com.originalpictures.pixelseal-video.1

Identity

Model checkpoints

Every file the runtime loads is pinned by SHA-256; a file with any other hash is refused.

Payload and error correction

The 51-bit identifier is carried five times with parity in the model's 256 bits. The identifier is an opaque record number issued by Original Pictures for one signed file. It carries no personal data and no content of the file, and on its own it means nothing outside Original Pictures' records.

Strength

Starts at 0.2 and steps up (0.2, 0.4, 0.6) only when the lighter mark does not survive the re-encode check. Per request, watermark_strength picks a slice of the same ladder: subtle 0.2; balanced 0.2, 0.4, 0.6; robust 0.2, 0.4, 0.6. No request can go above the qualified ladder.

How detection works

The detector reads the frames, combines the five copies and reports a detection only when they agree on at least 80% with a logit margin of at least 0.20. When embedding, a strength is accepted only if an H.264 CRF 23 re-encode of the marked video still returns the exact identifier at 97% raw bit accuracy. A detection is then looked up by exact equality among the recorded identifiers of the same algorithm, calibration and threshold, within the account that signed the file.

What a positive result means

A match means the file carries a watermark that leads to a record the signer's account made when it signed a file. It points to that file's C2PA manifest, which declares its origin. It is a probabilistic lead, not cryptographic proof: a watermark can be damaged by heavy edits or targeted attacks, and it says nothing about whether the content is true. The signed manifest, where it survives, is the proof.

False matches

On Original Pictures' 2026 benchmark (configuration PixelSeal@0.4), the production rule (key_match: a detection counts only when the decoded identifier exactly matches a recorded one) produced 0 false matches in 1,206 trials on unmarked media, a 95% upper bound of 2.48 × 10^-3 per check. Under the gating attack (h264_crf23) the identifier was read back at 99.9% bit accuracy. These are measurements on a fixed test set, not a guarantee for every file.

How to check a file

• Content Credentials. Any C2PA-aware validator can read and check the manifest of a file that still carries one, without calling Original Pictures.
• The watermark. Watermark recovery runs inside a verification: POST /v1/verifications on the Original Pictures API. When no manifest can be read, the verification searches the watermark and reports a single match as recovery-only (VALIDATION_RECOVERY_ONLY), never as cryptographic validity. Recovery searches only the bindings of the account that runs the verification. See lookup and recovery and watermarks.
• There is no public soft-binding resolution API. A third party can check a file on the signer's hosted verify page, if the signer publishes one; that page searches the signer's own watermarks only when the signer has switched recovery on (recover_own_assets). Otherwise, contact the signer or us.

Relation to C2PA

When a soft-binding algorithm has an identifier on the C2PA soft-binding algorithm list, the manifest can carry a c2pa.soft-binding assertion that names it in its alg field, and the watermark action is c2pa.watermarked.bound. Registration for com.originalpictures.pixelseal-video.1 has been requested with the C2PA soft binding algorithm list; no identifier has been assigned yet. Until one is, files watermarked with this algorithm record the action c2pa.watermarked.unbound and carry no watermark soft-binding assertion for it. This page is the entry's informational URL.

Status and contact

• Status: registration requested with the C2PA soft binding algorithm list.
• Contact: hello@originalpictures.com
• Last updated: 2026-11-08. The values on this page are generated from the production registry.
• All Original Pictures soft-binding algorithms