Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for AI Evidence Engine
Inspiration
Small creators and small businesses often have valuable files but no defensible evidence history. Source files, edits, approvals, tool information, timestamps, and previous versions are easy to lose. Large companies can purchase specialized provenance and evidence-preservation infrastructure; independent photographers, designers, illustrators, authors, content creators, agencies, and brand teams usually cannot.
AI Evidence Engine (AEE) gives their work a verifiable evidence history from the first recorded point onward.
What it does
AEE follows two truthful paths:
- Trusted provenance exists: AEE verifies content hashes, digital signatures, C2PA manifests, registry evidence, and signed parent-child version history.
- Prior provenance is unavailable: AEE does not invent the past. The creator can establish a clearly labeled First-Seen evidence point. AEE records when it received, fingerprinted, signed, and sealed that exact version while stating that earlier history remains unknown.
After First-Seen, each material change creates a new signed child Event instead of overwriting the prior record. This produces a verifiable V1 → V2 → V3 history.
The public verifier displays Verified Original, Verified Modified, Unverified, or Invalid Evidence. It can compare trusted recorded versions, measure changed pixels, generate a Modification Mask, show the changed region, and present C2PA and signature results. An unfamiliar image without trusted provenance returns Unverified; AEE does not guess whether it is real, fake, edited, or AI-generated from appearance.
How we built it
- Official c2patool 0.27.12 creates, embeds, reads, and verifies C2PA manifests.
- Official @contentauth/c2pa-web 0.13.4 verifies image provenance in the browser.
- RSA-2048/SHA-256 signs canonical evidence Events.
- An append-only parent-child Event chain preserves version and parent-hash relationships.
- Deterministic RGB image comparison between trusted recorded versions creates the Modification Mask, measured change ratio, and bounding box.
- The public Legacy Content Bridge establishes a First-Seen record with Prior History Unknown, then reconstructs persistent V1 → V2 history from sealed evidence rather than Cloud Run memory.
- Google Cloud Run hosts the Evidence Explainer and continuity services.
- Gemini 2.5 Flash is called through Vertex AI only after deterministic verification is complete.
- A Development/Test Evidence Black Box prototype uses Google Cloud Storage generation preconditions and short test retention to seal, retrieve, and reverify evidence continuity.
Gemini and deterministic evidence
Gemini receives only allowlisted structured verification facts and explains them in plain language. Gemini does not decide Integrity, Provenance, Signature, Hash, C2PA, Retention, or Evidence Validity. Those results come from deterministic cryptographic and comparison code.
Small Business Services
AEE gives creators and small businesses infrastructure for documenting delivery, reviewing revisions, explaining recorded AI involvement, and organizing technical evidence they may later choose to present when protecting their interests.
Our first customers are photographers, designers, illustrators, authors, content creators, advertising and design agencies, brand content teams, and AI-assisted creators.
Business model
The proposed model begins with a free creator entry tier, followed by paid evidence storage, Evidence Package export, professional and agency plans, and usage-based APIs for marketplaces and platforms. Current external users, paying customers, and revenue are all zero and are disclosed honestly.
Accomplishments
- Public provenance verification and known-version comparison
- Three signed image versions with real C2PA parent ingredients
- Signed Event IDs shared across C2PA assertions and the Registry
- Pixel-derived Modification Masks
- Public First-Seen registration with persistent V1 → V2 history
- Deployed Gemini explanation through Vertex AI
- Development/Test Google Cloud sealing, retrieval, SHA-256 reverification, HTTP 403 delete rejection during retention, HTTP 412 overwrite rejection, and Evidence Continuity
Challenges
The central challenge was separating content integrity from identity trust. A C2PA claim can be cryptographically intact even when its development certificate is not on an official production Trust List. AEE therefore reports development identity honestly instead of overstating trust.
Another challenge was preventing a helpful language-model explanation from becoming an ungrounded verdict. We designed a strict boundary: deterministic verification produces the facts, and Gemini may only explain them.
What we learned
Provenance should report evidence rather than make legal or world-truth judgments. First-Seen proves only that AEE recorded, fingerprinted, signed, and sealed a version at a specific point in time. It does not prove originality, authorship, copyright ownership, history before that point, court certification, or guaranteed admissibility.
Current, prototype, and future
Current production: public provenance verification, known-version comparison, Modification Mask, C2PA, digital signatures, version history, Gemini explanation, First-Seen public flow, and persistent V1 → V2 history.
Development/Test prototype: Google Cloud Evidence Black Box with short retention, deletion and overwrite rejection tests, retrieval, SHA-256 reverification, and evidence continuity. It is not represented as a permanent or court-certified vault.
Future: full Soft Binding recovery, invisible watermarking, audio, video, CAD, 3D, manufacturing evidence profiles, and single-asset forensic modification detection.
AEE does not invent the past. It starts preserving verifiable evidence history from the first recorded point.
Log in or sign up for Devpost to join the conversation.