Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering

Two ways to make a video

Look at the two frames at the top of this page. One comes from a video that Google labels as generated by its video model. The other comes from a video credited to a creator who worked with code and an AI assistant. You may feel sure which is which. But style is a weak clue: a model can be asked for many looks, and code can display imported photographs. A feeling is not evidence.

This page is a plain-language guide to a research paper about provenance: where a clip came from and how it was made. The paper asks how we could find out how a video was made, and what a watermark could and could not prove. A watermark, or mark for short, is a hidden signal added to a picture or video so that a detector can look for it later. The paper poses questions. It does not report experiments. First, here are the two main ways videos are made today.

Watch the video

Prefer to watch? This 4-minute explainer goes with this page. It was made by the paper's first author and follows the same research agenda in everyday words. You can play it right here.

Play the video4 min · loads YouTube

Route A: a model paints the pixels. Many image and video generators are diffusion models¹. They start from random noise and remove the noise step by step, guided by a text prompt.

Often the model works on a compressed internal code, and a decoder² expands that code into the final pixels. The steps in the middle are numbers inside the model, not instructions a person can read.

Route B: code draws the pixels. An AI assistant can instead write code. A separate tool, the renderer, runs that code and draws every frame. For example, Claude Code is an AI coding assistant that edits files and runs commands on a computer. Remotion³ has a tutorial on using Claude Code to build a video project. The renderer then draws frame 0, frame 1, frame 2, and so on, and combines them into a video file. Here the middle step is readable: it is the code.

In this page, a model “paints” (generates) pixels directly, and code “draws” (renders) them through a renderer. After this section we mostly use the technical words, generate and render.

A video can use both. A clip can have a generated background, a chart drawn by code, and a person's own annotations. When an AI agent⁴ chooses among these tools, the paper calls it a controller. A controller is not a third kind of video. It is the part that decides which tools to use.

The same chart, made two ways

The easiest place to see the difference is a still picture. Both charts below show the same four invented weekly numbers. The left one was made by an image-generation model. The right one is SVG code⁵ written by an AI agent and then turned into a picture on our own computer. Both are illustrations for the paper. Neither is a measurement of anything.

Image model

Code, then rasterised

A stranger who found these two pictures would have to guess the route from the style. A guess is not a label.

Real examples

Below are frames from real videos. Each caption names the source and says what that source itself reports about how the video was made. We took the labels from the sources, never from how a frame looks. These are screenshots of existing videos, shown only for illustration. We did not run any test on them.

Labelled as generated by a video model

Google's documentation labels these frames as outputs of its Veo 3.1 video model.

Model-generated

Model-generated

Model-generated

Model-generated

Credited to code-based workflows

Each frame here is credited to a video rendered from code. The credits come from the creators, or from the official Remotion gallery. Some of these videos also use imported images or 3D models. For the “still loading” frame, the credit comes from the creator's own report (he is a co-author of this paper), not from the public page.

Creator-reported code · assets unspecified

Code-rendered · assets unspecified

Code + imported assets

Key ideas

• A model can paint a video, code can draw one, and one video can use both.
• A finished video file often does not carry how it was made: not the prompt, not the code, not the model's hidden data.
• Labels here come from sources, not from appearance. Style alone does not show which route was used.

Three questions: guess, mark, authenticate

Imagine a friend sends you a video clip and asks, “Is this made by AI?” That one question contains three different questions. Each needs different evidence, and confusing them is the easiest way to claim too much.

1. Guess: does it look machine-made?

A detector studies the video and estimates how it was made. Nobody arranged anything beforehand, so the paper calls this passive inference (it also uses “detection” more loosely, for this and for finding a mark). Think of a detective judging a painting by the way it was painted.

Where the comparison breaks: a detective can point to clues and explain them. A detector may give a verdict learned from example videos⁶, and it can be wrong. The benchmarks we read do not settle whether a detector trained on videos from video models says anything reliable about a video drawn by code.

2. Mark: is a hidden signal in it?

Here someone adds a hidden mark that people do not notice: the creator, or the provider of the tool. Later a detector checks for it and may read a short hidden message. That is a watermark. Think of an invisible-ink stamp checked under ultraviolet light.

Where the comparison breaks: a stamp stays on the paper. A digital mark can be put in at different steps, and later edits can damage it. A detector also needs the right tool or key. And finding nothing does not show that no AI was involved. The clip may come from a tool that never marks, or the mark may have been lost.

3. Authenticate: does a signed record support it?

Here a trusted issuer, such as the company that provides a tool, signs a record that says, for example, “this file came out of our tool.” A digital signature lets anyone check who signed, and a later change to the signed data breaks the check. A standard called C2PA⁷ describes how such records work. Checking such a record is called authentication. Think of a receipt stamped by an official notary (a person who officially confirms a document).

Where the comparison breaks: a receipt says what the notary saw. Even a valid signature backs only the statement itself. It does not show that the scene is real or that nothing was added later. And a receipt can become separated from the file it describes.

Two small examples from the paper

• A trusted rendering service marks a video that was made from code a person wrote. The mark could support the claim that the service took part. It does not say who wrote the code.
• An animation keeps a mark that came from one generated texture (a picture wrapped onto a 3D surface), while most of the scene was authored separately. The mark applies to that texture only.

These examples do not make the evidence useless. They show that a result must always be reported together with the exact test that produced it. A mark is still useful evidence, but what it says depends on what was tested and who had what. A good system should also be allowed to answer “can't tell.”

Key ideas

• Guessing, marking and authenticating answer three different questions.
• Not finding a mark does not show that no AI was involved.
• Finding a mark does not show that the scene is true or that the history is complete.

What does the checker receive?

Imagine you are the checker. In this page, the checker is whoever or whatever examines a clip: a person, or software such as a detector. A clip arrives and you must say something about where it came from. What do you actually have?

Usually it is just the video: a grid of coloured dots, called pixels, for every frame. Sometimes the creator also provides the code. Sometimes there is a signed record. What you can honestly conclude depends on which you have.

Choose what the checker has

Each option below adds just one item to the video. The options are not stacked on top of each other.

The same idea as a grid

Each row is a claim someone might want to make. Each column is what the checker has. This grid is our own plain-language summary of Sections 2, 3 and 5 of the paper. The paper has no such table and does not rate evidence by strength. The shading shows how far each kind of evidence can go. No cell is unconditional: even the best case depends on a stated condition.

• Only if a stated condition holds
• Cannot establish by itself

Same picture, different code

Here is the smallest case where information disappears while rendering. Below is a tiny SVG drawing with a comment, a note for human readers. Suppose the creator hides one bit of a message there, 0 or 1. The renderer ignores comments. Below are three versions of the drawing, one after another; with scripts on, they appear as three tabs you can click.

<svg viewBox="0 0 160 100">
  <!-- message: 0 -->
  <rect width="160" height="100" fill="#f6f6f3"/>
  <circle cx="80" cy="50" r="28" fill="#d97757"/>
</svg>

<svg viewBox="0 0 160 100">
  <!-- message: 1 -->
  <rect width="160" height="100" fill="#f6f6f3"/>
  <circle cx="80" cy="50" r="28" fill="#d97757"/>
</svg>

<svg viewBox="0 0 160 100">
  <!-- message: 0 -->
  <rect width="160" height="100" fill="#f6f6f3"/>
  <circle cx="80" cy="50" r="32" fill="#d97757"/>
</svg>

Look at the second version again. A checker who sees only the picture can only guess⁸. That follows from the pictures being identical, not from anything special about circles.

Two limits show what this example does not claim. First, it depends on a renderer that ignores comments. Some renderers read comments or names, and a number in the code can turn into motion on screen. So the real question is never “is it code?” It is “does the change reach the pixels?” Second, it says nothing general about watermarks. Source-code marks exist, and so do marks in 3D assets that are designed to stay detectable in rendered images. The point is narrow: rendering can erase some differences and keep others.

Where could a watermark go?

Suppose you run a video company and want every clip to carry a hidden mark. Where would you put it? There are more places than you might expect.

Each route below is a list of steps. For each step, a panel shows what you could mark there, what can remove or limit the mark, and who needs access. With scripts on, you click a step to open its panel. The “what you could mark” lists follow Section 3 and the table of candidate locations (Table 2, Appendix D) of the paper. The “what can remove or limit it” and “who needs access” lines are our plain-language reading of Sections 3 and 5, not results from the paper. Where the paper names no published method for a stage, we say so. The lists show where a mark could sit, not that any product does this.

Method names are examples of published work, and each is linked under Read further. If you would rather start from a concrete example, section 5 shows the real path that Route B can follow.

Route A: a model paints the pixels

Route B: code draws the pixels

The last two steps are the same for both routes. A mark added to finished pixels can be applied to a model's video, to a code-rendered video, or to a camera's. What differs is everything before it. These steps are different places to put a mark. They are not ranked from weak to strong. Several can be used at once, and a checker may not know which step was marked.

How today's tools make code-made video

A creator types a request: “make a ranking video of the best-selling games, in a 3D scene.” Here is the documented path that request can follow, as the official documents describe it. We read the documents and the public code (a pinned snapshot of Remotion's open-source repository: one fixed commit, accessed 4 October 2026). We did not run any of it.

1. You describe the video in words. For example, a ranking of the best-selling games, shown in a 3D scene.
2. Claude Code writes the code. Claude Code is an AI coding assistant that edits files and runs commands. It works inside a Remotion project folder. Remotion's tutorial lists Claude Code among its supported coding agents and walks through creating the project, installing agent “skills” (add-on instruction packages) and starting a live preview (a window that shows the video while you edit).
3. Claude Code produces code. It says what to draw at each frame number.
4. A renderer runs the code, frame by frame. In server-side rendering, the renderer packages the project and picks a scene, which Remotion calls a composition. It then computes each frame, captures it, and compresses the frames into a video file.
5. The video file is exported.

So the assistant supplies the code, and a separate renderer draws the video. Remotion's documents also show a second way of working: a language model returns code as text, which is then compiled and rendered. That example uses a provider other than Anthropic.

Look at what the creator says. The code, the imported images and the 3D background have different origins. Who wrote the code, where each asset came from, and which renderer drew the final frames are three separate questions.

Where the code runs decides who holds what

The same code can run in three places. Each changes who can see the code, the logs and any secret keys. None of them changes who wrote the code.

• On a server. Remotion calls this server-side rendering. The operator (whoever runs the renderer) has the source files, the settings and the logs. Checkers who only have the video file get just the finished video. A stored copy of the code alone does not show which settings made a given file.
• In the browser. Remotion's client-side rendering runs inside the browser. It skips the server packaging step and supports only a subset of HTML. The paper infers that a preview that works may not guarantee a working export. Whoever runs the page can see its code. A secret key kept in that code is not secret from them.
• In the cloud. Remotion Lambda⁹ deploys the project to cloud storage, renders pieces in parallel and joins them. A record from one piece covers only that piece. Connecting it to the final file needs extra steps.

What marks and credentials exist today

Anthropic's help page (How Claude marks AI-generated content) describes two things: watermarks that some supported models add to the text they write, and C2PA credentials that some supported file types get. Which models and files are covered depends on the page; we did not test any of them. The page also says a positive detection result is evidence, not full proof. It adds that converting a file or taking a screenshot can remove metadata, the extra information stored inside a file.

Code is text, but a finished video is pixels. As the comment demo in section 3 showed, a mark in text does not automatically reach the pixels. None of the documents we read says that a mark in Claude's text is still present in a rendered video. This does not mean it is impossible. It only means we have no source that says it is present.

C2PA credentials are signed records tied to a file. If the attached data is lost, a watermark or fingerprint (a short summary computed from the content) can help find the right record again. C2PA calls this soft binding¹⁰. Soft binding helps find records, but it does not replace the signature.

Still pictures also have two routes

Chat assistants can draw still pictures in more than one way too, and a picture you receive may not say which. Claude's custom visuals feature builds diagrams and charts as web code, with SVG or HTML downloads. OpenAI documents both Code Interpreter, which runs Python and can make graph images, and a separate image-generation tool. The Claude Artifacts help page we consulted lists some export formats, and we found no general promise of MP4 export on it.

Mixed videos: many sources in one frame

The frame below comes from a music video called “still loading”. Its creator, Zheng Gao, is a co-author of this paper. He reports that the video was rendered by code written with Claude's help; we have not checked this independently, and the public Bilibili page does not say how it was made. The scene inside looks like a detailed illustration. So where did that scene come from? The sources do not say.

This can happen: a video drawn by code can still contain things the code did not create. Examples are pictures, 3D models, voices, or footage from elsewhere. Remotion's Prompt to Video template is a documented case. It combines a generated script, generated images and a generated voiceover, made with OpenAI and ElevenLabs services, into one video. An assistant that can both run code and call an image tool could, in principle, mix the two routes inside one project (the paper treats this as a modelled possibility).

So “model-made” and “code-made” can be too coarse. The paper treats an AI agent as a controller that picks operations. As section 1 said, a controller is not a third kind of video.

A mark on one layer is evidence about that layer only

Picture a lesson video with three layers: a generated background, a chart drawn by code, and a person's circle and arrow. Suppose a detector finds a watermark that belongs to the background. That tells you about the background. It does not tell you who drew the chart, who added the annotations, or whether the lesson is right.

Three traps follow from this.

• Hidden layers. Cropping, covering and transitions can hide the marked layer. A record that an asset was loaded does not prove that it is visible.
• Look-alike patches. The same patch of pixels can come from more than one asset, so some matches may need the answer “can't tell”.
• Copying. An asset can be reused or copied from elsewhere (in the paper's model, reuse is allowed). A match shows that a region corresponds to the asset. It does not show who used the asset, or when.

One 2026 preprint, TRACE (Gao et al.; its first author, Zheng Gao, is also this paper's first author), takes a different approach. It proposes marking an agent's log of actions instead of the pixels. A mark in the log is evidence about the log, and a checker who has only the clip does not have the log.

Before anyone says “robust”: seven things to pin down

Someone tells you their watermark is “robust”, which means the mark can still be read after edits. Robust against what? For whom? To support which claim? Without answers, the word means very little.

The paper asks for seven things to be written down before any comparison (Sections 1.3 and 2.2 of the paper). It calls the full set a verification specification. Here they are as plain questions. The small circled letter beside each is the symbol the paper uses.

1. P

   How was the video made?

   List the steps: inputs, tools, settings, and any randomness. If an AI agent is involved, say how its choices are limited.

2. I

   What may the party that adds the mark see and change?

   That party might see only the finished pixels, or the code, or a model's inner state. What they can access decides what they can mark.

3. O

   What does the checker receive?

   Only pixels? Also the code, a record, or a key? You saw in section 3 that this changes what can be concluded.

4. A

   What can an attacker see and do?

   Someone with only pixels can edit the file. Someone with the code can also rebuild it and render it again. These are different powers.

5. U

   What must stay true?

   The task the video does (the paper calls this task preservation). A chart must keep its numbers and labels. A lesson must keep its order of events. Looking similar is not enough.

6. χ

   What exactly is being claimed?

   “A mark is present.” “This layer came from that asset.” “This tool exported this file.” Each needs different evidence.

7. Q₀

   What does an unmarked video look like?

   You need a baseline to measure false alarms: how often a detector says “marked” about a clip that was never marked.

The paper's full specification also fixes how keys are generated, who may ask the issuer to sign things, and who may run the checker. We leave those out here to keep the list short. The benefit is simple. A test that uses only pixels, a test that reads a message from the code, and a signed export record each depend on different assumptions. If any of the seven things changes, you are no longer comparing the same thing. A good setup also lets the checker say “can't tell”.

Ten open questions

Imagine a short animation in which bars grow to their final heights, like the bar chart in Figure 2. The numbers and labels must stay right. (The paper's own worked example is smaller: one bar over five frames.) How much else about that animation could a creator change to carry a hidden message, and what would survive editing?

Section 6 of the paper poses ten questions of this kind. The paper does not answer them, and it does not claim that every version of them is unsolved everywhere. Each is written as a small, carefully limited problem with a small starting case where one can check the basic definitions. Below, each one is restated in plain words, with why it matters and a sensible first step. The full versions, with exact conditions, are in the paper. Many of them use the bar animation as a running example: its values and labels must stay correct, so the task limits what may be changed. The four themes in the filter are our own grouping for browsing, not the paper's sections.

What this page is and is not

Before you take anything from this page, here is exactly what it is.

What it is

• A plain-language guide to a conceptual research agenda. The paper sets out definitions, a few small worked examples, and ten questions.
• Built on published methods, official documents and public code that we read. Official documents were checked on 4 October 2026 and example pages on 5 and 6 October, and tools change.
• A working draft. It is not offered as a finished or publication-ready result.

What it is not

• Not an experiment. We measured nothing. We did not test any watermark, detector or credential on any example on this page, and there are no scores.
• Not a tool. This page implements no detector.
• Not a claim that these ideas are new. We did not run a novelty check. The paper does not claim that every version of its ten questions is unsolved in every setting.
• Not new theorems. The paper's short mathematical examples are elementary. They explain where information is lost or kept, how hidden changes must pass through rendering, and how searching many alignments affects false alarms. It claims no new theorems.
• Not every source was read in full. The paper's reference list has 80 entries: papers, official documents, specifications, code repositories and creator posts. Reading depth varied. Some central methods were read in technical detail. Several newer ones were only screened from their abstracts. Our source notes record which is which.
• Not a comparison of the two routes. The example frames show variety. They do not show that one route looks better, and we do not claim the two routes give identical pixels.

About the pictures

The video frames are screenshots or decoded frames of existing videos, used here to illustrate. One was supplied by the paper's author. Each caption gives the credit and what the source says about how the video was made. The five concept figures, and the left chart in Figure 2, were made with an image model for the paper. They explain ideas. They are not results and not proofs. One frame has a small retouched area, which its caption describes.

Words used here

Watermark

A hidden mark added to a picture, video or text so that a detector can find it later. It may also carry a short message. “Mark” is short for watermark.

Provenance

The history of where something came from: who or what made it, with which tools and inputs, and what happened to it afterwards.

LLM

Large language model: the kind of AI behind chat assistants.

Checker

Any person or software that examines a clip to say something about how it was made. What it can conclude depends on what it receives: pixels, code, keys or records.

Detector

A checker that looks for a mark or estimates how a clip was made. It can be wrong.

Passive inference (passive detection)

Guessing how a clip was made from the clip alone. Nobody arranged a mark beforehand, so the answer is an estimate and can be wrong.

Authentication

Checking a signed record from an issuer, such as “this file came out of our tool”, under stated trust assumptions.

Signed record

A statement protected by a digital signature, so that changes to it can be detected.

Issuer

The person or organisation that signs a record, such as the provider of a tool.

Key

A secret value, like a password, used to add a mark or to sign a record. A checker may need the matching key.

Fingerprint

A short code computed from the content of a clip. It can help find the matching record without a hidden mark.

Robust

A mark is robust if a checker can still read it after allowed edits such as compression or cropping. The paper asks: robust against what?

Diffusion model

A generator that starts from random noise and removes it step by step, guided by a prompt, until a picture or video appears.

Latent

A compressed internal code that some generators work on before turning it into pixels.

Decoder

The part of a generator that turns a latent into pixels.

Metadata

Extra information stored inside a file, such as who made it or a signed record. Converting the file can strip it.

Pixels

The tiny coloured dots that make up each frame of a picture or video.

Renderer

Software that follows a description, such as code or an SVG file, and draws the picture or video frames it describes.

Rendering

The act of drawing frames from code or an SVG file. The same code can give different results if the renderer or its settings change.

Operator

The person or company that runs a renderer or a service.

Asset

An image, 3D model, texture or sound file that code loads and uses when it renders a video.

SVG

A text format for drawings. A file lists shapes, colours and text. It can be opened and edited as text, or drawn as a picture.

Remotion

A toolkit that makes videos from React code. The code describes what each frame shows, and Remotion renders it.

Claude Code

An AI coding assistant from Anthropic that can edit files and run commands in a project. Remotion documents how to use it for video projects.

AI agent (controller)

Software, often guided by a language model, that picks tools and runs them. The paper calls it a controller when it chooses among ways of making media.

C2PA and Content Credentials

A standard for signed records about how a piece of media was made or handled. Content Credentials is the common name for such records.

Soft binding

Using a watermark or fingerprint in the content to find the matching C2PA record again when the metadata has been lost. It does not replace the signature.

Hybrid media

A video or image built from several sources, such as generated assets, code-drawn parts and human edits.

Task preservation

Keeping what the video is for. A chart keeps its right numbers and labels. It need not keep every pixel the same.

False alarm

A detector saying “marked” about a clip that was never marked.

Attacker

Anyone who tries to remove, fake or avoid a mark. What an attacker can see and change, such as only pixels or also the source, is part of the setup.

Can't tell (abstain)

To answer “can't tell” instead of yes or no. A good checker is allowed to do this.

Read further

Twenty-five primary sources from the paper's reference list. Each link goes to the source itself: a paper, a standard, or official documentation. Years are the first public (arXiv) year unless a venue is named.

Watermarks for images and video

• Video Seal: Open and Efficient Video Watermarking 2024 · Fernandez et al. A watermark added to finished video frames, which its authors designed to withstand common video edits (we did not test this).
• VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking 2025 · Hu et al. A mark placed in the starting noise of a video generator.
• The Stable Signature: Rooting Watermarks in Latent Diffusion Models 2023 · Fernandez et al. Changes an image generator's decoder so that the pictures it makes carry a hidden mark.
• Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust 2023 · Wen et al. Hides a pattern in the noise an image generator starts from.
• Watermark Anything with Localized Messages 2024 · Sander et al. Reads separate messages from different regions of one image.
• VideoMark: A Distortion-Free Robust Watermarking Framework for Video Diffusion Models 2025 · Hu et al. A video-generation mark that matches frames in time so that it can still be read after edits.
• HiDDeN: Hiding Data With Deep Networks 2018 · Zhu et al. A neural network trained to hide a message in an image and to read it back.
• TrustMark: Universal Watermarking for Arbitrary Resolution Images 2023 · Bui et al. A watermark added to finished images of any size.
• LVMark: Robust Watermark for Latent Video Diffusion Models 2024 · Jang et al. A watermark for video generators that work on a compressed internal code.
• Video Signature: Implicit Watermarking for Video Diffusion Models 2025 · Huang et al. A watermark built into a video generator itself, so that its videos carry the mark.
• LoT-Pass: Long-term-robust Image Watermarking for Image to Video Generation 2025 · Wang et al. A watermark for an input image that is meant to feed an image-to-video model.

Marks in code and in 3D assets

• SrcMarker: Dual-Channel Source Code Watermarking via Scalable Code Transformations 2024 · IEEE Symposium on Security and Privacy Hides a message in source code by rewriting the code in ways that carry the mark.
• CopyRNeRF: Protecting the CopyRight of Neural Radiance Fields 2023 · Luo et al. Marks a 3D scene so that pictures rendered from it carry the mark.
• Who Wrote this Code? Watermarking for Code Generation (SWEET) 2024 · Lee et al. · ACL Nudges the words a code-writing model picks at hard-to-predict points, so the code carries a pattern.
• Marking Code Without Breaking It (STONE) 2026 · Kim et al. · EACL Findings Chooses where to mark by the kind of code syntax, so that the marking does not break the code.
• Resilient Watermarking for AI-Generated Codes (ACW) 2024 · Li et al. Rewrites finished code with changes such as refactoring and reordering to carry a mark.
• WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights 2024 · Jang et al. · CVPR Marks a learned 3D scene so that views drawn from it carry the mark.

Tools and workflows

• Claude Code overview Official documentation What Claude Code is and what it can do on a computer.
• Prompting videos with coding agents Remotion documentation The tutorial for making a Remotion video with a coding agent.
• Client-side rendering Remotion documentation Rendering a video inside the browser instead of on a server.
• How Claude marks AI-generated content Anthropic help page What marks and credentials Claude's supported models and files carry.

Provenance, detection and limits

• Content Credentials: C2PA Technical Specification, version 2.2 2025 · C2PA The standard for signed records about media, including soft binding.
• PROV-DM: The PROV Data Model 2013 · W3C A standard vocabulary for who and what took part in making something.
• GenVidBench: A 6-Million Benchmark for AI-Generated Video Detection 2025 · Ni et al. A test set for detectors that guess whether a video was machine-generated.
• TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories 2026 · Gao et al. (first author is also this paper's first author) A watermark placed in an agent's log of actions instead of in the pixels.

Credits

Example frames

All frames are screenshots or decoded frames, shown to illustrate. We claim nothing about them beyond what each source says. Labels follow the sources and not how a frame looks. X may ask you to log in to open the X links below.

• Veo frames. Google AI for Developers, “Generate videos with Veo 3.1 in Gemini API” (page last updated 2026-09-17 UTC). The paraglider frame was captured on 5 October 2026. The other three were captured on 6 October 2026 from the page's animated previews, at an arbitrary point in each loop. The page labels each output as generated by Veo 3.1. Some of these clips start from input images that the page itself labels as generated by Nano Banana, so they are not plain text-to-video examples. The page says its content is licensed under CC BY 4.0 except as otherwise noted; it does not say whether the preview clips are covered. Each frame is a single still with black edge columns trimmed, and nothing else was changed. Source.
• Game-ranking frame. Dilum Sanjaya (@DilumSanjaya), via the official Remotion gallery entry, which credits him and labels the tool Claude Code. The creator's public thread describes the workflow and the imported assets. Gallery, original post, workflow post, asset post. Frame decoded from the gallery video, scaled to 1280 px wide; captured 5 October 2026. The game titles and sales numbers are the video's own content, not data we used.
• “still loading” frame. Music video by Zheng Gao, a co-author of this paper, posted on Bilibili on 1 October 2026 (account “Elvis的游乐园”, named here only as the source credit). He reports that it was rendered by code written with Claude's help; the public page does not state the workflow. The paper's Figure 4(b) and reference [51] credit the video to him. The origin of the images inside it is not stated. Source. Captured 5 October 2026.
• Retouch disclosure. In the “still loading” frame (01:11), an image model was used to paint over the platform's logo and account-name overlay in the upper-left corner (about 2% of the frame) and to redraw the part of the on-screen progress bar hidden behind it, so those pixels are generated, not original. Everything outside that small area is the original decoded frame. The other frames are not retouched; any trimming or scaling is described in their own credits.
• Companion video. “Rethinking Visual Provenance: Two Ways AI Makes Pictures, and How a Hidden Tag Might Help”, a 4-minute explainer (4:21) uploaded to YouTube by Zheng Gao (channel @GaoZheng-l2i), first author of this paper; YouTube lists it as published on 6 October 2026. Its description says it is “a research agenda: questions, not results” and gives these disclosures: “Drawn from code with AI help. Computer-generated voice. AI-generated characters.” It also credits the Google Veo 3.1 documentation paraglider still and the “still loading” music video (one corner retouched to remove a platform mark). We have not checked how it was made beyond its own description. The cover image on this page is a frame at about 0:08 from the local render of the video, not a screenshot of the YouTube page. The “Play the video” button opens the video in a player on this page, using YouTube's privacy-enhanced embed (youtube-nocookie.com). Nothing is loaded from YouTube until you press it. Source.
• Map-animation frame. The official Remotion gallery entry “Travel Route on Map with 3D Landmarks”, credited to @JNYBGR, with gallery labels Claude Code and Opus 4.5. Those labels belong to that example only. Source.
• Any further frames in the galleries carry their own credit line in the caption.

Illustrations

• On this page, Figures 1, 3, 4, 5 and 6 are conceptual illustrations made with an image model for the paper (Figures 1, 2, 3, 5 and 6 of the PDF). They explain ideas. They are not measurements and show no real detector output.
• In Figure 2 (Figures 4(e) and 4(f) of the PDF), the left chart came from an image-generation model. The right chart is SVG code written by an agent and turned into a picture on our own computer. The data are invented.
• The tiny circle drawings in section 3 are real inline SVG, shown next to their source.
• The small line drawing under the heading of section 3 is a decorative SVG drawing made by hand for this page. It is not a figure from the paper and shows no data.

The paper

“Rethinking Visual Provenance: Detection and Watermarking Across Direct Visual Generation and LLM-Driven Code Rendering”. Authors: Zheng Gao, Xiaoyu Li, Zhicheng Bao, Yang Song and Jiaojiao Jiang, UNSW Sydney. The PDF prints no date; its sources were accessed on 4 and 5 October 2026, and we date this page October 2026. We describe the paper as a conceptual working draft; the paper itself calls it a conceptual research agenda. Read it as a PDF (46 pages, 15.8 MB).