diff --git a/docs/synthid-detector-removal-plan.md b/docs/synthid-detector-removal-plan.md index ca22e6b..c945ac7 100644 --- a/docs/synthid-detector-removal-plan.md +++ b/docs/synthid-detector-removal-plan.md @@ -1424,6 +1424,167 @@ zero-control operating point retained a period-8 positive. The calibrated runtime therefore uses the top-candidate, period-bin, and high-band gates and makes no 0.5x detection claim. +### 2026-08-12: Registered color and phase-lock challenge + +A crop-specific research branch tested whether the recovered 16x16 carrier is +better represented in a perceptual color space or a shift-tolerant directional +transform. Every branch reused the direct RGB period-and-phase registration, +fitted on the first 30 positives, selected on the next 20 positives and 200 +controls, and reported the remaining 50 positives and 299 controls separately. +Only records whose recovered period was 15.5 through 16.5 were eligible. + +The frozen RGB template's channel norms were `0.887:1.000:0.930` for R:G:B, +including `0.903:1.000:0.916` above FFT radius 4.5. An SVD assigned 79.80% of +template energy to a nearly equal-channel component, 18.39% to a +green-vs-magenta component, and 1.81% to a red-vs-blue component. The common +component had strong diagonal energy, while 98.6% of the coarse +green-opponent orientation energy was axis-aligned. This measured carrier does +not support a fixed `0.85:1.00:0.70` channel rule or an exclusively diagonal +decoder. + +Nonlinear cube-root LMS coordinates from the OKLab transform exposed the +signal most strongly in the direct color-fold comparison, but the +development-selected full-vector candidate retained 32 of 50 final positives +and accepted six of 299 controls. This is evidence that nonlinear color +projections can improve carrier SNR, not evidence that the deployed embedder +uses Lab or OKLab internally. + +A three-level DTCWT probe retained all six orientations rather than only the +`+/-45` degree pair. Its development-selected near-vertical green energy +candidate retained 37 of 50 final positives and accepted eight controls. The +green-opponent near-vertical candidate retained 39 positives and accepted one +control. Separating energy, normalized complex correlation, and phase-only +coherence changed the development choice to all-orientation green-opponent +phase coherence, which retained 37 positives and accepted four controls. The +directional representation therefore exposes real carrier structure but fails +the low-false-positive gate. + +An explicit FFT probe then froze 8, 16, 32, or 64 carrier bins from the fit +positives and compared signed cosine phase coherence with the proposed +`abs(cos(delta_phase)) > 0.90` rule. The absolute rule never produced a usable +operating point; treating phase and antiphase as equivalent increased the null +overlap. With 64 bins, the development-selected green-channel signed cosine +retained 26 of 50 final positives and initially accepted none of 299 controls. +That result was underpowered because only 39 of 499 controls selected the +eligible period-16 branch. + +The green phase candidate and its threshold were frozen before a full +period-and-phase search over 1,000 COCO controls. It accepted five controls. +Among the 129 eligible controls, the maximum score was `0.6910271977636098`, +above the frozen `0.5443545641095117` threshold. Raising the threshold above +that maximum retained only eight of 100 positives. Explicit registered phase +lock is therefore a useful diagnostic of this carrier family but is rejected +as a standalone detector. Because it shares the RGB registration stage, it is +also not independent confirmation of the carrier. + +### 2026-08-12: Green phase perturbation and blind SWT removal + +A second removal probe tested the specific claim that changing only phase at +the recovered Green-channel carrier bins can preserve spectral magnitude and +image fidelity while defeating detection. It used the 100-image public Gemini +set at native period 16 and modified conjugate FFT pairs together so the +inverse remained real. Before pixel quantization, the maximum absolute change +in FFT magnitude was `5.24e-10` for the 32-pair inversion. After clipping and +rounding to 8-bit pixels, the maximum magnitude change relative to the largest +source coefficient was 0.175%. + +The native periodic detector accepted 59 of the 100 sources. Inverting the 32 +strongest unique Green-channel carrier pairs left one of those 59 positive. +Across all 100 images, PSNR was at least 43.36 dB and SSIM at least 0.99048; +the medians were 52.79 dB and 0.99739. Median signed phase coherence moved from +0.485 to -0.371 and the median full RGB tile score moved from 0.230 to 0.041. +This reproduces the proposed fidelity and local-score effect against the +recovered periodic detector. + +It does not establish SynthID removal. The current test targets the same +carrier used by the local score, and earlier wider complex-spectrum and +phase-projection candidates already cleared local phase models at 51.94-56.03 +dB while remaining detected in healthy Google verifier sessions. The 32-pair +Green candidate is therefore a preregistered oracle candidate, not a remover. +The official SynthID-Image description also identifies a post-hoc neural, +content-dependent encoder-decoder rather than a fixed Fourier codebook; it +does not document phase bins as its decision surface. + +The preregistered Google-oracle challenge then used three of the strongest +local positives. Each fixed group contained the original, its 32-pair Green +phase inversion, and an RMS-matched random-noise sham. All three phase +candidates fell below the local `0.17357069773071196` threshold, with PSNR +from 55.41 to 57.86 dB and SSIM from 0.99709 to 0.99807. The three shams +remained locally positive. Nine files were submitted to Gemini's `Verify with +SynthID` tool in separate chats with the unchanged prompt. Eight verdicts +persisted and all eight reported Google AI signals. This includes all three +phase candidates, both recoverable source controls, and all three shams. The +second source request was submitted, but its chat did not persist and no +verdict could be recovered; it was not retried outside the fixed upload budget. + +This falsifies the operative removal claim: Green-carrier phase inversion +clears the local periodic correlate on three of three images but clears the +Google oracle on zero of three. It is evidence that the local template observes +one stable component or correlate of SynthID, not that these FFT coefficients +form the proprietary decoder's sufficient decision surface. Do not productize +the Green phase inversion or report its local score change as SynthID removal. + +The three oracle-confirmed phase candidates were then treated as adversarial +hard positives for detector analysis, without using them to relax the existing +runtime thresholds. Both runtime modes missed all three. Their native scores +were 0.126-0.160 against the 0.174 threshold; their registered decision scores +were 0, 0, and 0.553 against the threshold of 1. A phase-invariant magnitude +profile was therefore tested as a possible rescue. The development-selected +all-bin RGB profile retained 39 of 50 final positives but accepted one of 299 +final Open Images controls and still missed all three hard positives. + +A frozen-template, top-32 Blue-magnitude profile did accept all three hard +positives and initially accepted none of 499 Open Images controls, but this was +a post-hoc hard-positive-selected branch with low ordinary sensitivity: 17 of +70 development and final positives. Its frozen threshold accepted 39 of 1,000 +fresh COCO controls. Combining it with a native-score floor of 0.10 happened to +accept none of all 3,000 COCO controls while retaining the three hard positives, +but failed the next independent challenge: 90 of 11,506 metadata-labeled +non-Google controls passed both gates. Accepted controls included Adobe +Firefly, local diffusion, Samsung, Microsoft, and several other generator +families. The phase-invariant magnitude rescue is therefore rejected as a +provider-specific detector; it measures a shared periodic rendering family. + +Channel separation exposed a narrower attack-specific rescue. The Green-only +phase inversion leaves Red and Blue pixels unchanged, but the runtime RGB score +normalizes all three channels jointly. On the three oracle-confirmed hard +positives, separate signed correlations remained 0.781-0.804 in Red and +0.798-0.825 in Blue while Green moved to -0.400 through -0.645. A Red threshold +of `0.3770237083693908`, frozen above 200 Open Images calibration controls, +retained 16 of 70 development and final ordinary positives and accepted none +of the remaining 299 Open Images controls. It also accepted all three oracle +hard positives and none of 3,000 fresh COCO controls. + +Red correlation alone remained a generic periodic-renderer correlate: it +accepted 96 of 11,506 metadata-labeled non-Google controls. Every one of those +96 had positive Green correlation. The attack-specific conjunction of Red at +or above the frozen threshold and negative Green accepted none of 15,005 total +controls across three independent corpora, while retaining all three +oracle-confirmed phase candidates. Across the 100-image synthetic inversion +probe, it recovered 19 of the 58 locally detected sources that the attack had +moved below the RGB threshold. One additional attacked image still passed the +existing detector. + +This channel-discordance rule is the first zero-control rescue for the +oracle-confirmed hard positives, but it is not added to runtime. Its form was +motivated after inspecting the attack, only three examples carry external +oracle labels, and its synthetic rescue sensitivity is 19 of 58. A valid next +gate must preregister this unchanged rule, obtain new oracle-confirmed +Green-perturbed positives, and challenge a newly collected control set plus +resize, crop, and codec views. Until then it is an attack diagnostic, not a +universal SynthID detector. + +A blind three-level `db2` SWT probe then soft-thresholded only the Green +horizontal, vertical, or diagonal detail bands at 0.25, 0.5, 1, and 2 times the +band's robust noise estimate. Diagonal HH thresholding left all 59 original +positives detected at every strength. Vertical thresholding cleared four at +strength 1 and five at strength 2, but the respective minimum fidelity fell to +32.57 dB and 0.96971 SSIM, then 28.52 dB and 0.93646. At strength 1, vertical +score reduction exceeded diagonal reduction on 97 of 100 paired images +(`p = 2.63e-25`, exact two-sided sign test). Blind HH soft-thresholding is +therefore rejected; the stronger vertical response is consistent with the +separately measured axis-aligned green-opponent carrier component. + ### 2026-08-10: OpenAI periodic-carrier challenge The OpenAI track repeated the Google carrier method without runtime provenance diff --git a/docs/synthid.md b/docs/synthid.md index 4974e1d..33fdf57 100644 --- a/docs/synthid.md +++ b/docs/synthid.md @@ -507,6 +507,47 @@ scale registration is explicit and `identify` keeps the native detector. The registered mode does not reliably detect 0.5x carriers and does not make the detector universal across crop, codecs, carrier epochs, or providers. +A crop-specific follow-up tested cube-root LMS and OKLab projections, all six +DTCWT orientations, and explicit FFT phase-lock metrics after period-and-phase +registration. Each representation exposed additional positive signal, but its +development-selected candidate failed a fresh control challenge. The strongest +registered green-channel phase candidate accepted five of 1,000 COCO controls; +a threshold above their maximum retained only eight of 100 positives. These +features remain research diagnostics and are not part of the runtime detector. +See the +[`Registered color and phase-lock challenge`](synthid-detector-removal-plan.md#2026-08-12-registered-color-and-phase-lock-challenge). + +Green-channel inversion of the 32 strongest conjugate carrier pairs then +cleared 58 of 59 locally detected public positives while preserving at least +43.36 dB PSNR and 0.99048 SSIM. This demonstrates precise control over the +local periodic correlate, not the proprietary decoder. A fixed Google-oracle +challenge made that distinction explicit: all three phase candidates cleared +the local threshold at 55.41-57.86 dB PSNR, while Gemini still reported Google +AI signals for all three. The recoverable source controls and RMS-matched shams +were also positive. One of nine submitted chats did not persist, but every +phase candidate produced a verdict. Blind Green-channel SWT-HH thresholding +cleared none of the 59 local positives. See the +[`Green phase perturbation and blind SWT removal`](synthid-detector-removal-plan.md#2026-08-12-green-phase-perturbation-and-blind-swt-removal) +challenge. + +Those three oracle-confirmed phase candidates are now adversarial hard +positives: both the native and registered runtime modes miss all three. A +phase-invariant Blue-carrier magnitude rescue recovered all three and happened +to reject 3,000 COCO controls when combined with a native-score floor, but it +then accepted 90 of 11,506 metadata-labeled non-Google controls. The branch is +therefore a shared generator or renderer correlate, not a SynthID-specific +rescue, and is not included in runtime. + +Separating signed channel correlations produced a more specific research +candidate. The three oracle-confirmed Green-phase hard positives retained Red +correlations of 0.781-0.804 while their Green correlations became negative. A +frozen `Red >= 0.377 and Green < 0` conjunction accepted all three and none of +15,005 controls across three independent corpora. It recovered 19 of +58 synthetic Green inversions that cleared the native detector. This remains +research-only because the rule was motivated after inspecting the attack, +only three recovered images have external oracle labels, and no untouched +control corpus remains for a final challenge. + A positive result identifies the carrier but does not attribute a provider. Provider identity still comes from provenance.