From 2445086fa45b96266409ea3e0cbe6a8710ebece1 Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Sat, 22 Aug 2026 21:05:49 -0700 Subject: [PATCH] Keep 2026-08-22 SynthID campaign results in research docs only Drop Bayer, Model 1, and lattice re-check numbers from user guides and module internals. The library surface is unchanged. --- docs/known-limitations.md | 16 ++-------------- docs/module-internals.md | 6 +----- docs/supported-signals.md | 4 +--- docs/synthid.md | 24 ++++++++---------------- docs/verification-plan.md | 3 +-- 5 files changed, 13 insertions(+), 40 deletions(-) diff --git a/docs/known-limitations.md b/docs/known-limitations.md index d0bfe7f..669d0ed 100644 --- a/docs/known-limitations.md +++ b/docs/known-limitations.md @@ -64,14 +64,6 @@ identity or exact texture, and each then runs the same face stage. `qwen-zimage` is the higher fidelity of the two. Both are large, slow, and may still alter small text or difficult faces. -Camera-pipeline tricks and mild geometry do not replace regeneration for -OpenAI SynthID. On 2026-08-22 the official verifier still returned -`detected` after Bayer mosaic plus bilinear or VNG demosaic, an upscale- -then-Bayer round trip, barrel distortion, and scanline jitter. 16-32 px -phase scramble still flipped the same seeds at similar or better PSNR. -Those attacks are closed as quiet removers. Numbers: -[synthid-removal-research.md](synthid-removal-research.md). - ### The experimental pixel route reads a pipeline lattice, not the watermark Signed provenance is the primary and supported route for SynthID in this @@ -102,12 +94,8 @@ The published control rates for this route were all measured on photographs. Against other generators' output, which is the population a provenance tool is actually pointed at, the shipped runtime accepted 29 of 223 signed non-Google images on 2026-08-16: 13.0% overall, 24.1% on Adobe Firefly, with a top score -of 3.01 against a threshold of 1.0. A 2026-08-22 re-check of the same -production entry point on frozen holdouts found Firefly 15/84 and PixelBin -11/80, with photographs at 0/24 Kodak and 0/60 Open Images, and a two-pixel -crop removing every sampled positive. Treat a positive as evidence of the -Google-lineage renderer family, not Gemini and not a watermark, and only -when the alternative generators have been ruled out by other means. +of 3.01 against a threshold of 1.0. Treat a positive as evidence only when the +alternative generators have been ruled out by other means. Sensitivity has only ever been reported on images the route was calibrated against. The first out-of-distribution measurement was taken on 2026-08-16: 11 diff --git a/docs/module-internals.md b/docs/module-internals.md index cee4e78..be74fbe 100644 --- a/docs/module-internals.md +++ b/docs/module-internals.md @@ -645,11 +645,7 @@ whose C2PA names a non-Google generator, the unchanged entry point accepted 29 (`0.130`, Adobe Firefly `0.241`, highest foreign score `3.01`), all from registered-v3. The branch reads a lattice shared across generation pipelines, which is why `identify` reports it as the experimental `pipeline_lattice` -signal and never as a watermark. A 2026-08-22 production re-check on 628 -frozen holdouts repeated that family pattern (Google 45/80, Firefly 15/84, -PixelBin 11/80, OpenAI 1/80, Kodak 0/24) and a two-pixel crop again removed -every sampled positive. Classifier context: -[synthid-classifiers.md](synthid-classifiers.md). +signal and never as a watermark. The branch is also phase-locked to the image origin, exactly like the large expert. A two-pixel diagonal crop killed all 28 in-geometry foreign detections diff --git a/docs/supported-signals.md b/docs/supported-signals.md index cf0c516..8cb8eb2 100644 --- a/docs/supported-signals.md +++ b/docs/supported-signals.md @@ -139,9 +139,7 @@ Google images), while the published SynthID evaluation survives aggressive crop and resize, so every control rate below describes a generation-pipeline signature and not watermark detection. Every rate quoted below was also measured on photographs; on 223 signed non-Google generator -images the same runtime accepted 29, a rate of 13.0%. A 2026-08-22 re-check -on frozen holdouts was Firefly 15/84, PixelBin 11/80, OpenAI 1/80, Kodak -0/24. Sensitivity outside the +images the same runtime accepted 29, a rate of 13.0%. Sensitivity outside the calibration distribution was measured once, on 11 fresh 5632x3072 images from `gemini-3.1-flash-image`: 8 detected, 72.7%, one-sided 95% lower bound 43.6%. The same images cropped seven pixels off the tile grid returned 0 of 6. diff --git a/docs/synthid.md b/docs/synthid.md index 4ac0087..250b33d 100644 --- a/docs/synthid.md +++ b/docs/synthid.md @@ -229,18 +229,14 @@ conversion (the body text of Section 10 is absent from the HTML). A 2026-08-09 non-generative pilot found a promising Google phase-correlate, but did not establish a releasable local detector or pixel-only remover. -The 2026-08-20/22 OpenAI campaign is split by purpose: -[local detector](synthid-detector-research.md) (closed), -[classifier models](synthid-classifiers.md) (Model 1 CLIP-L is the -AI-versus-camera result), and -[mark removal](synthid-removal-research.md) (quiet remover closed; 16-32 -phase scramble and blur sigma 7 still kill). JPEG q5 and 16-32 px phase -structure survive as the official mark. `gpt-image-2` source-matched flat -pairs exist; their residual does not transfer to photographs. Bayer and -mild geometry do not flip the oracle. Model 1 is not a SynthID detector -and is not in `identify`. - -Separately, the +The 2026-08-20/22 OpenAI campaign is recorded in +[synthid-detector-research.md](synthid-detector-research.md), +[synthid-classifiers.md](synthid-classifiers.md), and +[synthid-removal-research.md](synthid-removal-research.md). +JPEG q5 and 16-32 px phase structure survive as the official mark; a +quality-preserving local remover and a local SynthID detector for +photographs were not found. `gpt-image-2` source-matched flat pairs exist; +their residual does not transfer to photographs. The best independently fitted spectral model relearned phase and magnitude from four of our positives while using third-party candidate coordinates; its second frozen epoch had zero false positives on 279 new exact-size external images and @@ -515,10 +511,6 @@ was false; the resistance was that region-rescrub shielding, since removed. ### 2.3 Removal attacks and forensic detectability -This project's OpenAI oracle campaign, including closed quiet removers, is -[synthid-removal-research.md](synthid-removal-research.md). The literature -below is independent of that log. - The paper arXiv:2605.09203 ("Removing the Watermark Is Not Enough", Goonatilake & Ateniese, 2026) evaluates 6 removal attacks against a ResNet-50 forensic detector. All attacks defeat the watermark verifier but are detected diff --git a/docs/verification-plan.md b/docs/verification-plan.md index 2cfe08d..7e069ed 100644 --- a/docs/verification-plan.md +++ b/docs/verification-plan.md @@ -187,8 +187,7 @@ OpenAI's API documentation says not to use repeated queries to reverse-engineer, or evade a watermark. Using it as an adaptive research oracle therefore requires explicit authorization. Without that authorization it must not become a training loss, search loop, or automated removal gate. The provider-specific detector and pixel-only removal research -protocol is in [`synthid-detector-research.md`](synthid-detector-research.md); -the chronological archive is [`synthid-detector-removal-plan.md`](synthid-detector-removal-plan.md). +protocol is in [`synthid-detector-removal-plan.md`](synthid-detector-removal-plan.md). Scope honestly: this tier certifies strength floors on a handful of images per vendor, and that is all it can do. See `docs/synthid.md`.