模型指纹与溯源Model Fingerprinting and Provenance

内容侧：生成时嵌入可检测信号。C2PA 的「内容凭证」不嵌内容本身，而是用签名元数据记录内容的出处与处理历史，官方把它比作内容的配料表。

统计侧：拿得到模型的概率输出时，可以检验文本是否落在该模型 log 概率的负曲率区域。DetectGPT 论文描述的正是这条路，并说明它不需要单独训练分类器、不需要收集真实与生成的对照语料、也不需要事先加水印。

两条路的前提不同：凭证要求生成方愿意签发，统计方法要求你能调用到那个模型取概率。只有一个文本文件时，两者都可能用不上。

行为侧探测（固定提问集、比较回答风格与拒答边界）能把范围缩小到「像哪一家/哪一代」，但它给的是概率性判断，不是身份证明。

模型自身的来源靠文档链：权重文件的哈希与签名、许可证、模型卡里写了什么训练数据。厂商不写的那部分，官方未说明，只能记为未知。

One route marks the content. C2PA Content Credentials do not alter the text or image itself; they attach signed metadata recording origin and editing history, which C2PA describes as a nutrition label for digital content.

Another route reads the statistics. Where you can obtain a model's probabilities, DetectGPT tests whether a passage sits in a negative-curvature region of that model's log-probability function. The paper notes this needs no separately trained classifier, no collected corpus of real and generated samples, and no prior watermarking.

The two routes have different preconditions. Credentials require the generator to have signed something; probability-based tests require you to query that very model. A plain text file with no metadata and no API access leaves neither option working.

Behavioural probing - a fixed question set compared for style and refusal boundaries - can narrow a result to "looks like this family or generation", but that is a probabilistic judgement, not proof of identity.

Provenance of the model itself rests on a document trail: weight hashes and signatures, licence, and whatever the model card states about training data. What vendors leave out is unstated officially and should be recorded as unknown.