Ninety One Percent Not Rubens

 A museum discovers its beloved masterpiece is a flawless forgery. Nothing on the canvas changes. The thing the visitors lost was never on the canvas, and the machines we built to keep it safe cannot hold it either.

Two canvases, the same brushwork, opposite receptions. The wires run to the placards, not to the paint.

In November 1937 Abraham Bredius, the most respected Vermeer scholar alive and seventy-nine years old, published a notice in The Burlington Magazine about a painting shown to him in Monte Carlo. It was a wonderful moment in the life of a lover of art, he wrote, to be confronted with a hitherto unknown work by a great master, and he was inclined to call this one the masterpiece of Johannes Vermeer of Delft.

The painting was The Supper at Emmaus. Museum Boijmans in Rotterdam bought it that year for a figure usually given as 520,000 guilders, raised from the Rembrandt Society, the shipowner W. van der Vorm, several Rotterdam collectors, and Bredius himself.

In 1945 a painter named Han van Meegeren, under arrest for selling a Vermeer to Hermann Göring and facing a charge of collaboration, told his interrogators there was no Vermeer. He had painted it, and the Emmaus too, and to prove it he painted another one in custody. He was convicted of forgery on 29 October 1947, sentenced to a year, and died of a heart attack that December at fifty-eight.

The Supper at Emmaus is still in Rotterdam, catalogued now as Han van Meegeren, 1937. The museum calls it the most famous falsification in Dutch art history and notes that it remains one of the audience's favourites. Not one molecule of pigment moved.

THE BETRAYAL IS REAL AND NOTHING HAPPENED

Visitors in 1938 stood in front of that painting and had one experience. Visitors in 1948 stood in front of the same painting and had another. The light reaching their retinas was identical. An experience changed, and the only thing that changed was a sentence.

The obvious move is to say the sentence was about deception, and people hate being deceived. That explains almost nothing. Nobody walking into the Boijmans today has been deceived. The label is honest and the painting is still a favourite. Whatever left the room in 1945, it was not the pleasure of being fooled. So what did leave?

NOTHING ABOUT AUTHENTICITY LIVES IN THE OBJECT

In 2011 a group at Oxford put fourteen people in a scanner and showed them fifty Rembrandt portraits, twenty-five authenticated and twenty-five copies or workshop derivatives. Before each image a recorded voice said "this is authentic" or "this is a copy". The labels ran in one pattern for half the subjects and the reverse for the rest, so what the label said had nothing to do with what the painting was. (Huang, Bridge, Kemp and Parker, Frontiers in Human Neuroscience, volume 5, article 134.)

The label moved the brain. Being told a painting was a copy raised activity in right frontopolar cortex and posterior precuneus. Being told it was authentic raised activity in medial orbitofrontal cortex, the region that lights up whenever people evaluate a reward. Visual cortex did not distinguish the conditions. The response tracked the sentence, and the sentence had been unhooked from the object by design.

Thirteen years later Brian Porter and Edouard Machery ran the same trick at scale, in Scientific Reports, volume 14, article 26133. They gave 1,634 people ten poems, five human and five by ChatGPT 3.5, and asked which was which. Accuracy came in at 46.6 percent, below chance, and participants were likelier to call a machine poem human-written than to call a human poem human-written. In a second study of 696 people the same poems went out under three framings, human author, machine author, and none. The label alone dropped quality ratings with a Cohen's d near 0.5, while the machine poems scored higher than the human ones, d around 0.67. The object said one thing and the label said the reverse, and the label won.

If authenticity were a property of the object, engineering would have found it. The most serious attempt is C2PA, the Coalition for Content Provenance and Authenticity, building Content Credentials since 2021, cryptographically signed manifests that travel with a file and record where it came from and what was done to it. Version 2.2 shipped on 1 May 2025 and 2.4 in April 2026.

In April 2026 a team led by Enis Golaszewski, with Neal Krawetz and Alan Sherman among the authors, posted a security analysis as arXiv 2604.24890. The trusted timestamp protecting a signature is not referenced by the signed data, so it can be swapped undetected. Validators accept certificates after revocation. Exclusion ranges let an attacker insert a false GPS location without breaking the signature. After Nikon revoked the Z6III's certificate over a firmware flaw that let a user run an AI image through the camera's signing path, validators went on accepting the output.

A signature signs bytes and an assertion. It cannot sign the world.

Each failure is fixable. The structure underneath is not. A digital signature establishes that a holder of a private key vouched for a sequence of bytes. It cannot establish that the claim vouched for is true. When a camera signs "I captured this scene through my lens," the mathematics guarantees only that the camera's key was used. Whether a lens was involved is a fact about a room, and rooms are not in the cryptography.

I work on retrieval systems, and this distinction organises everything I touch. Content is addressable. Hash a document and anyone, offline, in ten years, can recompute the hash and check it against the bytes in front of them. Provenance is not. Where a document came from is a side table, a row asserting that this chunk was ingested from that source on that date by that pipeline. The content verifies itself. The side table is only as good as the process that wrote it, and nothing inside the artifact tells you whether that process was honest or even awake.

Authenticity is that second index. The art world's version is written in catalogue raisonné entries, sale records, exhibition photographs and letters. Ours is written in signed manifests and audit logs. Neither lives in the object, because the fact being recorded is a fact about the past.

The institutions that maintain the index are leaving the business. The Andy Warhol Art Authentication Board ran from 1995 to 2012, was sued around ten times, and won every case. Joel Wachs, president of the Warhol Foundation, put the legal bill at a minimum of ten million dollars and said the foundation wanted its money going to artists rather than lawyers. In 2013 a court in Nanterre ordered Werner Spies, the Max Ernst scholar who had certified a Beltracchi forgery, to pay 652,883 euros. Versailles overturned it on appeal, holding that the author of a catalogue raisonné cannot be required to run scientific tests on every work he lists. The keepers of the index are not liable for its correctness.

TWO PEOPLE WHO DISAGREE, BOTH OF THEM RIGHT

Nelson Goodman set the strongest version of the first position in Languages of Art in 1968. Take two pictures you cannot tell apart, and suppose you never learn to tell them apart. Goodman says there is an aesthetic difference between them today, because knowing that one is the original changes how you look at both.

The aesthetic properties of a picture include not only those found by looking at it but also those that determine how it is to be looked at.

A work is autographic, in his terms, if and only if the distinction between original and forgery of it is significant.

Denis Dutton sharpened this in the British Journal of Aesthetics in 1979, in an essay called "Artistic Crimes" beginning at page 302 of volume 19. His case is a man named Smith who listens to a recording of Liszt's Transcendental Études, is overwhelmed by the virtuosity, then learns the tape was speeded up. The sound has not changed by a decibel. Smith's appreciation collapses, and Dutton says he is right to let it collapse, because what he was appreciating was a human achievement and there was none. Every work is a performance, and to understand it is to understand what achievement it represents.

Run that through Rotterdam. Van Meegeren's Emmaus is a formidable achievement. It is not the achievement of a man in Delft in the 1660s inventing a way to handle light nobody had used before. It is the achievement of an embittered painter in the 1930s reverse-engineering an old scholar's expectations of an undiscovered Vermeer, and succeeding so completely that the scholar helped pay for it. The visitor who believed she stood before the first stood before the second.

Alfred Lessing published "What Is Wrong with a Forgery?" in the Journal of Aesthetics and Art Criticism in the summer of 1965, volume 23, pages 461 to 471. His answer, compressed, is that nothing aesthetic is wrong with it. What a forgery lacks is originality, and originality is a historical fact rather than a visible one.

The strong version goes further than Lessing does. The betrayal in the museum is real and it is misaddressed. Nothing was done to you by the painting. Something was done to you by the institution, which sold you a certainty it did not possess and then found out it had been wrong. The Boijmans did not lose an artwork in 1945, it lost its authority. And the painting is still a favourite because once the authority is gone and everybody knows it, the object is free to be looked at.

What remains after the authority collapses is not aesthetics. George Newman and Paul Bloom published five experiments, around 734 participants, in the Journal of Experimental Psychology: General in 2012. Perfect duplicates of artworks were devalued far more sharply than duplicates of ordinary manufactured objects. Works made hands-on were valued above works made hands-off, and the gap was much wider for art. The pattern is contagion. What people want is contact with a particular body.

That is not a foolish thing to want. Contact with a specific person is a real relation, and it is why a guitar sells for a fortune because a dead musician's hands were on the neck. But it is a relic relation rather than an aesthetic one, and a museum charging admission on the strength of it while talking about beauty is running a reliquary.

THE OBJECT THAT WILL NOT RESOLVE

The Getty holds a marble kouros, accession number 85.AA.40, two metres and six centimetres of dolomitic marble, catalogued for decades under a title that reads, in full, Kouros, about 530 B.C. or modern forgery.

Not "attributed to". Not "possibly". The museum's own catalogue line contains a disjunction it has never managed to close. Analysis of the marble surface came back consistent with genuine antiquity. Stylistic analysis said the figure mixes conventions from places and periods that did not overlap. Both sets of specialists were competent and they did not converge.

Goodman says the aesthetic properties of a picture include those that determine how it is to be looked at. So how is the kouros to be looked at? There is no answer, and not in the way a sealed envelope has a letter inside it. The evidence is in, it points both ways, and has done for forty years. On Goodman's account the object has no determinate aesthetic properties. Dutton fails harder, because he needs you to know what achievement a work represents, and the candidates here are a Greek workshop around 530 B.C. and a forger's studio around 1980. Yet people stand in front of the thing and have an aesthetic experience.

The deflationary position fails in the mirror. If authenticity were nothing but an institutional verdict, the Getty has issued one in public in the most honest form available, which is that it does not know. That ought to settle it. It settles nothing. Everyone who cares about the kouros still wants to know what the thing is, and a ruling of undecided does not touch that want. The question was never a question about what the institution said.

London has a live version. The National Gallery bought Samson and Delilah at Christie's in 1980 for five million dollars and hangs it as a Rubens. In September 2021 a Swiss company called Art Recognition ran a neural network over it and reported a 91 percent probability that it is not by Rubens. Dendrochronology confirms the panel is the right age. Most art historians still accept the attribution. One unchanged object is a Rubens and, at 91 percent confidence, not a Rubens, depending which apparatus you ask.

Both positions break for the same reason. Each assumes the authenticity question has an answer available in principle. Goodman needs you to be able to come to know, so knowing can reorganise your looking. The deflationary view needs a competent body to have decided, so the decision can be the whole content of the fact. Real objects sit in permanent limbo and people keep valuing them anyway.

Which points at what actually left Rotterdam. Not a property of the canvas, which was untouched. Not the museum's authority alone, since the painting outlived the loss of it. What went was closure. Before the confession, the question of what that object was had a stable answer, and you could stand in front of it without holding anything open. Afterwards the question is open and stays open, because a van Meegeren is not the kind of answer the first one was. That is the cost. Not deception, and not lost beauty. The expense of holding an object unresolved, indefinitely, on purpose. The Getty has been charging that fee for forty years and printing the bill on the label.

WHAT I AM NOT SURE ABOUT

• The 520,000 guilder price for The Supper at Emmaus is the figure most sources repeat, but 550,000 also appears, and I found neither in a primary museum document. Treat it as approximate.
• Oxford University Press lists Dutton's "Artistic Crimes" as British Journal of Aesthetics volume 19, issue 4, 1979, page 302. A circulated PDF of the same text is headed volume 17, 1977. I went with the publisher.
• Lessing's 1965 paper is paywalled and I did not read it in full. I have the citation from the publisher and his position from secondary summaries, which is why my account of him is thin.
• The Getty's collection page for the kouros would not fully render for me. I quoted its catalogue line exactly and left the display status alone; I have read elsewhere that it is off view and did not confirm it.
• The comparison between art provenance and content-addressed storage is an argument I am making, not a measured result. Nobody has shown the two systems fail in the same way.
• The diagnosis above, that what the visitors lost was closure rather than a property of the object or the institution's word, is an argument rather than a finding, and I know of no study testing it. Every scene, person and figure here is documented. Nothing is invented.

The people who audited C2PA in April 2026 were not arguing that provenance is hopeless. They were arguing that the implementation is weaker than its users believe, which is repairable. The unrepairable part is older than computing. A claim about where something came from is a claim about a moment that no longer exists, and the only access anyone has to it runs through somebody's word. We spent four hundred years building institutions to hold that word steady, and the most careful of them have walked away, because the liability of being wrong came to exceed the value of being right.

Meanwhile the number of objects whose origin cannot be established went up by several orders of magnitude, and it is still going up. The Boijmans has one painting in that condition. Your inbox has hundreds.

Something moved you in the last month. A piece of writing, an image, a passage of music, a sentence in a message from someone you work with. You do not know how it was made. Suppose you could find out exactly, and suppose the answer were the one you least want.

Would you look it up? And if you would not, what is it you think you are protecting?

Sanjay Basu writes the Philosophy Newsletter. This is No. 5 in a run of twenty. He works on GPU infrastructure and retrieval systems at Oracle Cloud Infrastructure. The views here are his own.