open-standards/wai/extensions/reconstruction-binding.md

WAI Extension: Reproducible-Reconstruction Binding

Status: Draft. A cryptographic hard binding over the deterministically decoded pixels of a neural-coded asset — the reconstruct-side analogue of the Asset Provenance extension, and a bridge from WAI's byte-exact decode into C2PA / JPEG Trust provenance. Reference impl: the reconstruction_binding module of wai-rs (feature provenance). Keywords MUST, MUST NOT, SHOULD, MAY are RFC 2119/8174.

1. Scope and model

A provenance manifest binds itself to an asset with a hard binding: a cryptographic hash over the asset's bytes. For neural-coded media that hash covers the compressed codestream, and it has been the only hard option available — because a neural decode is normally not reproducible. Two conformant decoders may produce different pixels, so a hash of the decoded image is not portable across implementations, and provenance over the rendered result has had to fall back to fuzzy soft bindings (perceptual hashes, watermarks), which are approximate and spoofable.

This is not incidental to the codec. The JPEG AI standard (ISO/IEC 6048 / ITU-T T.840) defines its normative bit-exact conformance point at the output of the entropy decoder, not at reconstruction to pixels; and its multi-branch design specifies up to three synthesis transforms (decoderID 0/1/2), any of which produces a conformant reconstruction of the same codestream. Reconstruction to pixels is therefore, by design, not required to be bit-exact, and one codestream may legally decode to different images. A hash of the decoded pixels is not portable under the base standard.

WAI decodes to RGB deterministically — one pinned reconstruction, byte-identical on every machine (integer entropy and dequant; fixed-order, reproducible synthesis). Pinning one reconstruction is a determinism guarantee beyond what the base standard requires, and it restores exactly the precondition a hard binding needs: a stable, portable hash of the decoded pixels. This extension expresses that hash as a provenance assertion.

A reconstruction-binding is not a content capability. The asset declares an ordinary capability (wai.image.jpegai, wai.neural.int_hyper, …) and is carried and decoded normally; the binding is metadata about the decoded result, the way provenance is metadata about the carried bytes.

2. The binding

A binding is a hash plus the descriptor that makes the decode reproducible:

{
  "alg": "sha256",
  "hash": "<lowercase hex SHA-256 over the canonical decoded pixels>",
  "reconstruction": {
    "decoderId":  0,          // the pinned synthesis branch (multi-branch codecs)
    "profile":    "<id>",     // codec profile
    "level":      "<id>",     // codec level
    "width":      256,
    "height":     256,
    "format":     "RGB8",     // canonical: row-major, 3 bytes/pixel, no padding, no alpha
    "colorSpace": "bt709"
  }
}

• Hash algorithm — sha256 (the C2PA default; every C2PA validator supports it). MUST be an algorithm in the C2PA hash-algorithm registry.
• Canonical buffer — the hash is computed over the decoded image as a RGB8 buffer: row-major, three bytes per pixel, no row padding, no alpha, exactly width * height * 3 bytes. No other pre-processing.
• The descriptor is part of the binding. A multi-branch codec decodes one codestream several ways; a verifier MUST decode under exactly the descriptor's decoderId, profile, and level before hashing, or the comparison is meaningless. The descriptor pins the one reconstruction the hash is over.

Conformance criterion: decode-equivalence — a verifier that decodes the codestream with a WAI decoder under the binding's descriptor, hashes the canonical RGB8 buffer, and compares MUST obtain the recorded hash.

3. C2PA / JPEG Trust carriage

C2PA (and JPEG Trust, ISO/IEC 21617-1, which is built on the C2PA architecture) has no standard assertion that hashes decoded/rendered pixels — every standard hard binding (c2pa.hash.data, c2pa.hash.boxes, c2pa.hash.bmff) hashes the compressed bytes. A reproducible-reconstruction binding is therefore expressed as a custom assertion, using C2PA's reverse-domain labelling for third-party assertions:

• Assertion label: science.transaction.wai.hash.reconstruction
• Body: the object in §2, serialized as a CBOR map (the C2PA assertion serialization). Field names map 1:1 to the JSON above: alg (text), hash (byte string), and reconstruction (a map of decoderId (uint), profile/level/format/colorSpace (text), width/height (uint)).
• Placement: this assertion is additional. A manifest SHOULD still carry a standard hard binding (c2pa.hash.data over the codestream) referenced by the claim's created_assertions, so it is valid in any C2PA validator; the reconstruction binding sits beside it. The byte-binding proves these compressed bytes; the reconstruction binding upgrades that to and anyone who decodes them per this descriptor obtains this exact image.
• Signature: the assertion is covered by the C2PA claim signature like any other, so it is tamper-evident.

The digest is the same value WAI's own receipt carries (§4), so a validator with a WAI decoder reaches a matching hash whether it reads the C2PA CBOR assertion or the WAI receipt.

4. WAI receipt carriage

The binding MAY be carried in a WAI receipt alongside an asset provenance receipt: provenance binds the opaque asset bytes (content-hash-equivalence, BLAKE3 over the envelope); this binds the reconstructed pixels (decode-equivalence, SHA-256 over the canonical RGB). Together they cover both halves of the thesis — the bytes that are carried and the pixels that are reconstructed. The reference impl emits the §2 JSON via ReconstructionBinding::to_json.

5. Machine-readable AI-content marking

A reproducible-reconstruction binding is a substrate for machine-readable marking of AI-processed media. Where a regime requires content to be marked in a machine-readable, detectable format (for example EU AI Act Article 50, whose transparency obligations apply from 2 August 2026, with the technical marking standards developed via the Code of Practice), a signed assertion that binds the reconstructed content — carried through the neural coding step rather than invalidated by it — is a mechanism that survives decode. WAI states this as a capability (a signed, reproducible binding over decoded content); it does not make a legal claim, and any deployment MUST confirm sufficiency against the applicable regime.

6. Reference implementation

wai-rs, feature provenance, module reconstruction_binding: ReconstructionDescriptor, ReconstructionBinding::{bind, verify, hash_hex, to_json, C2PA_LABEL}. bind hashes the canonical RGB8 buffer under a descriptor; verify re-hashes a freshly decoded buffer and compares. The digest is a plain SHA-256, reproducible by any SHA-256 implementation — which is what makes it portable into a C2PA validator.