NIST publishes AI 100-4 on reducing risks from synthetic content

NIST AI 100-4, titled Reducing Risks Posed by Synthetic Content An Overview of Technical Approaches to Digital Content Transparency, is a technical report on tools for authenticating and labeling AI-generated content, produced by the US AI Safety Institute housed within the National Institute of Standards and Technology.
It was published on November 20, 2024.

What it is

The report is subtitled An Overview of Technical Approaches to Digital Content Transparency and was approved by the NIST Editorial Review Board on 2024-11-18. It follows the definition of synthetic content set out in Executive Order 14110, describing it as information such as images, videos, audio clips, and text that has been significantly altered or generated by algorithms, including by AI. The US AI Safety Institute announced the release the same day, alongside the inaugural meeting of the International Network of AI Safety Institutes in San Francisco.

What it requires

Compliance with NIST AI 100-4 is voluntary, but it is expected to shape industry best practices for managing synthetic content risks. The report examines existing standards, tools, methods and practices for authenticating content and tracking provenance, labeling synthetic content through techniques such as watermarking, and detecting synthetic content. It also addresses preventing generative AI from producing child sexual abuse material or non-consensual intimate imagery of real individuals. Recommended technical mitigations include training data filtering, input and output filtering, hashing against known abuse-image databases, provenance data tracking, and red-teaming to find flaws in a controlled environment in collaboration with developers. The report also applies these concepts to the lifecycle stages of the NIST AI Risk Management Framework.

What security leaders should do

Security leaders can use the report's provenance and detection frameworks to evaluate vendor claims about watermarking or content authentication before relying on them for fraud or deepfake defense. Because NIST states that none of these techniques offer comprehensive solutions on their own, teams should combine layered technical controls with policy, training, and incident response planning rather than treating any single detection tool as sufficient. Given the report's note that synthetic images, voices, or video may be used to fool biometric authentication or facilitate fraudulent transactions, CISOs should reassess voice and video verification steps in high-value approval workflows.