Verify
Apply for certificate
XENLOOK C2PAVerify

Pilot · C2PA review in progress · Korea Mar 2027 · Japan Jun 2027 · Korean model law

Copyright C-2026-036487 · Patent app. 10-2026-0100026 (not yet registered)

Legal & policies →
Course contents
Chapter 3 of 10

Chapter 3Five layers of stamps that protect the source

A single technique breaks easily. In this chapter you meet the five layers this site uses (XMSE) one by one, and you sort the tools by type of content in a table.

  • Official session name · Pipeline and per-content-type module structure analysis
  • 4 practice steps
  • Some steps need you to sign in
What you will learn in this chapter
  • You know the names of the five layers, their order and what each one does.
  • You know the difference between a hash (an exact fingerprint) and a fingerprint (a look-alike fingerprint).
  • You know why images, video, audio and documents each need different tools.

The idea in plain words

It works like five locks on a front door
If a door has only one lock, one broken lock means you are in trouble. With a keypad, a deadbolt, a chain, a camera and an entry log working together, the rest still protect you when one fails. Source information is kept in several layers for the same reason. Posting a file on social media or re-saving it wipes some of the information.

When a file passes through social media, messaging apps or the web, its metadata (the extra information stored inside the file) can be wiped, or the file can be compressed again or cropped. Then the C2PA record alone may not be enough to keep the source.

Layer 1, the hidden mark (invisible watermark): a signal your eyes and ears cannot notice is planted inside the picture or sound. VideoSeal is used for images and video, and AudioSeal for music (both under the MIT licence).

Layer 2, the trace mark (forensic mark): a mark for finding signs that someone has handled the file. The site uses Sigil (Apache-2.0), with Pixseal as a helper. It is not used as grounds for pointing at a particular person.

Layer 3, the file fingerprint: the hash from chapter 2 is an “exact fingerprint,” and this one is a “look-alike fingerprint.” If the size changes a little, a similar value still comes out, so the file can be found again. For images the site uses PDQ (MIT) and imagehash (BSD-2). vPDQ for video is still in preparation.

Layer 4, the C2PA credential: it records who made the file, when, and with which tool, and signs it. You learn more in chapter 4. Layer 5, the archive: issuance records are chained one after another in a ledger that only approved parties can write to (a closed hash chain), and kept there.

Images, video, audio and documents have different signal structures, so the tools differ too. The site picks only open-source tools that are allowed for commercial use (MIT, Apache, BSD and similar) and leaves out research-only (research_only) assets. Checking licences is important work too.

Here is something to know honestly. Some steps on the practice page are a simulation, not the real engine. And there is not yet enough public measurement data showing how well each layer survives alteration. That is why you run your own experiments in this course.

See the picture

  1. Hidden markinvisible watermark
  2. Trace markforensic mark
  3. File fingerprintlook-alike fingerprint
  4. C2PA credentialrecord + signature
  5. Archiveclosed hash chain
The five layers stack in this order. The idea is that if one layer disappears, another can still help you find the source again.

Try it yourself

Work from the top, one step at a time. After each step, check that your screen matches “What you should see.”
  1. In the Technology group, open the five-layer structure page. Check the name and the job of each layer.
    What you should see The five layers are explained one after another.
    Open the five-layer pageNo sign-inPartly in Korean
  2. Open the pages for the hidden mark, the file fingerprint and the trace mark, one by one. On each page, find the tool it uses, its licence and its measurement status, and write them down.
    What you should see Each page shows a tool name (for example VideoSeal, PDQ or Sigil) and a licence.
    Open the hidden mark pageOpen the file fingerprint pageOpen the trace mark pageNo sign-inPartly in Korean
  3. On the conformance evidence page, look at the card for each file type. Count which kinds of file (image, video, audio, document) have had a C2PA credential attached.
    What you should see You see cards for image types such as PNG and JPEG, audio types such as MP3 and WAV, and document types such as PDF.
    Open the conformance evidence pageSign-in needed
  4. Make a comparison table. The rows are image, video, audio and document. The columns are the five layers. In each cell write the tool name. If you cannot find it, write “not found.” If it is still being prepared, write “in preparation.”
    What you should see A table of 4 rows by 5 columns is filled in. No cell is empty: each holds a tool name, “in preparation” or “not found.”
    No sign-in
The part you do with your mentor · Your pipeline mentor reviews the comparison table with you. Together you check whether each “not found” cell really has no tool, or whether the tool is simply not written on the page.

Check your work

If you can answer “yes” to everything below, you have finished this chapter.
  • Can you say the five layers in order?
  • Can you say the difference between a hash and a fingerprint in one sentence?
  • Have you filled in the comparison table by content type with no empty cell?

Easy to mix up

  • Common misunderstandingThe more stamps a photo has, the more real the photo is.
    What is actually trueMore layers only means the source information survives better. It says nothing about whether the content is true.
  • Common misunderstandingA hash and a fingerprint are the same thing.
    What is actually trueA hash is an exact fingerprint that changes completely if even one character differs. A fingerprint is a look-alike fingerprint that stays similar after a small change.
  • Common misunderstandingAny open-source tool can be used in a commercial service.
    What is actually trueEach licence has its own conditions. Research-only assets cannot be used in a commercial service, so they are left out.

Review questions

  1. Question 1Say the five layers in order.Show answerHide answer
    Hidden mark (watermark), then trace mark (forensic mark), then file fingerprint, then C2PA credential, then archive (closed hash chain).
  2. Question 2You shrank a photo a little. Which one stays similar, the hash or the fingerprint?Show answerHide answer
    The fingerprint. The hash becomes completely different, but a fingerprint is a look-alike, so a similar value still comes out.
  3. Question 3Why use different tools for different kinds of content?Show answerHide answer
    Images, video, audio and documents have different signal structures, so it is hard for one tool to handle them all at the same quality.

Key terms

Invisible watermark
A signal planted in content that your eyes and ears cannot notice.
Forensic mark
A mark used to find signs that someone has handled a file.
Fingerprint
A look-alike fingerprint that stays similar after a small change.
Modality
A type of content. Image, video, audio and document are each one modality.
Licence
The conditions under which you may use a piece of software. Whether commercial use is allowed is the key question.

Practice log

Print it and write by hand, or copy the same items into a document. Once your mentor has checked it, you are done.
Chapter 3 practice logFive layers of stamps that protect the source
Practice date
Written by
Mentor check
  1. The name and job of each of the five layers (one line each)
  2. The comparison table of provenance methods by content type (4 rows by 5 columns)
  3. Any tool left out because of its licence, and why
  4. Cells that stayed “in preparation” or “not found”
  5. Your mentor's review comments