# Adversarial Provenance **Domain:** Provenance / Supply-Chain Security / Continuity **Doc Type:** Threat Node **Classification:** Evidence-Chain Attack **Maturity:** Developed **Related:** [[wiki/Continuity Provenance|Continuity Provenance]], [[wiki/Proof of Descent|Proof of Descent]], [[wiki/Forensic Identity Attestation|Forensic Identity Attestation]] --- ## Definition **Adversarial Provenance** is the deliberate forging, poisoning, truncation or selective curation of lineage records so that a false continuity claim appears well supported or a valid claimant appears defective. ## Attack Surface - compromised capture devices or signing keys; - truthful hashes over manipulated source material; - omitted branches, redactions or custody intervals; - rollback to an older authorized state presented as current; - poisoned behavioral evidence designed to influence reconstruction; - trust-root capture and fraudulent revocation. ## Governing Rule Provenance must be evaluated as an adversarial system, not a decorative chain of hashes. Verification requires independent witnesses, key rotation history, transparency logs, anomaly detection, disclosure of gaps and the ability to challenge the trust root. A valid manifest proves only the propositions its trust model actually supports. ## Sources - [C2PA Technical Specification and Security Considerations](https://spec.c2pa.org/) - [SLSA — Supply-chain Levels for Software Artifacts](https://slsa.dev/spec/) ## See Also [[wiki/Continuity Fraud|Continuity Fraud]] · [[wiki/Root of Trust Succession|Root of Trust Succession]] · [[wiki/Restoration Integrity|Restoration Integrity]]