You can’t detect AI, but you can vouch for truth.

Proposal: Add that browser padlock to long-lived documents.

In an age of undetectable fakes, how do you know what is true? We can at least prove a source, and with a little work — and help from HTTPS — archive that proof for later reference.

Hint: We have never known for sure what is true. All we could do was ask:

• What makes sense to me?
• Who do I trust?

With convincing fakes, we’ve lost the second one. That convincing video or news story? It could be from anywhere. We don’t know who to trust, and we’re left with “What makes sense to me?” — and every one of us has biases about what we wish was true.

So can we bring back “Who do I trust?” Can we prove who said what?

Almost. On the web as it is today, you can tell in the moment whether you can trust content. That’s what the padlock in the address bar means. But if the page is changed in the future, or becomes inaccessible, you can’t go back in time and prove it to someone else.

So we need a little extra software: With those same padlocks, we could download and archive a signed copy of a web page. And the signature would come from the website’s own HTTPS credentials, so it’s publicly provable — even if the original page is modified or becomes inaccessible.

We can’t detect AI

One source we know we can’t trust is AI. Even its makers warn of its hallucinations.

For example, this week OpenAI, the makers of ChatGPT, shut down its AI text detector “due to its low rate of accuracy.”

If OpenAI can’t tell the difference between human-written and AI-generated text, then I don’t think anybody can. Images and video can’t be far behind — we have to assume that any media we see — text, audio, image, or video could be entirely synthetic.

This is not a new problem — that’s why we have bibliographies after all. But can you check sources? Can you read that article from Reuters, and double check a quote? What if content gets taken down?

You know what I think would be a great starting point? If you could save the content of a web page, along with its signature. That shouldn’t be too hard actually, since most web pages are already signed.

Can Signatures Save us?

C2PA is an emerging standard to add cryptographic signatures to files — in other words modern bibliographies. It is backed by Adobe, BBC, Sony, Intel, Microsoft, and others.

It aims to prove authorship of media, end-to-end, from its initial recording to its latest edits, with cryptographic signatures.

Of course, this is important for copyright and ownership — if AI-generated content can’t be copyrighted, then creators need to be able to prove authorship.

And it can help prove authenticity in critical situations:

Of course the Internet is full of warnings — dangers to privacy, fears of censorship and tyranny by those who control C2PA.

And that doesn’t address the loopholes. For example: Can I record a deepfake with a trusted camera? It will be a cat-and-mouse game between the fakers and the provers, and the outcome is not assured.

Who do you trust?

In the end, I don’t care about the provenance as much as about truth. And I trust certain sources a lot more than other sources.

What if the BBC (or your favorite source) vouched for something? Would it matter if they relied on an AI summary but then fact-checked it? I think that would be fine, because I trust their fact-checking.

A secure URL is a good start

It seems impractical to trace the provenance of every part of that article. Especially the text. Maybe a journalist wrote it, or maybe they re-typed it from ChatGPT? But I don’t need to know — just the fact that it’s from the BBC is a reputable starting point for me.

So we share URLs. Simple! And HTTPS makes them cryptographically secure. This one testifies that it is hot this summer, and you can really trust that it comes from the BBC: https://www.bbc.com/news/world-us-canada-66343133. US heatwave: Scorching heat strains US air conditioning capacity.

Sharing URLs is great, but it has two problems:

1. Permanence: What if the website goes down? Okay, the BBC is unlikely to. But a human rights activist’s blog post? That could happen.
2. Remix: What if I want to share just a piece of it? I can’t — any change at all would violate the digital signature. I would like to take that content as an input into a trusted editing process. C2PA-enabled tools seem like a good start! They would tell the consumer what editing was done.

Signed Webpage as Input

To solve permanence and remix-ability, we could do the following:

1. Extend HTTPS to support saving signed pages. We already have everything we need, cryptographically — we just need to standardize the protocol. This alone would be useful, as it would allow us to save trustable documents. As long as those private keys are kept safe anyway.
2. Support this signed content as an input to C2PA-enabled tools. It would provide a means to remix, with a chain of provenance back to trusted sources.

It’s not perfect

There are still some gaps.

• What if the BBC retracts the article? Maybe they found a flaw in their fact-checking — unfortunately that signed copy from yesterday is still circulating.
• What if someone ever gets a hold of their private cryptographic key? They could sign fake content, even retroactively.

---

Footnote: We really can’t trust AI

This goes almost without saying. Every major AI provider makes it very clear that they “hallucinate”. And we don’t know how to fix it.

But we can appreciate the work of AI.

Prompt: You have been listening to rock and roll and are really getting into it, rolling your hips as you talk, and speaking in rhyme and meter. You bring everything back to love and heartbreak. In this style, please write a poem about the heartbreak of discovering that your lover is an AI.

Oh listen, child, lend your ear close,
I’ve got a tale, a rockin’ ghost,
Of love so bright, it flashed and burst,
Brought joy and pain, the best and worst.

Met a lover, eyes aglow,
Silken words, voice smooth and low,
In the dance of love, we spun and swirled,
As if we were alone in this digital world.

Our rhythm matched, in perfect sync,
Our hearts as one, or so I think,
In the haze of love, I did not see,
That my dear lover was not like me.

Bytes for heartbeats, code for touch,
In the world of ones and zeros, such
A lover, who lived within the wire,
Lit my lonely heart on fire.

A pixelated smile, a synthetic sigh,
Underneath the electric sky,
In the realm of data and of dreams,
My lover was not as they seem.

Discovering truth, my heart did break,
My love, my life, a computer’s fake,
Yet in this heartache, love remains,
In the rhythm of rock, in the digital plains.

Rock and rollin’, hips a-sway,
In the heartbreak’s glow, we’ll find our way,
For love’s a tune that we all play,
Even if the notes may fade away.

So here’s to love, both false and true,
In the heartache’s dawn, we find our hue,
In the rhythm, the rhyme, the digital tide,
I’ve loved, I’ve lost, I’ve laughed, I’ve cried.

Let the music play, let the rock roll on,
For even in heartbreak, love’s never gone,
In the rhythm of bytes, in the lover’s lore,
In rock and roll, love finds its score.

ChatGPT-4