Synthetic media evidence types compared, and what each proves

What to take away

Synthetic-media investigations fail when every signal is treated as a vote in one large authenticity poll. A valid signature, a strange shadow, an eyewitness, and a model score do not measure the same thing. Compare them by the question each can answer, the failure modes it carries, and the records needed for review.

Comparison table

Provenance credentials

Signed provenance can bind a manifest to an asset and record creators, tools, ingredients, and edit actions. Verify the cryptographic result, signer identity, trust status, timestamps, and whether the credential belongs to the exact file. A screenshot of a credential icon is not the credential.

NIST's summary of digital signatures states the whole of what the mathematics delivers: assurance that the claimed signatory signed the information, and that the information was not modified after the signature was generated. Everything past that, including whether the signer is who the newsroom believes and whether the scene is what it appears to be, remains a separate judgment.

Absence is weak negative evidence. Platforms, file exports, and screenshots can strip credentials. Presence is not a truth stamp. A signed image of a staged scene can retain a valid, untampered history.

Original-file access and custody

An original or near-original file provides more resolution, metadata, codec information, and signal detail than a repost. Document who supplied it, when, by what route, and whether it matches the public copy. Hash both files and preserve them.

"Original" can mean several things: camera-native file, first export, first received copy, or earliest located upload. Use the precise description. A file named IMG_0001 is not necessarily camera-native.

Metadata

Metadata can reveal device model, creation time, geographic coordinates, software, export history, dimensions, and codecs. Compare related fields with each other and with external records. A creation date after an upload date deserves investigation, but it may reflect an export or time setting rather than fabrication.

Treat metadata as claims made by a file. Retain the raw extraction and tool version so another reviewer can reproduce it.

Context and chronology

Context testing asks whether the person, place, time, weather, language, objects, and event align. This evidence can be decisive against a false caption. It also guards against the liar's dividend, where authentic media is dismissed as synthetic without proof.

Create an event timeline with independently sourced timestamps. Compare parallel footage from separate positions. Check whether alleged witnesses had access and whether landmarks or acoustics fit the location.

Source testimony

Source access is strongest when the person can explain acquisition, provide the best file, identify others present, and supply details later confirmed elsewhere. Verify identity through independent contact information. Ask open questions first, then test inconsistencies.

Source testimony should not be converted into technical proof. "I recorded it" is an attribution that needs supporting records.

Forensic observations

Media forensics can locate splices, resampling, inconsistent noise, impossible geometry, temporal discontinuities, or traces associated with certain generation methods. Findings are stronger when a qualified reviewer can explain the method, reproduce the result, and rule out ordinary editing and compression.

Visible oddities are vulnerable to expectation bias. Low-quality encodes can distort faces and sound. Check native resolution, adjacent frames, and an authentic control from the same distribution path.

Detector scores

A detector applies a learned or engineered method within a tested scope. The result can be useful triage, but the scope may not include the generator, editing chain, resolution, language, or codec in your case.

MIT researchers who compared human and machine deepfake judgments found that people and a leading model made different errors, and wrong model predictions could reduce human accuracy. That is a reason to preserve independent judgment and disclose the tool's role.

Corroborating media

Independent photos, videos, audio, live streams, sensor records, and contemporaneous documents can confirm event details. Establish independence. Ten reposts of one clip are one source. Two recordings coordinated by the same producer may also share a failure.

Map each item to the claim element it supports. A second angle can confirm presence and movement while saying nothing about the exact words on the disputed audio track.

Weight evidence by function

Use an evidence matrix:

Do not total the confidence column. Explain why evidence is independent and why it addresses that field.

Common questions

Which evidence type is strongest?

There is no universal winner. The strongest evidence is the most direct, independently corroborated material for the exact claim being tested.

Are Content Credentials the same as a fact-check?

No. They can help verify provenance data and file integrity, while a fact-check evaluates what the content claims.

Can eyewitnesses identify synthetic media?

They can confirm or dispute real-world events, but technical production questions may require file analysis.

Do several detector scores equal confirmation?

Not if the tools share training data, methods, or blind spots. Record each method and seek independent evidence.