Provenance and Transparency
Every image in the series Gesicht & Fiktion (Face & Fiction) is generated locally on my own computer. To keep it traceable how each image came into being, a tool I built myself documents every single file – automatically, completely, and without altering the original.
- The images are AI-generated. They are made with a local image model and my own LoRA, trained on photographs of my own face.
- The tool TIMO PROVENANCE is my own development. I used AI assistance while programming it.
- From me come the concept, image ideas, prompts, selection and context. The AI is a tool, not the author.
The process – locally on my own computer
No image is made in the cloud. Models, prompts and results stay on my own computer; generation runs offline.
- My own face as source material. The basis is a set of photographs of my face. From these I trained a LoRA – a small add-on file (
kreaneuer) that teaches a large image model what I look like, without changing the model itself. - The base model. I use Krea2 Turbo as the image model, Qwen3-VL-4B as the text encoder and Wan2.1 as the VAE. All models are compressed (GGUF, Q4_K_M) so they run on ordinary hardware.
- The software. Images are computed with
stable-diffusion.cpp, a lean open-source implementation, via the Vulkan interface on an AMD Radeon RX 6400 with 4 GB of video memory. A deliberately modest setup: no data centre, no subscription. - The prompt. Every image starts with a text I write myself – a scene, a light, a time, a visual language. The LoRA places my face into this fiction (strength 1.0).
- Generation. In 8 steps, an image of 768 × 768 pixels is created. The seed fixes the randomness: same seed, same parameters, same image.
- Selection and repetition. Many variants are made; only a few remain. Selecting, discarding and rewriting the prompts again and again is the actual artistic part of the work.
- Documentation. As soon as an image is saved, TIMO PROVENANCE automatically records all data from this process.
I have been working on this series since 2024, initially with other image models. The tool has changed; the question has not.
What is documented
| Work ID & title | unique identifier, e.g. GF-20261022-140029-3 |
| Creator & collection | Timo Schuster · Gesicht & Fiktion |
| Timestamp | creation time in UTC (ISO 8601) |
| Software | stable-diffusion.cpp (local, offline) |
| Model, text encoder, VAE | Krea2 Turbo · Qwen3-VL-4B · Wan2.1 VAE |
| LoRA | kreaneuer – my own training on my face |
| Parameters | seed, steps, guidance, CFG, sampler, resolution |
| Prompt | full prompt and negative prompt |
| Fingerprint | SHA-256 hash of the original file |
| Signature (optional) | C2PA manifest (Content Credentials) in a signed copy |
How it works
- A watcher monitors the image generator’s output folder. Every new PNG file is detected and processed exactly once.
- The embedded generation data is extracted and merged with work ID, title and timestamp.
- A SHA-256 hash of the original file is calculated and stored in
timoprovenance.json. - Optionally, a copy is signed according to the C2PA standard. The original remains unchanged.
- For the website, a readable provenance block and structured data (JSON-LD) are generated.
Why
Since 2024 I have been working with AI image models and my own face. The series asks what a portrait still testifies to when it no longer needs a camera. That is exactly why I want to disclose how each image was made: which model, which parameters, which prompt. The fiction lies in the image – not in its origin.
Verify it yourself
Each image lists two SHA-256 values. SHA-256 (published) is the fingerprint of the exact file you can download here – compare it yourself (Windows: certutil -hashfile file.png SHA256, macOS/Linux: shasum -a 256 file.png). SHA-256 (original) refers to the unmodified output of stable-diffusion.cpp before the C2PA manifest was embedded; that file stays in my archive. Signed copies can be checked with a C2PA-capable verification tool such as contentcredentials.org/verify.
Signing key
Since 25 October 2026, new images are signed with my own key. Earlier images (up to and including October 2026) were signed with the public test certificate that ships with c2patool: those signatures show that a file has not been altered since signing, but not who signed it.
My certificate is self-issued and therefore not on the official C2PA Trust List – verification tools will report it as “untrusted”. What counts is the fingerprint: if a signature’s certificate matches the values below, it was made with my key.
Signer certificate “Timo Schuster” (SHA-256):ef68f3ff2eb92850544bbd1a078d3bfa8e013170d653f6aff48d4e30c6376c8a
Root certificate “Timo Schuster Root CA” (SHA-256):fc5c27fb421bacdc5645ced29f5e852a272d1b34ce688bcf225a716424815c14
Valid until 24 October 2031.
TIMO PROVENANCE v6.1 · self-developed with AI assistance · as of October 2026
