feat: detect soft-binding vendors, IPTC 2025.1, video/audio C2PA, TrustMark (v0.6.0)

Broadens metadata provenance coverage at the detection and container-strip level. Detection: - C2PA soft-binding `alg` -> forensic-watermark vendor (Adobe TrustMark, Digimarc, Imatag, Steg.AI, Microsoft, ...) via C2PA_SOFT_BINDINGS + soft_binding_vendors_in(); names the watermark vendor even when the watermark itself can't be decoded. - IPTC Photo Metadata 2025.1 AI-disclosure XMP fields (AISystemUsed etc.) via iptc_ai_system() + IPTC_AI_FIELD_MARKERS. - Adobe TrustMark open keyless decoder (trustmark_detector.py, optional extra `trustmark`) -- the watermark behind Adobe Durable Content Credentials. Detects provenance, not AI origin, so it does not assert is_ai. Removal / containers: - isobmff.strip_c2pa_boxes now also drops a top-level XMP uuid box that carries an AI label (matched by AI-marker content, byte-order-robust; plain XMP kept). - remove_ai_metadata routes MP4/MOV/M4V/M4A (and any ftyp-sniffed ISOBMFF) through the box stripper; raises a clear error for non-ISOBMFF audio/video (WebM/MP3/WAV) instead of crashing in the image path. Tests: soft-binding scan, IPTC element/attribute/presence, MP4 + M4A detect/ strip, ISOBMFF XMP surgical strip, content-sniff, unsupported-container guard, TrustMark absent-safety + identify integration. ruff clean; pyright clean on all new modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
feat: strip AI-provenance EXIF tags on removal (v0.5.6)
2026-10-15 14:00:54 +02:00 · 2026-05-26 17:56:48 -07:00 · 2026-05-26 14:26:20 -07:00 · 2026-05-26 14:14:35 -07:00 · 2026-05-26 12:47:28 -07:00 · 2026-05-25 16:09:52 -07:00
54 changed files with 2246 additions and 422 deletions
@@ -0,0 +1,2 @@
+# Enables the "Sponsor" button on the repository page.
+github: wiltodelta
@@ -21,8 +21,9 @@ Thumbs.db
 # Test results
 data/results/

-# SynthID corpus images (manifest.csv + README.md stay tracked)
-data/synthid_corpus/images/
+# SynthID corpus reference fills (synthetic black/white calibration tiles,
+# regenerable; the labeled pos/neg/cleaned images ARE tracked, see README)
+data/synthid_corpus/refs/

 # Reference materials
 _refs/
@@ -33,4 +34,3 @@ yolov8n.pt

 # Claude Code local settings
 .claude/settings.local.json
-data/synthid_corpus/refs/
@@ -14,22 +14,24 @@ You are a **principal Python engineer** maintaining a CLI tool and library for r
 - `bash maintain.sh` — uv-outdated, uv-secure, ruff check/fix, ruff format, pyright, pytest -n auto
 - `maintain.sh` may not finish fully green (pre-existing, not per-change): strict pyright carries debt in `remove_ai_metadata` / `cli.py` (untyped piexif/PIL/click/rich). (`uv-secure` is clean since idna was bumped 3.11 -> 3.16, fixing GHSA-65pc-fj4g-8rjx.) To gate a change, run `uv run ruff check`, `uv run pyright <changed files>`, `uv run pytest` directly.
 - Run `uv run` from the repo root — from another cwd it falls back to a bare env without numpy/cv2/torch.
- Metadata/C2PA tests assert against real committed fixtures in `data/samples/` (`chatgpt-*.png` = OpenAI C2PA, `firefly-1.png` = Adobe, `not-ai-*` = clean); synthetic byte blobs cover the JPEG/ISOBMFF format paths.
- SynthID reference corpus: `scripts/synthid_corpus.py` ingests labeled images into `data/synthid_corpus/` (`manifest.csv` tracked, `images/` gitignored); see its README for the collection protocol and verification oracles.
+- Metadata/C2PA tests assert against real committed fixtures in `data/samples/` (`chatgpt-*.png` = OpenAI C2PA, `firefly-1.png` = Adobe, `mj-*` = Midjourney IPTC, `doubao-1.png` = ByteDance Doubao with the China TC260 `<TC260:AIGC>` XMP label **and** a visible "豆包AI生成" text mark bottom-right; `grok-1.jpg` = xAI Grok with its EXIF-only `Signature:` blob + UUID `Artist` and no C2PA/SynthID/IPTC); synthetic byte blobs cover the JPEG/ISOBMFF format paths. The "non-AI / clean photo" control is no longer in `data/samples/` -- the `clean_photo` conftest fixture serves a verified-negative image from the corpus `neg/` set (skips if the corpus is absent).
+- SynthID reference corpus: `scripts/synthid_corpus.py` ingests labeled images into `data/synthid_corpus/`. The labeled `images/` (`pos/` `neg/` `cleaned/`) are **committed** (public repo -- review every image for private content before adding; `manifest.csv` is kept in sync with the files on disk, one row per tracked image); only the synthetic `refs/` calibration fills are gitignored. See its README for the collection protocol and verification oracles.

 ## Configuration

 - GPU/ML modules (invisible_engine, ctrlregen, watermark_remover) are optional — guard imports with `is_available()` checks
- Tests for ML modules are limited to availability checks (require multi-GB downloads)
+- Optional detection extras: `detect` (imwatermark — open SD/SDXL/FLUX watermark) and `trustmark` (Adobe TrustMark decoder; pulls torch + downloads weights). Both are guarded by `is_available()` and skipped by `identify` when absent.
+- Tests for the *model-running* paths are limited to availability checks (multi-GB downloads). But the **pure helpers inside ML-adjacent modules are unit-tested without any download** and must stay that way: `_target_size` (native-vs-downscale, `test_invisible_engine.py`), the MPS->CPU fallback control flow via mocked pipelines (`test_img2img_runner.py`, 100% cover), and the tiling math `tile_positions`/`make_blend_weight`/`resize_center_crop` (`test_tiling.py`; `pytest.importorskip("torch")` since `tiling.py` imports torch at module top). Don't skip these as "ML, needs a model" — only `run_tiled`/`remove_watermark`/the diffusion bodies do.

 ## Key modules

- `noai/c2pa.py` — PNG chunk parser; use `extract_c2pa_chunk(path)` to get raw caBX payload, `has_c2pa_metadata(path)` to detect. Do not reimplement chunk parsing. `extract_c2pa_info(path)` sets `synthid_watermark`/`synthid_vendors` when the manifest is signed by a SynthID-using vendor.
- `noai/constants.py` — PNG_SIGNATURE, C2PA_CHUNK_TYPE, C2PA_SIGNATURES, C2PA_ISSUERS, and `SYNTHID_C2PA_ISSUERS` (issuers that pair SynthID with C2PA: Google, OpenAI). Add a new issuer here, not inline.
- `metadata.py` — `synthid_source(path)` returns the vendor name(s) if the C2PA manifest implies a SynthID pixel watermark, else None. Format-agnostic: PNG via the caBX parser, JPEG/WebP/AVIF/HEIF/JXL via a binary scan (C2PA marker + SynthID issuer + AI-source marker). `get_ai_metadata` surfaces the verdict, and `metadata --check` prints it as a callout. Both `get_ai_metadata` and `has_ai_metadata` guard the PIL open with `except Exception` (HEIC/unknown formats raise non-OSError) and fall through to the binary scan.
- `identify.py` — `identify(path)` aggregates every locally-readable signal (C2PA issuer→platform, IPTC "Made with AI", embedded SD/ComfyUI params, SynthID proxy, visible Gemini sparkle) into one `ProvenanceReport`. `is_ai_generated` is True or None (never asserted False — stripped metadata is not proof of clean origin). Visible-sparkle is promoted only at confidence ≥ `_SPARKLE_THRESHOLD` (0.5; corpus-tuned to separate Gemini sparkles ≥0.56 from non-sparkle ≤0.49). The cv2 dependency lives in `gemini_engine.detect_sparkle_confidence`, not here. Add platform mappings to `_ISSUER_PLATFORM`, not inline. For non-PNG containers (JPEG/WebP/AVIF/HEIF/JXL) the caBX parser returns nothing, so issuer (`_issuers_in`) and generator (`_ai_tools_in`, reusing `C2PA_AI_TOOLS`) are recovered by binary-scanning the first MB. EXIF `Software` / `Make` / `Artist` / `ImageDescription` and XMP `CreatorTool` generator tags are read by `metadata.exif_generator` (PIL+piexif for any format PIL opens incl. AVIF, plus a container-agnostic XMP raw-byte scan that also covers HEIF/JXL), matched against `AI_GENERATOR_TOKENS` so ordinary editors (plain "Adobe Photoshop") and real-camera `Make` ("Apple"/"Canon") are not flagged. **Ideogram tags its output with EXIF `Make="Ideogram AI"`** (verified on a real download 2026-05-24) — that's why `Make` is read.
+- `noai/c2pa.py` — PNG chunk parser; use `extract_c2pa_chunk(path)` to get raw caBX payload, `has_c2pa_metadata(path)` to detect. Do not reimplement chunk parsing. `extract_c2pa_info(path)` sets `synthid_watermark`/`synthid_vendors` when the manifest is signed by a SynthID-using vendor, and `soft_binding`/`soft_binding_vendors` when a `c2pa.soft-binding` `alg` names a forensic-watermark vendor (`soft_binding_vendors_in(buffer)` is the shared byte-scan, used by both the PNG parser and the non-PNG binary path).
+- `noai/constants.py` — PNG_SIGNATURE, C2PA_CHUNK_TYPE, C2PA_SIGNATURES, C2PA_ISSUERS, `SYNTHID_C2PA_ISSUERS` (issuers that pair SynthID with C2PA: Google, OpenAI), and `C2PA_SOFT_BINDINGS` (soft-binding `alg` prefix → forensic-watermark vendor: Adobe TrustMark, Digimarc, Imatag, Steg.AI, Microsoft, ...). Add a new issuer/binding here, not inline.
+- `metadata.py` — `synthid_source(path)` returns the vendor name(s) if the C2PA manifest implies a SynthID pixel watermark, else None. Format-agnostic: PNG via the caBX parser, JPEG/WebP/AVIF/HEIF/JXL via a binary scan (C2PA marker + SynthID issuer + AI-source marker). `get_ai_metadata` surfaces the verdict, and `metadata --check` prints it as a callout. Both `get_ai_metadata` and `has_ai_metadata` guard the PIL open with `except Exception` (HEIC/unknown formats raise non-OSError) and fall through to the binary scan. `xai_signature(path)` detects xAI/Grok's EXIF-only scheme (`ImageDescription` = `Signature: <base64>` + UUID `Artist`); it feeds `has_ai_metadata`, `get_ai_metadata` (key `xai_signature`), and `identify`. `iptc_ai_system(path)` detects the IPTC Photo Metadata 2025.1 AI-disclosure XMP properties (`IPTC_AI_FIELD_MARKERS` = `AISystemUsed`/`AISystemVersionUsed`/`AIPromptInformation`/`AIPromptWriterName`) and returns the `AISystemUsed` generator name (or `"fields present"`). `remove_ai_metadata` routes **ISOBMFF video** (`.mp4`/`.mov`/`.m4v`) through the same `isobmff.strip_c2pa_boxes` as AVIF/HEIF (MP4 is ISOBMFF), and `_scrub_ai_exif` removes the xAI signature + AI-generator EXIF tags on JPEG output.
+- `identify.py` — `identify(path)` aggregates every locally-readable signal (C2PA issuer→platform, C2PA soft-binding forensic-watermark vendor, IPTC "Made with AI" + IPTC 2025.1 `AISystemUsed`, embedded SD/ComfyUI params, SynthID proxy, xAI/Grok EXIF signature via `metadata.xai_signature`, visible Gemini sparkle, open invisible watermark, Adobe TrustMark via `trustmark_detector`) into one `ProvenanceReport`. `is_ai_generated` is True or None (never asserted False — stripped metadata is not proof of clean origin). Visible-sparkle is promoted only at confidence ≥ `_SPARKLE_THRESHOLD` (0.5; corpus-tuned to separate Gemini sparkles ≥0.56 from non-sparkle ≤0.49). The cv2 dependency lives in `gemini_engine.detect_sparkle_confidence`, not here. Add platform mappings to `_ISSUER_PLATFORM`, not inline. For non-PNG containers (JPEG/WebP/AVIF/HEIF/JXL) the caBX parser returns nothing, so issuer (`_issuers_in`) and generator (`_ai_tools_in`, reusing `C2PA_AI_TOOLS`) are recovered by binary-scanning the first MB. EXIF `Software` / `Make` / `Artist` / `ImageDescription` and XMP `CreatorTool` generator tags are read by `metadata.exif_generator` (PIL+piexif for any format PIL opens incl. AVIF, plus a container-agnostic XMP raw-byte scan that also covers HEIF/JXL), matched against `AI_GENERATOR_TOKENS` so ordinary editors (plain "Adobe Photoshop") and real-camera `Make` ("Apple"/"Canon") are not flagged. **Ideogram tags its output with EXIF `Make="Ideogram AI"`** (verified on a real download 2026-05-24) — that's why `Make` is read.
 - `gemini_engine.py` — visible Gemini-sparkle remover/detector (cv2/numpy, no GPU). `detect_sparkle_confidence(path)` is the file-level entry point used by `identify.py`.
 - `invisible_watermark.py` — `detect_invisible_watermark(path)` decodes the OPEN DWT-DCT watermarks (public decoder, no key) embedded by Stable Diffusion / SDXL / FLUX via the `imwatermark` library. Known fixed patterns (verified against upstream source) live in `_BITS_48` (SDXL 48-bit, FLUX.2 48-bit) and `_SD1_STRING` ("StableDiffusionV1", SD 1.x/2.x). Optional dep (extra `detect`); returns None when absent. The `detect` extra pulls **torch** transitively (invisible-watermark declares torch a hard dep, and `WatermarkDecoder` eagerly imports `rivaGan` -> `torch` at import time), so detection needs torch present even though dwtDct runs CPU-only on cv2/numpy/pywavelets — no GPU and no separate `gpu` extra required. **Unlike SynthID this is locally detectable**, but the watermark is fragile (does not survive JPEG re-encode/resize — verified gone after JPEG q90), so it confirms origin only on pristine files. Add new known patterns here. The file carries a top-of-module pyright pragma because imwatermark/cv2 ship no type stubs.
+- `trustmark_detector.py` — `detect_trustmark(path)` decodes the OPEN, keyless **Adobe TrustMark** watermark (the soft binding behind Adobe Durable Content Credentials, `alg` `com.adobe.trustmark.P`) via the optional `trustmark` package (extra `trustmark`; pulls torch, downloads model weights on first use). Mirrors `invisible_watermark.py` (lazy singleton, top-of-module pyright pragma, returns None when absent). It detects *provenance*, not AI origin as such (TrustMark also marks human-authored content), so `identify` lists it as a watermark without setting `is_ai_generated`. Other soft-binding vendors (Digimarc/Imatag/Steg.AI/...) have no public decoder — they are only *named* via the `C2PA_SOFT_BINDINGS` scan, not decoded.
 - `face_protector.py` — YOLO detect + soft-blend pattern; mirror this for any "protect region during diffusion" features

 ## Watermarking landscape (research 2026-05-24)
@@ -38,16 +40,20 @@ Who embeds what, and whether it is locally detectable (so we know which gaps are
 - **Locally detectable (open decoder, no key/API):** Stable Diffusion / SDXL / FLUX via `imwatermark` DWT-DCT (now covered by `invisible_watermark.py`). FLUX uses the same library (`black-forest-labs/flux2` `src/flux2/watermark.py`, 48-bit `0b001010101111111010000111100111001111010100101110`); SDXL is the diffusers `WATERMARK_MESSAGE` (`0b101100111110110010010000011110111011000110011110`). Caveat: fragile to re-encoding.
 - **C2PA / IPTC (covered by the issuer/marker scan):** OpenAI, Google, Adobe Firefly, Microsoft (Designer + **Bing Image Creator** — collected 2026-05-24; Bing now runs Microsoft's own **MAI-Image** model, signs C2PA as "Microsoft", NOT OpenAI/DALL-E), and **Stability AI** (collected from Brand Studio / DreamStudio successor; signs C2PA as "Stability AI Ltd", no SynthID, no imwatermark on its current Stable Image model — issuer added to `C2PA_ISSUERS`). Still unsampled: Canva (its downloads are re-encoded design *exports* that strip C2PA, so a Canva "positive" is inconclusive — skipped), Getty, Shutterstock. Midjourney embeds NO C2PA and no invisible watermark (our `mj-*` sample carried only the IPTC tag).
 - **EXIF/XMP generator tag (caught by `exif_generator`):** **Ideogram** writes EXIF `Make="Ideogram AI"` (collected 2026-05-24 — no C2PA, no SynthID, no imwatermark; the Make tag is the only signal).
+- **xAI / Grok — its own EXIF signature scheme, NOT C2PA (DETECTED by `metadata.xai_signature`, built 2026-05-26).** Grok JPEG downloads (Aurora model) carry **no C2PA, no XMP, no SynthID, no IPTC** — only EXIF `Artist` = a UUID and EXIF `ImageDescription` = `Signature: <base64>` (a crypto signature, unverifiable locally without xAI's public key). This empirically kills the earlier unverified "xAI signs C2PA as xAI" lead — xAI is not even a C2PA member. `exif_generator` misses it (neither field holds an `AI_GENERATOR_TOKENS` token), so a dedicated detector `xai_signature(path)` matches the pair (`ImageDescription ~ ^Signature: [A-Za-z0-9+/=]{64,}` AND UUID `Artist`); wired into `has_ai_metadata`, `get_ai_metadata` (key `xai_signature`), and `identify` (signal `xai_signature`, platform "xAI (Grok / Aurora)"). **Format confirmed stable across n=3 genuine generations:** exactly three EXIF tags (`Artist`, `ExifOffset`, `ImageDescription`), `Signature:` prefix constant, base64 payload 300-1004 chars. Two capture facts: (a) the `Artist` UUID **equals the public image id** in the asset URL (`https://imagine-public.x.ai/imagine-public/images/<uuid>.jpg`), so it is NOT a private per-user secret — only the `Signature` blob is; (b) the Grok web-UI image is a re-encoded **WebP with no signature** — the EXIF survives only in the *original* JPEG (download button or that public tokenless URL), which is why screenshots / re-encodes are metadata-stripped. A real fixture `data/samples/grok-1.jpg` plus **synthetic** JPEG fixtures (fake UUID + fake `Signature:` blob) cover the detector; never add a real Grok image carrying private content (the repo is public). **Stripped on removal too:** `remove_ai_metadata` now calls `_scrub_ai_exif` on the JPEG EXIF, which deletes the xAI Signature+UUID-Artist pair **and** any `Software`/`Make`/`Artist`/`ImageDescription` tag holding an `AI_GENERATOR_TOKENS` token (so Ideogram's `Make="Ideogram AI"` is scrubbed too), while keeping genuine camera/editor EXIF. The shared `_is_xai_signature_pair` helper (module-level compiled regexes) is the single source of truth for the pattern, used by both `xai_signature` and `_scrub_ai_exif`. (AVIF/HEIF/JXL still strip only C2PA boxes via `isobmff`, not EXIF — unchanged.)
 - **China TC260 AIGC label (caught by `AIGC_MARKERS` / `metadata.aigc_label`, surfaced by `identify` as the `aigc` signal):** China-served generators embed an XMP `<TC260:AIGC>{"Label":"1","ContentProducer":...}` block — China's mandatory AI-content labeling (TC260 namespace `tc260.org.cn/ns/AIGC`). **Doubao** (ByteDance) uses it (verified on the real #13 sample 2026-05-25; `ContentProducer` `001191110102MACQD9K64010000`, no C2PA/SynthID/imwatermark — the XMP block is the only signal; GitHub attachment upload did NOT strip it). The same standard is mandatory for Jimeng/Kling/Qwen/Ernie etc., so the one marker covers the whole China-AIGC-labeled ecosystem. `aigc_label` json-decodes the (HTML-entity-encoded) block; container-agnostic raw-byte scan.
 - **No detectable signal on download (correctly reported `unknown`):** **Recraft** (PNG export is a re-encoded design export — strips everything), **Krea hosting FLUX 2** (no imwatermark despite FLUX — the host omits the encoder, same as Stability's hosted SDXL), and Midjourney (embeds nothing). Lesson: the imwatermark detector only fires on *pristine* output from a pipeline that runs the encoder (diffusers default, official BFL), not from re-hosts (Krea/Stability) or re-encoded exports (Recraft/Canva).
 - **Invisible but NOT locally detectable (proprietary, API/oracle only — same wall as SynthID):** Amazon Titan Image Generator + Nova Canvas (Bedrock `DetectGeneratedContent` API), Kakao (new SynthID image adopter, May 2026), NVIDIA Cosmos (SynthID video). No local detector possible; treat like SynthID.
+- **C2PA 2.4 "Durable Content Credentials" (April 2026; verified against the spec) raise the bar for metadata stripping.** 2.4 defines soft bindings (an invisible watermark or a content fingerprint) plus a server-side manifest repository and a new `c2pa.repository-receipt` assertion. Per the spec: "if a C2PA manifest is removed from an asset, but a copy of that manifest remains in a provenance store elsewhere, the manifest and asset may be matched using available soft bindings." So our local `metadata --remove` deletes the *embedded* manifest, but a fingerprint/watermark soft binding can still re-link the image to its manifest in a repository server-side. Stripping the file is becoming necessary-but-not-sufficient against durable provenance. (Our parsers target the stable embedded-manifest format documented in C2PA 2.1 §11; that format is unchanged in 2.4 -- the new pieces are repository/soft-binding infra, not the on-file box layout, so no parser change is implied.) Spec: https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html We now READ the soft-binding `alg` (`C2PA_SOFT_BINDINGS` / `soft_binding_vendors_in`) to name the forensic-watermark vendor, and locally DECODE the one open scheme, Adobe TrustMark (`trustmark_detector`); the rest (Digimarc/Imatag/Steg.AI/...) stay name-only (proprietary decoders).
+- **Built 2026-05-26 (this batch):** soft-binding `alg` vendor detection; IPTC Photo Metadata 2025.1 AI-disclosure fields (`AISystemUsed` etc.); **video C2PA metadata** detect + strip for MP4/MOV/M4V (free — `isobmff.py` is format-agnostic, MP4 is ISOBMFF); Adobe TrustMark open decoder. NOT done (out of cheap reach, per the feasibility review): visible video-logo removal (needs a video frame pipeline) and audio (SynthID/ElevenLabs/Resemble/Suno all oracle-only or unmarked). The soft-binding **box detection window**: non-PNG/video detection scans the first 1 MB, so a C2PA box placed after a large `mdat` in a streaming MP4 can be missed — front-placed manifests (the common case) are caught.
+- **Regulatory driver (context, not a code change):** AI-content labeling mandates are expanding, which pushes more generators toward exactly the C2PA + watermark signals we read. The full per-jurisdiction table lives in README "## Legal" -- keep it there, not duplicated here. Newly added + primary-source verified 2026-05-26: **EU AI Act Article 50** machine-readable marking applicable **2026-08-02** (verified against the article text); **South Korea AI Framework Act Art. 31(3)** in force since Jan 2026 (verified via Kim & Chang; Enforcement Decree accepts an invisible-watermark label); **California AB 853** (amends the CA AI Transparency Act) latent-disclosure duty operative **2026-08-02**, requiring a disclosure "permanent or extraordinarily difficult to remove" (verified against the leginfo bill text -- this is the exact disclosure our tool strips); **India IT Amendment Rules 2026** in force **2026-02-20** (verified via Chambers), which prominently-label + permanent-provenance-id all synthetic media AND **expressly prohibit removing/suppressing the label or metadata** -- the first major all-content removal ban outside China. **Removal liability (README "## Legal" disclaimer):** the tool is lawful general-purpose software; liability sits with the remover and is intent-gated -- downstream acts (fraud/deception/IP), plus US DMCA 17 USC 1202 (removing copyright-management info to conceal infringement), plus the removal-as-such bans in China + India. When extending the README table, verify each date/article against the statute/bill text before committing, not against search summaries.

 ## Known limitations

- `invisible` pipeline processes at **native resolution by default** (`max_resolution=0`), matching the hosted raiw.cc backend (fal fast-sdxl, no pre-downscale). The old forced downscale-to-1024 -> upscale-back round-trip was the main quality loss (issue #10) and is gone; at strength ~0.05 SDXL img2img does not need the ~1024 downscale. `--max-resolution N` re-introduces an opt-in long-side cap purely to bound GPU/MPS memory on very large inputs (it reintroduces the lossy round-trip). For huge images that OOM at native, tile-based diffusion is still the proper long-term fix.
+- `invisible` pipeline processes at **native resolution by default** (`max_resolution=0`), matching the hosted raiw.cc backend (fal fast-sdxl, no pre-downscale). The old forced downscale-to-1024 -> upscale-back round-trip was the main quality loss (issue #10) and is gone; at strength ~0.05 SDXL img2img does not need the ~1024 downscale. `--max-resolution N` re-introduces an opt-in long-side cap purely to bound GPU/MPS memory on very large inputs (it reintroduces the lossy round-trip). For huge images that OOM at native, tile-based diffusion is still the proper long-term fix. **Concrete MPS data point (verified 2026-05-25 on a 1254x1254 gpt-image SDXL run, fp32, 20 GB MPS ceiling):** native res OOMs at the *UNet* step (peak ~17 GiB), not only the VAE decode, and the auto-fallback in `img2img_runner` reloads on CPU and finishes (slow, ~13 min) -- the output is still weight-identical and defeats SynthID, so "looks hung/crashed" on Mac is usually this CPU fallback, not a pipeline error. Adding `enable_vae_tiling()` alone does NOT prevent it (the peak is the UNet, not the VAE). The fast Mac workarounds are fp16 on MPS (roughly halves memory) or `--max-resolution` to cap the long side; neither is wired as the default. The native-vs-downscale decision lives in the pure helper `invisible_engine._target_size(w, h, max_resolution)` (returns `None` for native, a clamped target tuple otherwise) so it is unit-tested (`tests/test_invisible_engine.py::TestTargetSize`, the #10/#15 regression guard) without loading the model -- keep that logic in the helper, don't re-inline it.
 - Pyright first run is slow (2-3 min) due to ML deps (torch/diffusers/transformers stubs); full-project `uv run pyright` can stall for many minutes — scope it to changed files.
 - `ultralytics` monkey-patches `PIL.Image.open` and tries to autoload `pi_heif`. When `pi_heif` is missing, opening files raises `ModuleNotFoundError`, not `UnidentifiedImageError`. Code that opens user-supplied or unknown-format files should `except Exception`, not just `OSError`/`UnidentifiedImageError`.
- Metadata detection for AVIF/HEIF/JPEG-XL relies on a binary scan for `C2PA_UUID` + `IPTC_AI_MARKERS`, plus EXIF `Software` / XMP `CreatorTool` generator tags via `metadata.exif_generator` (validated with synthesized AVIF/JPEG fixtures + an XMP raw-scan fixture). C2PA removal in those containers is implemented via `noai/isobmff.py` (top-level ``uuid`` / ``jumb`` box stripper, no re-encoding). EXIF/XMP boxes inside those containers are read for detection but not yet **scrubbed** on removal.
- **SynthID detection is metadata-only.** There is no reliable *local* detector of the SynthID *pixel* watermark — Google's decoder is proprietary, no public spec or API (only a waitlisted portal). We detect SynthID by its C2PA companion (`synthid_source` / `SYNTHID_C2PA_ISSUERS`), which is reliable while the manifest is intact but says nothing once C2PA is stripped. **Surface-dependent blind spot (verified 2026-05-24):** the same Google model emits different metadata per surface -- the Gemini *app* wraps outputs in Google C2PA, but the *API/playground* (AI Studio, Nano Banana / gemini-2.5-flash-image) emits the SynthID *pixel* watermark (confirmed via the Gemini-app oracle) + the visible sparkle but **no C2PA/IPTC at all**, so `synthid_source` returns None despite SynthID being present. Only the pixel oracle or the visible-sparkle detector catches those. (Meta AI is another surface mismatch: it writes the IPTC `digitalSourceType=trainedAlgorithmicMedia` marker, not C2PA and not SynthID.) Google→SynthID is long-standing; OpenAI→SynthID is confirmed by OpenAI's Help Center (ChatGPT/Codex/API "include both C2PA metadata and SynthID watermarks", updated 2026-05-21) but time-gated (pre-rollout OpenAI images carry C2PA without SynthID), so the OpenAI verdict is hedged "likely". Oracles: Gemini app "Verify with SynthID" (Google), openai.com/verify (OpenAI). The spectral phase-coherence approach from `github.com/aloshdenny/reverse-SynthID` was evaluated (May 2026) and **does not work for real-content detection**: on its own shipped codebook + validation set, watermarked and cleaned images were indistinguishable (conf within noise, cleaned often higher); it only fires on pure-black 1024x1024 reference images at exact resolution (the controlled case it was calibrated on). The README's "90% / conf=0.91" reproduces only in that lab condition. Do not build a production detector on it; if revisited, it is experimental/diagnostic only and needs a per-resolution, per-model reference corpus. A from-scratch gpt-image pilot (2026-05-24) confirmed this independently: 5 independent solid-black gpt-image outputs share a near-identical fixed signature (pairwise residual correlation **0.92**, avg-template retains 97% energy), so the watermark/carrier IS strongly present and consistent on flat content — but the carrier frequencies extracted from it do NOT discriminate real content (carrier-to-random ratio: cleaned 1.86 > watermarked 1.53; a non-gpt-image image scored highest at 3.67). The signature drowns in content texture. Net: a perfectly consistent solid-color signature still yields no real-content pixel detector with magnitude/carrier methods. A corpus discrimination test (2026-05-24, `scripts/synthid_pixel_probe.py`, raw zero-mean residual NCC) independently re-confirms this: at matched resolution, SynthID positives do NOT cluster apart from negatives (within-Gemini 0.07; at 1024 px pos-vs-neg >= pos-vs-pos). The only high correlations were near-duplicate *content* (5 ChatGPT renders of one prompt at ~0.92, while a distinct ChatGPT image scored ~0 against them) — content, not a carrier. The probe is solid-fills-only and EXPERIMENTAL/DIAGNOSTIC; do not use it on real content. **Correction (deeper re-examination 2026-05-25):** the carrier IS real on solid fills — the earlier "no carrier" was a *method* artifact of using spatial / FFT-magnitude NCC, which can't see it. The carrier is a fixed *phase* at specific low frequencies, so the right metric is **per-bin phase coherence**. On 8 white `gemini-2.5-flash-image` fills (generated via the reverse-SynthID trick: identity-edit prompt "Recreate this image exactly as it is" on a synthetic pure-white PNG — this bypasses the recitation block that rejects text prompts for pure colors), phase coherence at the white carriers `(0,±7..±12,±20..±23)` = **0.86** vs **0.31** random; single-image leave-one-out phase-match **+0.83** vs real photos **-0.24**. (Black `2.5-flash` fills clip to std≈0 — SynthID can't push values below 0, so no carrier in black; the repo's dark carriers come from nano-banana-pro.) **But it does not generalize:** (a) carriers are model-version + resolution + color specific — the repo's v4 codebook (built for `gemini-3.1-flash-image-preview` + `nano-banana-pro-preview`) scores ~0.527 on my 2.5-flash white fills, indistinguishable from negatives (~0.50), i.e. carriers shift across model versions and need a per-model codebook; (b) on real content (30 `2.5-flash` images) the carrier collapses — set phase coherence at carriers 0.37 ≈ random 0.42, and the repo's v4 detector gives content 0.518 ≈ negatives 0.504 (no separation; a faint +0.24 single-image lean is likely a brightness confound). Net: the spectral/phase approach is a real *controlled-fill* characterizer, NOT an arbitrary-real-content detector, and is brittle to model version. Metadata proxy + visible sparkle + online oracles remain the ceiling for real content.
+- Metadata detection for AVIF/HEIF/JPEG-XL relies on a binary scan for `C2PA_UUID` + `IPTC_AI_MARKERS`, plus EXIF `Software` / XMP `CreatorTool` generator tags via `metadata.exif_generator` (validated with synthesized AVIF/JPEG fixtures + an XMP raw-scan fixture). C2PA removal in those containers is implemented via `noai/isobmff.py` (top-level ``uuid`` / ``jumb`` box stripper, no re-encoding), which now also drops a top-level XMP ``uuid`` box that carries an AI label (matched by AI-marker content, not by the XMP UUID, so byte-order-robust) and covers MP4/MOV/M4V/M4A by content sniff. **Metadata boundary (researched 2026-05-26, deliberately NOT built — low yield / high risk):** EXIF/XMP stored as *items inside the ``meta`` box* (typical for AVIF/HEIF images) needs meta-box surgery (iinf/iloc edit + mdat splice) with corruption risk; WebM/Matroska is EBML (different container, would need a new parser); MP3 ID3 / WAV RIFF audio tags are low-yield (audio provenance is overwhelmingly oracle-only — SynthID/ElevenLabs/Resemble — or unmarked like Suno/Udio). For these, `remove_ai_metadata` raises a clear "not supported" error (`_UNSUPPORTED_CONTAINER_EXTS`) rather than crashing; detection via the `identify` byte scan still fires when the marker is in the first MB. (These are candidates for future work, not a hard ceiling — revisit when there's demand.)
+- **SynthID detection is metadata-only.** There is no reliable *local* detector of the SynthID *pixel* watermark — Google's decoder is proprietary, no public spec or API (only a waitlisted portal). Authoritative confirmation: Google DeepMind's own paper "SynthID-Image: Image watermarking at internet scale" (Gowal et al., arXiv:2510.09263) states the verification service is restricted to "trusted testers" and does not release detector weights or a reproducible algorithm — so a local pixel detector is infeasible by design, not just unbuilt. https://arxiv.org/abs/2510.09263 We detect SynthID by its C2PA companion (`synthid_source` / `SYNTHID_C2PA_ISSUERS`), which is reliable while the manifest is intact but says nothing once C2PA is stripped. **Surface-dependent blind spot (verified 2026-05-24):** the same Google model emits different metadata per surface -- the Gemini *app* wraps outputs in Google C2PA, but the *API/playground* (AI Studio, Nano Banana / gemini-2.5-flash-image) emits the SynthID *pixel* watermark (confirmed via the Gemini-app oracle) + the visible sparkle but **no C2PA/IPTC at all**, so `synthid_source` returns None despite SynthID being present. Only the pixel oracle or the visible-sparkle detector catches those. (Meta AI is another surface mismatch: it writes the IPTC `digitalSourceType=trainedAlgorithmicMedia` marker, not C2PA and not SynthID.) Google→SynthID is long-standing; OpenAI→SynthID is confirmed by OpenAI's Help Center (ChatGPT/Codex/API "include both C2PA metadata and SynthID watermarks", updated 2026-05-21) but time-gated (pre-rollout OpenAI images carry C2PA without SynthID), so the OpenAI verdict is hedged "likely". Oracles: Gemini app "Verify with SynthID" (Google), openai.com/verify (OpenAI). The spectral phase-coherence approach from `github.com/aloshdenny/reverse-SynthID` was evaluated (May 2026) and **does not work for real-content detection**: on its own shipped codebook + validation set, watermarked and cleaned images were indistinguishable (conf within noise, cleaned often higher); it only fires on pure-black 1024x1024 reference images at exact resolution (the controlled case it was calibrated on). The README's "90% / conf=0.91" reproduces only in that lab condition. Do not build a production detector on it; if revisited, it is experimental/diagnostic only and needs a per-resolution, per-model reference corpus. A from-scratch gpt-image pilot (2026-05-24) confirmed this independently: 5 independent solid-black gpt-image outputs share a near-identical fixed signature (pairwise residual correlation **0.92**, avg-template retains 97% energy), so the watermark/carrier IS strongly present and consistent on flat content — but the carrier frequencies extracted from it do NOT discriminate real content (carrier-to-random ratio: cleaned 1.86 > watermarked 1.53; a non-gpt-image image scored highest at 3.67). The signature drowns in content texture. Net: a perfectly consistent solid-color signature still yields no real-content pixel detector with magnitude/carrier methods. A corpus discrimination test (2026-05-24, `scripts/synthid_pixel_probe.py`, raw zero-mean residual NCC) independently re-confirms this: at matched resolution, SynthID positives do NOT cluster apart from negatives (within-Gemini 0.07; at 1024 px pos-vs-neg >= pos-vs-pos). The only high correlations were near-duplicate *content* (5 ChatGPT renders of one prompt at ~0.92, while a distinct ChatGPT image scored ~0 against them) — content, not a carrier. The probe is solid-fills-only and EXPERIMENTAL/DIAGNOSTIC; do not use it on real content. **Correction (deeper re-examination 2026-05-25):** the carrier IS real on solid fills — the earlier "no carrier" was a *method* artifact of using spatial / FFT-magnitude NCC, which can't see it. The carrier is a fixed *phase* at specific low frequencies, so the right metric is **per-bin phase coherence**. On 8 white `gemini-2.5-flash-image` fills (generated via the reverse-SynthID trick: identity-edit prompt "Recreate this image exactly as it is" on a synthetic pure-white PNG — this bypasses the recitation block that rejects text prompts for pure colors), phase coherence at the white carriers `(0,±7..±12,±20..±23)` = **0.86** vs **0.31** random; single-image leave-one-out phase-match **+0.83** vs real photos **-0.24**. (Black `2.5-flash` fills clip to std≈0 — SynthID can't push values below 0, so no carrier in black; the repo's dark carriers come from nano-banana-pro.) **But it does not generalize:** (a) carriers are model-version + resolution + color specific — the repo's v4 codebook (built for `gemini-3.1-flash-image-preview` + `nano-banana-pro-preview`) scores ~0.527 on my 2.5-flash white fills, indistinguishable from negatives (~0.50), i.e. carriers shift across model versions and need a per-model codebook; (b) on real content (30 `2.5-flash` images) the carrier collapses — set phase coherence at carriers 0.37 ≈ random 0.42, and the repo's v4 deteLine truncated
 - **External AI-vs-real classifier models are out of scope (decided 2026-05-24).** Generic HuggingFace detectors (`Organika/sdxl-detector` Swin Transformer, `umm-maybe/AI-image-detector`, and fine-tunes) exist and report ~0.98 on their *own* SDXL-vs-real validation sets, but they are per-generator and the model cards themselves note degraded accuracy off-distribution; they are untested on gpt-image / Gemini Nano Banana (the metadata-stripped surfaces we care about), and our own light SDXL pass would likely defeat them the same way it defeats SynthID. Detection here stays local + signal-based (metadata + visible sparkle); do not add a bundled classifier dependency.
- **SynthID v2 vs default pipeline:** the SDXL-based default profile (since May 2026) defeats SynthID v2. **Verified end-to-end (May 2026):** local SDXL run on a Gemini 3 Pro output, checked via the Gemini app's "Verify with SynthID" feature, returned "no SynthID watermark detected". Also confirmed against **OpenAI's** SynthID (2026-05-23): a fresh ChatGPT/gpt-image output read "SynthID detected" on openai.com/verify before the local SDXL run and "SynthID not detected" after (corpus regression chain: pos `4ef377bd` -> cleaned `47188e88`). The same configuration is used in raiw-app production (`fal-ai/fast-sdxl/image-to-image`, strength 0.05, steps 50, guidance 7.5, no pre-downscale). fal's own `llms.txt` for `fast-sdxl` names the base checkpoint as `stabilityai/stable-diffusion-xl-base-1.0` (verified 2026-05-25) -- the exact checkpoint the local CLI defaults to (`DEFAULT_MODEL_ID`). So the local `invisible` default is weight-for-weight identical to prod; "fast-sdxl" is fal's optimized serving, not different weights. After the native-resolution fix the local pipeline matches prod on weights + strength + steps + guidance + resolution. SD-1.5 dreamshaper at 768 px was previously the default and does NOT defeat v2 — verified empirically against the same feature (strength 0.04, 0.10, and elastic warp α∈{5,8} all flagged positive). That SD-1.5 path was removed; only `default` (SDXL) and `ctrlregen` profiles remain.
+- **SynthID v2 vs default pipeline:** the SDXL-based default profile (since May 2026) defeats SynthID v2. **Verified end-to-end (May 2026):** local SDXL run on a Gemini 3 Pro output, checked via the Gemini app's "Verify with SynthID" feature, returned "no SynthID watermark detected". Also confirmed against **OpenAI's** SynthID (2026-05-23): a fresh ChatGPT/gpt-image output read "SynthID detected" on openai.com/verify before the local SDXL run and "SynthID not detected" after (corpus regression chain: pos `4ef377bd` -> cleaned `47188e88`). The same configuration is used in raiw-app production (`fal-ai/fast-sdxl/image-to-image`, strength 0.05, steps 50, guidance 7.5, no pre-downscale). fal's own `llms.txt` for `fast-sdxl` names the base checkpoint as `stabilityai/stable-diffusion-xl-base-1.0` (verified 2026-05-25) -- the exact checkpoint the local CLI defaults to (`DEFAULT_MODEL_ID`). So the local `invisible` default is weight-for-weight identical to prod; "fast-sdxl" is fal's optimized serving, not different weights. After the native-resolution fix the local pipeline matches prod on weights + strength + steps + guidance + resolution. SD-1.5 dreamshaper at 768 px was previously the default and does NOT defeat v2 — verified empirically against the same feature (strength 0.04, 0.10, and elastic warp α∈{5,8} all flagged positive). That SD-1.5 path was removed; only `default` (SDXL) and `ctrlregen` profiles remain. **Scope of the claim: defeating the SynthID verifier is NOT the same as forensic invisibility.** "Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal" (arXiv:2605.09203, 2026-05) shows that six removal attacks across four families (UnMarker, CtrlRegen+, WatermarkAttacker, etc.) all leave forensic traces: independent detectors flag *removal-processed* images vs genuinely-clean ones at **>98% TPR at 1% FPR**. So our SDXL pass makes the oracle read "SynthID not detected," but the output can still be classifiable as "an image that went through a removal pipeline." Do not over-claim "indistinguishable from a real photo." https://arxiv.org/abs/2605.09203
@@ -4,19 +4,25 @@ Remove **visible** and **invisible** AI watermarks from images generated by Goog

 Strips SynthID, C2PA Content Credentials, EXIF/XMP "Made with AI" labels, and visible sparkle overlays — all in one command.

+> ## Try it online: [raiw.cc](https://raiw.cc)
+>
+> No Python, no GPU, no setup. Visible-watermark and metadata removal are **free**. Invisible-watermark removal (SynthID / SDXL regeneration) normally needs a local GPU and ~2 GB of models. On **[raiw.cc](https://raiw.cc)** it runs on cloud GPUs in one click for a small per-image fee.
+
+[![Sponsor](https://img.shields.io/badge/Sponsor-GitHub-db61a2?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/wiltodelta)
+
+If this tool saves you time, consider [sponsoring its development](https://github.com/sponsors/wiltodelta).
+
 ## Features

 - **Visible watermark removal** — Gemini / Nano Banana sparkle logo via reverse alpha blending (fast, offline, deterministic)
- **Invisible watermark removal** — SynthID, StableSignature, TreeRing via diffusion-based regeneration
- **AI metadata stripping** — EXIF, PNG text chunks, C2PA provenance manifests (PNG / JPEG / AVIF / HEIF / JPEG-XL), XMP DigitalSourceType
+- **Invisible watermark removal** — SynthID, StableSignature, TreeRing via diffusion-based regeneration (needs a local GPU, or run it with no setup on [raiw.cc](https://raiw.cc))
+- **AI metadata stripping** — EXIF, PNG text chunks, C2PA provenance manifests (PNG / JPEG / AVIF / HEIF / JPEG-XL, and **MP4 / MOV / M4V video** at the container level), XMP DigitalSourceType
 - **"Made with AI" label removal** — removes the metadata that triggers AI labels on Instagram, Facebook, X (Twitter)
 - **Analog Humanizer** — film grain and chromatic aberration to bypass AI image classifiers
 - **Smart Face Protection** — automatic extraction and blending of human faces to prevent AI distortion
 - **Batch processing** — process entire directories
 - **Detection** — three-stage NCC watermark detection with confidence scoring
- **Provenance detection (`identify`)** — aggregate C2PA issuer, IPTC "Made with AI", embedded SD/ComfyUI params, EXIF/XMP generator tags, the SynthID metadata proxy, the visible sparkle, and the open SD/SDXL/FLUX invisible watermark into one origin-platform + watermark-inventory verdict (`--json` for machine output)
-
-> **Try it online** — don't want to install anything? Use [raiw.cc](https://raiw.cc), a free web service powered by this library.
+- **Provenance detection (`identify`)** — aggregate C2PA issuer, the C2PA soft-binding forensic-watermark vendor (Adobe TrustMark, Digimarc, Imatag, ...), IPTC "Made with AI" plus the IPTC 2025.1 `AISystemUsed` field, embedded SD/ComfyUI params, EXIF/XMP generator tags, the xAI/Grok EXIF signature, the SynthID metadata proxy, the visible sparkle, the open SD/SDXL/FLUX invisible watermark, and (with the `trustmark` extra) the open Adobe TrustMark watermark into one origin-platform + watermark-inventory verdict (`--json` for machine output)

 ## Examples

@@ -36,6 +42,7 @@ Strips SynthID, C2PA Content Credentials, EXIF/XMP "Made with AI" labels, and vi
 | **Adobe Firefly** | — | — | ✅ Content Credentials (C2PA) | Metadata strip |
 | **Stability AI** (DreamStudio / Stable Image) | — | — | ✅ C2PA ("Stability AI Ltd") | Metadata strip |
 | **Microsoft Designer / Bing Image Creator** | — | ✅ SynthID via DALL-E backend (Designer) | ✅ C2PA (Bing runs MAI-Image, signed "Microsoft") | Metadata strip |
+| **xAI Grok (Aurora)** | — | — | ✅ EXIF signature scheme (no C2PA): `Signature:` blob + UUID `Artist` | Detected (`identify`); metadata strip |
 | **Midjourney** | — | — | ✅ EXIF + XMP (prompt, model, seed) | Metadata strip |
 | **Meta AI** | — | — | ✅ IPTC "Made with AI" (digitalSourceType) | Metadata strip (removes the label) |
 | **Doubao** (ByteDance) / China AIGC generators | — | — | ✅ TC260 `<TC260:AIGC>` XMP label (China's mandatory AI labeling) | Metadata strip |
@@ -44,7 +51,7 @@ Strips SynthID, C2PA Content Credentials, EXIF/XMP "Made with AI" labels, and vi

 > Visible watermarks (logo overlays) are currently used only by Google Gemini / Nano Banana. Other services rely on invisible watermarks and/or metadata. Our diffusion-based regeneration works against any invisible watermark in pixel or frequency domain.

-> **Detection:** `remove-ai-watermarks identify <image>` reports the origin platform and watermark inventory for all the signals above — C2PA issuer, IPTC "Made with AI", the China TC260 AIGC label, embedded generation params, EXIF/XMP generator tags, the SynthID metadata proxy, the visible sparkle, and (with the `[detect]` extra) the open SD/SDXL/FLUX invisible watermark. The SynthID *pixel* watermark has no local decoder, so it is reported as a metadata proxy only.
+> **Detection:** `remove-ai-watermarks identify <image>` reports the origin platform and watermark inventory for all the signals above — C2PA issuer, the C2PA soft-binding forensic-watermark vendor (TrustMark / Digimarc / Imatag / ...), IPTC "Made with AI" plus the IPTC 2025.1 `AISystemUsed` field, the China TC260 AIGC label, embedded generation params, EXIF/XMP generator tags, the xAI/Grok EXIF signature, the SynthID metadata proxy, the visible sparkle, and (with the `[detect]` / `[trustmark]` extras) the open SD/SDXL/FLUX and Adobe TrustMark invisible watermarks. SynthID and the proprietary soft-binding watermarks (Digimarc etc.) have no local decoder, so they are reported by metadata proxy / vendor name only.

 ## How it works

@@ -81,11 +88,11 @@ image → encode to latent space (VAE) at native resolution

 By default the image is processed at its **native resolution** with no pre-downscale, matching the hosted raiw.cc backend (fal `fast-sdxl`, which is `stabilityai/stable-diffusion-xl-base-1.0` — the same checkpoint the CLI defaults to). At strength ~0.05 SDXL img2img does not need the input shrunk, and the old forced downscale-to-1024 then upscale-back round-trip was the main quality loss. Pass `--max-resolution N` to cap the long side only when a very large image runs out of GPU/MPS memory (it reintroduces that lossy round-trip).

-SDXL is the default since May 2026: empirically defeats SynthID v2 on Gemini 3 Pro outputs, where the older SD-1.5 pipeline at 768 px did not. The SD-1.5 path was removed once it was verified not to handle v2.
+SDXL is the default since May 2026: empirically defeats SynthID v2 on Gemini 3 Pro outputs, where the older SD-1.5 pipeline at 768 px did not. The SD-1.5 path was removed once it was verified not to handle v2. Note the scope: this defeats the SynthID *verifier*, which is not the same as being forensically indistinguishable from a real photo. Recent work ([arXiv:2605.09203](https://arxiv.org/abs/2605.09203)) shows watermark-removal pipelines leave detectable traces, so a separate "this image was processed" classifier can still flag the output.

 **Face Protection**: before diffusion, YOLO detects people in the image and extracts them. After diffusion, the original faces are blended back with a soft elliptical mask to prevent AI distortion of facial features.

-**Analog Humanizer**: optional film grain and chromatic aberration injection that makes the output indistinguishable from a photo of a screen, defeating AI-generated image classifiers.
+**Analog Humanizer**: optional film grain and chromatic aberration injection that mimics a photo of a screen, raising the bar for AI-generated image classifiers. (It frustrates generic classifiers but does not guarantee forensic invisibility — see the [arXiv:2605.09203](https://arxiv.org/abs/2605.09203) note above.)

 ### Stripping C2PA, EXIF, and "Made with AI" metadata

@@ -152,6 +159,14 @@ After installation the `remove-ai-watermarks` command is available system-wide.
 > ```bash
 > pip install -e ".[detect]"   # or: uv pip install -e ".[detect]"
 > ```
+>
+> To also decode the open **Adobe TrustMark** watermark (behind Adobe Durable
+> Content Credentials), install the `trustmark` extra (pulls torch and downloads
+> model weights on first use):
+>
+> ```bash
+> pip install -e ".[trustmark]"   # or: uv pip install -e ".[trustmark]"
+> ```

 #### Invisible watermark removal

@@ -306,7 +321,10 @@ Watermarking and provenance for AI-generated content is now regulated in several
 | EU | AI Act, Article 50 | Transparency duties apply from **2 August 2026**. Legacy generative systems (placed on the market before that date) get a grandfathering period to **2 December 2026** for the Article 50(2) marking duty, under the Digital Omnibus (Commission proposal Nov 2025; co-legislator political agreement 7 May 2026). Article 50 guidelines and a marking Code of Practice are being finalised through 2026. | Removing mandated provenance markers with intent to deceive may be sanctioned under national implementations. |
 | US (federal) | COPIED Act | **Reintroduced April 2025; not enacted** (pending in the Senate). | If passed, would set NIST provenance standards and prohibit tampering with / removing provenance information. The tool itself is lawful; usage may not be. |
 | US (state) | CA AB 2655, TX SB 751, similar | TX SB 751 in force; **CA AB 2655 struck down** by a federal court (Aug 2025, Section 230 / First Amendment). | Content-specific (election deepfakes, sexual deepfakes). Not tool-specific. |
-| China | Measures for Labeling AI-Generated Content (+ GB 45438-2025) | In force since **1 September 2025**. | Mandatory explicit (visible) + implicit (metadata) labels for AI content; tampering with or removing labels is prohibited. |
+| US (state) | CA AB 853 (amends the California AI Transparency Act) | Core provider duties operative **2 August 2026** (delayed from 1 January 2026); large platforms 1 January 2027; capture devices 1 January 2028. | Covered providers (1M+ monthly users) must embed a latent disclosure that is "permanent or extraordinarily difficult to remove" and offer a free detection tool. Removing that disclosure is what this tool does. |
+| South Korea | AI Framework Act (Basic Act on AI), Article 31 | In force since **January 2026** (one-year transition after promulgation). | Art. 31(3): AI output "difficult to distinguish from reality" must be labeled so users "clearly recognize" it; the draft Enforcement Decree accepts a machine-readable (invisible-watermark) label. Artistic/creative works get a presentation exception. |
+| China | Measures for Labeling AI-Generated Content (+ GB 45438-2025) | In force since **1 September 2025**. | Mandatory explicit (visible) + implicit (metadata) labels across image / audio / video; tampering with, forging, or removing labels is prohibited. |
+| India | IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 | In force since **20 February 2026** (notified 10 February 2026). | All "synthetically generated information" must be **prominently labelled** and carry **permanent metadata / a provenance identifier**; the rules expressly **prohibit modifying, suppressing, or removing** that label or metadata. Covers image, audio, and audio-visual content. |
 | UK | Online Safety Act 2023 / Ofcom guidance | In force, but **no statutory AI-provenance or watermarking obligation**. | Ofcom encourages watermarking / provenance metadata as voluntary "attribution measures"; platform duties, not user obligations. |

 ## Threat model
@@ -331,7 +349,12 @@ This tool is intended for legitimate purposes such as:
 - Removing false-positive "Made with AI" labels from human-edited photographs.
 - Security research and watermark robustness study.

-Removing AI provenance markers to misrepresent AI-generated content as human-created may violate the laws above, the DMCA, and platform terms of service. Users are solely responsible for ensuring their use complies with all applicable laws. The authors do not condone use of this tool for deception, fraud, or any activity that violates applicable laws or regulations.
+**Who bears the liability.** This is general-purpose software and is itself lawful to publish and run; legal responsibility attaches to the person who removes a marker and to how the result is then used, and the hinge is intent. Removing AI provenance to pass AI-generated content off as human-made, to commit fraud, to produce non-consensual deepfakes, or to conceal copyright infringement can expose the remover to liability. Two kinds of exposure are worth knowing:
+
+- **The downstream act.** Deception, fraud, defamation, IP infringement, or breaking a platform's terms — judged by intent and harm, not by the act of editing metadata itself. In the US, the **DMCA (17 U.S.C. § 1202)** specifically bars removing "copyright management information" *with intent to conceal or enable infringement*.
+- **The removal itself.** Some jurisdictions penalise tampering with the label/metadata as such, regardless of downstream use — notably **China** (Labeling Measures) and **India** (IT Amendment Rules 2026), which expressly prohibit removing or suppressing the AI label and provenance metadata. The US **COPIED Act** would do the same if enacted.
+
+Legitimate uses — publishing your own work, privacy (stripping metadata that leaks an account identifier), security / robustness research, or removing a false-positive "Made with AI" label from a human-edited photograph — are generally lawful. Users are solely responsible for ensuring their use complies with all applicable laws. The authors do not condone use of this tool for deception, fraud, or any activity that violates applicable laws or regulations. None of this is legal advice.

 ## License

@@ -17,16 +17,21 @@ external oracle, recorded per image in `verified_via` (see below).
 ```
 data/synthid_corpus/
  README.md        # this protocol (committed)
-  manifest.csv     # labels + provenance (committed, reviewable)
-  images/          # the actual files (gitignored, local-only)
+  manifest.csv     # labels + provenance (committed; one row per tracked image)
+  images/          # the labeled corpus (committed)
    pos/           # SynthID present
-    neg/           # SynthID absent
+    neg/           # SynthID absent (incl. reviewed real photos)
    cleaned/       # our pipeline output from a pos image
+  refs/            # synthetic black/white calibration fills (gitignored, regenerable)
 ```

-Images are gitignored on purpose: the corpus is large, may contain personal or
-licensed content, and SynthID-positive outputs are best kept local. The
-`manifest.csv` (sha256 + labels + extracted metadata) is the durable artifact.
+The labeled images are committed so the corpus is reproducible and the removal
+regression set runs in CI. `manifest.csv` is kept in sync with the files on
+disk (one row per tracked image; dangling rows are pruned when files are
+removed). Before adding any image, confirm it carries no private or
+identifiable content you would not publish -- this is a public repo and git
+history is permanent. The synthetic `refs/` fills stay gitignored (regenerable,
+not part of the labeled set).

 ## Verification levels (`verified_via`)

@@ -58,7 +63,8 @@ For the **regression set**:
 - `neg` controls: non-AI photos and outputs from non-SynthID models (SD,
  Midjourney, Firefly) verified negative.

-Avoid personal or identifiable content; the corpus stays local.
+The corpus is committed to a public repo: review every image before adding it
+and keep out anything private or identifiable you would not publish.

 ## Ingesting

@@ -1,118 +1,26 @@
 sha256,filename,label,source,model,width,height,format,c2pa_issuer,synthid_metadata,verified_via,added,notes
 4ef377bde1a1d4eff141972841938643b173f5052992a018b9a21b31ac31731e,"4ef377bd-ChatGPT Image May 23, 2026, 02_43_02 PM.png",pos,ChatGPT,gpt-image,1254,1254,png,OpenAI,yes,openai-verify,2026-05-23T21:48:12Z,fresh post-rollout 2026-05-23; openai.com/verify: SynthID+C2PA detected
 d09f84c0e4c6d8b336bf4a9a7277314e940dcb5052ae7051e785cbb3bb42d656,d09f84c0-Gemini_Generated_Image_vq7wkwvq7wkwvq7w.png,pos,Gemini app,gemini,2816,1536,png,Google LLC,yes,c2pa-metadata,2026-05-23T21:52:40Z,"user: latest Gemini, SynthID v2"
-47188e88f956291bd38ab6906e5f21eb273d4a697ddc8b4479deac9f48915e1a,47188e88-disco_synthid_removed.png,cleaned,our pipeline (invisible/SDXL),stabilityai/stable-diffusion-xl-base-1.0,1254,1254,png,,,openai-verify,2026-05-23T22:06:54Z,cleaned from 4ef377bd disco; openai.com/verify: SynthID NOT detected (defeated)
-52bb6bd524a74bff1b74ed893784c1c0ee76f48a9b45a009bae95ad4a57b7759,"52bb6bd5-ChatGPT Image May 24, 2026, 11_01_02 AM.png",pos,ChatGPT,gpt-image,1254,1254,png,OpenAI,yes,c2pa-metadata,2026-05-24T18:49:35Z,solid black ref (spectral pilot 2026-05-24)
-ee75ade07914d6306eae3443b3028782e0ac8c125a31b2d5a141f75aebdafb18,"ee75ade0-ChatGPT Image May 24, 2026, 11_10_04 AM.png",pos,ChatGPT,gpt-image,1254,1254,png,OpenAI,yes,c2pa-metadata,2026-05-24T18:49:35Z,solid black ref (spectral pilot 2026-05-24)
-9398c74dfad0f030633bd3ac224ba53e56a7ff9711d7b3a4c464e0073ece51b5,"9398c74d-ChatGPT Image May 24, 2026, 11_10_09 AM.png",pos,ChatGPT,gpt-image,1254,1254,png,OpenAI,yes,c2pa-metadata,2026-05-24T18:49:35Z,solid black ref (spectral pilot 2026-05-24)
-79c3733895e82e3c9e506de0ddd6dfbf20ba09171263d88444520777151868c8,"79c37338-ChatGPT Image May 24, 2026, 11_10_13 AM.png",pos,ChatGPT,gpt-image,1254,1254,png,OpenAI,yes,c2pa-metadata,2026-05-24T18:49:35Z,solid black ref (spectral pilot 2026-05-24)
-38315a0a83aa0e094a50520ea44e01aa26115927f09a532ff2ab8636de743e0a,"38315a0a-ChatGPT Image May 24, 2026, 11_10_19 AM.png",pos,ChatGPT,gpt-image,1254,1254,png,OpenAI,yes,c2pa-metadata,2026-05-24T18:49:35Z,solid black ref (spectral pilot 2026-05-24)
-f3a1fbc3bc8f768265400724bb9800d322f8e0b1461b2c585540845ea8352c5d,f3a1fbc3-winter_scene_X.png,neg,local (SDXL/processed),sdxl-or-processed,2816,1536,png,,,none,2026-05-24T18:52:23Z,metadata-clean: no C2PA/SynthID source
-f07bc0bcad09a5a5687ae312a1298c9ddd110a5e414265efc52ef4d524b36f86,f07bc0bc-api_enterprise_gate_ax.png,neg,local (SDXL/processed),sdxl-or-processed,1080,1350,png,,,none,2026-05-24T18:52:23Z,metadata-clean: no C2PA/SynthID source
-89571987e368f1ce82f9dedfa9101584434def842e50d1f4c759de64db5c21d9,89571987-c87bd3c48a4443a68cb84a65604dacd3_clean.png,neg,local (SDXL/processed),sdxl-or-processed,2816,1536,png,,,none,2026-05-24T18:52:23Z,metadata-clean: no C2PA/SynthID source
 7b650522d42db09568e249c04d683c469fb3e280a2c53fcd1031cb9df27c619a,"7b650522-ChatGPT Image May 24, 2026, 12_19_54 PM.png",pos,ChatGPT,gpt-image,1602,982,png,OpenAI,yes,c2pa-metadata,2026-05-24T19:20:25Z,content: misty pine forest at dawn
 fb28dba2a82cc101a92fdee5714867b32610d0564f37737fe4bb70782b8ecf32,fb28dba2-Gemini_Generated_Image_dsjlnsdsjlnsdsjl.png,pos,Gemini app,gemini,2816,1536,png,Google LLC,yes,c2pa-metadata,2026-05-24T19:30:25Z,content: elderly fisherman portrait
 d20d4cc936dbdfe909c52502039a9e84ba93d97b42b24a0acee5b7d6c71930ae,d20d4cc9-Gemini_Generated_Image_ug6kdpug6kdpug6k.png,pos,Gemini app,gemini,2816,1536,png,Google LLC,yes,c2pa-metadata,2026-05-24T19:33:15Z,content: red coffee mug product shot
 28f323345f6496d936c3f1a72f671ddf59d0f81565c24a63bf3286860f633afe,28f32334-chatgpt_fisherman.png,pos,ChatGPT,gpt-image,1023,1537,png,OpenAI,yes,c2pa-metadata,2026-05-24T19:39:20Z,content: elderly fisherman portrait (fetch+blob dl)
 88e61a384c2e0b12d97bc66046e4a10542b2987448ba89c4b49e66311e969c84,88e61a38-chatgpt_tokyo.png,pos,ChatGPT,gpt-image,1023,1537,png,OpenAI,yes,c2pa-metadata,2026-05-24T19:42:02Z,content: tokyo street night (fetch+blob dl)
-607087e40da1ac2636f7233c06784295d374d503ab928bb0c0c9b09e0140b3bc,607087e4-IMG_0505.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
 1fa5f77f710c11a4cc69fed60195450def734401ed57c2600a84ce191f985440,1fa5f77f-IMG_0786.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-ac32346771d3ebb6b9d7d395e1efad995972fb708b76082905d15299d61dcfaa,ac323467-IMG_0114.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
 2ea228ed270cd169e9d38bc3f1a162de7edbf54b6e5ad3c701a3c90010ec7067,2ea228ed-IMG_1791.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-eb0e14f7c8dfe88d710804fe0d2e74eb033d4d72db5525a526bb3751f2d52f4f,eb0e14f7-ai_price_software_not_hardware.png,neg,iPhone (me/post_photos),,1200,675,png,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-cd2c0eba3625bf7a90178063b4a769667cf00904db968efff7502734f8456892,cd2c0eba-IMG_3201.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-208b21ccfa8c81d2e75903a6083f2806ac068d856ad12957e6f6ea7870af0096,208b21cc-IMG_0712.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-f9c64806fd2b1ea4cf39a49f67e651f2146e9c892f1a401d9981e9d7f0601062,f9c64806-grep_vs_vector_agentic_search.png,neg,iPhone (me/post_photos),,1600,900,png,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-beaae48cf40c8d471c9c1a49d205cd87cf6c079211847f66ced4d4310aa7cff4,beaae48c-IMG_1699.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-41307ceeb9c981fa766ec4d711fe72f647fce86d21f1026e63c45dcd95063a65,41307cee-IMG_2148.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-3801fbe36a77134336508f888f658deb03657c5b765c8b3205b2d928e1b3a5f8,3801fbe3-IMG_2364.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-3012ff6d1db0535423c4dfb22e8d4d2da77b94b776c38cf06fa06958b7a71860,3012ff6d-IMG_2489.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-b978efbdec5ec96b320e53fb23a1aec306f5a32a796a56a032ae66929c803e7b,b978efbd-IMG_0334.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-1136f4df74e842e4ba95c91731656e4bf125361b0aa83b1fc4e128161668a8fe,1136f4df-IMG_0363.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-6e768835f52e840ec0f6af4a9604bd31ed38b2ce3fa187cfe5cc7daa2acb56e4,6e768835-IMG_3492.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-5470ded7892073b1deb31980b3cc541ce73b4cf025d56a43eb6e80c2db810ff2,5470ded7-IMG_1417.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
 0bb4c176d83fbcbf4e628de7587d6183b9134c4f3fa85f55b96e94185273c7f6,0bb4c176-IMG_1790.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-c1f3267973e33e91c82ab889d21b6be18a6128e2178a85403bf89b04a6ea8c36,c1f32679-IMG_2981.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-efcb985a4ecc055029bea0df82ba161442340b1df6aa54639c2c717f8ebe7c4e,efcb985a-IMG_0841.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-383c6d9f4d74d1d30eeab2bfbe9b83212dcedb52b36b8ac403efa45730563326,383c6d9f-IMG_1616.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-b284d9ad7f58a44dc2b0d2e69b12236cf004d5052fb5484cfa1c21548bfd3821,b284d9ad-IMG_1250.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-85802ce2d2d8a7a155e631ef36a82cb912691fbbab4b2c28bb2438efed0b9225,85802ce2-IMG_2973.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-15b1e4e26340630345fc18e439ec98995ddca2816f38e13d4b2ee9e99ed26bac,15b1e4e2-IMG_1563.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-d8a1eed3cc327b5db7f5fd635fd4c37b29ff24a3360fce57622ea1cf35af284a,d8a1eed3-IMG_1666.heic,neg,iPhone (me/post_photos),,3024,4032,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-505047f592db5fd2ce4fc0fc3580e0b28abc19b6720a98a73530f2cb7158f7c1,505047f5-IMG_2569.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:47Z,post photo; no C2PA/SynthID (verified)
-a499773829f0ed206f9bd8c46740fc01955c1d43f45e8e775582015d9db9956c,a4997738-IMG_1980.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-a2f98b6a8887c7b4909601c46d03fb1f6e5145e714ffe3bc8b7056bc636bfee0,a2f98b6a-IMG_0780.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-9172987b14366231857e74a3f7b554ec0fc8cc23ebb7f88cd8eca3ce95ef8498,9172987b-IMG_3293.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-2f21fcd7b1ace88aa368028a7a97ffadd6ebe7cffe6c221d47abbed2a205074b,2f21fcd7-IMG_3144.PNG,neg,iPhone (me/post_photos),,2250,3000,png,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-d95e9af4d343501c4597918b5dfc66a1afc338b126e29c9eba13e7b2a61174d5,d95e9af4-IMG_1390.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-25b72de3a2ba4110c5dea68e82af6d19592eecc7000b2f12f52f8512afd48e73,25b72de3-IMG_1369.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-d18874c51b17ced8f736e24cd12ba54bd6c4f76292cba702a9c8a2d97c72f1c4,d18874c5-IMG_1447.HEIC,neg,iPhone (me/post_photos),,3088,2316,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-bf5abcd01037f44b2418b586c3b864340188a00f95047433832972ab797ae2d5,bf5abcd0-IMG_0743.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-a2782e0e6bb3d611925cace6ca3da10259ae70229aad3f366bc25b9e94538ab4,a2782e0e-IMG_0345.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 3fc0c4253f86427777904f41355eacbdcc1a29f6897ec694c7fc68b6e7f70846,3fc0c425-IMG_1450.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-56023f628e6d8ad0a3fb204b5bd10c9e9182446bad9032b0ab8c8d068a311bc7,56023f62-IMG_1796.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-100a121953049a83a714cd8771c7ac3f5afba69d8f8abb073535e98358395014,100a1219-IMG_0037.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-3e287f9e838f4f1bef5d8417957ea504954e5851de61656bbe32915c90db3a1f,3e287f9e-IMG_2323.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-237ff92d14163216687649f1fe222d5427f8600d8a97cb667386e71466a5d908,237ff92d-IMG_2270.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-a3f4a1a85bbd1cc6236e20c5a7d58bc18ccf695bc471cc02f36c1ad885551df8,a3f4a1a8-IMG_1309.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-be2f8bcb71f4bc5a4e79821bb4691e0f3c817ce916a35b05ffacce003a380c1c,be2f8bcb-IMG_0999.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-d5a4f2f81e86696cd18d38796c6b92ce96dcfe073bfd3a9c5dedf9d574aa66d6,d5a4f2f8-span_vs_flattening.png,neg,iPhone (me/post_photos),,1600,1000,png,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 2b148db2b1a314a87647a03828b3d235e7c4c939252f448b572b7658c7bb9723,2b148db2-IMG_1832.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 2d02fed0b6d60ce1142eadac9837a83896569dddbdad7cc5cfdec018f0506d36,2d02fed0-IMG_1520.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-68bf936a5491478484a295b3d882fef042f77e9784cae1b64a9e6e1b72d0628c,68bf936a-IMG_1107.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-32a9b71a13ecec3c90dcd7b54b90206acbe0f646a2296c955e227baa83823eec,32a9b71a-IMG_1238.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 8f170c06f843c2bcf4cf6e249dd76365287fdb3a322637ba93c570f50cb19772,8f170c06-IMG_1078.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-f7634a3779812f52de0599736b4c35f55b61027bae191e4ca060b10341661731,f7634a37-IMG_1605.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-e2ae859a96a5076f37b6efc5a1dad4952e29550f93cee4bba4899ef6fda09305,e2ae859a-IMG_3394.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-b4ea1e6f9134dfc91b4334ed723a15c937eee4fe3fd65b210cc31959884e5c4e,b4ea1e6f-IMG_1595.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-bf9d4d9ebb17cbae46407446d440b273fc136ea3e157a648e4959b116fca376d,bf9d4d9e-IMG_0916.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-2546689c376f365188a5e5a85e72982ff099b5680608e861c8490bde340e8a29,2546689c-IMG_2481.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-88944f46e3d85ea5c4f6d4559f8da9360f68060f73bb8b8c3344c3fdd3b54476,88944f46-IMG_2157.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 3fc4c8316012abc462df5534d4d995e5af84d35076a2927331107ff994293d9e,3fc4c831-IMG_2566.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-af59d9a72a859a72b6ad8e6178992e320934f74eb2a88d74c9d4c64b5bdb89f5,af59d9a7-IMG_2198.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-4f9d6807ff42d0bcd9494dc5d4c9d15f7b96691e29bfe2d670b8e3bceba934de,4f9d6807-IMG_0371.HEIC,neg,iPhone (me/post_photos),,3088,2316,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-237492e65e73acacf8135a2a903a2a231ee9c68ddcc2c590e90ec6e54c6a4520,237492e6-IMG_0473.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-d8a339db6b19c71d4ccf1a467c8999c5d2947b5c8cfd07a8b17b343f579e3f26,d8a339db-IMG_1798.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-abe73f771fb57c959663070cb560cfd5365999ef6b9aa419b18ea1031fab4a9d,abe73f77-IMG_3434.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-15fbe3e101bce529ec9b7a49fb668ecdad62c3aceb6e649f4668b58af1784c32,15fbe3e1-IMG_0481.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-455d618e94ebf2e469ede016e06c48def5cc14ef68c090584b31570b9fc5e34e,455d618e-IMG_2957.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-dae46cfca7baa921675ffaf74701617b6fe10e629c5e7f099c67bf21a3f2a62c,dae46cfc-IMG_0356.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-cb4d61e66982736d552b043866d80bfb304fe1f44ec07f3acabeff71d08b3708,cb4d61e6-IMG_1681.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-c7776595d517bebab73370b6395deb1dc2bb507f99d2bd551bfe1a2416f5165b,c7776595-168E1031-ADC1-48A2-8B63-F5EB228DF5B4.JPG,neg,iPhone (me/post_photos),,3664,2062,jpeg,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 5fe59521d579b536340253d2bcaa7c28ddd2485fa964fc27a9b9e5118ad0cdd1,5fe59521-IMG_1496.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-81e4e532c124b182b1608d19feda52b829390adc9b77f47b72d89829035917ff,81e4e532-IMG_2193.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
 4ead7918a5aeea7fba78b36af44358fea7ed1db7f46f4bc675152b9d04e68c38,4ead7918-IMG_1300.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:48Z,post photo; no C2PA/SynthID (verified)
-75f8a25c217374689d8224d58736f09245882334a9e4d39931025bd66a6df341,75f8a25c-IMG_3540.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-574acd7b8a49652d62df90539c2e18d1f3f510399a294f6c5209ab725c96a7df,574acd7b-IMG_3393.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-8115feaa7b758fd1b984c55355fc8f4c10dfe02192fe810bb6692556190d5176,8115feaa-IMG_1341.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
 4c795238b89178cf52a3674e721ed7f4cd5068028385491d12171a3c62545c35,4c795238-IMG_3034.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
 5abfaccb37c549de67c7f3a751a528a423e24a82c643fdb29094be8debbb206d,5abfaccb-IMG_3018.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
 5fed1923d513c1e9ffcba2f240e617fa9344fb39d35144169570ece8b0bd0f33,5fed1923-IMG_0272.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-b3e1b034bc9ff1fd7e3db77ae0f0a695fcb4ed7bdcb473312427d78aa18700a1,b3e1b034-IMG_1199.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-79a12ccab0ccb954b1917d8edc75cb7c01d02c3a803b34f45be7afdb69cf80ea,79a12cca-IMG_0767.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-7252adc2103f7be6d04d56e0eed0d90122c8203af0ae08c28f922338b7c1bbb5,7252adc2-IMG_0623.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
 06b04d8fe8e1cd6bee9a973f93bfda37586924cbfec7d372f59d52aa9196160b,06b04d8f-IMG_1474.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-591636c01c57864c44bdf7c1062bf6fca87efa8fae25bfc58c7cffb5a73424ab,591636c0-IMG_2809.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-ca2f226f45a5e37071605f074fa64de31cd09f923b22f57bb8255aa9046c6b92,ca2f226f-IMG_1419.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-ed751e2489ce4b26c268019942ed65a1f95a10f8056f26ac646d7d19e5db58ad,ed751e24-IMG_1225.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-3757e6100e567cbbf8eadf4cb8a064d79073cea1588251125a3b1ae13893e778,3757e610-IMG_2583.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-e973424c779cfa5dcd2403f103673423771192509395586f8efc459c92240d5d,e973424c-IMG_2215.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-46657fb69680b3e5db8fdb17aa306f2b6ee41a719408ac5812ff4cb399e15485,46657fb6-IMG_1439.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-dd112d116dda31847b50f40ab0990306d1c1f137780c67bb094ee6992f2d6f7e,dd112d11-IMG_1317.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-a0cdcc17d39eda2a7b2c34ff1f4ed97290fa996fef530c1d24da91722b1a6893,a0cdcc17-IMG_0005.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-70fabcbeedafb3c033d5805328ffd12bf644102e8666b878eca5968bd075b3fe,70fabcbe-IMG_3500.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
 8fdb574a94e65e14ac29017cf2d5a2ede18a8c4e3f12e04c64292b0d38570062,8fdb574a-IMG_3557.HEIC,neg,iPhone (me/post_photos),,4032,3024,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-cb6777332e357aa38916400c2c1fe76801aad54946e789e9fa6a7d4659d02948,cb677733-IMG_3582.HEIC,neg,iPhone (me/post_photos),,5712,4284,heic,,,none,2026-05-24T20:58:49Z,post photo; no C2PA/SynthID (verified)
-72c71846fdb9eb3d960142c24627304349ee4fd8665d10d06e336430b0e20d80,72c71846-meta_lake.jpg,neg,Meta AI,meta,810,1440,jpeg,,,none,2026-05-24T21:33:47Z,"IPTC Made-with-AI (trainedAlgorithmicMedia); NO SynthID, NO C2PA"
 c86973424817f62510e2a312b85c52e05adf47ace87a8e717fd442607596f501,c8697342-aistudio_lake.png,pos,Google AI Studio (Nano Banana),gemini-2.5-flash-image,1024,1024,png,,,gemini-app,2026-05-24T21:39:09Z,"API/playground: SynthID pixel CONFIRMED (Gemini-app oracle) + visible sparkle, but NO C2PA/IPTC -> synthid_source blind spot"
 1f81827c06d67cf6f6c7f5d53ec8f9738183942a6d1d2717b161fea0fdcc540a,1f81827c-Designer.png,pos,Microsoft Designer,dall-e (Designer),1024,1024,png,"OpenAI, Microsoft",yes,c2pa-metadata,2026-05-24T22:18:40Z,C2PA issuer OpenAI+Microsoft; synthid_source=OpenAI (DALL-E surface inherits OpenAI SynthID+C2PA)
-f3ebe4683fc40aa2a0b80cc3ced3dc8062385ae32b488f4b33cb2330949e658d,f3ebe468-leonardo_lake.jpg,neg,Leonardo.ai,lucid-origin,1024,1024,jpeg,,,none,2026-05-24T22:22:15Z,non-SynthID AI; NO provenance metadata (no C2PA/IPTC/SynthID)
-12775f4c0aec1ecd615e88c4941a788a053d0258d08d31ad34d330d3e21969bd,12775f4c-grok_original.jpg,neg,Grok (xAI),aurora,784,1168,jpeg,,,none,2026-05-24T22:47:46Z,full-res original via Download button; xAI non-adopter; NO C2PA/IPTC/SynthID (has benign EXIF block)
-74b605deb102d74443a182f70fbea34a6a470bed381d62ae0bfa0083a6ecc5a3,74b605de-_e1f7984d-98e7-4cdc-91d2-f72314a4bc56.jpeg,neg,Bing Image Creator,MAI-Image-2e,1024,1024,jpeg,,,c2pa-metadata,2026-05-25T00:10:28Z,C2PA issuer Microsoft; non-SynthID; issuer-coverage fixture
-f9bb6b1039ee228221d2eead7daebd46422a36a4a8959a74fa0198e1aa19f9b8,f9bb6b10-a_red_ceramic_coffee_mug_on_a_wooden_table_soft_morning_light_photorealistic_20260525000725_04.png,neg,Stability Brand Studio,Stable Image,1024,1024,png,Stability AI,,c2pa-metadata,2026-05-25T00:10:31Z,C2PA issuer Stability AI; non-SynthID; no imwatermark
-23a06e0067930a9ad09a803f634414eb8ca0234fc0bbaca8d33f138745175e2e,23a06e00-a-red-ceramic-coffee-mug-on-a-wooden-table--soft-m.png,neg,Recraft V4.1,recraft-v4,896,1152,png,,,none,2026-05-25T01:21:35Z,"PNG export, no C2PA/EXIF/IPTC/imwatermark; clean download"
-4f3fea84c24fda8d72a6e7bfbae31827348d9edc755ec9a5e8c835860130de57,4f3fea84-a_red_ceramic_coffee_mug_on_a_wooden_table_soft_morning_light_photorealistic_67qgxtyin9kjk5yb5mph_0.png,neg,Krea (FLUX 2 host),flux-2-dev via Krea,832,1248,png,,,none,2026-05-25T01:21:38Z,no imwatermark despite FLUX; Krea host strips/omits; clean download
-7bdff2c3131cdc21783282a8a95c88f4b14ad38494a1041d0d68691af7fa5cd8,7bdff2c3-0001_1_a-red-ceramic-coffee-mug-sits-on-weather_D3BRZfOyUwuh5Emjtu8v4g_F7yI1GFGTayDA1NAUmkraw_cover.jpeg,neg,Ideogram,ideogram-3,1024,1024,jpeg,,,none,2026-05-25T01:36:38Z,EXIF Make='Ideogram AI'; no C2PA/SynthID; caught via exif_generator
-ca2162624607b8f030c63cb1371d6afdd3f0d7af3d9b17514f7ae64a2e8f378c,ca216262-0001_2_a-red-ceramic-coffee-mug-sits-on-weather_rs0Lt1beXV-Mwjs33vWKVw_F7yI1GFGTayDA1NAUmkraw.jpeg,neg,Ideogram,ideogram-3,1024,1024,jpeg,,,none,2026-05-25T01:36:38Z,EXIF Make='Ideogram AI'; no C2PA/SynthID; caught via exif_generator
-8a90f2ddf83ceedd7944531d27248191c79dc321ec76ea1f36df6cff9f6b8916,8a90f2dd-0001_3_a-red-ceramic-coffee-mug-sits-on-weather_Lm96lBwcXsmdeCfCpm52vw_F7yI1GFGTayDA1NAUmkraw.jpeg,neg,Ideogram,ideogram-3,1024,1024,jpeg,,,none,2026-05-25T01:36:38Z,EXIF Make='Ideogram AI'; no C2PA/SynthID; caught via exif_generator
-87fca198d5c436b27a16685972802a2ff0a310a941248c9ec8d81560d7f387a1,87fca198-0001_4_a-red-ceramic-coffee-mug-sits-on-weather_pGmlgcH4XqSaq41hc0a9AQ_F7yI1GFGTayDA1NAUmkraw.jpeg,neg,Ideogram,ideogram-3,1024,1024,jpeg,,,none,2026-05-25T01:36:38Z,EXIF Make='Ideogram AI'; no C2PA/SynthID; caught via exif_generator
+f6dd47a5ffd319aea21bf10dcf9877097666420b02c2620080bac12b03976e7e,f6dd47a5-4ef377bd-gpt-image-2-cleaned.png,cleaned,"our pipeline (invisible/SDXL, native-res default)",stabilityai/stable-diffusion-xl-base-1.0,1254,1254,png,,,openai-verify,2026-05-25T20:50:38Z,"cleaned from 4ef377bd via v0.5.3 'all' at native 1254x1254 (prod-equivalent); openai.com/verify: SynthID NOT detected. Re-confirms #10 native-res default defeats OpenAI SynthID (closes #15 root cause). Note: native res OOMs on 20GB MPS, auto-fell back to CPU."
@@ -1,6 +1,6 @@
 [project]
 name = "remove-ai-watermarks"
-version = "0.5.3"
+version = "0.6.0"
 description = "Remove visible and invisible AI watermarks from images (Gemini / Nano Banana, ChatGPT, Stable Diffusion)"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -36,6 +36,21 @@ gpu = [
 detect = [
    "invisible-watermark>=0.2.0",
 ]
+# Adobe TrustMark decoder -- the open, keyless watermark behind Adobe Durable
+# Content Credentials (soft-binding alg ``com.adobe.trustmark.P``). Optional
+# because it pulls torch and downloads model weights on first use. identify()
+# guards the import and skips the TrustMark signal when absent.
+trustmark = [
+    "trustmark>=0.8.0",
+]
+# Universal region eraser backend -- big-LaMa via onnxruntime (Carve/LaMa-ONNX,
+# Apache-2.0). CPU, no torch. Model (~200 MB) is downloaded on first use and
+# cached by huggingface_hub; it is never bundled in this repo. The default cv2
+# eraser backend needs none of this.
+lama = [
+    "onnxruntime>=1.16.0",
+    "huggingface-hub>=0.20.0",
+]
 dev = [
    "pytest>=8.0.0",
    "pytest-cov>=4.1.0",
@@ -43,7 +58,7 @@ dev = [
    "pyright>=1.1.0",
    "invisible-watermark>=0.2.0",
 ]
-all = ["remove-ai-watermarks[gpu,detect,dev]"]
+all = ["remove-ai-watermarks[gpu,detect,trustmark,lama,dev]"]

 # diffusers 0.38.0 (security fix for GHSA-98h9-4798-4q5v) declares a dependency
 # on safetensors>=0.8.0rc0 — a pre-release. Allow pre-releases globally so the
@@ -1,3 +1,3 @@
 """Remove-AI-Watermarks: Unified tool for removing visible and invisible AI watermarks."""

-__version__ = "0.5.3"
+__version__ = "0.6.0"
@@ -26,12 +26,15 @@ from remove_ai_watermarks.metadata import (
    AI_METADATA_KEYS,
    AIGC_MARKERS,
    C2PA_UUID,
+    IPTC_AI_FIELD_MARKERS,
    IPTC_AI_MARKERS,
    aigc_label,
    exif_generator,
    get_ai_metadata,
+    iptc_ai_system,
+    xai_signature,
 )
-from remove_ai_watermarks.noai.c2pa import extract_c2pa_info
+from remove_ai_watermarks.noai.c2pa import extract_c2pa_info, soft_binding_vendors_in
 from remove_ai_watermarks.noai.constants import C2PA_AI_TOOLS, C2PA_ISSUERS

 if TYPE_CHECKING:
@@ -161,6 +164,17 @@ def _invisible_watermark(image_path: Path) -> str | None:
    return detect_invisible_watermark(image_path)


+def _trustmark(image_path: Path) -> str | None:
+    """Adobe TrustMark scheme name or None.
+
+    Optional: needs the ``trustmark`` decoder (extra ``trustmark``). Returns None
+    if it is not installed or no TrustMark watermark decodes.
+    """
+    from remove_ai_watermarks.trustmark_detector import detect_trustmark
+
+    return detect_trustmark(image_path)
+
+
 def identify(image_path: Path, *, check_visible: bool = True, check_invisible: bool = True) -> ProvenanceReport:
    """Identify an image's origin platform and watermark inventory.

@@ -212,6 +226,14 @@ def identify(image_path: Path, *, check_visible: bool = True, check_invisible: b
        if "OpenAI" in (" ".join(issuers) + synthid):
            caveats.append(_OPENAI_CAVEAT)

+    # ── C2PA soft-binding: a named forensic/third-party watermark vendor ─
+    # (Adobe TrustMark, Digimarc, Imatag, ...). Present in the manifest even when
+    # the watermark itself can't be decoded; names whose watermark stamped the pixels.
+    soft_binding = meta.get("soft_binding") or (", ".join(v) if (v := soft_binding_vendors_in(head)) else None)
+    if soft_binding:
+        signals.append(Signal("soft_binding", f"C2PA soft binding: {soft_binding}", "high"))
+        watermarks.append(f"Forensic watermark soft binding ({soft_binding})")
+
    # ── IPTC "Made with AI" (Meta etc.), only meaningful without C2PA ─
    iptc = any(m in head for m in IPTC_AI_MARKERS)
    if iptc and not has_c2pa:
@@ -221,6 +243,18 @@ def identify(image_path: Path, *, check_visible: bool = True, check_invisible: b
        if platform is None:
            platform = "Made-with-AI tag (e.g. Meta AI); platform not specified"

+    # ── IPTC 2025.1 AI-disclosure fields (Iptc4xmpExt:AISystemUsed etc.) ─
+    iptc_ai = any(m in head for m in IPTC_AI_FIELD_MARKERS)
+    if iptc_ai:
+        system = iptc_ai_system(image_path)
+        named = bool(system) and system != "fields present"
+        signals.append(
+            Signal("iptc_ai_system", f"IPTC AI disclosure ({system})" if named else "IPTC AI disclosure fields", "high")
+        )
+        watermarks.append(f"IPTC 2025.1 AI disclosure ({system})" if named else "IPTC 2025.1 AI disclosure fields")
+        if platform is None and named:
+            platform = f"{system} (IPTC AISystemUsed)"
+
    # ── China TC260 AIGC label (Doubao and other China-served gens) ──
    aigc = any(m in head for m in AIGC_MARKERS)
    if aigc:
@@ -246,6 +280,16 @@ def identify(image_path: Path, *, check_visible: bool = True, check_invisible: b
        if platform is None:
            platform = f"{generator_tag} (EXIF/XMP generator tag)"

+    # ── xAI / Grok EXIF signature scheme (no C2PA/SynthID/IPTC) ──────
+    # Grok's only provenance signal: EXIF ImageDescription "Signature: <base64>"
+    # + a UUID Artist. Distinct from exif_generator (which matches generator
+    # tokens); verified stable across 3 generations. See CLAUDE.md.
+    if xai_signature(image_path):
+        signals.append(Signal("xai_signature", "EXIF Signature blob + UUID Artist", "high"))
+        watermarks.append("xAI/Grok EXIF signature")
+        if platform is None:
+            platform = "xAI (Grok / Aurora)"
+
    # ── Open invisible watermark (SD / SDXL / FLUX, dwtDct) ──────────
    # Public decoder, no key -- a definitive embedded signal on pristine files.
    if check_invisible and (scheme := _invisible_watermark(image_path)) is not None:
@@ -255,11 +299,29 @@ def identify(image_path: Path, *, check_visible: bool = True, check_invisible: b
        if platform is None:
            platform = f"{scheme} (open DWT-DCT watermark)"

+    # ── Adobe TrustMark invisible watermark (open decoder, no key) ───
+    # The watermark behind Adobe Durable Content Credentials. Decoded locally,
+    # but it binds provenance for human-authored content too, so it enriches the
+    # watermark inventory without by itself asserting AI origin.
+    if check_invisible and (tm_scheme := _trustmark(image_path)) is not None:
+        signals.append(Signal("trustmark", tm_scheme, "high"))
+        watermarks.append(f"Adobe TrustMark invisible watermark ({tm_scheme})")
+        if platform is None:
+            platform = "Adobe (TrustMark / Content Credentials)"
+
    # ── Verdict so far (metadata + embedded watermark) ──────────────
    invisible_wm = any(s.name == "invisible_watermark" for s in signals)
    exif_gen = any(s.name == "exif_generator" for s in signals)
+    xai_sig = any(s.name == "xai_signature" for s in signals)
    ai_from_metadata = bool(
-        (has_c2pa and (c2pa_is_ai or synthid)) or iptc or aigc or local_keys or invisible_wm or exif_gen
+        (has_c2pa and (c2pa_is_ai or synthid))
+        or iptc
+        or iptc_ai
+        or aigc
+        or local_keys
+        or invisible_wm
+        or exif_gen
+        or xai_sig
    )

    # ── Visible Gemini sparkle (fallback for stripped-metadata case) ─
@@ -42,6 +42,24 @@ def is_available() -> bool:
        return False


+def _target_size(width: int, height: int, max_resolution: int) -> tuple[int, int] | None:
+    """Compute the downscaled (width, height) for a long-side cap, or None for native.
+
+    Returns None when no pre-downscale is needed: ``max_resolution <= 0`` (native
+    resolution, the default that matches the raiw.cc backend -- see issue #10) or
+    the long side already fits the cap. Otherwise scales the long side down to
+    ``max_resolution`` preserving aspect ratio (integer-truncated, matching the
+    PIL ``resize`` call site). Pure function so the native-vs-downscale decision
+    is unit-testable without loading the diffusion model.
+    """
+    if max_resolution > 0 and max(width, height) > max_resolution:
+        ratio = max_resolution / max(width, height)
+        # Clamp the short side to >=1: extreme aspect ratios (e.g. 5000x3 capped
+        # at 1024) would otherwise truncate it to 0 and crash image.resize().
+        return (max(1, int(width * ratio)), max(1, int(height * ratio)))
+    return None
+
+
 class InvisibleEngine:
    """Remove invisible AI watermarks using diffusion model regeneration.

@@ -142,37 +160,26 @@ class InvisibleEngine:
        image = Image.open(image_path)
        image = ImageOps.exif_transpose(image)
        orig_size = image.size  # (width, height)
-        _tmp_path = None

-        if max_resolution > 0 and max(image.width, image.height) > max_resolution:
-            ratio = max_resolution / max(image.width, image.height)
-            new_size = (int(image.width * ratio), int(image.height * ratio))
+        # Optional long-side downscale; native resolution by default (issue #10).
+        target = _target_size(image.width, image.height, max_resolution)
+        if target is not None:
            if self._progress_callback:
                self._progress_callback(
                    f"Downscaling {image.width}x{image.height} "
-                    f"to {new_size[0]}x{new_size[1]} "
+                    f"to {target[0]}x{target[1]} "
                    f"(max-resolution cap {max_resolution}px)..."
                )
-            image = image.resize(new_size, Image.Resampling.LANCZOS)
+            image = image.resize(target, Image.Resampling.LANCZOS)

-            # Save to a temp file instead of overwriting the original
-            _tmp_fd, _tmp_str = tempfile.mkstemp(suffix=image_path.suffix)
-            _tmp_path = Path(_tmp_str)
-            image.save(_tmp_path)
-            import os as _os
-
-            _os.close(_tmp_fd)
-            image_path = _tmp_path
-        else:
-            # We must save the transposed image back to a tmp file if it was rotated
-            # otherwise WatermarkRemover will reload it without EXIF rotation!
-            _tmp_fd, _tmp_str = tempfile.mkstemp(suffix=image_path.suffix)
-            _tmp_path = Path(_tmp_str)
-            image.save(_tmp_path)
-            import os as _os
-
-            _os.close(_tmp_fd)
-            image_path = _tmp_path
+        # Always persist to a temp file, even without downscaling: WatermarkRemover
+        # reloads by path, so the EXIF-transposed pixels must be saved or rotation
+        # is lost. Cleaned up in the finally block via _tmp_path.
+        _tmp_fd, _tmp_str = tempfile.mkstemp(suffix=image_path.suffix)
+        _tmp_path = Path(_tmp_str)
+        image.save(_tmp_path)
+        os.close(_tmp_fd)
+        image_path = _tmp_path

        try:
            # Optional: Face protection (Phase 1 - Extraction)
@@ -253,7 +260,8 @@ class InvisibleEngine:

            return out_path
        finally:
-            if _tmp_path is not None and _tmp_path.exists():
+            # _tmp_path is always set above (we persist the image unconditionally).
+            if _tmp_path.exists():
                _tmp_path.unlink()

    def remove_watermark_batch(
@@ -10,6 +10,7 @@ from __future__ import annotations

 import contextlib
 import logging
+import re
 from typing import TYPE_CHECKING

 if TYPE_CHECKING:
@@ -73,6 +74,29 @@ IPTC_AI_MARKERS: tuple[bytes, ...] = (
    b"compositeWithTrainedAlgorithmicMedia",
 )

+# IPTC Photo Metadata 2025.1 (published 2025-11-27) added explicit AI-disclosure
+# XMP properties in the Iptc4xmpExt namespace. Their mere presence is an AI
+# signal; ``AISystemUsed`` additionally carries the generator name. Property
+# tokens verified against the IPTC 2025.1 specification.
+IPTC_AI_FIELD_MARKERS: tuple[bytes, ...] = (
+    b"AISystemUsed",
+    b"AISystemVersionUsed",
+    b"AIPromptInformation",
+    b"AIPromptWriterName",
+)
+
+# ISOBMFF containers whose AI-provenance boxes ``remove_ai_metadata`` strips at
+# the container level (image, video, audio -- all ISOBMFF). A content sniff
+# (``ftyp``) is also accepted, so this is a fast-path hint, not the sole gate.
+_ISOBMFF_EXTS: frozenset[str] = frozenset({".avif", ".heif", ".heic", ".jxl", ".mp4", ".mov", ".m4v", ".m4a"})
+
+# Non-ISOBMFF audio/video we can DETECT (binary scan) but not strip at the
+# container level (EBML / framed / RIFF need re-encoding). remove_ai_metadata
+# fails clearly on these rather than crashing in the image path.
+_UNSUPPORTED_CONTAINER_EXTS: frozenset[str] = frozenset(
+    {".webm", ".mkv", ".mka", ".mp3", ".wav", ".flac", ".ogg", ".oga", ".opus", ".aac"}
+)
+
 # China's mandatory AI-content labeling (TC260, the national cybersecurity
 # standards committee). AI generators serving China embed an XMP block in the
 # TC260 namespace -- ``<TC260:AIGC>{"Label":"1",...}``. Doubao (ByteDance) uses
@@ -152,7 +176,13 @@ def has_ai_metadata(image_path: Path) -> bool:
        return True
    if any(marker in data for marker in AIGC_MARKERS):
        return True
-    return any(marker in data for marker in IPTC_AI_MARKERS)
+    if any(marker in data for marker in IPTC_AI_MARKERS):
+        return True
+    # IPTC 2025.1 AI-disclosure XMP properties (their presence flags AI content).
+    if any(marker in data for marker in IPTC_AI_FIELD_MARKERS):
+        return True
+    # xAI / Grok: no C2PA/IPTC/XMP -- only the EXIF Signature + UUID-Artist pair.
+    return xai_signature(image_path)


 def aigc_label(image_path: Path) -> dict[str, str] | None:
@@ -179,6 +209,26 @@ def aigc_label(image_path: Path) -> dict[str, str] | None:
    return {str(k): str(v) for k, v in parsed.items()} if isinstance(parsed, dict) else None


+def iptc_ai_system(image_path: Path) -> str | None:
+    """Return an IPTC 2025.1 AI-disclosure note if the file carries those XMP
+    properties, else None.
+
+    IPTC Photo Metadata 2025.1 added ``Iptc4xmpExt`` AI-disclosure properties
+    (see ``IPTC_AI_FIELD_MARKERS``); their presence alone flags AI content, and
+    ``AISystemUsed`` names the generator. Returns the ``AISystemUsed`` value when
+    extractable, otherwise the literal ``"fields present"``. Container-agnostic
+    raw-byte scan; handles both XMP element and attribute serializations.
+    """
+    with open(image_path, "rb") as f:
+        data = f.read(1024 * 1024)
+    if not any(marker in data for marker in IPTC_AI_FIELD_MARKERS):
+        return None
+    match = re.search(rb"AISystemUsed[=:\s]*[\"'>]\s*([^<\"']{1,120})", data)
+    if match and (value := match.group(1).decode("utf-8", "replace").strip()):
+        return value
+    return "fields present"
+
+
 def synthid_source(image_path: Path) -> str | None:
    """Return the vendor name(s) if the image carries a SynthID pixel watermark.

@@ -274,6 +324,97 @@ def exif_generator(image_path: Path) -> str | None:
    return None


+# xAI / Grok EXIF signature scheme. A 64+ char base64 blob after "Signature:"
+# is far beyond any incidental description text, and the UUID Artist makes the
+# pair xAI-specific -- both required keeps the false-positive rate near zero.
+_XAI_SIGNATURE_RE = re.compile(r"Signature:\s*[A-Za-z0-9+/=]{64,}")
+_UUID_RE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", re.IGNORECASE)
+
+
+def _is_xai_signature_pair(description: str, artist: str) -> bool:
+    """True if an EXIF (ImageDescription, Artist) pair is xAI/Grok's scheme."""
+    return _XAI_SIGNATURE_RE.match(description) is not None and _UUID_RE.fullmatch(artist) is not None
+
+
+def _exif_text(ifd: dict, tag: int) -> str:
+    """Decode a piexif 0th-IFD byte tag to a stripped string ('' if absent)."""
+    value = ifd.get(tag)
+    return value.decode("latin1", "replace").strip() if isinstance(value, bytes) else ""
+
+
+def xai_signature(image_path: Path) -> bool:
+    """Detect xAI / Grok's EXIF provenance signature scheme.
+
+    Grok image downloads (Aurora model) carry no C2PA, XMP, SynthID, or IPTC --
+    their only provenance signal is a private EXIF pair: ``ImageDescription`` =
+    ``"Signature: <base64>"`` together with ``Artist`` = the image UUID. Verified
+    stable across three independent generations (2026-05-26; see CLAUDE.md). The
+    signature is xAI's and is not locally verifiable (no public key); detection
+    keys on this distinctive, low-false-positive shape, not on the signature's
+    validity. It survives only on the *original* JPEG download -- the web-UI
+    image is a re-encoded WebP that drops EXIF.
+    """
+    try:
+        import piexif
+        from PIL import Image
+
+        with Image.open(image_path) as img:
+            exif_bytes = img.info.get("exif")
+        if not exif_bytes:
+            return False
+        tags = piexif.load(exif_bytes).get("0th", {})
+    except Exception as exc:  # unopenable format / malformed EXIF
+        logger.debug("xAI-signature EXIF read failed for %s: %s", image_path, exc)
+        return False
+
+    return _is_xai_signature_pair(
+        _exif_text(tags, piexif.ImageIFD.ImageDescription), _exif_text(tags, piexif.ImageIFD.Artist)
+    )
+
+
+def _scrub_ai_exif(exif_dict: dict) -> list[str]:
+    """Delete AI-provenance tags from a piexif dict's ``0th`` IFD, in place.
+
+    Removes (a) the xAI/Grok signature pair (``ImageDescription`` "Signature: ..."
+    + UUID ``Artist``) and (b) any ``Software`` / ``Make`` / ``Artist`` /
+    ``ImageDescription`` tag whose value carries an ``AI_GENERATOR_TOKENS`` token
+    (Ideogram's ``Make``, Firefly's ``Software``, etc.). Mirrors the detection in
+    ``xai_signature`` / ``exif_generator`` so removal scrubs exactly what
+    ``identify`` flags, while leaving genuine camera/editor EXIF intact. Returns
+    the names of the removed tags (for logging).
+    """
+    import piexif
+
+    from remove_ai_watermarks.noai.constants import AI_GENERATOR_TOKENS
+
+    ifd = exif_dict.get("0th")
+    if not ifd:
+        return []
+
+    drop: dict[int, str] = {}
+
+    # (a) xAI / Grok: the Signature blob and the UUID Artist go together.
+    if _is_xai_signature_pair(
+        _exif_text(ifd, piexif.ImageIFD.ImageDescription), _exif_text(ifd, piexif.ImageIFD.Artist)
+    ):
+        drop[piexif.ImageIFD.ImageDescription] = "ImageDescription"
+        drop[piexif.ImageIFD.Artist] = "Artist"
+
+    # (b) Known AI generator token in any of the text tags.
+    for tag, name in (
+        (piexif.ImageIFD.Software, "Software"),
+        (piexif.ImageIFD.Make, "Make"),
+        (piexif.ImageIFD.Artist, "Artist"),
+        (piexif.ImageIFD.ImageDescription, "ImageDescription"),
+    ):
+        if any(token in _exif_text(ifd, tag).lower() for token in AI_GENERATOR_TOKENS):
+            drop[tag] = name
+
+    for tag in drop:
+        ifd.pop(tag, None)
+    return list(drop.values())
+
+
 def get_ai_metadata(image_path: Path) -> dict[str, str]:
    """Extract AI-related metadata from an image.

@@ -285,7 +426,7 @@ def get_ai_metadata(image_path: Path) -> dict[str, str]:
    """
    from PIL import Image

-    from remove_ai_watermarks.noai.c2pa import extract_c2pa_info, synthid_verdict
+    from remove_ai_watermarks.noai.c2pa import extract_c2pa_info, soft_binding_vendors_in, synthid_verdict

    result: dict[str, str] = {}

@@ -315,19 +456,34 @@ def get_ai_metadata(image_path: Path) -> dict[str, str]:
        "source_type",
        "actions",
        "synthid_watermark",
+        "soft_binding",
    ):
        if key in c2pa:
            result.setdefault(key, str(c2pa[key]))

-    # Non-PNG containers (JPEG/WebP/AVIF): extract_c2pa_info is PNG-only, so
-    # fall back to the format-agnostic source check for the SynthID verdict.
+    # Non-PNG containers (JPEG/WebP/AVIF/MP4): extract_c2pa_info is PNG-only, so
+    # fall back to the format-agnostic source check for the SynthID verdict and
+    # the soft-binding (forensic-watermark vendor) scan.
    if "synthid_watermark" not in result and (vendor := synthid_source(image_path)):
        result.setdefault("synthid_watermark", synthid_verdict(vendor))
+    if "soft_binding" not in result:
+        with open(image_path, "rb") as f:
+            head = f.read(1024 * 1024)
+        if vendors := soft_binding_vendors_in(head):
+            result["soft_binding"] = ", ".join(vendors)

    # China TC260 AI-content label (Doubao and other China-served generators).
    if aigc := aigc_label(image_path):
        producer = aigc.get("ContentProducer", "")
        result["aigc_label"] = f"China AIGC label (TC260){f'; producer {producer}' if producer else ''}"
+
+    # xAI / Grok EXIF signature scheme (its only provenance signal).
+    if xai_signature(image_path):
+        result.setdefault("xai_signature", "xAI/Grok EXIF signature (Artist UUID + Signature blob)")
+
+    # IPTC 2025.1 AI-disclosure XMP fields (Iptc4xmpExt:AISystemUsed etc.).
+    if system := iptc_ai_system(image_path):
+        result.setdefault("ai_system", f"IPTC 2025.1 AI disclosure ({system})")
    return result


@@ -356,19 +512,34 @@ def remove_ai_metadata(
    if output_path is None:
        output_path = source_path

-    # AVIF/HEIF/JPEG-XL: strip C2PA boxes at the container level without
-    # re-encoding. Avoids needing PIL plugins (pillow-heif / pillow-jxl) and
-    # preserves pixel data bit-for-bit.
-    if source_path.suffix.lower() in (".avif", ".heif", ".heic", ".jxl"):
-        from remove_ai_watermarks.noai.isobmff import strip_c2pa_boxes
+    # ISOBMFF containers (AVIF/HEIF/JPEG-XL images, MP4/MOV/M4V video, M4A audio):
+    # strip C2PA + AI-label boxes at the container level without re-encoding.
+    # Avoids needing PIL plugins (pillow-heif / pillow-jxl) and preserves the
+    # codestream bit-for-bit. MP4/MOV/M4A are ISOBMFF too, so the same top-level
+    # uuid/jumb box walker applies. Route by suffix OR by an ``ftyp`` content
+    # sniff, so a correctly-shaped container is handled whatever its extension.
+    from remove_ai_watermarks.noai.isobmff import is_isobmff, strip_c2pa_boxes

+    with open(source_path, "rb") as f:
+        head = f.read(12)
+    if source_path.suffix.lower() in _ISOBMFF_EXTS or is_isobmff(head):
        data = source_path.read_bytes()
        cleaned, stripped = strip_c2pa_boxes(data)
        output_path.parent.mkdir(parents=True, exist_ok=True)
        output_path.write_bytes(cleaned)
-        logger.info("Stripped %d C2PA box(es) → %s", stripped, output_path)
+        logger.info("Stripped %d AI-provenance box(es) → %s", stripped, output_path)
        return output_path

+    # Containers we can detect (via identify's byte scan) but cannot strip at the
+    # container level: non-ISOBMFF audio/video (Matroska/WebM are EBML; MP3 is
+    # framed; WAV is RIFF). Re-encoding them is out of scope, so fail clearly
+    # rather than crash in the PIL image path below.
+    if source_path.suffix.lower() in _UNSUPPORTED_CONTAINER_EXTS:
+        raise ValueError(
+            f"container-level metadata removal is not supported for {source_path.suffix} "
+            "(detection via `identify` still works); re-encode it with a media tool to strip metadata"
+        )
+
    # Read image and filter metadata
    with Image.open(source_path) as img:
        img = img.copy()
@@ -407,6 +578,10 @@ def remove_ai_metadata(
            save_kwargs["pnginfo"] = pnginfo

        if exif_data and save_kwargs["format"] == "JPEG":
+            # Scrub AI-provenance EXIF tags (xAI/Grok signature, generator tokens)
+            # while keeping genuine camera/editor EXIF; PNG output drops EXIF entirely.
+            if removed := _scrub_ai_exif(exif_data):
+                logger.info("Scrubbed AI EXIF tag(s): %s", ", ".join(removed))
            with contextlib.suppress(Exception):
                save_kwargs["exif"] = piexif.dump(exif_data)

@@ -28,6 +28,7 @@ from remove_ai_watermarks.noai.constants import (
    C2PA_CHUNK_TYPE,
    C2PA_ISSUERS,
    C2PA_SIGNATURES,
+    C2PA_SOFT_BINDINGS,
    PNG_SIGNATURE,
    SYNTHID_C2PA_ISSUERS,
 )
@@ -174,6 +175,18 @@ def synthid_vendors_in(buffer: bytes) -> list[str]:
    return sorted({name for sig, name in C2PA_ISSUERS.items() if sig in buffer and sig in SYNTHID_C2PA_ISSUERS})


+def soft_binding_vendors_in(buffer: bytes) -> list[str]:
+    """Return forensic-watermark vendor names whose C2PA soft-binding ``alg``
+    identifier appears in ``buffer``.
+
+    A ``c2pa.soft-binding`` assertion names the watermark scheme that stamped the
+    pixels (Adobe TrustMark, Digimarc, Imatag, Steg.AI, ...). Shared by the PNG
+    caBX parser and the format-agnostic binary scan so both apply the same
+    C2PA_SOFT_BINDINGS rule against their respective bytes.
+    """
+    return sorted({name for sig, name in C2PA_SOFT_BINDINGS.items() if sig in buffer})
+
+
 def _parse_c2pa_chunk(chunk_data: bytes, c2pa_info: dict[str, Any]) -> None:
    """Parse C2PA chunk data and populate info dictionary."""
    c2pa_info["c2pa_manifest"] = f"C2PA manifest ({len(chunk_data)} bytes)"
@@ -238,6 +251,13 @@ def _parse_c2pa_chunk(chunk_data: bytes, c2pa_info: dict[str, Any]) -> None:
        c2pa_info["synthid_vendors"] = synthid_vendors
        c2pa_info["synthid_watermark"] = synthid_verdict(", ".join(synthid_vendors))

+    # Soft-binding: a forensic/third-party watermark vendor named in the
+    # manifest (Adobe TrustMark, Digimarc, ...), independent of the issuer.
+    soft_binding_vendors = soft_binding_vendors_in(chunk_data)
+    if soft_binding_vendors:
+        c2pa_info["soft_binding_vendors"] = soft_binding_vendors
+        c2pa_info["soft_binding"] = ", ".join(soft_binding_vendors)
+

 def extract_c2pa_chunk(image_path: Path) -> bytes | None:
    """
@@ -122,6 +122,26 @@ C2PA_AI_TOOLS = {
    b"Firefly": "Firefly",
 }

+# C2PA ``c2pa.soft-binding`` algorithm identifiers -> the forensic-watermark
+# vendor that stamped the pixels. The manifest's ``alg`` field names the
+# watermark scheme even when the watermark itself cannot be decoded locally, so
+# a byte-scan for these (keyed on a distinctive prefix to catch all variants)
+# tells us a third-party forensic watermark is present and whose. Verified
+# against the official C2PA registry (github.com/c2pa-org/softbinding-algorithm-list).
+# Adobe TrustMark is additionally decodable locally (see ``trustmark_detector``);
+# the rest (Digimarc, Imatag, Steg.AI, etc.) are proprietary oracle-only decoders.
+C2PA_SOFT_BINDINGS = {
+    b"com.adobe.trustmark": "Adobe TrustMark",
+    b"com.digimarc": "Digimarc",
+    b"com.imatag.lamark": "Imatag (Lamark)",
+    b"ai.steg": "Steg.AI",
+    b"com.microsoft.invismark": "Microsoft InvisMark",
+    b"com.microsoft.wavmark": "Microsoft WavMark",
+    b"com.verimatrix": "Verimatrix",
+    b"com.nagra.nexguard": "NAGRA NexGuard",
+    b"com.aiwatermark": "AIWatermark",
+}
+
 # Lowercased substrings that mark an AI generator when found in an EXIF
 # ``Software`` / XMP ``CreatorTool`` value. Conservative on purpose: plain
 # editors like "Adobe Photoshop" or "GIMP" must NOT match (no AI token), so only
@@ -23,13 +23,25 @@ from typing import TYPE_CHECKING
 if TYPE_CHECKING:
    from collections.abc import Iterator

-from remove_ai_watermarks.metadata import C2PA_UUID
+from remove_ai_watermarks.metadata import (
+    AIGC_MARKERS,
+    C2PA_UUID,
+    IPTC_AI_FIELD_MARKERS,
+    IPTC_AI_MARKERS,
+)

-# Top-level box types that carry C2PA payload. ``uuid`` boxes are checked
-# against ``C2PA_UUID`` before being stripped; ``jumb`` boxes are always
-# stripped (JPEG-XL uses them exclusively for JUMBF).
+# Top-level box types that may carry AI provenance. ``uuid`` boxes are checked
+# against ``C2PA_UUID`` / AI-label markers before being stripped; ``jumb`` boxes
+# are always stripped (JPEG-XL uses them exclusively for JUMBF).
 C2PA_BOX_TYPES: frozenset[bytes] = frozenset({b"uuid", b"jumb"})

+# AI-label byte markers (TC260 AIGC, IPTC "Made with AI", IPTC 2025.1 AI fields)
+# whose presence inside an XMP ``uuid`` box means the box carries an AI label.
+# Matching the payload rather than a fixed XMP UUID avoids the XMP-box UUID
+# byte-order ambiguity and stays surgical: only AI-bearing XMP is dropped, plain
+# XMP (copyright, camera info) is kept.
+_AI_LABEL_MARKERS: tuple[bytes, ...] = AIGC_MARKERS + IPTC_AI_MARKERS + IPTC_AI_FIELD_MARKERS
+

 def _iter_top_level_boxes(data: bytes) -> Iterator[tuple[int, int, bytes, int]]:
    """Yield ``(start, end, type, payload_offset)`` for each top-level box.
@@ -67,12 +79,22 @@ def is_isobmff(data: bytes) -> bool:


 def strip_c2pa_boxes(data: bytes) -> tuple[bytes, int]:
-    """Return ``(cleaned_bytes, stripped_count)``.
+    """Return ``(cleaned_bytes, stripped_count)`` with AI-provenance boxes removed.

-    Walks top-level boxes; drops any ``uuid`` box whose UUID equals
-    ``C2PA_UUID`` and any ``jumb`` box (JPEG-XL JUMBF container). All other
-    boxes are emitted verbatim. If the input is not ISOBMFF-shaped, returns
-    it unchanged.
+    Walks top-level boxes and drops:
+    - any ``uuid`` box whose UUID equals ``C2PA_UUID`` (a C2PA manifest);
+    - any ``uuid`` box whose payload carries an AI-label marker (an XMP packet
+      with a TC260 / IPTC / IPTC-2025.1 AI field -- caught by content, not by the
+      XMP UUID, so it works regardless of the UUID's byte order, and leaves plain
+      non-AI XMP intact);
+    - any ``jumb`` box (JPEG-XL JUMBF container).
+
+    All other boxes (incl. ``mdat`` / codestream) are emitted verbatim, so pixel
+    and audio data is preserved bit-for-bit. Non-ISOBMFF input is returned
+    unchanged. Despite the name this also covers MP4/MOV/M4A video and audio
+    (all ISOBMFF). NOTE: EXIF/XMP stored as *items inside the ``meta`` box*
+    (typical for AVIF/HEIF images) is not removed -- that needs meta-box surgery
+    and is a documented limitation.
    """
    if not is_isobmff(data):
        return data, 0
@@ -80,14 +102,15 @@ def strip_c2pa_boxes(data: bytes) -> tuple[bytes, int]:
    out = bytearray()
    stripped = 0
    for start, end, box_type, payload_off in _iter_top_level_boxes(data):
-        if box_type in C2PA_BOX_TYPES:
-            if box_type == b"uuid":
-                # uuid boxes carry the 16-byte UUID immediately after the type.
-                if payload_off + 16 <= end and data[payload_off : payload_off + 16] == C2PA_UUID:
-                    stripped += 1
-                    continue
-            else:  # b"jumb"
+        if box_type == b"uuid":
+            # uuid boxes carry the 16-byte UUID immediately after the type.
+            is_c2pa = payload_off + 16 <= end and data[payload_off : payload_off + 16] == C2PA_UUID
+            has_ai_label = any(marker in data[payload_off:end] for marker in _AI_LABEL_MARKERS)
+            if is_c2pa or has_ai_label:
                stripped += 1
                continue
+        elif box_type == b"jumb":
+            stripped += 1
+            continue
        out.extend(data[start:end])
    return bytes(out), stripped
@@ -0,0 +1,72 @@
+"""Detect Adobe TrustMark invisible watermarks.
+
+TrustMark (github.com/adobe/trustmark, MIT) is the open, keyless image watermark
+behind Adobe "Durable Content Credentials": when a C2PA manifest is stripped, a
+TrustMark soft binding can still re-link the asset to its manifest in a
+repository. Unlike SynthID it has a PUBLIC decoder with no secret key, so a
+TrustMark-stamped image can be identified locally. Adobe's shipping products use
+Variant P (the ``com.adobe.trustmark.P`` soft-binding ``alg``); this wrapper
+loads that model.
+
+Optional dependency (extra: ``trustmark``); the model weights download on first
+use. ``detect_trustmark`` returns None when the package is absent. This detects
+provenance (Adobe Content Credentials), NOT AI generation as such -- TrustMark
+also marks human-authored content -- so callers should treat it as a watermark
+signal, not proof of AI origin.
+"""
+
+# trustmark ships no type stubs; relax untyped-library diagnostics for this thin
+# wrapper module only.
+# pyright: reportMissingTypeStubs=false, reportUnknownMemberType=false, reportUnknownVariableType=false, reportUnknownArgumentType=false, reportMissingImports=false
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+log = logging.getLogger(__name__)
+
+# Adobe ships Variant P in production (com.adobe.trustmark.P).
+_MODEL_TYPE = "P"
+# Lazily constructed singleton -- model load + first-use download is expensive.
+_tm: Any = None
+
+
+def is_available() -> bool:
+    """True if the optional ``trustmark`` package is installed."""
+    import importlib.util
+
+    return importlib.util.find_spec("trustmark") is not None
+
+
+def _decoder() -> Any:
+    global _tm
+    if _tm is None:
+        from trustmark import TrustMark
+
+        _tm = TrustMark(verbose=False, model_type=_MODEL_TYPE)
+    return _tm
+
+
+def detect_trustmark(image_path: Path) -> str | None:
+    """Return a TrustMark scheme note if a TrustMark watermark is decoded, else None.
+
+    Returns e.g. ``"Adobe TrustMark (variant P, schema 0)"`` when the decoder
+    reports the watermark present, or None if it is absent, the optional
+    ``trustmark`` package is not installed, or the image cannot be read/decoded.
+    """
+    if not is_available():
+        return None
+    try:
+        from PIL import Image
+
+        with Image.open(image_path) as img:
+            cover = img.convert("RGB")
+        _wm_secret, wm_present, wm_schema = _decoder().decode(cover)
+    except Exception as exc:  # model download / decode failure / unreadable image
+        log.debug("TrustMark decode failed for %s: %s", image_path, exc)
+        return None
+    return f"Adobe TrustMark (variant {_MODEL_TYPE}, schema {wm_schema})" if wm_present else None
@@ -2,10 +2,7 @@

 from __future__ import annotations

-from typing import TYPE_CHECKING
-
-if TYPE_CHECKING:
-    from pathlib import Path
+from pathlib import Path

 import cv2
 import numpy as np
@@ -13,6 +10,22 @@ import pytest
 from PIL import Image
 from PIL.PngImagePlugin import PngInfo

+CORPUS_NEG_DIR = Path(__file__).resolve().parent.parent / "data" / "synthid_corpus" / "images" / "neg"
+
+
+@pytest.fixture
+def clean_photo() -> Path:
+    """A verified-negative real photo from the corpus neg/ set.
+
+    Used by the "non-AI image" assertions (no SynthID, verdict unknown). These
+    are real photos with no AI provenance, the ground truth for "must not false-
+    positive". Skips if the corpus is not checked out.
+    """
+    files = sorted(CORPUS_NEG_DIR.glob("*")) if CORPUS_NEG_DIR.exists() else []
+    if not files:
+        pytest.skip("no corpus neg/ images present")
+    return files[0]
+

@pytest.fixture
 def tmp_image_path(tmp_path: Path) -> Path:
@@ -156,15 +156,15 @@ class TestIdentifyRealSamples:
        assert r.is_ai_generated is True
        assert any("IPTC" in w for w in r.watermarks)

-    def test_clean_photo_is_unknown_not_clean(self):
-        r = identify(SAMPLES_DIR / "not-ai-1.jpeg", check_visible=False)
+    def test_clean_photo_is_unknown_not_clean(self, clean_photo: Path):
+        r = identify(clean_photo, check_visible=False)
        assert r.is_ai_generated is None  # never asserted False
        assert r.platform is None
        assert r.confidence == "none"
        assert r.watermarks == []

-    def test_strip_caveat_always_present(self):
-        r = identify(SAMPLES_DIR / "not-ai-1.jpeg", check_visible=False)
+    def test_strip_caveat_always_present(self, clean_photo: Path):
+        r = identify(clean_photo, check_visible=False)
        assert any("not proof" in c for c in r.caveats)

    def test_returns_report_dataclass(self):
@@ -284,6 +284,59 @@ class TestIdentifyExifGenerator:
        assert any("generator tag" in w for w in r.watermarks)


+class TestIdentifyXaiSignature:
+    """xAI / Grok's EXIF Signature + UUID-Artist drives an xAI verdict."""
+
+    def test_grok_signature_attributed(self, tmp_path: Path):
+        import piexif
+        from PIL import Image
+
+        exif = piexif.dump(
+            {
+                "0th": {
+                    piexif.ImageIFD.ImageDescription: b"Signature: " + b"A" * 120,
+                    piexif.ImageIFD.Artist: b"12345678-1234-1234-1234-123456789abc",
+                },
+                "Exif": {},
+                "GPS": {},
+                "1st": {},
+            }
+        )
+        path = tmp_path / "grok.jpg"
+        Image.new("RGB", (64, 64), (70, 80, 90)).save(path, exif=exif)
+        r = identify(path, check_visible=False)
+        assert r.is_ai_generated is True
+        assert r.platform is not None
+        assert "xAI" in r.platform
+        assert any("xAI/Grok" in w for w in r.watermarks)
+
+
+class TestIdentifySoftBinding:
+    """A C2PA soft-binding alg names a forensic-watermark vendor in the inventory."""
+
+    def test_soft_binding_vendor_listed(self, tmp_path: Path):
+        p = tmp_path / "sb.jpg"
+        p.write_bytes(b"\xff\xd8\xff\xe1 c2pa jumb com.digimarc.validate.1 \xff\xd9")
+        r = identify(p, check_visible=False, check_invisible=False)
+        assert any("Digimarc" in w for w in r.watermarks)
+        assert any(s.name == "soft_binding" for s in r.signals)
+
+
+class TestIdentifyIptcAi:
+    """IPTC 2025.1 AISystemUsed drives an AI verdict + platform attribution."""
+
+    def test_iptc_ai_system_attributed(self, tmp_path: Path):
+        p = tmp_path / "iptc.jpg"
+        p.write_bytes(
+            b"\xff\xd8\xff\xe1<x:xmpmeta><Iptc4xmpExt:AISystemUsed>Google Gemini"
+            b"</Iptc4xmpExt:AISystemUsed></x:xmpmeta>\xff\xd9"
+        )
+        r = identify(p, check_visible=False, check_invisible=False)
+        assert r.is_ai_generated is True
+        assert r.platform is not None
+        assert "Gemini" in r.platform
+
+
 # ── Open invisible watermark (SD/SDXL/FLUX) integration ─────────────

 from remove_ai_watermarks.invisible_watermark import is_available as _wm_available  # noqa: E402
@@ -0,0 +1,130 @@
+"""Unit tests for the MPS->CPU fallback orchestration (no GPU/model required).
+
+``img2img_runner`` has no torch import at module top -- the pipeline is
+injected as a plain callable -- so the fallback control flow is fully
+mockable. This guards the exact behavior hit in production on Apple Silicon:
+a native-resolution SDXL run that OOMs on MPS must transparently retry on CPU,
+while any non-MPS error must propagate unchanged.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import Mock
+
+import pytest
+
+from remove_ai_watermarks.noai import img2img_runner
+from remove_ai_watermarks.noai.img2img_runner import run_img2img, run_img2img_with_mps_fallback
+
+_MPS_OOM = "MPS backend out of memory (MPS allocated: 17.21 GiB, max allowed: 20.13 GiB)"
+
+
+def _result(image: object) -> Mock:
+    """A stand-in for a diffusers pipeline output object (has .images)."""
+    out = Mock()
+    out.images = [image]
+    return out
+
+
+class TestMpsFallback:
+    def test_mps_error_reloads_on_cpu_and_retries(self, monkeypatch: pytest.MonkeyPatch):
+        sentinel = object()
+        inner = Mock(side_effect=[RuntimeError(_MPS_OOM), sentinel])
+        monkeypatch.setattr(img2img_runner, "run_img2img", inner)
+        load_pipeline = Mock(return_value="gpu_pipe")
+        reload_on_cpu = Mock(return_value="cpu_pipe")
+
+        img, device = run_img2img_with_mps_fallback(
+            load_pipeline, object(), 0.05, 50, 7.5, "gen", "mps", lambda _m: None, reload_on_cpu=reload_on_cpu
+        )
+
+        assert (img, device) == (sentinel, "cpu")
+        reload_on_cpu.assert_called_once()
+        assert inner.call_count == 2
+        # Retry must use the reloaded CPU pipeline, device "cpu", and drop the
+        # MPS generator (generator=None) so CPU runs deterministically.
+        retry_args = inner.call_args_list[1].args
+        assert retry_args[0] == "cpu_pipe"
+        assert retry_args[5] is None  # generator
+        assert retry_args[6] == "cpu"  # device
+
+    def test_happy_path_returns_original_device_without_reload(self, monkeypatch: pytest.MonkeyPatch):
+        sentinel = object()
+        monkeypatch.setattr(img2img_runner, "run_img2img", Mock(return_value=sentinel))
+        reload_on_cpu = Mock()
+
+        img, device = run_img2img_with_mps_fallback(
+            Mock(return_value="gpu_pipe"),
+            object(),
+            0.05,
+            50,
+            7.5,
+            "gen",
+            "mps",
+            lambda _m: None,
+            reload_on_cpu=reload_on_cpu,
+        )
+
+        assert (img, device) == (sentinel, "mps")
+        reload_on_cpu.assert_not_called()
+
+    def test_non_mps_runtime_error_propagates(self, monkeypatch: pytest.MonkeyPatch):
+        monkeypatch.setattr(img2img_runner, "run_img2img", Mock(side_effect=RuntimeError("CUDA out of memory")))
+        reload_on_cpu = Mock()
+
+        with pytest.raises(RuntimeError, match="CUDA"):
+            run_img2img_with_mps_fallback(
+                Mock(return_value="gpu_pipe"),
+                object(),
+                0.05,
+                50,
+                7.5,
+                "gen",
+                "mps",
+                lambda _m: None,
+                reload_on_cpu=reload_on_cpu,
+            )
+        reload_on_cpu.assert_not_called()
+
+    def test_mps_error_on_non_mps_device_propagates(self, monkeypatch: pytest.MonkeyPatch):
+        # An "mps"-worded error while running on cpu must NOT trigger the reload.
+        monkeypatch.setattr(img2img_runner, "run_img2img", Mock(side_effect=RuntimeError(_MPS_OOM)))
+        reload_on_cpu = Mock()
+
+        with pytest.raises(RuntimeError, match="MPS backend"):
+            run_img2img_with_mps_fallback(
+                Mock(return_value="cpu_pipe"),
+                object(),
+                0.05,
+                50,
+                7.5,
+                None,
+                "cpu",
+                lambda _m: None,
+                reload_on_cpu=reload_on_cpu,
+            )
+        reload_on_cpu.assert_not_called()
+
+
+class TestRunImg2Img:
+    def test_returns_first_image_from_pipeline_result(self):
+        sentinel = object()
+        pipeline = Mock(return_value=_result(sentinel))
+
+        out = run_img2img(pipeline, object(), 0.05, 50, 7.5, None, "cpu", lambda _m: None)
+
+        assert out is sentinel
+
+    def test_typeerror_on_callback_retries_without_callback(self):
+        # Older diffusers reject the progress callback kwarg with TypeError;
+        # run_img2img must retry once without it rather than fail.
+        sentinel = object()
+        pipeline = Mock(side_effect=[TypeError("unexpected keyword 'callback'"), _result(sentinel)])
+
+        out = run_img2img(pipeline, object(), 0.05, 50, 7.5, None, "cpu", lambda _m: None)
+
+        assert out is sentinel
+        assert pipeline.call_count == 2
+        # First attempt passes the progress callback; the retry omits it.
+        assert "callback" in pipeline.call_args_list[0].kwargs
+        assert "callback" not in pipeline.call_args_list[1].kwargs
@@ -2,7 +2,7 @@

 from __future__ import annotations

-from remove_ai_watermarks.invisible_engine import InvisibleEngine, is_available
+from remove_ai_watermarks.invisible_engine import InvisibleEngine, _target_size, is_available


 class TestIsAvailable:
@@ -26,3 +26,45 @@ class TestInvisibleEngineInit:

    def test_ctrlregen_model_id(self):
        assert InvisibleEngine.CTRLREGEN_MODEL_ID == "yepengliu/ctrlregen"
+
+
+class TestTargetSize:
+    """Regression guard for the native-resolution decision (issues #10 / #15).
+
+    max_resolution=0 must NOT downscale -- the forced downscale->upscale
+    round-trip was the quality loss in #10, and downscaling at all let SynthID
+    survive in #15 (the native SDXL pass at strength ~0.05 is what defeats it).
+    """
+
+    def test_native_default_no_downscale(self):
+        # The default (0) means native resolution: no resize, regardless of size.
+        assert _target_size(4096, 4096, 0) is None
+        assert _target_size(123, 456, 0) is None
+
+    def test_negative_cap_treated_as_native(self):
+        assert _target_size(4096, 4096, -1) is None
+
+    def test_cap_below_long_side_downscales(self):
+        # 2000x1000, cap 1024 -> long side scaled to 1024, aspect preserved.
+        assert _target_size(2000, 1000, 1024) == (1024, 512)
+
+    def test_cap_uses_long_side_for_portrait(self):
+        # Portrait: height is the long side, so it drives the ratio.
+        assert _target_size(1000, 2000, 1024) == (512, 1024)
+
+    def test_cap_at_or_above_long_side_no_downscale(self):
+        # Already within the cap (and exactly equal) -> no resize.
+        assert _target_size(800, 600, 1024) is None
+        assert _target_size(1024, 768, 1024) is None
+
+    def test_integer_truncation_matches_pil_call_site(self):
+        # 1254x1254 (the gpt-image sample) capped at 1000: int(1254*1000/1254)=1000.
+        assert _target_size(1254, 1254, 1000) == (1000, 1000)
+        # Non-divisible ratio truncates toward zero like int() at the call site.
+        assert _target_size(1000, 333, 500) == (500, 166)
+
+    def test_extreme_aspect_ratio_clamps_short_side_to_one(self):
+        # 5000x3 capped at 1024: int(3 * 1024/5000) = 0 would crash resize();
+        # the short side must clamp to 1, never 0.
+        assert _target_size(5000, 3, 1024) == (1024, 1)
+        assert _target_size(3, 5000, 1024) == (1, 1024)
@@ -14,8 +14,10 @@ from remove_ai_watermarks.metadata import (
    exif_generator,
    get_ai_metadata,
    has_ai_metadata,
+    iptc_ai_system,
    remove_ai_metadata,
    synthid_source,
+    xai_signature,
 )

 # Real, committed C2PA sample images used to ground the SynthID-source tests.
@@ -224,8 +226,8 @@ class TestSynthIDSource:
        assert synthid_source(SAMPLES_DIR / "firefly-1.png") is None
        assert "synthid_watermark" not in get_ai_metadata(SAMPLES_DIR / "firefly-1.png")

-    def test_non_ai_image_is_not_synthid_source(self):
-        assert synthid_source(SAMPLES_DIR / "not-ai-1.jpeg") is None
+    def test_non_ai_image_is_not_synthid_source(self, clean_photo: Path):
+        assert synthid_source(clean_photo) is None


 class TestSynthIDSourceNonPng:
@@ -377,6 +379,24 @@ class TestExifGenerator:
        Image.new("RGB", (64, 64)).save(path, exif=exif)
        assert exif_generator(path) is None

+    def test_artist_tag_ai_tool_detected(self, tmp_path: Path):
+        # exif_generator also reads the EXIF Artist field for an AI token.
+        exif = piexif.dump({"0th": {piexif.ImageIFD.Artist: b"Midjourney"}, "Exif": {}, "GPS": {}, "1st": {}})
+        path = tmp_path / "artist.jpg"
+        Image.new("RGB", (64, 64)).save(path, exif=exif)
+        assert exif_generator(path) == "Midjourney"
+
+    def test_imagedescription_tag_ai_tool_detected(self, tmp_path: Path):
+        # ...and the EXIF ImageDescription field.
+        exif = piexif.dump(
+            {"0th": {piexif.ImageIFD.ImageDescription: b"Made with Stable Diffusion"}, "Exif": {}, "GPS": {}, "1st": {}}
+        )
+        path = tmp_path / "desc.jpg"
+        Image.new("RGB", (64, 64)).save(path, exif=exif)
+        result = exif_generator(path)
+        assert result is not None
+        assert "Stable Diffusion" in result
+
    def test_xmp_creatortool_scan_covers_unopenable(self, tmp_path: Path):
        # PIL can't open this fake HEIF; the raw XMP CreatorTool scan still works.
        path = tmp_path / "fake.heic"
@@ -392,6 +412,104 @@ class TestExifGenerator:
        assert exif_generator(tmp_clean_png) is None


+_FAKE_SIG = "A" * 120  # 64+ base64 chars; real Grok payloads are 300-1004
+_FAKE_UUID = "12345678-1234-1234-1234-123456789abc"
+
+
+def _grok_jpeg(tmp_path: Path, *, signature: str = _FAKE_SIG, artist: str = _FAKE_UUID) -> Path:
+    """Write a synthetic Grok-style JPEG: EXIF ImageDescription "Signature: ..."
+    + a UUID Artist. Synthetic on purpose -- never commit a real Grok image
+    (its Artist UUID + signature are user/session data; this is a public repo)."""
+    exif = piexif.dump(
+        {
+            "0th": {
+                piexif.ImageIFD.ImageDescription: f"Signature: {signature}".encode("latin1"),
+                piexif.ImageIFD.Artist: artist.encode("latin1"),
+            },
+            "Exif": {},
+            "GPS": {},
+            "1st": {},
+        }
+    )
+    path = tmp_path / "grok.jpg"
+    Image.new("RGB", (64, 64), (70, 80, 90)).save(path, exif=exif)
+    return path
+
+
+class TestXaiSignature:
+    """xAI / Grok's EXIF Signature + UUID-Artist provenance scheme."""
+
+    def test_signature_plus_uuid_detected(self, tmp_path: Path):
+        assert xai_signature(_grok_jpeg(tmp_path)) is True
+
+    def test_real_grok_sample_detected(self):
+        # Real committed Grok download (data/samples/grok-1.jpg); the EXIF
+        # Signature + UUID-Artist pair is the only AI signal it carries.
+        assert xai_signature(SAMPLES_DIR / "grok-1.jpg") is True
+
+    def test_signature_without_uuid_artist_not_flagged(self, tmp_path: Path):
+        # A "Signature:" blob but a non-UUID Artist is not the Grok pair.
+        assert xai_signature(_grok_jpeg(tmp_path, artist="John Doe")) is False
+
+    def test_bare_uuid_artist_not_flagged(self, tmp_path: Path):
+        # A UUID Artist alone (no Signature blob) must not false-positive.
+        exif = piexif.dump({"0th": {piexif.ImageIFD.Artist: _FAKE_UUID.encode()}, "Exif": {}, "GPS": {}, "1st": {}})
+        path = tmp_path / "uuid_only.jpg"
+        Image.new("RGB", (64, 64)).save(path, exif=exif)
+        assert xai_signature(path) is False
+
+    def test_short_signature_text_not_flagged(self, tmp_path: Path):
+        # Incidental short "Signature: ..." text is below the 64-char base64 bar.
+        assert xai_signature(_grok_jpeg(tmp_path, signature="ok")) is False
+
+    def test_clean_image_is_false(self, tmp_clean_png: Path):
+        assert xai_signature(tmp_clean_png) is False
+
+    def test_surfaced_in_get_ai_metadata(self, tmp_path: Path):
+        assert "xai_signature" in get_ai_metadata(_grok_jpeg(tmp_path))
+
+    def test_has_ai_metadata_true(self, tmp_path: Path):
+        assert has_ai_metadata(_grok_jpeg(tmp_path)) is True
+
+
+class TestRemoveAiExif:
+    """remove_ai_metadata scrubs AI-provenance EXIF tags but keeps genuine EXIF."""
+
+    def test_grok_signature_stripped_on_jpeg_output(self, tmp_path: Path):
+        src = _grok_jpeg(tmp_path)
+        assert xai_signature(src) is True
+        out = tmp_path / "clean.jpg"
+        remove_ai_metadata(src, out)
+        assert xai_signature(out) is False
+        assert has_ai_metadata(out) is False
+
+    def test_generator_make_token_stripped(self, tmp_path: Path):
+        # Ideogram's EXIF Make="Ideogram AI" must be scrubbed on removal.
+        exif = piexif.dump({"0th": {piexif.ImageIFD.Make: b"Ideogram AI"}, "Exif": {}, "GPS": {}, "1st": {}})
+        src = tmp_path / "ideogram.jpg"
+        Image.new("RGB", (64, 64)).save(src, exif=exif)
+        out = tmp_path / "clean.jpg"
+        remove_ai_metadata(src, out)
+        assert exif_generator(out) is None
+
+    def test_real_camera_exif_preserved(self, tmp_path: Path):
+        # A real-camera Make ("Apple") carries no AI token and must survive.
+        exif = piexif.dump(
+            {
+                "0th": {piexif.ImageIFD.Make: b"Apple", piexif.ImageIFD.Model: b"iPhone 15"},
+                "Exif": {},
+                "GPS": {},
+                "1st": {},
+            }
+        )
+        src = tmp_path / "photo.jpg"
+        Image.new("RGB", (64, 64)).save(src, exif=exif)
+        out = tmp_path / "out.jpg"
+        remove_ai_metadata(src, out)
+        kept = piexif.load(Image.open(out).info["exif"])["0th"]
+        assert kept.get(piexif.ImageIFD.Make) == b"Apple"
+
+
 class TestAIGCLabel:
    """China TC260 AIGC labeling (Doubao and other China-served generators)."""

@@ -433,3 +551,154 @@ class TestAIGCLabel:
        meta = get_ai_metadata(self._aigc_png(tmp_path))
        assert "aigc_label" in meta
        assert "TC260" in meta["aigc_label"]
+
+
+@pytest.mark.skipif(not (SAMPLES_DIR / "doubao-1.png").exists(), reason="doubao sample not present")
+class TestAIGCRealSample:
+    """Real Doubao (ByteDance) sample carries the China TC260 AIGC XMP label."""
+
+    def test_doubao_aigc_label(self):
+        from remove_ai_watermarks.metadata import aigc_label
+
+        info = aigc_label(SAMPLES_DIR / "doubao-1.png")
+        assert info is not None
+        assert info["Label"] == "1"
+        assert info["ContentProducer"]  # ByteDance producer code present
+
+    def test_doubao_detected_as_ai(self):
+        assert has_ai_metadata(SAMPLES_DIR / "doubao-1.png")
+        assert "aigc_label" in get_ai_metadata(SAMPLES_DIR / "doubao-1.png")
+
+
+class TestSoftBinding:
+    """C2PA soft-binding alg identifier -> forensic-watermark vendor name."""
+
+    def test_vendors_in_recognizes_known_algs(self):
+        from remove_ai_watermarks.noai.c2pa import soft_binding_vendors_in
+
+        assert soft_binding_vendors_in(b"...alg...com.adobe.trustmark.P...") == ["Adobe TrustMark"]
+        assert soft_binding_vendors_in(b"com.digimarc.validate.1") == ["Digimarc"]
+        assert soft_binding_vendors_in(b"ai.steg.api blah") == ["Steg.AI"]
+
+    def test_vendors_in_empty_when_absent(self):
+        from remove_ai_watermarks.noai.c2pa import soft_binding_vendors_in
+
+        assert soft_binding_vendors_in(b"no soft binding here") == []
+
+    def test_get_ai_metadata_surfaces_soft_binding(self, tmp_path: Path):
+        # Non-PNG binary-scan path: a manifest naming a soft-binding vendor.
+        p = tmp_path / "fake.jpg"
+        p.write_bytes(b"\xff\xd8\xff\xe1 c2pa jumb com.adobe.trustmark.P \xff\xd9")
+        assert get_ai_metadata(p).get("soft_binding") == "Adobe TrustMark"
+
+
+class TestIptcAiFields:
+    """IPTC 2025.1 AI-disclosure XMP properties (Iptc4xmpExt:AISystemUsed etc.)."""
+
+    def test_detects_ai_system_used_element_form(self, tmp_path: Path):
+        p = tmp_path / "iptc_ai.jpg"
+        p.write_bytes(
+            b"\xff\xd8\xff\xe1<x:xmpmeta><Iptc4xmpExt:AISystemUsed>ChatGPT DALL-E"
+            b"</Iptc4xmpExt:AISystemUsed></x:xmpmeta>\xff\xd9"
+        )
+        assert has_ai_metadata(p) is True
+        assert iptc_ai_system(p) == "ChatGPT DALL-E"
+        assert "ChatGPT DALL-E" in get_ai_metadata(p)["ai_system"]
+
+    def test_attribute_serialization(self, tmp_path: Path):
+        p = tmp_path / "attr.jpg"
+        p.write_bytes(b'\xff\xd8\xff\xe1 Iptc4xmpExt:AISystemUsed="Google Gemini" \xff\xd9')
+        assert iptc_ai_system(p) == "Google Gemini"
+
+    def test_present_without_value(self, tmp_path: Path):
+        # A disclosure field with no extractable value still flags presence.
+        p = tmp_path / "novalue.jpg"
+        p.write_bytes(b"\xff\xd8\xff\xe1 Iptc4xmpExt:AIPromptWriterName \xff\xd9")
+        assert iptc_ai_system(p) == "fields present"
+        assert has_ai_metadata(p) is True
+
+    def test_clean_image_none(self, tmp_clean_png: Path):
+        assert iptc_ai_system(tmp_clean_png) is None
+
+
+# Synthetic MP4 (ISOBMFF): ftyp + C2PA uuid box + mdat. Same box format as AVIF.
+_MP4_FTYP = b"\x00\x00\x00\x18ftypmp42\x00\x00\x00\x00mp42isom"
+_MP4_MDAT = b"\x00\x00\x00\x10mdat" + b"videodat"
+
+
+class TestVideoC2pa:
+    """C2PA in MP4 (ISOBMFF) -- detect + strip, reusing the image box walker."""
+
+    def test_detects_c2pa_in_mp4(self, tmp_path: Path):
+        from remove_ai_watermarks.metadata import C2PA_UUID
+
+        uuid_box = b"\x00\x00\x00\x20uuid" + C2PA_UUID + b"manifest"
+        p = tmp_path / "ai.mp4"
+        p.write_bytes(_MP4_FTYP + uuid_box + _MP4_MDAT)
+        assert has_ai_metadata(p) is True
+
+    def test_strips_c2pa_in_mp4(self, tmp_path: Path):
+        from remove_ai_watermarks.metadata import C2PA_UUID
+
+        uuid_box = b"\x00\x00\x00\x20uuid" + C2PA_UUID + b"manifest"
+        src = tmp_path / "in.mp4"
+        src.write_bytes(_MP4_FTYP + uuid_box + _MP4_MDAT)
+        out = tmp_path / "out.mp4"
+        remove_ai_metadata(src, out)
+        assert out.read_bytes() == _MP4_FTYP + _MP4_MDAT
+        assert has_ai_metadata(out) is False
+
+
+class TestIsobmffMetadataRemoval:
+    """Container-level AI-provenance stripping across ISOBMFF image/video/audio."""
+
+    def test_strips_ai_xmp_uuid_box(self):
+        # A uuid box carrying a TC260 AIGC label is dropped by content match,
+        # regardless of the (non-C2PA) XMP UUID's byte order.
+        from remove_ai_watermarks.noai.isobmff import strip_c2pa_boxes
+
+        xmp_uuid = bytes(range(16))  # arbitrary, not the C2PA UUID
+        payload = b'<x:xmpmeta><TC260:AIGC>{"Label":"1"}</TC260:AIGC></x:xmpmeta>'
+        box = (24 + len(payload)).to_bytes(4, "big") + b"uuid" + xmp_uuid + payload
+        cleaned, stripped = strip_c2pa_boxes(_MP4_FTYP + box + _MP4_MDAT)
+        assert stripped == 1
+        assert cleaned == _MP4_FTYP + _MP4_MDAT
+
+    def test_keeps_plain_non_ai_xmp(self):
+        # A uuid box with ordinary (non-AI) XMP must be preserved.
+        from remove_ai_watermarks.noai.isobmff import strip_c2pa_boxes
+
+        xmp_uuid = bytes(range(16))
+        payload = b"<x:xmpmeta><dc:rights>(c) me</dc:rights></x:xmpmeta>"
+        box = (24 + len(payload)).to_bytes(4, "big") + b"uuid" + xmp_uuid + payload
+        cleaned, stripped = strip_c2pa_boxes(_MP4_FTYP + box + _MP4_MDAT)
+        assert stripped == 0
+        assert cleaned == _MP4_FTYP + box + _MP4_MDAT
+
+    def test_m4a_c2pa_stripped(self, tmp_path: Path):
+        from remove_ai_watermarks.metadata import C2PA_UUID
+
+        uuid_box = b"\x00\x00\x00\x20uuid" + C2PA_UUID + b"manifest"
+        src = tmp_path / "voice.m4a"
+        src.write_bytes(_MP4_FTYP + uuid_box + _MP4_MDAT)
+        out = tmp_path / "clean.m4a"
+        remove_ai_metadata(src, out)
+        assert out.read_bytes() == _MP4_FTYP + _MP4_MDAT
+
+    def test_content_sniff_routes_unknown_suffix(self, tmp_path: Path):
+        # An ISOBMFF file with a non-standard extension is still box-stripped.
+        from remove_ai_watermarks.metadata import C2PA_UUID
+
+        uuid_box = b"\x00\x00\x00\x20uuid" + C2PA_UUID + b"manifest"
+        src = tmp_path / "mystery.bin"
+        src.write_bytes(_MP4_FTYP + uuid_box + _MP4_MDAT)
+        out = tmp_path / "out.bin"
+        remove_ai_metadata(src, out)
+        assert out.read_bytes() == _MP4_FTYP + _MP4_MDAT
+
+    def test_unsupported_container_raises(self, tmp_path: Path):
+        src = tmp_path / "audio.mp3"
+        src.write_bytes(b"ID3\x04\x00\x00\x00\x00\x00\x00 fake mp3 frames")
+        out = tmp_path / "out.mp3"
+        with pytest.raises(ValueError, match="not supported"):
+            remove_ai_metadata(src, out)
@@ -259,6 +259,29 @@ class TestParseChunkGuards:
        assert "OpenAI" in info["issuer"]  # issuer byte-search still robust


+class TestC2PADigitalSourceType:
+    """The three IPTC digitalSourceType variants drive the AI verdict.
+
+    Only *trained* and *composite-with-trained* mean AI-generated (and so imply
+    a SynthID proxy for a SynthID vendor); plain ``algorithmicMedia`` is
+    procedural (not trained) and must NOT be flagged as AI.
+    """
+
+    def test_plain_algorithmic_media_not_flagged_ai(self):
+        chunk = b"...name" + bytes([0x69]) + b"some-tool" + b" OpenAI algorithmicMedia"
+        info: dict = {}
+        _parse_c2pa_chunk(chunk, info)
+        assert info["source_type"] == "algorithmicMedia"
+        assert "synthid_watermark" not in info  # procedural, not AI-generated
+
+    def test_composite_with_trained_is_ai_and_synthid(self):
+        chunk = b"...name" + bytes([0x69]) + b"some-tool" + b" OpenAI compositeWithTrainedAlgorithmicMedia"
+        info: dict = {}
+        _parse_c2pa_chunk(chunk, info)
+        assert "compositeWithTrainedAlgorithmicMedia" in info["source_type"]
+        assert "synthid_watermark" in info  # AI-enhanced + OpenAI issuer
+
+
 # ── ISOBMFF (AVIF / HEIF / JPEG-XL container stripping) ──────────────

 FTYP = b"\x00\x00\x00\x18ftypavif\x00\x00\x00\x00avifmif1"  # 24-byte ftyp box
@@ -294,3 +317,31 @@ class TestISOBMFF:
        cleaned, stripped = strip_c2pa_boxes(FTYP + b"\x00\x00\x00\x04XXXX")
        assert stripped == 0
        assert cleaned.startswith(FTYP)
+
+    def test_size_zero_box_runs_to_eof(self):
+        # size32==0 means the box extends to EOF; a non-C2PA box round-trips.
+        box = struct.pack(">I", 0) + b"free" + b"\x00\x00\x00\x00"
+        cleaned, stripped = strip_c2pa_boxes(FTYP + box)
+        assert stripped == 0
+        assert cleaned == FTYP + box
+
+    def test_truncated_largesize_terminates_safely(self):
+        # size32==1 promises a 64-bit largesize, but the box ends after 8 bytes;
+        # iteration must stop rather than read the missing largesize past EOF.
+        cleaned, stripped = strip_c2pa_boxes(FTYP + b"\x00\x00\x00\x01uuid")
+        assert stripped == 0
+        assert cleaned == FTYP
+
+
+class TestC2PAInvalidSignature:
+    """A .png file that is not actually PNG-signed must read as clean, not crash."""
+
+    def test_has_c2pa_false_for_non_png_bytes(self, tmp_path: Path):
+        fake = tmp_path / "fake.png"
+        fake.write_bytes(b"\xff\xd8\xff\xe0 not a png at all, just garbage bytes")
+        assert has_c2pa_metadata(fake) is False
+
+    def test_extract_chunk_none_for_non_png_bytes(self, tmp_path: Path):
+        fake = tmp_path / "fake.png"
+        fake.write_bytes(b"\xff\xd8\xff\xe0 not a png at all, just garbage bytes")
+        assert extract_c2pa_chunk(fake) is None
@@ -0,0 +1,76 @@
+"""Unit tests for the pure tiling helpers (no GPU/model required).
+
+``tiling.py`` imports torch at module top, so skip cleanly when torch is
+absent. The helpers themselves are pure numpy/PIL/math -- they decide how a
+large image is split into overlapping tiles and blended back, so a regression
+here would seam or crop the CtrlRegen output wrongly.
+"""
+
+from __future__ import annotations
+
+import numpy as np
+import pytest
+
+pytest.importorskip("torch")
+
+from PIL import Image
+
+from remove_ai_watermarks.noai.ctrlregen.tiling import (
+    make_blend_weight,
+    resize_center_crop,
+    tile_positions,
+)
+
+
+class TestTilePositions:
+    def test_image_smaller_than_tile_single_position(self):
+        assert tile_positions(500, 512, 64) == [0]
+
+    def test_image_equal_to_tile_single_position(self):
+        assert tile_positions(512, 512, 64) == [0]
+
+    def test_first_is_zero_last_is_total_minus_tile(self):
+        # The tiles must fully cover the span: first starts at 0, last ends at
+        # the far edge (start == total - tile), or the image's edge is missed.
+        pos = tile_positions(2000, 512, 64)
+        assert pos[0] == 0
+        assert pos[-1] == 2000 - 512
+
+    def test_overlap_positions_are_monotonic_and_exact(self):
+        assert tile_positions(1000, 512, 64) == [0, 244, 488]
+
+    def test_zero_overlap_tiles_are_contiguous(self):
+        # 1024 wide, 512 tile, no overlap -> two tiles butting at 512.
+        assert tile_positions(1024, 512, 0) == [0, 512]
+
+
+class TestMakeBlendWeight:
+    def test_zero_overlap_is_all_ones(self):
+        w = make_blend_weight(8, 8, 0)
+        assert w.shape == (8, 8)
+        assert w.dtype == np.float64
+        assert np.all(w == 1.0)
+
+    def test_overlap_ramps_corners_to_zero_center_to_one(self):
+        w = make_blend_weight(16, 16, 4)
+        assert w[0, 0] == 0.0  # cosine ramp starts at 0
+        assert w[8, 8] == 1.0  # center is unweighted
+        assert w.max() == 1.0
+        assert w.min() == 0.0
+
+    def test_weight_is_point_symmetric(self):
+        # Symmetric ramps on both edges -> mask equals its 180-degree rotation,
+        # so opposite tile seams blend identically.
+        w = make_blend_weight(16, 16, 4)
+        assert np.allclose(w, w[::-1, ::-1])
+
+
+class TestResizeCenterCrop:
+    @pytest.mark.parametrize(("width", "height"), [(400, 800), (800, 400), (300, 300), (1000, 1001)])
+    def test_output_is_always_square_of_requested_size(self, width: int, height: int):
+        out = resize_center_crop(Image.new("RGB", (width, height)), 256)
+        assert out.size == (256, 256)
+
+    def test_default_size_is_512(self):
+        out = resize_center_crop(Image.new("RGB", (640, 480)))
+        assert out.size == (512, 512)
@@ -0,0 +1,36 @@
+"""Tests for the optional Adobe TrustMark detector.
+
+TrustMark is an optional dependency (extra ``trustmark``) that downloads model
+weights on first use, so the decode path is only exercised when it is installed
+(mirrors the imwatermark handling). The always-on test pins the graceful
+absent/error behaviour: detect must return None, never raise.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+
+from remove_ai_watermarks.trustmark_detector import detect_trustmark, is_available
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+def test_detect_never_raises(tmp_clean_png: Path):
+    # Whether or not trustmark is installed, a clean image must yield None
+    # (no watermark) without raising. When absent, the import guard returns None.
+    assert detect_trustmark(tmp_clean_png) is None
+
+
+def test_unreadable_file_returns_none(tmp_path: Path):
+    bad = tmp_path / "not_an_image.txt"
+    bad.write_bytes(b"not an image")
+    assert detect_trustmark(bad) is None
+
+
+@pytest.mark.skipif(not is_available(), reason="trustmark not installed")
+def test_clean_image_reports_no_watermark(tmp_clean_png: Path):
+    # With the decoder present, an un-watermarked image must report absent.
+    assert detect_trustmark(tmp_clean_png) is None
Author	SHA1	Message	Date
test-userandClaude Opus 4.7	c196a16900	feat: detect soft-binding vendors, IPTC 2025.1, video/audio C2PA, TrustMark (v0.6.0) Broadens metadata provenance coverage at the detection and container-strip level. Detection: - C2PA soft-binding `alg` -> forensic-watermark vendor (Adobe TrustMark, Digimarc, Imatag, Steg.AI, Microsoft, ...) via C2PA_SOFT_BINDINGS + soft_binding_vendors_in(); names the watermark vendor even when the watermark itself can't be decoded. - IPTC Photo Metadata 2025.1 AI-disclosure XMP fields (AISystemUsed etc.) via iptc_ai_system() + IPTC_AI_FIELD_MARKERS. - Adobe TrustMark open keyless decoder (trustmark_detector.py, optional extra `trustmark`) -- the watermark behind Adobe Durable Content Credentials. Detects provenance, not AI origin, so it does not assert is_ai. Removal / containers: - isobmff.strip_c2pa_boxes now also drops a top-level XMP uuid box that carries an AI label (matched by AI-marker content, byte-order-robust; plain XMP kept). - remove_ai_metadata routes MP4/MOV/M4V/M4A (and any ftyp-sniffed ISOBMFF) through the box stripper; raises a clear error for non-ISOBMFF audio/video (WebM/MP3/WAV) instead of crashing in the image path. Tests: soft-binding scan, IPTC element/attribute/presence, MP4 + M4A detect/ strip, ISOBMFF XMP surgical strip, content-sniff, unsupported-container guard, TrustMark absent-safety + identify integration. ruff clean; pyright clean on all new modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 17:56:48 -07:00
test-userandClaude Opus 4.7	ba94de8275	feat: strip AI-provenance EXIF tags on removal (v0.5.6) remove_ai_metadata now scrubs AI tags from the JPEG EXIF instead of passing the block through wholesale. Closes the v0.5.5 follow-up: the xAI/Grok Signature + UUID-Artist pair was detected but not removed. - metadata._scrub_ai_exif(): deletes the xAI signature pair and any Software/Make/Artist/ImageDescription tag carrying an AI_GENERATOR_TOKENS token (so Ideogram's Make="Ideogram AI" is scrubbed too), keeping genuine camera/editor EXIF intact. - Shared _is_xai_signature_pair / _exif_text helpers (module-level compiled regexes) are now the single source of truth, used by both xai_signature and _scrub_ai_exif. - Tests: Grok signature stripped on JPEG output, Ideogram Make stripped, real-camera Make ("Apple") preserved. 325 passing. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 14:26:20 -07:00
test-userandClaude Opus 4.7	74618b91a7	feat: detect xAI/Grok EXIF signature; refresh watermarking landscape (v0.5.5) xAI Grok (Aurora) images carry no C2PA/SynthID/IPTC -- their only provenance signal is an EXIF pair: ImageDescription "Signature: <base64>" + a UUID Artist. Verified stable across 3 genuine generations (a real download previously read as unknown / "no AI metadata"). - metadata.xai_signature(): matches the Signature blob + UUID Artist pair; wired into has_ai_metadata, get_ai_metadata, and identify (platform "xAI (Grok / Aurora)"). - data/samples/grok-1.jpg: real Grok fixture (neutral content; the Artist UUID is the public image id, not PII). - Tests: synthetic-fixture unit tests, real-sample assertion, identify integration (322 passing). Docs (research refresh, May 2026): - C2PA 2.4 Durable Content Credentials (soft-binding re-discovery after the embedded manifest is stripped). - New AI-labeling laws, primary-source verified: EU AI Act Art 50 (2026-08-02), South Korea AI Framework Act Art 31(3), California AB 853. - Hedge removal claims: defeating the SynthID verifier is not forensic invisibility (arXiv:2605.09203); cite SynthID-Image (arXiv:2510.09263). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 14:14:35 -07:00
test-userandClaude Opus 4.7	5e29c69e7b	README: lead with hosted raiw.cc CTA, honest free/paid split Move the raiw.cc call-to-action above the sponsor ask and drop the misleading "free web service" framing: visible-watermark and metadata removal are free, invisible removal runs on paid cloud GPUs. Also point no-GPU users to the hosted service from the invisible-removal feature bullet, where the GPU requirement is stated. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 12:47:28 -07:00
test-userandClaude Opus 4.7	8ed4a754ff	Add GitHub Sponsors donation button (FUNDING.yml + README badge) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 16:09:52 -07:00
test-userandClaude Opus 4.7	03fb460f77	Track the labeled SynthID corpus; complete metadata-source test coverage Corpus images were gitignored (local-only). The negatives were reviewed and cleared for publishing, so the labeled set is now committed (regular git, 65 MB across 25 files) -- making the removal regression set reproducible and CI-able. Corpus: - Track data/synthid_corpus/images/ (pos 9, neg 15, cleaned 1); keep only the synthetic refs/ calibration fills gitignored. - Reconcile manifest.csv to the on-disk files: 117 -> 25 rows (92 dangling rows for removed images pruned; dedup left one cleaned output, f6dd47a5). - Rewrite the corpus README layout/policy (images committed; review every image for private content before adding -- public repo, permanent history). Test fixtures: - Remove data/samples/not-ai-1/2/3 (personal iPhone photos, incl. GPS EXIF). - Add the clean_photo conftest fixture serving a verified-negative image from the corpus neg/ set; repoint the three "non-AI / clean photo" tests onto it (skips if the corpus is absent). Metadata-source coverage (close the last sub-variant gaps): - c2pa digitalSourceType: algorithmicMedia (procedural, not flagged AI) and compositeWithTrainedAlgorithmicMedia (AI + SynthID proxy). - exif_generator: EXIF Artist and ImageDescription fields (Software/Make/XMP CreatorTool were already covered). All 8 metadata-source kinds are now tested at both the unit and identify() level. 313 tests pass. CLAUDE.md updated (corpus tracked, clean_photo fixture). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 14:46:47 -07:00
test-userandClaude Opus 4.7	3ebdee57b8	Test the untested pure logic: MPS fallback, tiling, isobmff/c2pa edges Coverage audit (pytest --cov) found real, non-model logic at 0%/low cover. Add unit tests that need no model download: - img2img_runner.py 0% -> 100%: the MPS->CPU fallback orchestration, mocked via injected load_pipeline/reload_on_cpu callables. Guards the production behavior hit this session (native-res SDXL OOMs on MPS, must retry on CPU; non-MPS errors must propagate; "mps"-worded error on a cpu device must not reload). - ctrlregen/tiling.py 0% -> 40%: the pure tile math (tile_positions, make_blend_weight, resize_center_crop) that decides how large images are split and blended. (run_tiled stays model-bound, untested.) - isobmff.py 93% -> 100%: size==0 (box-to-EOF) and truncated 64-bit largesize parsing branches for AVIF/HEIF/JXL C2PA stripping. - c2pa.py: non-PNG-signed .png reads as clean (has_c2pa_metadata / extract_c2pa_chunk) instead of mis-parsing. 309 tests pass (+23). Document in CLAUDE.md that these pure helpers are unit-tested without downloads so future sessions don't skip them as "ML". No src/ change, no release. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 14:21:32 -07:00
test-userandClaude Opus 4.7	d24d8a4b14	Extract _target_size helper + regression-test native resolution (v0.5.4) The native-vs-downscale decision in InvisibleEngine.remove_watermark (the issue #10/#15 fix: max_resolution=0 must not pre-downscale, since any downscale both loses quality and lets SynthID survive) had no test. Extract it into a pure helper invisible_engine._target_size(w, h, max_resolution) and cover it with tests/test_invisible_engine.py::TestTargetSize so a re-introduced forced downscale fails CI instead of silently regressing #15. Also: - Clamp the short side to >=1 in _target_size: extreme aspect ratios (e.g. 5000x3 with --max-resolution 1024) truncated it to 0 and crashed image.resize(). Pre-existing in the inline math; fixed now that it is a named, tested function. - Consolidate the two duplicated temp-file save blocks into one unconditional save (behavior unchanged: the EXIF-transposed image is still always persisted before WatermarkRemover reloads it by path), and drop the now-redundant `_tmp_path is not None` guard in finally. - Bump version 0.5.3 -> 0.5.4 (pyproject, __init__, uv.lock); document the helper as the regression guard in CLAUDE.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 14:09:33 -07:00
test-userandClaude Opus 4.7	28fe13db8f	Document native-res MPS OOM -> CPU-fallback behavior in limitations Concrete data point from the 2026-05-25 gpt-image SDXL run: native 1254x1254 fp32 OOMs at the UNet step (not just VAE) on a 20 GB MPS ceiling, and img2img_runner auto-falls back to CPU and completes (slow, weight-identical, still defeats SynthID). enable_vae_tiling() alone does not prevent it. Fast Mac workarounds: fp16 on MPS or --max-resolution; neither is the default. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 13:57:13 -07:00
test-userandClaude Opus 4.7	59d72c5db7	Record verified gpt-image-2 SynthID-cleaned chain in corpus Add manifest row for the 4ef377bd -> f6dd47a5 chain: a gpt-image-2 sample (openai.com/verify: SynthID + C2PA detected) cleaned via v0.5.3 `all` at native 1254x1254 (prod-equivalent SDXL base, strength 0.05, 50 steps). openai.com/verify reports SynthID NOT detected after the run, re-confirming that the #10 native-resolution default defeats OpenAI SynthID and resolving the #15 root cause (older SD-1.5/768px downscale default did not). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 13:55:10 -07:00
test-userandClaude Opus 4.7	e27f24f520	test(samples): commit real Doubao fixture + AIGC real-sample test data/samples/doubao-1.png is the real #13 sample: carries the China TC260 <TC260:AIGC> XMP label and a visible '豆包AI生成' text mark (bottom-right). Grounds the AIGC detection on a real file (alongside the synthetic tests) and serves as the fixture for visible-watermark removal work. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 12:37:15 -07:00
test-userandClaude Opus 4.7	1afc1e60ef	test(samples): add real Doubao TC260 AIGC reference sample 2048x2048 PNG carrying China's TC260 <TC260:AIGC> label; identify reports it as a China AIGC-labeled generator (TC260). Reference fixture for manual re-verification of the TC260 detection path -- the automated tests use synthetic blobs, so nothing depends on this file being present. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 12:36:28 -07:00