Markup Detection

Markup Detection

When to Use

• Assess whether images or video show signs of tampering, compositing, or inconsistent capture metadata
• Review documents (Office, PDF) for hidden markup, revision layers, comments, or undisclosed edits
• Run metadata and provenance checks—EXIF/XMP, file hashes, embedded timestamps, export vs capture mismatches
• Triage synthetic media and deepfake concerns using observable workflow indicators (not model training)
• Interpret watermarks, C2PA / content credentials, and publisher attestation claims at a high level
• Produce investigation memos with confidence tiers, evidence tables, and stated limitations
• Compare source chain (original upload, reposts, screenshots) when authenticity is disputed

When NOT to Use

• Train, fine-tune, or benchmark detection ML models → ml-research-engineer-safeguards
• Design cryptographic watermarks, steganography, or signing schemes → cryptographer-specialist
• Perform full digital forensics with chain-of-custody, disk imaging, or courtroom expert testimony → specialized forensics vendor / digital-forensics-analyst (when installed)
• Conduct authorized offensive security or adversarial AI red teaming → ai-redteam, penetration-tester
• Map findings to audit attestations, SOC 2 opinions, or control effectiveness → auditor, compliance-engineer
• Blockchain-only address tracing, sanctions, or on-chain attribution → blockint / investigation skills unless user adds document/media context
• Issue legal conclusions on fraud, defamation, or admissibility → counsel; state facts and uncertainty only

Related skills

Core Workflows

1. Intake and scope

1. Identify asset type (image, video, audio, PDF, Office, email archive, web capture) 2. Record claimed provenance (author, date, device, platform, original URL) 3. List decision needed (internal triage, incident response, press review, litigation support prep—not legal advice) 4. Note constraints (only copies available, re-encoded social video, missing originals) 5. Select reference files from the table below

2. Preserve and catalog evidence

1. Obtain best available originals; avoid unnecessary re-saving that strips metadata 2. Compute cryptographic hashes (SHA-256) per file; record filename, size, received time 3. Capture context screenshots (platform UI, URLs, conversation thread) separately from the asset 4. Document tool versions used for extraction or enhancement 5. If chain of custody matters, route to formal forensics—do not improvise custody from this skill alone

3. Layered analysis

Run checks in parallel where possible; corroborate across layers before strong conclusions.

1. Structural / visual — lighting, shadows, edges, noise, perspective, duplicate regions (see visual reference) 2. Metadata — EXIF/XMP, container timestamps, software strings, GPS/device fields (see document integrity reference) 3. Document markup — tracked changes, comments, hidden text, embedded objects (see document integrity reference) 4. Synthetic-media signals — face boundary, blink cadence, audio-visual sync at workflow level (see synthetic reference) 5. Attestation — C2PA manifest, publisher credentials, visible watermarks (see watermarks reference)

4. Score and report

1. Classify each finding: observed fact vs inference vs hypothesis 2. Assign confidence (High / Medium / Low) per finding with rationale 3. State alternative explanations (heavy compression, beauty filters, legitimate edits) 4. Deliver memo using templates in references/investigation_reporting_and_limits.md 5. Recommend next steps (obtain original, specialist lab, legal review) when confidence is insufficient

Quality bar

• Never present heuristic suspicion as definitive proof of manipulation
• Separate undisclosed editorial markup from malicious tampering when intent is unknown
• Call out re-encoding, screenshots, and platform transcoding as common false-positive drivers
• Cite which checks were not run when tooling or access was missing

Document integrity and metadata

Purpose

Guide document markup discovery and metadata forensics for Office files, PDFs, email containers, and raster exports—complementing visual tampering checks.

Table of contents

1. Document markup and hidden content 2. PDF-specific integrity 3. Office Open XML 4. Email and archives 5. EXIF and XMP on images 6. Hashes and file identity 7. Timestamp interpretation 8. Metadata spoofing awareness

Document markup and hidden content

• Tracked changes — insertions/deletions not accepted; compare display vs stored revision XML
• Comments and annotations — author identity, unresolved threads, deleted-but-recoverable comment history
• Hidden text — font color matching background, hidden paragraph flag, collapsed outline levels
• White-on-white or microfont text in contracts and invoices
• Embedded objects — OLE packages, linked spreadsheets, external URLs in macros (route malware concerns separately)
• Form fields — default values changed after signing workflow claimed complete

PDF-specific integrity

• Incremental updates — multiple generations in one file; prior object versions may remain recoverable
• Revision history — some editors embed change logs in proprietary ways
• Redaction failures — black boxes overlaying text still selectable or extractable underneath
• Digital signatures — validate certificate chain, coverage (what is signed), and post-sign modifications
• JavaScript / actions — unexpected launch actions (security issue distinct from markup)
• XMP metadata — CreatorTool, CreateDate, ModifyDate, custom keys

Office Open XML

• Unzip .docx/.xlsx/.pptx (OOXML) and inspect:
• word/document.xml, word/comments.xml, word/revisions.xml (when present)
• docProps/core.xml and app.xml for author and timestamps
• customXml/ for workflow or DMS residue
• Compare printed/PDF export vs editable source when dispute is “what was shared”
• Watch template and theme paths revealing internal share locations

Email and archives

• EML/MBOX — Received hops vs Date header; MIME boundaries for altered attachments
• TNEF winmail.dat — nested attachments with separate metadata
• S/MIME or PGP signatures on messages (integrity of body, not necessarily attachments)

EXIF and XMP on images

Hashes and file identity

• Compute SHA-256 on received bytes; record before any conversion
• Compare hashes across purported duplicates from different sources
• Perceptual hashes (pHash) — similarity for near-duplicates; not cryptographic proof
• Note hash collision risk is theoretical for SHA-256; focus on process integrity

Timestamp interpretation

• Distinguish filesystem times (copy time) from internal metadata times
• Timezone offsets in EXIF vs UTC in PDF XMP
• Container mtime after cloud sync may reflect upload, not capture
• Versioned storage (SharePoint, Drive) — use platform audit logs when available (outside this skill’s file-only pass)

Metadata spoofing awareness

• EXIF and PDF info dict are editor-controlled—treat as claims, not ground truth
• Correlate metadata with visual and structural evidence
• Screenshot of metadata is weaker than extracted tool output from original file

Workflow

1. Inventory file types and versions received 2. Extract metadata with documented tools; save raw dumps in evidence annex 3. Run markup extraction (comments, revisions, hidden text) 4. Cross-check author strings and timestamps against known timeline from user 5. Flag gaps (stripped EXIF) as limitations, not automatic guilt

Investigation reporting and limits

Purpose

Standardize how to report markup and authenticity findings with explicit confidence, limitations, and boundaries—without legal conclusions or forensic overclaim.

Table of contents

1. Confidence scale 2. Finding structure 3. Report template 4. Evidence annex 5. Limitations catalog 6. Disclaimers 7. Peer handoffs

Confidence scale

Rules:

• Never label “High” on ELA or detector score alone
• Downgrade one level if only derivative copies exist
• Upgrade only with corroboration across visual + metadata + manifest (any two)

Finding structure

Each finding should include:

1. ID — FIND-001 2. Category — Visual / Metadata / Document markup / Synthetic / C2PA 3. Observation — factual description of what was measured or seen 4. Inference — what it might imply (clearly labeled) 5. Confidence — High / Medium / Low / Inconclusive 6. Alternatives — benign explanations considered 7. Evidence refs — file hash, frame timecode, tool output name

Report template

# Content authenticity assessment — [short title]

**Date:** YYYY-MM-DD  
**Analyst role:** Markup detection (workflow triage; not legal or lab forensics)  
**Requestor / context:** [internal team, incident ID]  
**Assets:** [list with SHA-256]

## Executive summary
[3–5 sentences: question asked, overall assessment tier, key limitation]

## Scope
- In scope: [files and checks performed]
- Out of scope: [lab forensics, legal opinions, model training, etc.]

## Findings summary
| ID | Category | Confidence | One-line summary |
|----|----------|------------|------------------|

## Detailed findings
[Repeat finding structure per item]

## Provenance timeline
| Time (UTC) | Event | Source |
|------------|-------|--------|

## Limitations
[Bullets from limitations catalog below]

## Recommendations
1. [Obtain original / C2PA-preserving export / specialist lab]
2. [Policy or legal review if needed]

## Tools and methods
| Tool | Version | Use |
|------|---------|-----|

Evidence annex

Maintain:

• Hash list for every file analyzed
• Metadata dumps (raw EXIF/XMP, PDF info)
• Screenshots of tool outputs (label as derivative)
• C2PA manifest exports when present
• Chain-of-custody note if formal forensics will continue elsewhere

Do not include illegal, highly sensitive, or unnecessary PII in shared annexes.

Limitations catalog

Copy applicable items into every report:

• Analysis performed on copies; originals not available
• Re-encoding via [platform] may have removed metadata and forensic signals
• No hardware acquisition of source device
• No specialist lab techniques (PRNU, advanced audio phonetics, etc.)
• Detector tools not run or not licensed for this engagement
• C2PA absent or failed validation; credentials not checked against custom trust store
• Timezone / clock accuracy not verified
• Intent not assessed—manipulation ≠ fraud without context
• Language / jurisdiction for admissibility not evaluated

Disclaimers

Standard footer (adapt to org policy):

This assessment is technical triage based on available files and stated methods. It is not legal advice, not a expert witness opinion, and not a guarantee of authenticity or inauthenticity. Strong conclusions may require specialist forensic examination and preserved originals.

Peer handoffs

Markup detection scope and boundaries

Purpose

Define what markup detection and content authenticity assessment cover in this skill, how findings differ from full forensic attribution, and which deliverables are in scope.

Definitions

Engagement types

In scope

• Visual tampering heuristics on images and video stills
• Metadata extraction and consistency checks (EXIF, XMP, container times)
• Hashing and file-identity comparison across copies
• Office and PDF markup, comments, hidden text, embedded objects
• Workflow-level synthetic-media and deepfake indicators
• C2PA / content credentials and watermark interpretation (verify signatures when tools allow)
• Structured reporting with confidence, limitations, and alternative explanations

Out of scope (route elsewhere)

Relationship to adjacent roles

• Information security engineer — implements DLP, logging, and integrity controls; this skill assesses a specific asset.
• Auditor — tests control operating effectiveness over time; this skill examines one artifact or a small corpus.
• AI red team — adversarial testing of LLM applications; overlap only when synthetic text or multimodal model output is the asset under review.
• Cryptographer specialist — designs signing and watermark protocols; this skill reads attestations when present.

Independence and ethics

• Do not enhance evidence in ways that invent pixels or remove materially relevant metadata without disclosure.
• Disclose when analysis is non-exhaustive (no ELAs, no lab hardware, no subpoenaed originals).
• Avoid deanonymization beyond what the user’s authorization and policy allow.
• For CSAM or imminent harm content, follow jurisdictional reporting obligations; do not redistribute illegal material.

Minimum inputs

Deliverable standards

• Every strong claim needs linked observation (what was seen) and confidence.
• Include a limitations section (tools not run, missing originals).
• Recommend escalation (specialist lab, legal) when conclusions would affect rights or safety.

Synthetic media and deepfakes

Purpose

Support workflow-level triage of suspected AI-generated or face-swapped content without training detectors or claiming laboratory certainty.

Table of contents

1. Categories of synthetic media 2. Face-swap and lip-sync indicators 3. Full synthetic imagery 4. Audio and voice cloning 5. Multimodal LLM outputs 6. Detection limitations 7. Escalation paths

Categories of synthetic media

Face-swap and lip-sync indicators

• Face boundary artifacts — jawline shimmer, hair-edge halos, skin tone seam at cheeks
• Eye behavior — irregular blinks, lack of micro-saccades, mismatched gaze on turns
• Teeth and mouth — blurred interior, inconsistent tooth count frame-to-frame
• Head pose vs torso — neck stiffness, misaligned jaw when body rotates
• Temporal consistency — face box jitter, resolution change localized to face crop
• Lighting on face vs lighting on scene — inconsistent specular on nose vs environment

Full synthetic imagery

• Anatomical errors — hands, ears, text in scene, jewelry symmetry (common in generative stills)
• Background logic — incoherent signage text, impossible reflections
• Metadata — absent camera EXIF; Software tags naming generative tools (when not stripped)
• Noise uniformity — synthetic images sometimes lack sensor noise model of claimed camera
• Semantic impossibilities — shadows inconsistent with multiple objects (overlap with visual tampering reference)

Audio and voice cloning

• Spectral flatness or metallic timbre in cloned speech
• Breath and mouth sounds missing or misaligned with video
• Background room tone discontinuities at splice points
• Phoneme timing — rushed consonants or uniform vowel length unnatural for speaker
• Route deepfake audio-only claims to specialist tools; note this skill does not certify voice identity

Multimodal LLM outputs

• When asset is chat-exported image from an LLM:
• Document provenance (prompt, model version, policy filters)
• Do not treat as camera capture; label synthetic by construction
• For documents mixing human and model text, use document integrity reference for revision markup
• AI red team skill applies to testing apps, not adjudicating a single disputed JPEG

Detection limitations

• No universal detector — scores vary by generator version and compression
• Adversarial recompression on social platforms degrades both real and fake signals
• Benign filters trigger many face-boundary heuristics
• P deepfakes in adult content contexts — handle under policy; avoid redistribution
• Scientific consensus — report suspicion tier, not “100% fake” without lab consensus

Escalation paths

Triage checklist

1. Classify synthetic type (swap, lip-sync, full gen, audio-only) 2. List observable indicators with timestamps for video 3. Note platform and generation count (re-uploads) 4. Assign confidence; default Low if only social-quality copy exists 5. Recommend original acquisition or lab analysis before irreversible actions

Visual media tampering indicators

Purpose

Provide workflow-level heuristics to flag possible image or video-frame manipulation. These are screening aids—not standalone proof.

Table of contents

1. Global consistency 2. Lighting and shadows 3. Edges, noise, and compression 4. Geometry and perspective 5. Duplicate-region and splicing 6. Video-specific cues 7. Common false positives 8. Tooling notes

Global consistency

• Color cast mismatch between subject and background (white balance not unified after composite)
• Resolution islands — sharper subject on softer background without depth-of-field justification
• Histogram discontinuities when examining regional stats (subject vs sky vs floor)
• Chromatic aberration present on one layer but absent on adjacent edges that should share an optical path

Lighting and shadows

• Shadow direction inconsistent across objects allegedly in the same scene
• Shadow hardness mismatch (hard flash on face, soft ambient shadow on ground)
• Specular highlights on eyes or metal that do not match stated light sources
• Missing contact shadows where objects appear to float above surfaces
• Night scenes with mixed artificial sources but uniform shadow angles

Edges, noise, and compression

• Halos or bright fringes around cutouts (especially hair and foliage)
• Noise pattern change at boundaries (sensor noise should be spatially correlated in one capture)
• JPEG block boundaries aligned differently across regions after double compression
• Over-sharpened subject on blurred background from selective filtering
• Inpainting smear — repetitive micro-texture in filled areas (sky, pavement)

Geometry and perspective

• Vanishing lines that do not converge for coplanar structures
• Scale errors — door height vs person height implausible
• Reflection mismatch in mirrors, glass, or water relative to scene geometry
• Lens distortion absent on background but present on foreground (or vice versa) in one alleged shot

Duplicate-region and splicing

• Clone-stamp patterns — repeated texture patches (clouds, grass, bricks)
• Seam lines visible at stitch boundaries in panoramas or manual composites
• Different JPEG quality on left vs right of a horizontal splice
• Cut-line jitter in video where frame-to-frame alignment shifts at a fixed row

Video-specific cues

• Temporal flicker at composite edges when compression varies frame to frame
• Inconsistent motion blur on moving objects vs static background
• Frame interpolation artifacts after slow-motion synthesis from few source frames
• Audio-visual mismatch — lip movement cadence vs phonemes (see synthetic media reference for depth)

Common false positives

Tooling notes

• ELA (error level analysis) — useful for JPEG double-save hints; not definitive; document tool settings
• Clone detection plugins — flag candidates for human review
• Hex / structure viewers — confirm container type vs claimed extension
• Avoid presenting heatmaps as court-ready proof without expert validation

Review checklist

1. Establish single-capture hypothesis vs composite hypothesis 2. List ≥3 independent visual observations before Medium+ confidence on tampering 3. Attempt benign alternative for each observation 4. Request original file or RAW if only screenshots exist 5. Record display conditions (HDR, OLED, browser scaling) that affect perception

Watermarks, provenance, and C2PA

Purpose

Explain how to interpret visible watermarks, embedded marks, and C2PA (Content Credentials) manifests during markup detection—not how to design cryptographic watermark schemes.

Table of contents

1. Visible and forensic watermarks 2. C2PA content credentials 3. Verification workflow 4. Publisher and platform claims 5. Limits and attacks 6. Routing to cryptographer specialist

Visible and forensic watermarks

• Record whether watermark is present, location, and whether cropped
• Distinguish platform overlay (TikTok handle) from creator watermark
• Absence of watermark does not prove authenticity

C2PA content credentials

C2PA embeds a signed manifest chain describing actions on content (capture, edit, publish).

Common manifest elements:

• Claim generator — software that produced the manifest
• Actions — c2pa.created, c2pa.edited, c2pa.placed, etc.
• Ingredients — parent assets when compositing
• Signature — credential bound to issuer (camera app, Adobe, etc.)

What strong verification implies

• Manifest signature validates against trusted roots configured in verifier
• Ingredient chain is internally consistent
• Timestamps align with other evidence (weak alone)

What it does not imply

• Moral truth of depicted events—only processing history attested by signer
• Impossibility of fake—attackers can strip manifests or attach fake ones if verifiers are naive

Verification workflow

1. Use a C2PA-aware viewer or CLI (project tooling evolves—cite tool name and version in report) 2. Capture manifest JSON or export for evidence annex 3. Record validation result: valid / invalid / absent / partial 4. Map issuer to expected publisher (news org camera app vs unknown generator) 5. If manifest says edited, list claimed edits; compare to user dispute 6. Cross-link visual and metadata references when manifest claims created but EXIF is empty

Publisher and platform claims

• Newsroom “original” badges — verify crypto where offered; otherwise organizational trust only
• Stock sites — license metadata ≠ capture provenance
• Social platforms — “labeled as altered” policies vary; screenshot labels are not C2PA
• Blockchain NFT pointers — do not prove image authenticity; route on-chain questions to blockint skills

Limits and attacks

Routing to cryptographer specialist

Route to cryptographer-specialist when the user needs:

• Design of watermarking, perceptual hashing at scale, or custom signing hierarchies
• Protocol review for content-auth APIs, key rotation, or cross-org trust fabrics
• Threat modeling of steganographic channels

This skill reads credentials; it does not architect them.