Architecture DecisionPublished on August 08, 20267 min read

MetaSift: why metadata sanitization should fail closed

Privacy, provenance and technical metadata are not the same thing. A safe tool needs to know what it can remove, what it must preserve and when it should refuse the operation.

  • Security
  • Metadata
  • Privacy
  • Python
  • View related project

    'Remove metadata' is deceptively simple. Location EXIF, ICC profiles, internal comments, generation prompts and Content Credentials belong to different categories and have different consequences when removed.

    MetaSift models sanitization as inspect → plan → sanitize → verify. Users can see intent before mutation, and the result must be verifiable before the final output is committed.

    The safety policy depends on four separations:

    • Privacy is not the same as provenance or authenticity
    • Technical metadata may be required for rendering and interoperability
    • Field-level removal is preferable to deleting entire metadata blocks without need
    • Formats that cannot be safely supported should be rejected instead of silently processed on a best-effort basis

    Fail-closed behavior matters because sanitization handles untrusted files and carries a strong user expectation: if the tool says something was removed, the resulting artifact should support that claim.

    That is why verification can use independent backends such as ExifTool and C2PA validation when available. The implementation that performs the mutation should not be the only evidence that its own mutation worked.

    MetaSift also avoids claiming that metadata cleanup makes AI-generated content indistinguishable from human-created content. Signal-level watermarks, external service records and content classifiers are different mechanisms.

    Should a privacy tool optimize for 'remove as much as possible' or 'remove only what it can explain and verify'?

    The second option is less dramatic but provides a stronger contract: preserve originals, express intent, bound mutation and verify output.

    For complex formats, refusing an operation is a security feature when the alternative is false confidence.

    Invariant

    If we cannot prove what was removed and what was preserved, should we produce the file at all?

    Sources and supporting references

    These are some of the works, studies and institutions used as conceptual support for the article's arguments.

    Keep the conversation going

    Want to take this conversation into a real project?

    If this reflection touches something relevant to your current moment, I can help turn context, vision and needs into a well-shaped project.

    More writing from the blog to expand the conversation between technology, process, market and real experience.