What is authenticity?

Authenticity, integrity, and confidentiality

In information security, authenticity is often discussed alongside neighboring concepts. They are easy to confuse, so here is the distinction.

• Authenticity: being genuine — who made it, whether the origin is verified, and that it is not an impersonation.
• Integrity: being unaltered — that the content has not changed since creation.
• Confidentiality: being visible only to those permitted.

Integrity guarantees that the contents have not changed, but on its own it does not guarantee that the thing came from a genuine origin in the first place. Authenticity is the broader concept: integrity plus verification of origin (provenance).

Authenticity, legibility, and preservation — the three requirements for Japanese e-records

In Japanese regulation, authenticity is defined as a concrete requirement. The Electronic Books Preservation Act^[1] and the Ministry of Health, Labour and Welfare's guidelines for medical information systems (electronic medical records)^[2] require three properties of electronic records: authenticity, legibility, and preservation.

• Authenticity: the record is genuine, any alteration or deletion is traceable, and the author's responsibility is clear.
• Legibility: it can be output in a readable form when needed.
• Preservation: it stays readable throughout the retention period.

Of these, authenticity is upheld through electronic signatures, timestamps, and management of operation history (provenance). Lemma's provenance proof fixes exactly this — who created which version, when, and whether it was altered — in a cryptographically verifiable form. See Regulatory Attribute Proof (Pillar 04).

Where authenticity is at stake (by domain)

Authenticity is a single word, but what it requires changes with each setting.

• Regulation & e-records: electronic books, electronic medical records, contracts, and audit trails. You need to be able to prove later that a record is a genuine, unaltered original. → Regulatory Attribute Proof (Pillar 04); for operational adoption, a data foundation for delegating work to AI safely. Related case: Wirecard's forged bank balance confirmations (No.021).
• Media & content: that a photo, video, or article is genuine and unedited since capture. The industry standard C2PA (Coalition for Content Provenance and Authenticity)^[3] and Content Credentials standardize the recording of origin and provenance. → Related cases: deepfakes generating real people (No.050/053/084).
• Finance & DeFi: that a transaction or cross-chain transfer is genuine and came from a legitimate origin. Without verifying the origin's provenance, unbacked issuance and illicit transfers follow directly. → Related case: a bridge infinite-mint (No.085).
• AI agents & AI output: that you can trace what an AI's referenced facts and generated output are backed by (their provenance). → Verifiable AI (Pillar 02).
• Supply chain & procurement: that parts, inspection records, and supplier qualifications are genuine and from a legitimate issuer. → Supply-chain ESG.

The domains differ, but the root is the same: can you independently verify where it came from, whose it is, and which version it is? That is the core of authenticity.

How to verify authenticity

The technologies that support authenticity divide into several layers.

• Electronic signatures: show that the author is who they claim and that nothing was altered after signing.
• Timestamps: fix when something existed.
• Hashes: check whether contents match.
• Provenance: record the chain of who created or edited what, when, and where. C2PA is the standard for attaching this provenance to content.
• Zero-knowledge proofs (ZK proofs): prove only that a condition is met, without disclosing the underlying data.

The key point is that detection and proof are different things. Detection — finding anomalies after the fact — is indispensable for grasping damage. But detection does not establish, before the fact, whether the data in hand is genuine and came from a legitimate origin. Finding an anomaly afterward does not stop a process that has already gone through. Authenticity is upheld only when there is a layer that independently verifies provenance before execution (see detection is not proof).

Meet authenticity with Lemma's provenance proof

Lemma proves provenance without handing over the data. The source data never goes to Lemma; what you receive is only a proof that the provenance is traceable.

• Cryptographically verified provenance: fixes who created which version, when, and whether it was altered, as a tamper-proof proof.
• Prove without exposing data: zero-knowledge proofs show only authenticity without disclosing the source data. Selective disclosure reveals only the attributes you need, minimally.
• Works alongside standards: designed to cooperate with C2PA, MCP, A2A, and x402. It does not replace content provenance standards — it layers verification on top of them.
• Model-independent: even when AI models change, the provenance proof remains.

For the design, see Verifiable Origin (Pillar 01) and Seal; for verifying AI output, see Verifiable AI (Pillar 02) and Trust402.

Frequently asked questions

What is the difference between authenticity and integrity?

Integrity guarantees that the content has not been altered. Authenticity adds to that whether the origin is genuine — who made it and that it is not an impersonation — a broader concept.

What does authenticity mean under e-record and medical-record rules?

That a record is genuine, that any alteration or deletion is traceable, and that the author's responsibility is clear. It is upheld through electronic signatures, timestamps, and operation history (provenance). In Japanese e-records it is one of three requirements: authenticity, legibility, and preservation.

How does C2PA relate to provenance proof?

C2PA is an industry standard for attaching provenance information to content. Lemma's provenance proof works alongside it, providing the layer that cryptographically verifies the attached provenance. It is complementary, not a replacement.

Can detection tools alone protect authenticity?

Detection finds anomalies after the fact and is indispensable for grasping damage. But it does not establish, before execution, whether something came from a genuine origin. Authenticity needs a layer that independently verifies provenance beforehand.