Do AI provenance marks survive common image, video and audio pipelines?

The EU AI Act (Art. 50(2)), California's AI Transparency Act (SB 942 as amended by AB 853) and China's GB 45438-2025 require synthetic media to carry machine-readable marks. In practice these are: a C2PA manifest whose actions declare an IPTC digitalSourceType (trainedAlgorithmicMedia), the same IPTC term in XMP (Iptc4xmpExt:DigitalSourceType), and the Chinese TC260:AIGC XMP field.

We built a reproducible local lab: 23 synthetic fixtures (JPEG, PNG, WebP, MP4, M4A, WAV, MP3) signed with the c2patool test certificate, plus one public C2PA sample. We ran them through 41 transformations in Pillow, sharp/libvips (including an exact replica of the next/image optimizer), ImageMagick, ExifTool and ffmpeg, which gave 154 outputs and 474 output × mark observations.

No pixel or container rewrite kept an embedded C2PA manifest (0/124), including every "keep metadata" option we tested. Editing a single XMP field after signing left the manifest present but invalid (6/6). The two XMP marks always shared the same fate. They survived only when the pipeline explicitly kept XMP: never the default in sharp, next/image or Pillow, and the default in ImageMagick unless stripping. ffmpeg dropped every mark in every MP4/M4A/WAV/MP3 configuration tried. The only tested route to a valid credential on a derivative was re-signing after processing, with the original as an ingredient (4/4), and even then the AI declaration survived only inside the ingredient, not in the new active manifest. CDN, platform and legal behaviour is reported from literal documentation quotes, kept separate from what we measured.