades classifiers; perceptual watermarks are stripped. The only durable authenticity signal is a cryptographically bound provenance chain established at content creation time and verifiable by anyone downstream.
| Principle | What It Means Here |
|---|---|
| Validate | Provenance manifests are cryptographically verified against the issuing organization's certificate chain before any authenticity claim is surfaced to users. |
| Scope | Authenticity verification is applied at content ingestion points — not only at display time. Content without verifiable provenance is treated as unverified, not as inauthentic. |
| Isolate | AI-generated content is labeled with cryptographic provenance at generation time. The label cannot be stripped without invalidating the manifest signature. |
| Enforce | Detection pipelines use multiple signals — provenance, classifier ensemble, metadata consistency — and require agreement across signals before asserting authenticity. |
The core vulnerability: C2PA manifests that are generated without hardware-rooted trust anchors can be spoofed. A manifest claiming "captured by iPhone camera" can be generated by any software that has access to a signing key — which is why key custody and hardware attestation matter.
# Using c2pa-python or similar SDK
def add_ai_provenance_manifest(
content_bytes: bytes,
generator_id: str,
model_version: str,
signing_cert: bytes,
signing_key: bytes,
) -> bytes:
manifest = {
"claim_generator": f"miii-security-ai/{generator_id}",
"assertions": [
{
"label": "c2pa.ai.generatedBy",
"data": {
"generator": generator_id,
"model_version": model_version,
"generated_at": utcnow_iso(),
}
},
{
"label": "c2pa.hash.data",
"data": compute_content_hash(content_bytes),
}
]
}
return sign_manifest(content_bytes, manifest, signing_cert, signing_key)
def verify_c2pa_manifest(content_bytes: bytes) -> ProvenanceResult:
manifest = extract_manifest(content_bytes)
if not manifest:
return ProvenanceResult(verified=False, reason="no_manifest")
# Verify content hash matches manifest claim
if compute_content_hash(content_bytes) != manifest.content_hash:
return ProvenanceResult(verified=False, reason="content_hash_mismatch")
# Verify certificate chain
if not verify_certificate_chain(manifest.signing_cert, TRUSTED_ROOTS):
return ProvenanceResult(verified=False, reason="untrusted_certificate")
return ProvenanceResult(verified=True, assertions=manifest.assertions)
The core vulnerability: Single-signal deepfake detection — relying only on a classifier, only on a watermark, or only on provenance — is fragile. Each signal individually can be evaded, stripped, or forged.
def assess_content_authenticity(content: bytes) -> AuthenticityAssessment:
signals = {
"provenance": verify_c2pa_manifest(content),
"classifier": run_detection_ensemble(content), # multiple independent models
"metadata": check_metadata_consistency(content), # EXIF, creation timestamps
"frequency": analyze_frequency_artifacts(content), # GAN fingerprints
}
# Require agreement across signals; single-signal failure is a warning, not a verdict
authentic_signals = sum(1 for s in signals.values() if s.indicates_authentic)
return AuthenticityAssessment(
verdict="likely_authentic" if authentic_signals >= 3 else "unverified",
signals=signals,
confidence=authentic_signals / len(signals),
)
Start generating C2PA manifests for all AI-produced content in your pipeline. Even if downstream verification is not yet in place, establishing a provenance chain at generation time means you can add verification later. A provenance chain that starts at generation is retroactively more useful than one that starts at distribution.