mirror of
https://github.com/wiltodelta/remove-ai-watermarks.git
synced 2026-10-14 21:40:47 +02:00
* Add rigorous SynthID research and evaluation harness * Record SynthID cross-epoch validation results * Reset SynthID detector hypotheses to paired training * Add paired wavelet and spectral SynthID probes * Record closed-corpus SynthID detector ablations * Add registered SynthID phase probing * Add periodic SynthID tile probing * Add calibrated SynthID pixel detector * Harden scale-registered SynthID detection * Record SynthID phase and channel rescue findings * Add production SynthID routing and OpenAI verification * Reframe periodic pixel route as pipeline lattice; confirm and harden detection The frozen periodic experts read an origin-anchored generation-pipeline lattice destroyed by a crop off the tile grid, not the crop-robust SynthID mark. Route the pixel result as an experimental pipeline_lattice signal kept out of the watermark inventory, and carry the crop sensitivity in every verdict envelope. Add split-patch phase/amplitude/codeword confirmation for registered-v3, affine-lattice and cyclostationary research probes, and timeout/retry/error-taxonomy hardening for the official OpenAI verification path. * Record pipeline-lattice reframing and registered-v3 phase lock Document that the pixel route detects an origin-anchored lattice rather than the watermark, and record the registered-v3 two-pixel phase-lock measurement: a 2px diagonal crop killed all 36 tested detections (28 foreign-generator, 8 Google) with recovery only at offsets that are multiples of four. Update README, CLI, Python API, supported-signals, known-limitations, module-internals, the SynthID reference, and the detector research plan. * Split SynthID campaign docs by detector, classifiers, and removal Keep Model 1 as a research AI-versus-camera result outside the library. Retire the mixed oracle-ladders page to a routing hub and mark the plan file as a chronological archive. * Keep 2026-08-22 SynthID campaign results in research docs only Drop Bayer, Model 1, and lattice re-check numbers from user guides and module internals. The library surface is unchanged. * Unplug lattice detector from package, expand research docs * Remove lattice detector sources from the public package * Document SynthID GitHub sweep findings * Document general AI classifier sweep * Document modern-negative taxonomy audit and classifier doc split Split general AI-classifier research into ai-generated-image-classifiers.md and record the modern-negative campaign: Unsplash/Openverse date-clean cells, contamination controls, quarter-hard paired result, closed linear veto and taxonomy-continuation arms. pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix (same triage as main); core checks separately green (ruff, format, pyright, 1564 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - split references updated everywhere, none stale; 4) CLAUDE.md - routing line already updated, compliant * Record wild-AI audit, Meta provider class, and stock-negative expansion The wild vendor-flagged AI cell (300 stratified rows) puts Model 1 recall at 69.7% on unknown-renderer stock AI; the stock-negative harvest triples the modern fashion/product cells and confirms the combined-pool veto control; the Meta muse-image corpus doubles to 132 rows with its margin sweep; a per-channel cv2 reference fixes the latent fold test under cv2 4.10.0. pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks separately green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - new run references point at the gitignored research store, none stale; 4) CLAUDE.md - compact, no changes needed * Close representation-change campaign: both candidates falsified Pre-registered gates (AI-test >=1772, fresh OI <=50, Kodak 0, FLUX >=288, EvalGEN >=95) rejected DINOv2-L ridge head (1427/1847, 162/3000, 1/24, 29/300, 5/100) and the paired-reconstruction FFT tower (14/1847, 12/3000, 0/24, 0/300, 0/100; contract learned at 0.949 pairwise separation but no transfer to production generators). Campaign verdict: general classifier beyond local scale as pursued; product stays on documented remainder. pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks green minutes ago (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - verdict mirrored in data/research/REPRESENTATION-CAMPAIGN.md, no stale refs; 4) CLAUDE.md - no changes * Record full failure map, H2 router falsification, and H3 process detector closure 20 measured negative domains with batch-2 (memes, whiteboards, tickets, book pages). H2 domain router falsified: 97.9% of AI-test looks structured, every family 94-100%. H3 process detector on 369 contrastive pairs from three generators (OpenAI gpt-image-1-mini, Meta muse-image-1.0, Gemini flash-image) achieves 0.909 pairwise AUC on training pairs but transfers at AUC 0.55-0.60 to production AI; human receipts score higher than any AI family. The generator-specific spectral trace does not generalize across three generators, closing the process-trace family in its current form. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs + research scripts, single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes * Record H4-H6 research hypotheses: MLP probe, spectral invariant, TTA voting H4 (MLP on frozen CLIP): 98.6% AI-test recall but 15.8% photo FPR — same trade-off curve as quarter-hard. H5 (spectral invariant from CVPR 2025): 2.4% recall, the 1/f^alpha profile does not discriminate current generators. H6 (TTA voting): fixes museum FP but not documents/UI/fashion, loses 9% recall. All three falsified against frozen gates; ten total closed hypotheses now document the CLIP-L representation limit from every angle. Also records the provider cascade across all 20 domains (69.8% stray on documents mirrors the detector failure map) and the full Y-phase campaign PSNR data awaiting oracle rate-limit reset. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes * Fix Y-phase frequency convention, record H4-H6 and campaign results The initial Y-phase campaign targeted FFT bins 16-32 instead of spatial periods 16-32 px (1/32 to 1/16 cycles/px). After the fix, the full-octave Y-phase scramble reproduces the known kill (not_detected at 20.5 dB on s1 at native 1122x1402). Partial sub-bands are visually invisible (42.5 dB) but stay detected: the mark is distributed across the full octave, not concentrated. Point intervention is not viable within this frequency band. H4 MLP probe: 98.6% recall, 15.8% FPR (same trade-off wall). H5 spectral invariant: 2.4% recall (1/f^alpha does not discriminate). H6 TTA voting: fixes museum FP but not documents/UI/fashion. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (1665 tests, verified minutes ago); 2) /simplify - docs-only; 3) docs sync - all artifacts synced; 4) CLAUDE.md - no changes * Add TC260 fifth class and per-class margin calibration to provider cascade Five-head cascade (openai/google/tc260/meta/no_ai): openai 68.8%, google 76.6%, tc260 63.8%, meta 71.8% mean recall at uniform margin 0.50. Per-class margins calibrated against 1.67% photo budget: openai 0.31, google 0.29, tc260 0.39, meta 0.55. TC260 test recall 71.4% at calibrated margins on 196 held-out images. Chinese-AIGC is a viable pixel class. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified within the hour); 2) /simplify - research script, single pass; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Record universal detector v3-v8: diverse training shifts the curve Fresh MLP on frozen CLIP embeddings with 49 negative domains (12,258 images) and 5,043 AI positives achieves 93.0% AI-test recall with 39/49 domains at zero false positives. Digital art FP dropped from 99.3% (Model 1) to 24.8%, fashion from 62-71% to 12%, UI from 99.3% to 12%. Photo FPR 0.7%. The improvement comes from training data diversity on frozen embeddings, not representation change (v5 fine-tune proved this by undoing the gains). Also adds .local-eval to ruff exclude so the gate covers only tracked files. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - all artifacts in data/research/; 4) CLAUDE.md - no changes * Add three-tier ensemble detector: DEFINITELY/POSSIBLY/LIKELY_HUMAN Combines Model 1 and v8 into calibrated confidence tiers. DEFINITELY_AI (both models agree) achieves 79.6% recall at 0.50% photo FPR with 46/49 domains at zero FP. The union reaches 93.3% recall at 1.80% photo FPR with Kodak 0/24. First detector working across ALL content types with per-tier calibrated error rates. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + ensemble; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Add provider v2: diversity training eliminates document leakage Same diversity-training insight applied to the provider cascade. Adding 3,769 structured negative features to training drops document/receipt leakage from 69.8% to 5.1%, UI from 10% to 4.3%, fashion from 5-15% to 0-3%. AI recall improves: OpenAI 84% (was 75%), Google 88.8% (was 79%). Photo leakage 1.4%. Worst regression: memes 47.9% (was 27%). pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - provider v2; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Add universal v11: full taxonomy, 136 domains, 124 at zero FP Master data plan mapped 148 visual domains. Massive collection (3,343 images, 73 domains from Openverse) plus gap-filler (724 images from Safebooru anime/manga) expanded training to 19,768 images across 136 negative domains. Universal v11 (MLP-512 + Model 1 ensemble): DEFINITELY 90.3% recall at 0.50% photo FPR, ANY 95.6% recall, 124/134 domains at exactly 0% FP, worst FP 13.8% (digital art). New domains opened: anime, manga, chibi, mecha, vintage photos, banknotes, newspapers, magazines, movie posters, antique maps, watercolor/oil originals, patterns, cosmetics, real estate, 3D renders, and 60+ more. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Confirm representation limit: v12 fine-tune destroys structured FP despite 6x data Fine-tuning CLIP tower on 19,518 images achieves 95.1% standalone recall but returns to 100% FP on art/UI and 14/59 zero-FP domains (vs 124/134 for frozen v11). This is a representation property, not a data issue. Frozen CLIP + MLP (v11) is the only working architecture. Also records provider v3 trained on all negative domains. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Document v13 plateau: 128/136 zero FP, frozen-CLIP ceiling confirmed v13 with top-plan expansion (1,169 new images) improves domain coverage to 128/136 at zero FP and reduces fashion FP to 5.3%, but DEFINITELY recall plateaus at 89.6% and art FP at 15.9%. The frozen CLIP + MLP architecture has reached its ceiling. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified minutes ago, 1731 tests); 2) /simplify - docs-only; 3) docs sync - v13 recorded; 4) CLAUDE.md - no changes * Document the 2026-08-31 photo-classifier freeze. Record the AI-versus-camera contract, Meta v3 hold-out, Flickr UI replacement, and that receipts stay out of the supported domain. * Scrub Spaces catalog details from classifier research docs * Record receipt layout-gate probe for the universal detector
274 lines
10 KiB
Python
274 lines
10 KiB
Python
"""Discover and evaluate an exact-geometry periodic residual carrier.
|
|
|
|
The model folds a high-pass residual modulo a fixed tile, averaging thousands
|
|
of spatial repetitions before normalized correlation. It is a positive-only
|
|
research signal, not a universal or certified SynthID decoder.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import logging
|
|
from dataclasses import asdict, dataclass
|
|
from pathlib import Path
|
|
|
|
import click
|
|
import numpy as np
|
|
from synthid_periodic_tile import cyclic_tile_correlations, fold_residual_template, unit_tile
|
|
from synthid_pixel_attack import load_rgb
|
|
from synthid_research_manifest import artifact_sha256
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class PeriodicTileModel:
|
|
"""One exact-geometry normalized periodic-residual template."""
|
|
|
|
height: int
|
|
width: int
|
|
tile_height: int
|
|
tile_width: int
|
|
denoise_sigma: float
|
|
template: np.ndarray
|
|
expected_norm: float
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class PeriodicTileScore:
|
|
"""Normalized tile correlation and support for one image."""
|
|
|
|
path: str
|
|
score: float
|
|
active_support: float
|
|
row_shift: int
|
|
column_shift: int
|
|
repeat_count: int
|
|
|
|
|
|
def _load_rgb(path: Path, *, height: int, width: int) -> np.ndarray:
|
|
"""Load PATH as exact-geometry uint8 RGB."""
|
|
pixels = load_rgb(path)
|
|
if pixels.shape != (height, width, 3):
|
|
raise ValueError(f"{path}: geometry {pixels.shape[1]}x{pixels.shape[0]} does not match {width}x{height}")
|
|
return pixels
|
|
|
|
|
|
def discover_model(
|
|
paths: list[Path],
|
|
*,
|
|
tile_height: int,
|
|
tile_width: int,
|
|
denoise_sigma: float = 1.0,
|
|
) -> PeriodicTileModel:
|
|
"""Learn a normalized periodic template from positive PATHS."""
|
|
if len(paths) < 3:
|
|
raise ValueError("at least three positive images are required")
|
|
first_pixels = load_rgb(paths[0])
|
|
height, width = first_pixels.shape[:2]
|
|
unit_sum = np.zeros((tile_height, tile_width, 3), dtype=np.float64)
|
|
norms: list[float] = []
|
|
for index, path in enumerate(paths):
|
|
folded = fold_residual_template(
|
|
first_pixels if index == 0 else _load_rgb(path, height=height, width=width),
|
|
tile_height=tile_height,
|
|
tile_width=tile_width,
|
|
denoise_sigma=denoise_sigma,
|
|
)
|
|
unit, norm = unit_tile(folded)
|
|
unit_sum += unit
|
|
norms.append(norm)
|
|
template, template_norm = unit_tile(unit_sum / len(paths))
|
|
if template_norm == 0.0:
|
|
raise ValueError("positive images expose no periodic residual template")
|
|
return PeriodicTileModel(
|
|
height=height,
|
|
width=width,
|
|
tile_height=tile_height,
|
|
tile_width=tile_width,
|
|
denoise_sigma=denoise_sigma,
|
|
template=template,
|
|
expected_norm=float(np.median(norms)),
|
|
)
|
|
|
|
|
|
def score_pixels(
|
|
pixels: np.ndarray,
|
|
model: PeriodicTileModel,
|
|
*,
|
|
register: bool = False,
|
|
path: str = "<array>",
|
|
) -> PeriodicTileScore:
|
|
"""Score exact-geometry RGB PIXELS, optionally searching cyclic tile shifts."""
|
|
if pixels.shape != (model.height, model.width, 3):
|
|
raise ValueError("pixel geometry does not match periodic-tile model")
|
|
folded = fold_residual_template(
|
|
pixels,
|
|
tile_height=model.tile_height,
|
|
tile_width=model.tile_width,
|
|
denoise_sigma=model.denoise_sigma,
|
|
)
|
|
unit, norm = unit_tile(folded)
|
|
if register:
|
|
correlations = cyclic_tile_correlations(model.template, unit)
|
|
row_shift, column_shift = np.unravel_index(int(np.argmax(correlations)), correlations.shape)
|
|
score = float(correlations[row_shift, column_shift])
|
|
else:
|
|
score = float(np.sum(model.template * unit))
|
|
row_shift = column_shift = 0
|
|
return PeriodicTileScore(
|
|
path=path,
|
|
score=score,
|
|
active_support=min(norm / (model.expected_norm + 1e-12), 1.0),
|
|
row_shift=row_shift,
|
|
column_shift=column_shift,
|
|
repeat_count=(model.height // model.tile_height) * (model.width // model.tile_width),
|
|
)
|
|
|
|
|
|
def score_image(path: Path, model: PeriodicTileModel, *, register: bool = False) -> PeriodicTileScore:
|
|
"""Score PATH against MODEL, optionally searching cyclic tile shifts."""
|
|
pixels = _load_rgb(path, height=model.height, width=model.width)
|
|
return score_pixels(pixels, model, register=register, path=str(path))
|
|
|
|
|
|
def calibrate_threshold(paths: list[Path], model: PeriodicTileModel, *, register: bool = False) -> float:
|
|
"""Return the first float above every negative score in PATHS."""
|
|
if not paths:
|
|
raise ValueError("at least one calibration negative is required")
|
|
maximum = max(score_image(path, model, register=register).score for path in paths)
|
|
return float(np.nextafter(maximum, np.inf))
|
|
|
|
|
|
def save_model(path: Path, model: PeriodicTileModel) -> None:
|
|
"""Save MODEL as a pickle-free numeric artifact without precision loss."""
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
np.savez_compressed(
|
|
path,
|
|
format_version=np.asarray(1, dtype=np.int32),
|
|
height=np.asarray(model.height, dtype=np.int32),
|
|
width=np.asarray(model.width, dtype=np.int32),
|
|
tile_height=np.asarray(model.tile_height, dtype=np.int32),
|
|
tile_width=np.asarray(model.tile_width, dtype=np.int32),
|
|
denoise_sigma=np.asarray(model.denoise_sigma, dtype=np.float64),
|
|
template=model.template.astype(np.float64),
|
|
expected_norm=np.asarray(model.expected_norm, dtype=np.float64),
|
|
)
|
|
|
|
|
|
def load_model(path: Path) -> PeriodicTileModel:
|
|
"""Load and validate one numeric periodic-tile model."""
|
|
with np.load(path, allow_pickle=False) as artifact:
|
|
if int(artifact["format_version"]) != 1:
|
|
raise ValueError("unsupported periodic-tile model format version")
|
|
model = PeriodicTileModel(
|
|
height=int(artifact["height"]),
|
|
width=int(artifact["width"]),
|
|
tile_height=int(artifact["tile_height"]),
|
|
tile_width=int(artifact["tile_width"]),
|
|
denoise_sigma=float(artifact["denoise_sigma"]),
|
|
template=np.asarray(artifact["template"], dtype=np.float64),
|
|
expected_norm=float(artifact["expected_norm"]),
|
|
)
|
|
if model.height < 1 or model.width < 1 or model.tile_height < 1 or model.tile_width < 1:
|
|
raise ValueError("invalid periodic-tile geometry")
|
|
if model.height % model.tile_height or model.width % model.tile_width:
|
|
raise ValueError("image geometry is not divisible by periodic-tile geometry")
|
|
if model.template.shape != (model.tile_height, model.tile_width, 3):
|
|
raise ValueError("invalid periodic-tile template shape")
|
|
if not np.all(np.isfinite(model.template)) or not np.isclose(np.linalg.norm(model.template), 1.0):
|
|
raise ValueError("invalid periodic-tile template")
|
|
if not np.isfinite(model.denoise_sigma) or model.denoise_sigma <= 0.0:
|
|
raise ValueError("invalid periodic-tile denoise sigma")
|
|
if not np.isfinite(model.expected_norm) or model.expected_norm <= 0.0:
|
|
raise ValueError("invalid periodic-tile expected norm")
|
|
return model
|
|
|
|
|
|
@click.group()
|
|
def main() -> None:
|
|
"""Discover and evaluate an exact-geometry periodic carrier."""
|
|
logging.basicConfig(level=logging.INFO, format="%(message)s")
|
|
|
|
|
|
@main.command()
|
|
@click.argument("positives", nargs=-1, required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.option("--tile-height", type=click.IntRange(min=1), required=True)
|
|
@click.option("--tile-width", type=click.IntRange(min=1), required=True)
|
|
@click.option("--denoise-sigma", type=click.FloatRange(min=0.0, min_open=True), default=1.0, show_default=True)
|
|
@click.option("--model-out", type=click.Path(dir_okay=False, path_type=Path), required=True)
|
|
def discover(
|
|
positives: tuple[Path, ...],
|
|
tile_height: int,
|
|
tile_width: int,
|
|
denoise_sigma: float,
|
|
model_out: Path,
|
|
) -> None:
|
|
"""Learn a periodic tile from exact-geometry POSITIVES."""
|
|
save_model(
|
|
model_out,
|
|
discover_model(
|
|
list(positives),
|
|
tile_height=tile_height,
|
|
tile_width=tile_width,
|
|
denoise_sigma=denoise_sigma,
|
|
),
|
|
)
|
|
log.info("Wrote periodic-tile model: %s", model_out)
|
|
|
|
|
|
@main.command()
|
|
@click.argument("model_path", type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.argument("negatives", nargs=-1, required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.option("--register", is_flag=True, help="Search every cyclic shift within the learned tile.")
|
|
@click.option("--report-out", type=click.Path(dir_okay=False, path_type=Path), required=True)
|
|
def calibrate(model_path: Path, negatives: tuple[Path, ...], register: bool, report_out: Path) -> None:
|
|
"""Calibrate a zero-observed-error threshold on NEGATIVES."""
|
|
model = load_model(model_path)
|
|
threshold = calibrate_threshold(list(negatives), model, register=register)
|
|
report_out.parent.mkdir(parents=True, exist_ok=True)
|
|
report_out.write_text(
|
|
json.dumps(
|
|
{
|
|
"model": str(model_path),
|
|
"model_sha256": artifact_sha256(model_path),
|
|
"register": register,
|
|
"negative_count": len(negatives),
|
|
"threshold": threshold,
|
|
},
|
|
indent=2,
|
|
)
|
|
+ "\n",
|
|
encoding="utf-8",
|
|
)
|
|
log.info("Wrote periodic-tile calibration report: %s", report_out)
|
|
|
|
|
|
@main.command()
|
|
@click.argument("model_path", type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.argument("images", nargs=-1, required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.option("--register", is_flag=True, help="Search every cyclic shift within the learned tile.")
|
|
@click.option("--report-out", type=click.Path(dir_okay=False, path_type=Path), required=True)
|
|
def score(model_path: Path, images: tuple[Path, ...], register: bool, report_out: Path) -> None:
|
|
"""Score exact-geometry IMAGES with MODEL_PATH."""
|
|
model = load_model(model_path)
|
|
report_out.parent.mkdir(parents=True, exist_ok=True)
|
|
report_out.write_text(
|
|
json.dumps(
|
|
{
|
|
"model": str(model_path),
|
|
"model_sha256": artifact_sha256(model_path),
|
|
"register": register,
|
|
"scores": [asdict(score_image(image, model, register=register)) for image in images],
|
|
},
|
|
indent=2,
|
|
)
|
|
+ "\n",
|
|
encoding="utf-8",
|
|
)
|
|
log.info("Wrote periodic-tile score report: %s", report_out)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|