The Foundation publishes its protocol papers and its formal models openly. Anyone can read them, run the models and check the claims.
In an ordinary provenance design, whoever checks the camera and records the photo can link the two, and that link is a map of who photographed what. This paper describes a protocol that never builds the map. It splits the work across independently operated components, so no single component holds what it takes to link a camera to a photo.
The paper evaluates the design one component at a time. For each component, it asks whether an attacker who holds everything that component holds can assemble the link. Twelve security properties are machine-checked in ProVerif. Timing and traffic leakage, which the proofs do not model, are measured in simulation. The paper also describes a reference deployment, the Birthmark Standard, and estimates its device-side cost from published benchmarks.
The Protocol paper gives the architecture. This paper specifies the parts that architecture assumes: the packets a camera builds, the format of its token, and the validator that checks the token and returns a verdict without reading the photo's fingerprint. It also specifies the edit workflow, in which each edit becomes a new record chained to its parent.
The paper estimates the camera's cost from published benchmarks and states that no figure is yet measured on this design. It says which governance protections the protocol structure already provides and which remain necessary. It lists its own limits: exact-file hashing, software-attested edits, per-manufacturer anonymity sets and a blinded-key construction that has not been reviewed.
Preprint on arXiv (2602.04933). Not peer reviewed. arXiv →
ProVerif is a tool that checks security protocols automatically. A model is a precise description of a protocol, written so the tool can test it. The tool assumes an attacker who controls the network and holds everything a chosen compromised component holds. It then asks whether that attacker can break a stated property, such as linking a camera to a photo or forging a record.
The Foundation publishes eleven models that cover twelve security properties. Each model has a twin with one deliberate fault. The twin must fail. If it did not, a passing result would prove nothing. The models check the logic of the protocol, not a specific implementation.
Published in the repository. Repository →
Code is licensed AGPL-3.0 for the blockchain component and Apache-2.0 for the tools. Technical specifications are published as prior art.