OpenWater aims to provide a simple way for media and data to carry their own history around, leveraging fully decentralized infrastructure and without requiring appointment of any company, government or blockchain as Ministry of Reality
Writing the a blog post last week on the obvious folly of anti-AI statistical text watermarking reminded me I haven’t yet said much publicly about a side project I’ve been playing with, called OpenWater. Which also deals with watermarking, though of a more traditional and I believe much more useful sort.
OpenWater is not AGI—it’s a much simpler sort of tool—but it’s a tool I think both humans and AGIs are going to need rather badly. Basically: a fully open and decentralized approach for dealing with deepfakes and related issues.
For those who want to plunge into the devilish details, the overall preliminary design is here. Early prototype code is here.
The reasons this sort of thing is needed shouldn’t require too much elaboration. We’re well into the era in which a photograph no longer proves that a camera saw something, a recording no longer proves that a person spoke, and a video no longer proves that the event it depicts ever occurred. Pretty much any digital artifact can soon be manufactured with exquisite realism, at low cost, by systems available to millions of people and billions of software agents. I like to think I’m reasonably good at spotting fakery— some of the things random people online believe are real leave me rather perplexed—but “squint at it and see if it feels off” doesn’t scale as an epistemology, for humans or for AI systems learning how to think from the internet.
The web of BS gets quite involved these days. Fake material gets presented as real, and real material gets dismissed as fake—and the second effect, sometimes called the liar’s dividend, may end up more corrosive than the first, because once nothing can be authenticated, the most powerful actor in any dispute can simply deny whatever evidence is inconvenient.
So, yes, it feels like we need a far more solid solution to data provenance, digital provenance, media provenance—validating that something you see online is what it says it is, or at least seeing clearly what can and can’t be established about where it came from.
And better yet, we would like a solution to these problems that doesn’t require placing faith in any sole source of truth, but relies solely on a decentralized network of participants. (Decentralized networks being the most reliable and productive source of all sorts of truth in human history, really.)
The problem of decentralized data provenance is not trivial, but it’s also not incredibly hard. But I haven’t seen a fully adequate solution out there, so I felt moved to spell one out and prototype it.
I do understand of course, that there’s a technological problem and then there’s an adoption problem. What I’ll sketch here is how to solve the technological problem—I’ve got a prototype codebase, and a nicer version is being built in the SingularityNET ecosystem. Solving the adoption problem is the next step, and I’ll say a little about that toward the end, but I do understand it is probably the more difficult part.
How not to approach the problem
First, let me say something about one way NOT to approach the data provenance problem—which is with AI at the center. Advanced AI can solve an awful lot of things, but it’s not in itself the core solution to absolutely EVERYTHING. There is a role for AI here, a fairly important one, but it’s a subordinate role that I’ll describe a little later.
Specifically: Training machine learning models to tell deepfake pictures from real pictures, deepfake video from real video, essays written by William from essays written by an LLM emulating William… this is a losing proposition. AI-generated images don’t have three fingers or seven fingers anymore. The statistics of how a certain person writes can be measured—and then used to guide the production of an LLM-based system that writes closer and closer exactly that way.
At any given point in time there may be some heuristics that separate AI-generated stuff from stuff that came out of a camera or a human at a keyboard, but it’s one side versus the other in a co-evolutionary arms race, and the fakers are going to win. That much seems near-inevitable to me. A detector returns a probability, not a history; new generators learn to evade old detectors; compression and re-editing confuse the classifiers; and a sufficiently capable attacker can simply train against the detector itself.
The stronger question is not “does this look fake?” but “what can this artifact prove about where it came from, which systems touched it, which parties signed claims about it, and how it changed along the way?” This is the conceptually, pragmatically and politically critical shift from detection to provenance.
Watermarks and signed claims
It is no big revelation that you can watermark things. A camera can put an invisible watermark into a picture based on the camera hardware, the GPS coordinates, the time and place. Same for video. A person typing on a laptop can have biometrics—the fingerprint pad, say—feed into a watermark embedded in the resulting document. An AI model can watermark its outputs and sign a claim that it produced them. An editing tool can sign a claim describing exactly what edits it made. A publisher can sign a claim that it released this particular version.
Concretely: suppose a photojournalist captures an image. The camera signs a claim that its sensor produced the original pixels. An editing application later signs a claim that it cropped the image and adjusted the contrast. The newspaper signs a claim that it published this version. A robust invisible watermark or fingerprint embedded in the image then provides a durable pointer back to those records—so that even after the image has been screenshotted, recompressed and reposted through a dozen platforms that strip its metadata, the chain of custody can still be recovered. A viewer’s browser can then display something like: captured by an attested camera, edited by a signed tool, published by a newsroom you’ve chosen to trust, current pixels match the signed commitment. Which is a lot more informative than a green badge that just says “real.”
None of this guarantees truth in any complete sense. A camera can record a staged scene, a government can sign propaganda, a newspaper can screw up. What provenance does is make responsibility visible—it tells you which claims were made by whom, and whether the artifact still matches those claims. That’s the raw material out of which people, institutions and AI systems can form more intelligent judgments.
The obvious way to build this is the wrong way
The obvious way to deploy watermarking is a centralized system—one company or one government as the gatekeeper of validity.
Google’s SynthID is a good example of the useful-but-limited version of this: it embeds imperceptible watermarks into AI-generated images, audio, video and text within Google’s products, and Google’s tools can later look for those signals.
Sure, this is considerably better than publishing synthetic media with no provenance signal at all.
But the limitation is obvious and architectural: the same organization controls the generator, the watermark, the detector, the update schedule, the access policy and the interpretation.
You get one controller of policy, who will sooner or later be leaned on or captured by some government—and some governments are great, some… are not. And even great ones have a way of eventually or at least periodically becoming much less so.
Also, security-wise, with the centralized approach, you get a single point of failure: one bug or one hack into that one thing, and everyone is compromised at once.
And you probably end up with incompatible watermarking fiefdoms on different computing platforms—an Apple-versus-Android sort of situation—the sort of thing likely to take a decade or more to sort itself out, if it ever does.
On the whole, this is a perfect case for neither monopoly nor chaos—i.e. for an open, decentralized, interoperation-focused ecosystem.
I should be clear that my critique isn’t aimed at open standards. The C2PA coalition (Coalition for Content Provenance and Authenticity) has built an important open standard for Content Credentials—tamper-evident records of origin and edit history that work something like a nutrition label for media—and my own OpenWater proposal is designed to be compatible with C2PA rather than to replace it.
But an open format is necessary rather than sufficient. The repositories, the watermark resolution, the key histories, the revocation lists and the trust decisions also have to be plural and auditable, or you’ve just rebuilt the same bottleneck one layer up.
The OpenWater design
So OpenWater is an open framework for making provenance credentials durable while keeping the trust architecture decentralized.
Boiled down, it combines a handful of simple ideas:
- whomever produces or transforms a piece of content—a camera, an AI model, an editing tool, a publisher, a software agent—signs precise claims about what it did, using an open credentialing framework;
- the claims get packaged into an interoperable credential, preferably C2PA-compatible;
- a robust invisible watermark or media fingerprint provides the route back to the credential even when ordinary metadata has been stripped away;
- the credentials are stored and resolved by many independent services—some publicly owned anchors, some private companies, a distributed network rather than one mandatory database;
- and each user, institution or AI system applies its own trust policy to the evidence, rather than pressing some universal “truth” button.
None of this is especially deep or crazy—it’s just “how things should work.” What is peculiar is that nothing like this is rolled out and widely adopted already.
The last item on the above bullet list deserves a bit of emphasis, because provenance verdicts are not naturally binary. Different pieces of evidence get watermarked into an artifact, and members of the network weigh them.
Maybe this image came from a camera that appears to have been in Iraq; it carries a fingerprint reading from a particular guy; but there’s no liveness detection attached to that reading, so we can’t rule out that somebody took his finger—it was a battle zone, after all. So we can say the image was captured on his camera with his fingerprint present, and we can’t say for sure that he took it.
Different parties, with different priors and different trust bundles, can reach different judgments from the same evidence—and the public can inspect all of it. A science journal, an indigenous media network, a national archive, a dissident collective and a social platform can accept different sets of signers while speaking the same underlying protocol.
What you get isn’t a Ministry of Truth, but rather a shared grammar of evidence… and a community using this grammar to communicate.
Along these lines, there also some very relevant things OpenWater deliberately refuses to do
- it doesn’t appoint a global authority to decide which institutions are truthful;
- it doesn’t claim that signed media depicts an unstaged event;
- it doesn’t require creators to reveal their civil identities;
- it doesn’t treat the absence of a watermark as proof of fakery.
This sort of design discipline is what keeps a provenance layer from mutating into censorship infrastructure.
Where AI comes in
The crux of OpenWater doesn’t require AI or anything else sophisticated beyond basic watermarking tech and decentralized networks. However, there is an important use of AI in a critical supporting role: reputation management.
If you have a decentralized network of parties storing credentials, resolving watermarks and vouching for signers, you face the question of how you trust them. And that is not a digital watermarking problem—it’s a reputation problem. You need a reputation system for the participants, and then, inevitably, people will try to game the reputation system. This is where you do bottom out in AI: you need AI to recognize the patterns of actors faking good behavior in order to accumulate undeserved reputation.
We worked out a lot of the mechanics of decentralized reputation systems years ago in the SingularityNET context—published some papers, built some prototypes—and the adversarial part, spotting sophisticated reputation-gaming, is exactly the sort of pattern recognition machine learning is good at. So: AI to police the reputation layer, not AI to declare what’s a deepfake. The role is subordinate but real.
Blockchains yes, wired-in tokens no
Another technology that is very helpful for OpenWater, but is intentionally not placed at its center, is blockchain.
This kind of decenrralized system has extremely good reasons to make use of blockchains—public chains are a natural place to anchor compact commitments, key transparency logs and revocations. But something like OpenWater shouldn’t live exclusively on any one blockchain, and it certainly shouldn’t have an exclusive cryptocurrency attached to it.
Storage, indexing, certification and auditing all cost money, and different operators will fund them differently—some with token-backed infrastructure and staking, some with subscriptions, public funding, institutional budgets or plain old cloud invoices. The protocol should allow all of these and mandate none of them. A provenance standard that major countries, regulated industries and ordinary businesses reject because it forces exposure to a speculative asset has failed before its cryptography ever gets tested—near-universal adoption is the security model here.
So OpenWater is designed as token-agnostic and chain-agnostic: chains as optional trust backends, not sovereigns of the system.
Why AGIs need this too
I said at the start that this is a tool both humans and AGIs need, and I totally meant it…. The next generation of AI systems will be shaped by vast streams of images, text, audio, video, scientific observations, simulations and agent-generated experience. If those streams arrive without provenance, model builders can’t reliably answer basic questions: was this created by a person or by another model? Was it licensed? Was it edited, and by whom? Which instrument produced this measurement? Has this same synthetic artifact been copied through a thousand datasets?
Basically: Models trained on untraceable data inherit untraceable assumptions, while models trained on well-provenanced data can reason about source quality, distinguish observation from simulation, respect licensing and consent, and avoid amplifying the same hidden error through recursive synthetic-data loops.
And OpenWater-style credentials don’t have to stop at public media—the same machinery can attach provenance to training examples, dataset versions, model outputs and agent actions. A model can state which dataset version contributed to a result; a robot can sign which sensors supplied an observation; an agent can identify which tools and which human authorizations were involved in some consequential action it took. For a decentralized network of AI systems—the sort of AGI network I’ve spent most of the last decade directly working toward—provenance is the connective tissue between knowledge, reputation and accountability.
From prototype to adoption
So… I vibe-coded a simple prototype of the OpenWater framework a while back, and a colleague in the SingularityNET / SingularityDAO ecosystem built a nicer version, which is still an early prototype but shows the idea clearly… The plan is to roll the technology out through a partnership between the SingularityNET Foundation and BGI Labs, staying compatible with the broader Content Credentials ecosystem throughout.
And then it comes down to adoption, which is always the hard part. ASI:Chain may be a help here — when we get OmegaClaw agents running on ASI:Chain, producing and handling media at scale with an effective decentralized watermarking and provenance framework built in from the start, then… as we said back when I lived in Australia… Bob’s your uncle. Agents are in some ways an easier adoption vector than humans: they can be configured to sign and verify by default, without anyone having to change their habits.
I won’t pretend watermarking fascinates me as much as core AGI cognition algorithms. But it does seem an important thing to have in place, so that AIs and humans alike can take a decent stab at telling bullshit from reality on the internet.
For sure there’s a long queue of other bullshit-detection problems waiting behind this one, but decentralized, impartial, rational measurement of the evidence regarding the provenance of digital artifacts—this one, at least, is solvable, and mostly solved at the level of design.
Nobody can own truth in the philosophical sense—truth is a relationship among minds, evidence and the world. But societies do get to decide who owns the infrastructure through which evidence is preserved and contested. The centralized answer is that a few tech companies or states should maintain the authoritative memory of digital events; the nihilistic answer is that nothing can be trusted and every claim is just power in drag. OpenWater is a bet on a third answer: evidence organized as an open, decentralized, interoperable commons, with judgment left plural, distributed across human and machine communities. The future of truth should be a protocol, not a product.
(The same machinery, incidentally, turns out to be useful for doing a less centralized job of proof of humanity—establishing that there’s an actual human on the other end of an interaction, without making one company’s biometric orb the gatekeeper of the human internet. That’s the subject of the next post in this series.)
Sources and further reading
OpenWater: A Comprehensive Framework for Robust Provenance Watermarking — the underlying OpenWater design and public entry point. See also early prototype code here.
C2PA — the open Content Credentials standard — open technical standards for cryptographically verifiable media provenance.
C2PA explainer on durable Content Credentials — why soft bindings such as watermarks and fingerprints help recover credentials after metadata is removed.
Google DeepMind SynthID — a prominent vendor-operated watermarking system for AI-generated media.
C2PA implementation guidance — practical guidance on manifest repositories, invisible watermarking and fingerprint fallback.
