Files
remove-ai-watermarks/scripts/synthid_runtime/_synthid_confirmation.py
T
Victor Kuznetsov 07b07634cf Merge the docs/arxiv-paper-review research line into main (#95)
* Add rigorous SynthID research and evaluation harness

* Record SynthID cross-epoch validation results

* Reset SynthID detector hypotheses to paired training

* Add paired wavelet and spectral SynthID probes

* Record closed-corpus SynthID detector ablations

* Add registered SynthID phase probing

* Add periodic SynthID tile probing

* Add calibrated SynthID pixel detector

* Harden scale-registered SynthID detection

* Record SynthID phase and channel rescue findings

* Add production SynthID routing and OpenAI verification

* Reframe periodic pixel route as pipeline lattice; confirm and harden detection

The frozen periodic experts read an origin-anchored generation-pipeline lattice destroyed by a crop off the tile grid, not the crop-robust SynthID mark. Route the pixel result as an experimental pipeline_lattice signal kept out of the watermark inventory, and carry the crop sensitivity in every verdict envelope.

Add split-patch phase/amplitude/codeword confirmation for registered-v3, affine-lattice and cyclostationary research probes, and timeout/retry/error-taxonomy hardening for the official OpenAI verification path.

* Record pipeline-lattice reframing and registered-v3 phase lock

Document that the pixel route detects an origin-anchored lattice rather than the watermark, and record the registered-v3 two-pixel phase-lock measurement: a 2px diagonal crop killed all 36 tested detections (28 foreign-generator, 8 Google) with recovery only at offsets that are multiples of four. Update README, CLI, Python API, supported-signals, known-limitations, module-internals, the SynthID reference, and the detector research plan.

* Split SynthID campaign docs by detector, classifiers, and removal

Keep Model 1 as a research AI-versus-camera result outside the library.
Retire the mixed oracle-ladders page to a routing hub and mark the plan
file as a chronological archive.

* Keep 2026-08-22 SynthID campaign results in research docs only

Drop Bayer, Model 1, and lattice re-check numbers from user guides and
module internals. The library surface is unchanged.

* Unplug lattice detector from package, expand research docs

* Remove lattice detector sources from the public package

* Document SynthID GitHub sweep findings

* Document general AI classifier sweep

* Document modern-negative taxonomy audit and classifier doc split

Split general AI-classifier research into ai-generated-image-classifiers.md
and record the modern-negative campaign: Unsplash/Openverse date-clean cells,
contamination controls, quarter-hard paired result, closed linear veto and
taxonomy-continuation arms.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix (same triage as main); core checks separately green (ruff, format, pyright, 1564 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - split references updated everywhere, none stale; 4) CLAUDE.md - routing line already updated, compliant

* Record wild-AI audit, Meta provider class, and stock-negative expansion

The wild vendor-flagged AI cell (300 stratified rows) puts Model 1 recall at
69.7% on unknown-renderer stock AI; the stock-negative harvest triples the
modern fashion/product cells and confirms the combined-pool veto control;
the Meta muse-image corpus doubles to 132 rows with its margin sweep; a
per-channel cv2 reference fixes the latent fold test under cv2 4.10.0.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks separately green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - new run references point at the gitignored research store, none stale; 4) CLAUDE.md - compact, no changes needed

* Close representation-change campaign: both candidates falsified

Pre-registered gates (AI-test >=1772, fresh OI <=50, Kodak 0, FLUX >=288,
EvalGEN >=95) rejected DINOv2-L ridge head (1427/1847, 162/3000, 1/24, 29/300,
5/100) and the paired-reconstruction FFT tower (14/1847, 12/3000, 0/24, 0/300,
0/100; contract learned at 0.949 pairwise separation but no transfer to
production generators). Campaign verdict: general classifier beyond local
scale as pursued; product stays on documented remainder.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks green minutes ago (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - verdict mirrored in data/research/REPRESENTATION-CAMPAIGN.md, no stale refs; 4) CLAUDE.md - no changes

* Record full failure map, H2 router falsification, and H3 process detector closure

20 measured negative domains with batch-2 (memes, whiteboards, tickets, book
pages). H2 domain router falsified: 97.9% of AI-test looks structured, every
family 94-100%. H3 process detector on 369 contrastive pairs from three
generators (OpenAI gpt-image-1-mini, Meta muse-image-1.0, Gemini flash-image)
achieves 0.909 pairwise AUC on training pairs but transfers at AUC 0.55-0.60
to production AI; human receipts score higher than any AI family. The
generator-specific spectral trace does not generalize across three generators,
closing the process-trace family in its current form.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs + research scripts, single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes

* Record H4-H6 research hypotheses: MLP probe, spectral invariant, TTA voting

H4 (MLP on frozen CLIP): 98.6% AI-test recall but 15.8% photo FPR — same
trade-off curve as quarter-hard. H5 (spectral invariant from CVPR 2025):
2.4% recall, the 1/f^alpha profile does not discriminate current generators.
H6 (TTA voting): fixes museum FP but not documents/UI/fashion, loses 9% recall.
All three falsified against frozen gates; ten total closed hypotheses now
document the CLIP-L representation limit from every angle.

Also records the provider cascade across all 20 domains (69.8% stray on
documents mirrors the detector failure map) and the full Y-phase campaign
PSNR data awaiting oracle rate-limit reset.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes

* Fix Y-phase frequency convention, record H4-H6 and campaign results

The initial Y-phase campaign targeted FFT bins 16-32 instead of spatial
periods 16-32 px (1/32 to 1/16 cycles/px). After the fix, the full-octave
Y-phase scramble reproduces the known kill (not_detected at 20.5 dB on s1
at native 1122x1402). Partial sub-bands are visually invisible (42.5 dB)
but stay detected: the mark is distributed across the full octave, not
concentrated. Point intervention is not viable within this frequency band.

H4 MLP probe: 98.6% recall, 15.8% FPR (same trade-off wall).
H5 spectral invariant: 2.4% recall (1/f^alpha does not discriminate).
H6 TTA voting: fixes museum FP but not documents/UI/fashion.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (1665 tests, verified minutes ago); 2) /simplify - docs-only; 3) docs sync - all artifacts synced; 4) CLAUDE.md - no changes

* Add TC260 fifth class and per-class margin calibration to provider cascade

Five-head cascade (openai/google/tc260/meta/no_ai): openai 68.8%, google
76.6%, tc260 63.8%, meta 71.8% mean recall at uniform margin 0.50.
Per-class margins calibrated against 1.67% photo budget: openai 0.31,
google 0.29, tc260 0.39, meta 0.55. TC260 test recall 71.4% at calibrated
margins on 196 held-out images. Chinese-AIGC is a viable pixel class.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified within the hour); 2) /simplify - research script, single pass; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Record universal detector v3-v8: diverse training shifts the curve

Fresh MLP on frozen CLIP embeddings with 49 negative domains (12,258 images)
and 5,043 AI positives achieves 93.0% AI-test recall with 39/49 domains at
zero false positives. Digital art FP dropped from 99.3% (Model 1) to 24.8%,
fashion from 62-71% to 12%, UI from 99.3% to 12%. Photo FPR 0.7%. The
improvement comes from training data diversity on frozen embeddings, not
representation change (v5 fine-tune proved this by undoing the gains).
Also adds .local-eval to ruff exclude so the gate covers only tracked files.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - all artifacts in data/research/; 4) CLAUDE.md - no changes

* Add three-tier ensemble detector: DEFINITELY/POSSIBLY/LIKELY_HUMAN

Combines Model 1 and v8 into calibrated confidence tiers. DEFINITELY_AI
(both models agree) achieves 79.6% recall at 0.50% photo FPR with 46/49
domains at zero FP. The union reaches 93.3% recall at 1.80% photo FPR
with Kodak 0/24. First detector working across ALL content types with
per-tier calibrated error rates.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + ensemble; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Add provider v2: diversity training eliminates document leakage

Same diversity-training insight applied to the provider cascade. Adding
3,769 structured negative features to training drops document/receipt
leakage from 69.8% to 5.1%, UI from 10% to 4.3%, fashion from 5-15% to
0-3%. AI recall improves: OpenAI 84% (was 75%), Google 88.8% (was 79%).
Photo leakage 1.4%. Worst regression: memes 47.9% (was 27%).

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - provider v2; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Add universal v11: full taxonomy, 136 domains, 124 at zero FP

Master data plan mapped 148 visual domains. Massive collection (3,343
images, 73 domains from Openverse) plus gap-filler (724 images from
Safebooru anime/manga) expanded training to 19,768 images across 136
negative domains. Universal v11 (MLP-512 + Model 1 ensemble):
DEFINITELY 90.3% recall at 0.50% photo FPR, ANY 95.6% recall,
124/134 domains at exactly 0% FP, worst FP 13.8% (digital art).

New domains opened: anime, manga, chibi, mecha, vintage photos,
banknotes, newspapers, magazines, movie posters, antique maps,
watercolor/oil originals, patterns, cosmetics, real estate, 3D
renders, and 60+ more.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Confirm representation limit: v12 fine-tune destroys structured FP despite 6x data

Fine-tuning CLIP tower on 19,518 images achieves 95.1% standalone recall
but returns to 100% FP on art/UI and 14/59 zero-FP domains (vs 124/134
for frozen v11). This is a representation property, not a data issue.
Frozen CLIP + MLP (v11) is the only working architecture. Also records
provider v3 trained on all negative domains.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Document v13 plateau: 128/136 zero FP, frozen-CLIP ceiling confirmed

v13 with top-plan expansion (1,169 new images) improves domain coverage
to 128/136 at zero FP and reduces fashion FP to 5.3%, but DEFINITELY
recall plateaus at 89.6% and art FP at 15.9%. The frozen CLIP + MLP
architecture has reached its ceiling.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified minutes ago, 1731 tests); 2) /simplify - docs-only; 3) docs sync - v13 recorded; 4) CLAUDE.md - no changes

* Document the 2026-08-31 photo-classifier freeze.

Record the AI-versus-camera contract, Meta v3 hold-out, Flickr UI
replacement, and that receipts stay out of the supported domain.

* Scrub Spaces catalog details from classifier research docs

* Record receipt layout-gate probe for the universal detector
2026-09-01 11:37:32 -07:00

289 lines
11 KiB
Python

"""Independent split-patch confirmation for the registered SynthID carrier."""
# The optional numeric libraries do not provide complete types for this path.
# pyright: reportMissingTypeStubs=false, reportUnknownMemberType=false, reportUnknownVariableType=false, reportUnknownArgumentType=false
from __future__ import annotations
import math
from dataclasses import dataclass
from typing import TYPE_CHECKING, Any
import cv2
import numpy as np
from synthid_runtime.synthid_detector import fold_residual_template, unit_tile
if TYPE_CHECKING:
from numpy.typing import NDArray
MIN_PERIOD = 10.0
MIN_COHERENCE = 0.30
MIN_AMPLITUDE = 0.0
H5_PERIOD = (18.0, 18.6)
H5_MIN = 0.13
STRONG_COHERENCE_PERIOD = (18.6, 20.0)
STRONG_COHERENCE_MIN = 0.40
WEAK_H5_PERIOD = (20.0, 22.0)
WEAK_H5_MIN = 0.02
PATCH_SIZE = 256
GRID_SIZE = 4
HARMONIC_COUNT = 16
@dataclass(frozen=True)
class RegisteredConfirmationComponents:
"""Auditable split-patch confirmation components for one fixed period."""
period: float
joint_coherence: float
joint_amplitude: float
unknown_codeword_fixed_confirmation: float
selection_patches: int
confirmation_patches: int
@property
def passes(self) -> bool:
"""Whether every frozen period-aware confirmation gate passes."""
return registered_confirmation_passes(
self.period,
self.joint_coherence,
self.joint_amplitude,
self.unknown_codeword_fixed_confirmation,
)
def registered_confirmation_passes(
period: float,
joint_coherence: float,
joint_amplitude: float,
unknown_codeword_fixed_confirmation: float,
) -> bool:
"""Apply the single frozen registered-carrier confirmation rule."""
if period < MIN_PERIOD:
return False
if joint_coherence < MIN_COHERENCE or joint_amplitude < MIN_AMPLITUDE:
return False
if H5_PERIOD[0] <= period < H5_PERIOD[1]:
return unknown_codeword_fixed_confirmation >= H5_MIN
if STRONG_COHERENCE_PERIOD[0] <= period < STRONG_COHERENCE_PERIOD[1]:
return joint_coherence >= STRONG_COHERENCE_MIN
if WEAK_H5_PERIOD[0] <= period < WEAK_H5_PERIOD[1]:
return unknown_codeword_fixed_confirmation >= WEAK_H5_MIN
return True
def _opponent_channels(values: NDArray[Any]) -> NDArray[Any]:
red = values[:, :, 0]
green = values[:, :, 1]
blue = values[:, :, 2]
return np.stack((green, red - green, blue - 0.5 * (red + green)), axis=2)
def _template_harmonics(template: NDArray[Any]) -> tuple[NDArray[Any], NDArray[Any]]:
opponent = _opponent_channels(np.asarray(template, dtype=np.float64))
spectrum = np.fft.fft2(opponent, axes=(0, 1))
height, width = template.shape[:2]
candidates: list[tuple[float, int, int]] = []
for row in range(height):
signed_row = row if row <= height // 2 else row - height
for column in range(width):
signed_column = column if column <= width // 2 else column - width
if signed_row < 0 or (signed_row == 0 and signed_column <= 0):
continue
power = float(np.sum(np.abs(spectrum[row, column]) ** 2))
candidates.append((power, signed_row, signed_column))
candidates.sort(reverse=True)
selected = candidates[:HARMONIC_COUNT]
harmonics = np.asarray([(row, column) for _power, row, column in selected], dtype=np.float64)
coefficients = np.asarray([spectrum[int(row) % height, int(column) % width] for row, column in harmonics])
weights = np.abs(coefficients)
weight_sum = float(np.sum(weights))
if weight_sum <= 0.0:
raise ValueError("template has no nonzero periodic harmonics")
return harmonics, weights / weight_sum
def _patch_origins(height: int, width: int) -> list[tuple[int, int, int]]:
if height < PATCH_SIZE or width < PATCH_SIZE:
raise ValueError("registered confirmation needs both image sides to be at least 256 pixels")
y_values = np.linspace(0, height - PATCH_SIZE, min(GRID_SIZE, height // PATCH_SIZE), dtype=np.int64)
x_values = np.linspace(0, width - PATCH_SIZE, min(GRID_SIZE, width // PATCH_SIZE), dtype=np.int64)
origins = [
(int(y), int(x), (y_index + x_index) % 2)
for y_index, y in enumerate(np.unique(y_values))
for x_index, x in enumerate(np.unique(x_values))
]
if {group for _y, _x, group in origins} != {0, 1}:
raise ValueError("registered confirmation needs two independent patch groups")
return origins
def _bilinear_sample(spectrum: NDArray[Any], y: NDArray[Any], x: NDArray[Any]) -> NDArray[Any]:
height, width = spectrum.shape
y_floor = np.floor(y)
x_floor = np.floor(x)
y0 = y_floor.astype(np.int64) % height
x0 = x_floor.astype(np.int64) % width
y1 = (y0 + 1) % height
x1 = (x0 + 1) % width
dy = y - y_floor
dx = x - x_floor
return (
spectrum[y0, x0] * (1.0 - dy) * (1.0 - dx)
+ spectrum[y1, x0] * dy * (1.0 - dx)
+ spectrum[y0, x1] * (1.0 - dy) * dx
+ spectrum[y1, x1] * dy * dx
)
def _patch_unit_values(
pixels: NDArray[Any],
origin_y: int,
origin_x: int,
period: float,
harmonics: NDArray[Any],
denoise_sigma: float,
) -> NDArray[Any]:
patch = np.asarray(
pixels[origin_y : origin_y + PATCH_SIZE, origin_x : origin_x + PATCH_SIZE],
dtype=np.float32,
)
channels = _opponent_channels(patch)
window_1d = np.hanning(PATCH_SIZE).astype(np.float32)
window = window_1d[:, None] * window_1d[None, :]
frequencies_y = harmonics[:, 0] / period
frequencies_x = harmonics[:, 1] / period
sample_y = frequencies_y * PATCH_SIZE
sample_x = frequencies_x * PATCH_SIZE
sampled = np.empty((len(harmonics), 3), dtype=np.complex128)
for channel in range(3):
residual = channels[:, :, channel]
residual -= cv2.GaussianBlur(
residual,
(0, 0),
sigmaX=denoise_sigma,
sigmaY=denoise_sigma,
borderType=cv2.BORDER_REFLECT_101,
)
sampled[:, channel] = _bilinear_sample(np.fft.fft2(residual * window), sample_y, sample_x)
sampled *= np.exp(-2j * math.pi * (frequencies_y * origin_y + frequencies_x * origin_x))[:, None]
magnitudes = np.abs(sampled)
return np.divide(sampled, magnitudes, out=np.zeros_like(sampled), where=magnitudes > 1e-12)
def _coherence(values: list[NDArray[Any]], weights: NDArray[Any]) -> float:
coherence = np.abs(np.mean(np.stack(values), axis=0))
return float(np.sum(coherence * weights))
def _unknown_codeword_fixed_confirmation(
selection_values: list[NDArray[Any]],
confirmation_values: list[NDArray[Any]],
weights: NDArray[Any],
) -> float:
cross_codeword = np.mean(np.stack(confirmation_values), axis=0) * np.conj(
np.mean(np.stack(selection_values), axis=0)
)
confirmation_mask = np.arange(len(weights)) % 2 == 1
masked_weights = weights[confirmation_mask]
return float(np.abs(np.sum(cross_codeword[confirmation_mask] * masked_weights)) / np.sum(masked_weights))
def _canonical_pixels(pixels: NDArray[Any], template: NDArray[Any], period: float) -> NDArray[Any]:
width = max(template.shape[1], round(pixels.shape[1] * template.shape[1] / period))
height = max(template.shape[0], round(pixels.shape[0] * template.shape[0] / period))
if (height, width) == pixels.shape[:2]:
return pixels
interpolation = cv2.INTER_AREA if width < pixels.shape[1] else cv2.INTER_CUBIC
return np.asarray(cv2.resize(pixels, (width, height), interpolation=interpolation))
def _cyclic_correlations(template: NDArray[Any], tile: NDArray[Any]) -> NDArray[Any]:
template_spectrum = np.fft.fft2(template, axes=(0, 1))
tile_spectrum = np.fft.fft2(tile, axes=(0, 1))
return np.fft.ifft2(np.sum(template_spectrum * np.conj(tile_spectrum), axis=2)).real
def _joint_amplitude(
pixels: NDArray[Any],
template: NDArray[Any],
period: float,
denoise_sigma: float,
) -> tuple[float, int, int]:
canonical = _canonical_pixels(pixels, template, period)
tile_height, tile_width = template.shape[:2]
grouped_units: dict[int, list[NDArray[Any]]] = {0: [], 1: []}
origins = _patch_origins(*canonical.shape[:2])
for origin_y, origin_x, group in origins:
aligned_y = (origin_y // tile_height) * tile_height
aligned_x = (origin_x // tile_width) * tile_width
folded = fold_residual_template(
canonical[aligned_y : aligned_y + PATCH_SIZE, aligned_x : aligned_x + PATCH_SIZE],
tile_height=tile_height,
tile_width=tile_width,
denoise_sigma=denoise_sigma,
)
unit, _norm = unit_tile(folded)
grouped_units[group].append(unit)
selection_tile, _selection_norm = unit_tile(np.mean(grouped_units[0], axis=0))
confirmation_tile, _confirmation_norm = unit_tile(np.mean(grouped_units[1], axis=0))
selection_correlations = _cyclic_correlations(template, selection_tile)
confirmation_correlations = _cyclic_correlations(template, confirmation_tile)
shift_y, shift_x = np.unravel_index(int(np.argmax(selection_correlations)), selection_correlations.shape)
return (
min(
float(selection_correlations[shift_y, shift_x]),
float(confirmation_correlations[shift_y, shift_x]),
),
len(grouped_units[0]),
len(grouped_units[1]),
)
def registered_confirmation_components(
pixels: NDArray[Any],
template: NDArray[Any],
period: float,
denoise_sigma: float,
) -> RegisteredConfirmationComponents:
"""Measure the frozen split-patch gates at one registered carrier period."""
if pixels.ndim != 3 or pixels.shape[2] != 3:
raise ValueError("pixels must have shape (height, width, 3)")
if not math.isfinite(period) or period <= 0.0:
raise ValueError("registered period must be finite and positive")
harmonics, weights = _template_harmonics(template)
grouped_values: dict[int, list[NDArray[Any]]] = {0: [], 1: []}
for origin_y, origin_x, group in _patch_origins(*pixels.shape[:2]):
grouped_values[group].append(
_patch_unit_values(
pixels,
origin_y,
origin_x,
period,
harmonics,
denoise_sigma,
)
)
amplitude, selection_patches, confirmation_patches = _joint_amplitude(
pixels,
template,
period,
denoise_sigma,
)
return RegisteredConfirmationComponents(
period=period,
joint_coherence=min(
_coherence(grouped_values[0], weights),
_coherence(grouped_values[1], weights),
),
joint_amplitude=amplitude,
unknown_codeword_fixed_confirmation=_unknown_codeword_fixed_confirmation(
grouped_values[0],
grouped_values[1],
weights,
),
selection_patches=selection_patches,
confirmation_patches=confirmation_patches,
)