HGCP: A Voluntary Signing Framework for Human Expression in the Age of AI

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 1 October 2025.¶

Copyright Notice

Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶

Table of Contents

1. Introduction

In the rapidly evolving digital world, a flood of content from countless sources fills our screens—much of it now automatically generated, indistinguishable, and detached from genuine human intent. As artificial intelligence becomes increasingly proficient at mimicking human expression, the boundary between real thought and algorithmic generation is becoming ever more blurred. The rise of AI-generated content brings tremendous opportunity, but it also presents a critical question: if we can no longer identify who wrote something, how can we trust it?¶

The Human-Generated Content Protocol (HGCP) is proposed as a voluntary signing framework to address this issue. HGCP does not attempt to detect AI content through technical means; instead, it introduces a simple yet powerful idea: that a human author should be able to voluntarily declare, "This was written by me, and I take responsibility for it."¶

HGCP is not a detection algorithm or classification tool. It is a social and ethical trust mechanism. It provides a standardized signing format that enables any publisher—across any platform and identity type—to assert authorship in a verifiable and human-responsible manner. HGCP is platform-neutral, identity-flexible, and supports both anonymous and real-name authors who wish to make their human expression distinguishable and trustworthy.¶

HGCP is intentionally designed as a minimal core protocol—simple, declarative, and human-first. It does not attempt to encode all possible expression scenarios from the start. Instead, it offers a stable foundation that can evolve over time to support multi-signer declarations, partial claims, multimedia expressions, and richer trust semantics.¶

2. The Problem of Expression Trust

The internet was originally built to foster human connection and communication. Yet in a world where content creation, duplication, and distribution approach zero cost, the origin of information has become increasingly obscured. We once relied on domain names, writing style, and user profiles to infer trustworthiness—but now, all of these can be simulated or spoofed by AI.¶

We face a growing asymmetry: it is far easier to generate content than to verify its trust. This leads not only to an explosion of noise and manipulation but to a slow erosion of meaning itself. Readers hesitate to believe; authors hesitate to sign their work; platforms hesitate to take responsibility.¶

Many recent solutions have focused on "AI detection"—using machine learning classifiers to guess whether a given text was written by an AI. These tools are inherently probabilistic, easily evaded, and perpetually behind in the arms race of model advancement. The more essential question is not "Was this written by an AI?", but rather: "Is someone willing to take human responsibility for having said this?"¶

HGCP addresses this deeper layer: the level of expression responsibility. It introduces a new kind of signal—not derived from how content was generated, but from whether someone is willing to stand behind it. In doing so, trust becomes not a passive inference but an active, verifiable commitment.¶

3. The Philosophy of HGCP: Responsibility Over Provenance

The core idea of HGCP is not to verify originality, authorship, or human origin of content—but to offer a voluntary, structured mechanism for a person to take public responsibility for their expression.¶

Whereas most classification systems ask "Who wrote this?", HGCP invites a more meaningful question: "Are you willing to claim this expression as your own?"¶

Signing under HGCP does not imply that the content is accurate, high-quality, or original. It simply affirms: "I am a human being, and I am publicly acknowledging that I wrote this."¶

This makes HGCP signing a social gesture rather than a technical classification. It is not about improving detection precision, but about restoring the most basic principle of communication: to speak is to bear responsibility.¶

HGCP is not anti-AI. It does not forbid AI-assisted writing. Its purpose is not to exclude AI, but to identify human intent and responsibility. Even if a human uses AI to assist, as long as they willingly sign, they are taking responsibility as a human.¶

HGCP is an open framework. It does not restrict what tools you use; it only asks whether you are willing to sign. It does not judge your expertise; it only values your readiness to be held accountable. This voluntary human claim becomes the root signal of trust in HGCP.¶

4. Signature Declaration Structure

HGCP recommends that any author willing to assume responsibility for their expression include a standardized signature declaration when publishing content. The declaration should contain the following elements:¶

Required Fields:¶

signer_id: A pen name, public key fingerprint, platform username, or other verifiable identity reference (RFC 9580 [RFC9580] OpenPGP fingerprints recommended)¶

timestamp: A UTC timestamp indicating when the signature was made (preferably in [RFC3339] format)¶

content_hash: A cryptographic digest of the original text using a standard hash function (SHA-256 recommended, as defined in [RFC6234])¶

hgcp_version: A required version field to indicate which version of the HGCP signature structure is being used (e.g., "0.2"). This helps ensure future compatibility as the protocol evolves.¶

declaration: A clear statement of responsibility, e.g., "I affirm that the above content was written by me and I accept responsibility for it."¶

Optional Fields:¶

tools_used: If any tools (AI assistants, grammar correctors, translation engines) were involved, list them transparently¶

identity_type: e.g., real-name, anonymous, pseudonymous, organizational¶

revocability: Whether the signature can be withdrawn or the content edited. Suggested standard values include:
- immutable
- editable-until-locked
- time-limited-editable
- revocable-with-proof¶

id_format: e.g., "GitHub username", "PGP fingerprint", "platform alias"¶

Example Signature (Markdown):¶

Author: Tao Qiwen
Timestamp: 2025-03-29T14:22Z
HGCP Version: 0.2
ID Type: anonymous
Tools Used: ChatGPT + manual edits
Content Hash (SHA-256, base64): aGVsbG8sIHdvcmxk...
Revocability: editable-until-locked
Declaration: I confirm that the above content was published by me, and I take responsibility as a human author.¶

Example HGCP Signature (JSON, v0.1):¶

{ "signer_id": "qiwen2025", "id_type": "anonymous", "timestamp": "2025-03-29T14:22Z", "hgcp_version": "0.2", "content_hash": "a732c8dffe34aabbcc...", "tools_used": ["ChatGPT", "Notion AI"], "revocability": "editable-until-locked", "declaration": "I confirm that the above content was published by me, and I take responsibility as a human author." }¶

Optional (PGP Signature):¶

"gpg_signature": "-----BEGIN PGP SIGNATURE-----\n...\n-----END PGP SIGNATURE-----"¶

HGCP signatures are versioned to ensure clarity, compatibility, and future evolution. The hgcp_version field in the signature block indicates which structure is used.¶

• v0.1: Basic HGCP signature, including signer ID, timestamp, content hash, and a declaration. Suitable for human-readable contexts (e.g., Markdown).¶

• v0.2: Adds optional cryptographic signing (e.g., PGP) for enhanced verification. Fully backward-compatible with v0.1.¶

"hgcp_version": "0.2"¶

The version number refers to the signature structure specification, not the tool version or software implementation. Future versions may include DID bindings, cross-platform trust references, or encrypted metadata.¶

5. Identity Types and Trust Levels

HGCP does not require real-name identification, but encourages the use of consistent and interpretable identity labels. Each identity_type is associated with a general trust signal, though long-term behavior and signing consistency are more important than any single declaration.¶

Identity Types and Suggested Trust Levels

¶

 

human
A human author who signs and takes responsibility.
Trust Level: High¶

human+ai
A human-led expression with AI assistance.
Trust Level: Medium-High¶

organization
A collective statement signed on behalf of an entity.
Trust Level: Medium¶

anonymous
An identity with no disclosed name but consistent signing history.
Trust Level: Medium¶

ai
Clearly labeled as AI-generated, signature for transparency only.
Trust Level: Low¶

Even anonymous users may build trust over time through persistent and verifiable signing behavior. Platforms may choose to highlight signer identity history to assist readers in evaluating context.¶

6. Platform and Tool Integration Suggestions

HGCP is platform-neutral and decentralized, but content platforms, publishing tools, and browser extensions are encouraged to integrate HGCP through the following actions:¶

For content platforms:¶

Provide HGCP signing support (e.g., auto-generate timestamp, content hash, signature block)¶

Visibly display signature declarations and identity type¶

Offer exportable signature metadata (e.g., JSON-LD)¶

Provide "verify signature" buttons for end users¶

Allow flagging or auditing of forged or misleading signatures¶

For authoring tools:¶

Markdown/word editors can embed HGCP plugins for local signing¶

AI-assisted writing apps should encourage users to optionally sign with responsibility¶

Publishing interfaces should invite voluntary HGCP signing at submission time¶

For reader tools and plugins:¶

Browser extensions can detect and visually mark HGCP-signed content¶

Enable readers to view signer reputation, signature validity, and signing history¶

7. Social and Ethical Considerations

HGCP is not a replacement for content governance, but a voluntary signal system designed to restore visibility to human-authored expressions in an increasingly hybrid content landscape.¶

HGCP does NOT:¶

Detect AI content or act as an AI classifier¶

Track real identities or force doxxing¶

Judge truth, originality, or value of signed content¶

Restrict unsigned content from being published¶

HGCP DOES protect:¶

Anonymous authors’ right to claim authorship¶

Signers’ right to choose their identity level¶

The right to revoke, edit, or update signed content¶

Each platform’s autonomy in adapting or extending HGCP support¶

HGCP offers a decentralized path to expression accountability—not by censorship, but by providing those who want to be recognized and trusted the ability to do so.¶

8. Example Use Cases

HGCP is platform-neutral and supports a wide spectrum of content styles and identities. Each use case involves a signer voluntarily declaring both their identity context and expression responsibility.¶

9. Criticisms and Responses

As a voluntary protocol, HGCP is not without its skeptics. Below are common concerns and clarifications to address them:¶

10. Scope and Limits of Human Responsibility

HGCP affirms an ethical gesture of responsibility, but it is not a legal instrument. Signing indicates that the author:¶

• Is human (or self-identifies as such),¶

• Chooses to claim the expression,¶

• Accepts the social consequences of that claim.¶

However, the scope of “responsibility” should be clearly understood:¶

• HGCP does not confer legal liability unless enforced by separate legal agreements or jurisdictions.¶

• HGCP does not guarantee truth, originality, or moral correctness.¶

• HGCP does allow for revocation, and platforms may record and display revocation histories transparently.¶

Over time, frequent revocations or inconsistency in signing behavior may reduce the perceived trustworthiness of a signer. Platforms and readers are encouraged to interpret such patterns thoughtfully.¶

HGCP serves as a signal, not a sentence. It is a flag of presence—not proof of virtue.¶

11. Why We Need HGCP Now

In an era where synthetic content floods our screens and truth feels elusive, what we are losing is not just facts—but responsibility.¶

Expression has never merely been about information. It is about standing behind what one says.¶

HGCP is a quiet signal. It is not a firewall or detection tool, but a torch, held by those willing to say:¶

"This is what I said. And I am willing to be remembered for it."¶

Those who sign are not necessarily perfect, but they are present. They are not hiding. They are accountable.¶

HGCP does not aim to stop AI, nor does it attempt to verify the origin or value of content. Instead, it offers a decentralized and consistent way for humans to voluntarily claim authorship and responsibility.¶

Just as HTTPS creates trust in communication, HGCP creates trust in expression—not by policing the source, but by making visible those who choose to stand behind their words.¶

In an age of artificial voice, those who remain human by choice will be trusted first.¶

12. Future Extensions and Evolving Use Cases

HGCP is deliberately minimal by design. Its current version focuses on text-based, single-signer declarations of human responsibility. However, real-world content and trust environments are far more diverse. Future protocol versions may support:¶

• Multi-signer declarations (e.g., co-authorship, joint statements)¶

• Partial responsibility claims (e.g., hybrid AI + human paragraph-level tags)¶

• Multimedia content hashes (e.g., audio, image, or video signatures)¶

• Publisher-declared AI content without human responsibility¶

• Role-based identity claims (e.g., editor, translator, commentator)¶

• Richer metadata for curatorial or interpretive context¶

HGCP will evolve cautiously. Its core principle remains: responsibility, voluntarily claimed, should be visible and interpretable. Extensions should enhance this clarity—not dilute it.¶

13. IANA Considerations

This document has no IANA actions.¶

14. Security Considerations

HGCP does not introduce new network protocols or data exchange layers, and thus does not pose direct technical threats such as injection, eavesdropping, or man-in-the-middle attacks. However, it introduces indirect risks rooted in the potential misuse, manipulation, or misunderstanding of signature claims. These risks are primarily social and structural in nature, rather than cryptographic.¶

Key risks include:¶

Identity Impersonation and Signature Forgery¶

In the absence of strong cryptographic validation (e.g., OpenPGP signatures), it is possible for malicious actors to forge HGCP-style declarations using arbitrary signer IDs. Platforms should support optional cryptographic signing or verified identity bindings (e.g., platform-verified accounts) to mitigate impersonation and provide trustworthy signature attribution.¶

Mass Signature Automation (Sybil Attacks)¶

Without rate limits or identity constraints, attackers could mass-generate AI content paired with fabricated signature blocks to simulate trustworthiness at scale. This undermines the value of human-authored declarations. To address this, platforms may implement frequency controls, account reputation checks, or trust graphs to detect and contain such behavior.¶

Content Hash Evasion through Minimal Edits¶

HGCP relies on cryptographic content hashes to bind declarations to content. Yet even trivial edits (e.g., changing a space or emoji) produce a different hash, potentially allowing near-identical but unsigned derivatives to circulate unchallenged. Platforms are encouraged to store content snapshots alongside signatures, or explore fuzzy hashing techniques to detect close variants of signed material.¶

Revocation Abuse and Responsibility Avoidance¶

HGCP supports revocable or editable signature declarations, which can enhance flexibility—but also invite strategic denial or erasure of public statements. To preserve accountability, platforms should retain and display signature histories, including revocation timestamps, and clearly indicate whether a signed expression has been withdrawn or altered post-publication.¶

Lack of Native Trust Scoring or Validation Layer¶

HGCP intentionally avoids enforcing a centralized trust model. While this encourages openness, it also requires platforms and communities to build supplementary mechanisms for evaluating signer credibility, such as reputation systems, signature consistency tracking, or peer endorsement. Transparency in how these trust layers are constructed is essential to avoid unintended bias or exclusion.¶

Ultimately, HGCP’s effectiveness hinges not on cryptographic certainty, but on the visible willingness of authors to claim responsibility and the surrounding ecosystem’s support for interpretation, verification, and dispute resolution. It is a voluntary, human-centered protocol—its security lies in participation, not enforcement.¶

15. Informative References

[RFC3339]

Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, <https://www.rfc-editor.org/rfc/rfc3339>.

[RFC6234]

Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)", RFC 6234, DOI 10.17487/RFC6234, May 2011, <https://www.rfc-editor.org/rfc/rfc6234>.

[RFC9580]

Wouters, P., Ed., Huigens, D., Winter, J., and Y. Niibe, "OpenPGP", RFC 9580, DOI 10.17487/RFC9580, July 2024, <https://www.rfc-editor.org/rfc/rfc9580>.

Acknowledgments

This document was initially drafted using ChatGPT (OpenAI), and subsequently edited and approved by the human signer. The signer acknowledges responsibility for the final content.¶

Author's Address