From ee19173338ddefa6371df769cbce1b4fff0090e8 Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Mon, 7 Sep 2026 18:22:06 -0700 Subject: [PATCH] Record the ETI blur+JPEG protocol filter as a conditional follow-up The ETI scoring program applies median blur and JPEG before decoding, so an attack only wins if the watermark stays dead under ordinary handling. Our removal paths are structural, so no driving question exists today; the note records the hour-sized handling arm over removed-state artifacts as the follow-up if removal durability under platform re-encoding ever becomes a real question. Also records that participant attack code was never published. --- docs/external-benchmark-licensing.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/external-benchmark-licensing.md b/docs/external-benchmark-licensing.md index 213ef40..cdbd4d5 100644 --- a/docs/external-benchmark-licensing.md +++ b/docs/external-benchmark-licensing.md @@ -57,3 +57,15 @@ questions with pinned local evidence, and W-Bench would add its editing-profile attack axis (regeneration, image-to-video). The ETI profile stays closed until the organizers grant a license; nothing in this repository should download or derive from it meanwhile. + +One protocol detail is worth keeping as a candidate, not a commitment: the +ETI scoring program runs submissions through median blur and JPEG +compression before decoding, so an attack only wins if the watermark stays +dead under ordinary handling - that filter separates fragile +adversarial-perturbation removals from structural ones. Our removal paths +are structural (fill, regeneration), so no driving question exists today; +if removal durability under platform re-encoding ever becomes one, the +follow-up is an hour-sized handling arm over removed-state artifacts in the +existing cohorts. Participant attack code was never published (the release +carries attacked images and metrics only), so there is no implementation to +learn from even where reading would be lawful.