Systems and methods for activation-keyed dual-channel watermarking with content-only verification and verifiable inference credentials (VIC-WM)
Systems and methods label machine-generated content. During inference, internal activations are sampled, projected, and error-correcting encoded to generate an activation digest. A cryptographic commitment to the activation digest is generated, and a session key is derived using a key-derivation function over inputs comprising at least the activation digest, inference context data, and a domain-separation label and, when available, validated attestation data. A watermark encoder embeds a dual-channel watermark into output content, including (i) a payload channel for statistical detection and (ii) a control-channel codeword for candidate record and/or commitment determination. A verifiable inference credential record includes the commitment, output metadata, policy flags, transparency metadata, and one or more digital signatures, and the commitment is recorded in a tamper-evident log with checkpoints and inclusion proofs. From content alone, a detector computes a payload statistic, decodes the codeword, verifies signatures and log inclusion, and outputs a provenance report with machine-verifiable reason codes.
1 . A computer-implemented method for labeling machine-generated content, comprising:
receiving, at a model execution engine, an inference request including a model input;
executing an artificial intelligence model on the model input within an execution environment and sampling, during execution, internal activations of the artificial intelligence model at one or more sampling locations;
projecting the sampled internal activations into a representation having a dimensionality lower than that of the sampled internal activations to produce a projected representation;
encoding the projected representation using an error-correcting encoder to produce an activation digest;
generating a cryptographic commitment to the activation digest;
obtaining inference context data for the inference request, the inference context data comprising at least one of a distribution channel identifier, a policy profile identifier, or a time-window identifier;
determining whether the execution environment comprises an attested runtime environment and, in response to determining that the execution environment comprises the attested runtime environment, obtaining attestation data associated with the attested runtime environment, the attestation data describing integrity of at least a portion of the runtime environment used to execute the artificial intelligence model;
deriving a session key by applying a key-derivation function to inputs comprising (i) the activation digest, (ii) the inference context data, and (iii) a domain-separation label identifying a purpose of a derived key, wherein, when the execution environment comprises the attested runtime environment, the inputs further comprise at least a portion of the attestation data;
embedding, by a watermark encoder parameterized by the session key, into content generated by the artificial intelligence model, a dual-channel watermark comprising a payload channel and a control-channel codeword to produce a watermarked output;
generating a verifiable inference credential record comprising the cryptographic commitment and metadata describing at least the watermarked output; and
publishing at least one of the watermarked output and the verifiable inference credential record.
2 . The method of claim 1 , wherein the inference context data further comprises one or more of: a request identifier, a provider identifier, and a model-family identifier, and wherein the domain-separation label causes the key-derivation function to derive distinct keys for distinct purposes including at least watermark embedding and control-channel mapping, and wherein the control-channel codeword is configured to be error-correcting decodable from the watermarked output alone such that a detector, from the watermarked output alone, can decode the control-channel codeword and, based at least thereon, determine at least one of:
(i) an identifier usable to obtain, from a credential store storing verifiable inference credential records, a candidate verifiable inference credential record corresponding to the watermarked output; or
(ii) a value usable to deterministically reconstruct, in a canonical commitment representation, a candidate cryptographic commitment corresponding to the activation digest for verification.
3 . The method of claim 1 , wherein embedding the dual-channel watermark comprises, for textual content, biasing token selection probabilities of a language model in accordance with key-dependent bucket assignments determined from the session key and encoding bits of the control-channel codeword using the bucket assignments across a plurality of text segments, the dual-channel watermark being configured such that, under a detector profile, after a content-preserving transformation comprising paraphrasing, the control-channel codeword is decodable by an error-correcting decoder with a bit error rate not exceeding a threshold specified by the detector profile.
4 . The method of claim 1 , further comprising recording, in a tamper-evident log store, a log entry including at least an identifier of the verifiable inference credential record and the cryptographic commitment to the activation digest.
5 . The method of claim 1 , wherein the cryptographic commitment is generated using a cryptographic commitment scheme configured such that the cryptographic commitment does not enable derivation of the activation digest or reconstruction of the sampled internal activations, and wherein the verifiable inference credential record further comprises one or more flags indicating that specified policies or compliance checks were applied during generation of the watermarked output.
6 . The method of claim 1 , wherein the verifiable inference credential record is encoded in a manifest format that is attachable as embedded metadata within a media container, as a sidecar file associated with a file containing the watermarked output, or both.
7 . The method of claim 1 , further comprising validating an attestation report generated by the attested runtime environment to produce validated attestation data, wherein at least a portion of the attestation data used as an input to the key-derivation function is derived from the validated attestation data.
8 . The method of claim 1 , wherein the dual-channel watermark embedded in the watermarked output remains detectable, with a payload channel statistic exceeding a predetermined detection threshold specified by a detector profile, after at least one content-preserving transformation selected from the group consisting of paraphrasing, cropping, scaling, lossy re-encoding, and format conversion.
9 . The method of claim 1 , further comprising applying, to an external representation of the watermarked output, a human-perceivable disclosure artifact selected according to a policy profile, the human-perceivable disclosure artifact comprising at least one of a visible badge, caption, banner, overlay, or an audible disclosure tag.
10 . The method of claim 1 , wherein the verifiable inference credential record further comprises transparency metadata including at least one of: a notice event identifier; a notice surface identifier; a notice version digest; a disclosure mode indicator; an accessibility label; a watermark profile identifier; a detector profile identifier; or a detection threshold identifier corresponding to a target false-positive rate.
11 . The method of claim 4 , wherein the log entry further includes at least one policy outcome or reason code indicating whether a disclosure requirement was satisfied, and wherein the tamper-evident log store issues transparency checkpoints that are anchored by publication to an external transparency service and cosigned by a plurality of witnesses.
12 . The method of claim 9 , further comprising receiving, from a distributor system or platform, one or more distributor digital signatures applied to at least a portion of the verifiable inference credential record, each distributor digital signature attesting preservation of the human-perceivable disclosure artifact for a respective distribution channel.
13 . A system for labeling machine-generated content, comprising:
a model execution engine configured to execute an artificial intelligence model in response to inference requests within an execution environment;
an activation sampler configured to sample internal activations of the artificial intelligence model during execution at one or more sampling locations;
an activation projection logic configured to project the sampled internal activations into a representation having a dimensionality lower than that of the sampled internal activations to produce a projected representation;
an error-correcting encoder configured to encode the projected representation to produce an activation digest;
a digest commitment logic configured to generate a cryptographic commitment to the activation digest;
an inference context store configured to provide inference context data for an inference request, the inference context data comprising at least one of a distribution channel identifier, a policy profile identifier, or a time-window identifier;
an attestation interface configured, when the execution environment comprises an attested runtime environment, to obtain attestation data describing integrity of at least a portion of a runtime environment used to execute the artificial intelligence model;
a key derivation component configured to derive a session key by applying a key-derivation function to inputs comprising (i) the activation digest, (ii) the inference context data, and (iii) a domain-separation label identifying a purpose of a derived key, wherein, when the execution environment comprises the attested runtime environment, the inputs further comprise at least a portion of the attestation data;
a watermark encoder configured to embed, into content generated by the artificial intelligence model, a dual-channel watermark comprising a payload channel and a control-channel codeword, the dual-channel watermark being parameterized by the session key, to produce a watermarked output;
a verifiable inference credential generator configured to generate a verifiable inference credential record comprising the cryptographic commitment and metadata describing at least the watermarked output; and
a network interface configured to output at least the watermarked output and the verifiable inference credential record.
14 . The system of claim 13 , further comprising an attestation verifier configured to validate an attestation report generated by the attested runtime environment, the attestation data being derived from the validated attestation report.
15 . The system of claim 13 , wherein the watermark encoder comprises one or more modality-specific watermark encoders configured to embed the dual-channel watermark in at least one respective modality selected from text, image, video, or audio.
16 . The system of claim 13 , further comprising a log writer and a tamper-evident log store, the log writer being configured to write log entries including the cryptographic commitment, and the tamper-evident log store being configured to issue transparency checkpoints and provide inclusion proofs anchored by the transparency checkpoints, wherein the transparency checkpoints are cosigned by a plurality of witnesses.
17 . The system of claim 13 , further comprising a credential store configured to store signed instances of the verifiable inference credential record, a signing engine configured to sign the verifiable inference credential record using a provider signing key, a key-status service configured to publish a signed key-status record indicating whether the provider signing key is active or revoked, and a credential verifier configured to verify the signed key-status record.
18 . The system of claim 13 , wherein the verifiable inference credential generator is configured to encode the verifiable inference credential record in a canonical structured document format suitable for inclusion in a content provenance manifest and configured to support detached signature verification.
19 . The system of claim 13 , wherein the inference context data comprises at least a distribution channel identifier and a policy profile identifier such that the session key is channel-specific and policy-profile-specific.
20 . The system of claim 13 , wherein the model execution engine, activation sampler, activation projection logic, error-correcting encoder, digest commitment logic, key derivation component, watermark encoder, and verifiable inference credential generator are implemented at least in part within a trusted execution environment of the attested runtime environment.
21 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving an inference request including an input;
executing an artificial intelligence model on the input within an execution environment while sampling internal activations;
projecting the sampled internal activations into a representation having a dimensionality lower than that of the sampled internal activations to produce a projected representation;
encoding the projected representation using an error-correcting encoder to produce an activation digest;
generating a cryptographic commitment to the activation digest;
obtaining inference context data for the inference request, the inference context data comprising at least one of a distribution channel identifier, a policy profile identifier, or a time-window identifier;
determining whether the execution environment comprises an attested runtime environment and, in response to determining that the execution environment comprises the attested runtime environment, obtaining attestation data corresponding to the attested runtime environment;
deriving a session key by applying a key-derivation function to inputs comprising (i) the activation digest, (ii) the inference context data, and (iii) a domain-separation label identifying a purpose of a derived key, wherein, when the execution environment comprises the attested runtime environment, the inputs further comprise at least a portion of the attestation data;
embedding, into an output of the artificial intelligence model, a dual-channel watermark comprising a payload channel and a control-channel codeword, the dual-channel watermark being parameterized by the session key, to produce a watermarked output;
generating a verifiable inference credential record comprising the cryptographic commitment and metadata describing at least the watermarked output; and
emitting at least the watermarked output from a network interface.
22 . The non-transitory computer-readable medium of claim 21 , wherein the operations further comprise encoding the verifiable inference credential record in a manifest format and attaching the manifest to a file containing the watermarked output as embedded container metadata and/or as a sidecar file.
23 . The non-transitory computer-readable medium of claim 21 , wherein the operations further comprise writing a log entry to a tamper-evident log store, the log entry including the cryptographic commitment and a reference to the verifiable inference credential record, and wherein the tamper-evident log store issues transparency checkpoints cosigned by a plurality of witnesses.
24 . The non-transitory computer-readable medium of claim 21 , wherein the dual-channel watermark is configured such that, when present in the watermarked output, a detector can, from content alone, compute a payload channel statistic and compare the payload channel statistic to a predetermined detection threshold defined by a detector profile, decode the control-channel codeword, and determine a candidate verifiable inference credential record, a candidate cryptographic commitment, or both, for verification.