Seven fields, shared evidence
Synthetic Media
Examine the media object, its transformations, and the records behind it.
Read reference02AI Artifacts
Recover meaning from application state, storage, logs, and exports.
Read reference03Interaction Forensics
Reconstruct exchanges, context, revisions, and downstream actions.
Read reference04AI Agent Forensics
Follow delegated actions from task initiation to external effects.
Read reference05Model Forensics
Assess model lineage, configuration, identity claims, and integrity.
Read reference06Provenance
Verify recorded history, signed assertions, bindings, and trust.
Read reference07Synthetic Identity Forensics
Examine represented identities, account traces, and coordination.
Read reference- 01Media & identity
- 02Application & interaction
- 03Agent & model
- 04Provenance across all fields
How the fields overlap
A generated image can be a media object, an application attachment, the output of an interaction, and a node in a provenance chain. An agent action may involve a model configuration, an account identity, and external filesystem evidence. These relationships help decide where to collect and how to corroborate; they are not exclusive categories.
Evidence and method relationships
| Question | Start here | Then correlate |
|---|---|---|
| What changed in this media file? | Synthetic Media Forensics | Creation records and provenance |
| What did the application retain? | AI Artifact Forensics | Interaction and cloud state |
| How did this exchange develop? | Interaction Forensics | Uploads, tools, and downstream files |
| Which external action occurred? | Agent Forensics | System and network logs |
| Which model was deployed? | Model Forensics | Configuration and lineage |
| What origin claims can be verified? | Provenance Forensics | Signatures and independent records |
| What links a persona to an account? | Synthetic Identity Forensics | Media, access, and behavior |
Start with a bounded question
Use the evidence taxonomy to inventory sources, the methods reference to distinguish examination from interpretation, and the published SFIF to structure the workflow. The glossary defines shared terms without treating this project’s taxonomy as ownership of the field.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- NIST AI 100-4: Reducing Risks Posed by Synthetic Content
2024 overview of detection, watermarking, and content provenance approaches. Method performance requires context-specific evaluation.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
Canonical reference: https://syntheticforensics.org/fields/
Report a technical correction