Files
remove-ai-watermarks/scripts/synthid_v3_codebook_probe.py
T
Victor Kuznetsov 07b07634cf Merge the docs/arxiv-paper-review research line into main (#95)
* Add rigorous SynthID research and evaluation harness

* Record SynthID cross-epoch validation results

* Reset SynthID detector hypotheses to paired training

* Add paired wavelet and spectral SynthID probes

* Record closed-corpus SynthID detector ablations

* Add registered SynthID phase probing

* Add periodic SynthID tile probing

* Add calibrated SynthID pixel detector

* Harden scale-registered SynthID detection

* Record SynthID phase and channel rescue findings

* Add production SynthID routing and OpenAI verification

* Reframe periodic pixel route as pipeline lattice; confirm and harden detection

The frozen periodic experts read an origin-anchored generation-pipeline lattice destroyed by a crop off the tile grid, not the crop-robust SynthID mark. Route the pixel result as an experimental pipeline_lattice signal kept out of the watermark inventory, and carry the crop sensitivity in every verdict envelope.

Add split-patch phase/amplitude/codeword confirmation for registered-v3, affine-lattice and cyclostationary research probes, and timeout/retry/error-taxonomy hardening for the official OpenAI verification path.

* Record pipeline-lattice reframing and registered-v3 phase lock

Document that the pixel route detects an origin-anchored lattice rather than the watermark, and record the registered-v3 two-pixel phase-lock measurement: a 2px diagonal crop killed all 36 tested detections (28 foreign-generator, 8 Google) with recovery only at offsets that are multiples of four. Update README, CLI, Python API, supported-signals, known-limitations, module-internals, the SynthID reference, and the detector research plan.

* Split SynthID campaign docs by detector, classifiers, and removal

Keep Model 1 as a research AI-versus-camera result outside the library.
Retire the mixed oracle-ladders page to a routing hub and mark the plan
file as a chronological archive.

* Keep 2026-08-22 SynthID campaign results in research docs only

Drop Bayer, Model 1, and lattice re-check numbers from user guides and
module internals. The library surface is unchanged.

* Unplug lattice detector from package, expand research docs

* Remove lattice detector sources from the public package

* Document SynthID GitHub sweep findings

* Document general AI classifier sweep

* Document modern-negative taxonomy audit and classifier doc split

Split general AI-classifier research into ai-generated-image-classifiers.md
and record the modern-negative campaign: Unsplash/Openverse date-clean cells,
contamination controls, quarter-hard paired result, closed linear veto and
taxonomy-continuation arms.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix (same triage as main); core checks separately green (ruff, format, pyright, 1564 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - split references updated everywhere, none stale; 4) CLAUDE.md - routing line already updated, compliant

* Record wild-AI audit, Meta provider class, and stock-negative expansion

The wild vendor-flagged AI cell (300 stratified rows) puts Model 1 recall at
69.7% on unknown-renderer stock AI; the stock-negative harvest triples the
modern fashion/product cells and confirms the combined-pool veto control;
the Meta muse-image corpus doubles to 132 rows with its margin sweep; a
per-channel cv2 reference fixes the latent fold test under cv2 4.10.0.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks separately green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - new run references point at the gitignored research store, none stale; 4) CLAUDE.md - compact, no changes needed

* Close representation-change campaign: both candidates falsified

Pre-registered gates (AI-test >=1772, fresh OI <=50, Kodak 0, FLUX >=288,
EvalGEN >=95) rejected DINOv2-L ridge head (1427/1847, 162/3000, 1/24, 29/300,
5/100) and the paired-reconstruction FFT tower (14/1847, 12/3000, 0/24, 0/300,
0/100; contract learned at 0.949 pairwise separation but no transfer to
production generators). Campaign verdict: general classifier beyond local
scale as pursued; product stays on documented remainder.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks green minutes ago (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - verdict mirrored in data/research/REPRESENTATION-CAMPAIGN.md, no stale refs; 4) CLAUDE.md - no changes

* Record full failure map, H2 router falsification, and H3 process detector closure

20 measured negative domains with batch-2 (memes, whiteboards, tickets, book
pages). H2 domain router falsified: 97.9% of AI-test looks structured, every
family 94-100%. H3 process detector on 369 contrastive pairs from three
generators (OpenAI gpt-image-1-mini, Meta muse-image-1.0, Gemini flash-image)
achieves 0.909 pairwise AUC on training pairs but transfers at AUC 0.55-0.60
to production AI; human receipts score higher than any AI family. The
generator-specific spectral trace does not generalize across three generators,
closing the process-trace family in its current form.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs + research scripts, single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes

* Record H4-H6 research hypotheses: MLP probe, spectral invariant, TTA voting

H4 (MLP on frozen CLIP): 98.6% AI-test recall but 15.8% photo FPR — same
trade-off curve as quarter-hard. H5 (spectral invariant from CVPR 2025):
2.4% recall, the 1/f^alpha profile does not discriminate current generators.
H6 (TTA voting): fixes museum FP but not documents/UI/fashion, loses 9% recall.
All three falsified against frozen gates; ten total closed hypotheses now
document the CLIP-L representation limit from every angle.

Also records the provider cascade across all 20 domains (69.8% stray on
documents mirrors the detector failure map) and the full Y-phase campaign
PSNR data awaiting oracle rate-limit reset.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes

* Fix Y-phase frequency convention, record H4-H6 and campaign results

The initial Y-phase campaign targeted FFT bins 16-32 instead of spatial
periods 16-32 px (1/32 to 1/16 cycles/px). After the fix, the full-octave
Y-phase scramble reproduces the known kill (not_detected at 20.5 dB on s1
at native 1122x1402). Partial sub-bands are visually invisible (42.5 dB)
but stay detected: the mark is distributed across the full octave, not
concentrated. Point intervention is not viable within this frequency band.

H4 MLP probe: 98.6% recall, 15.8% FPR (same trade-off wall).
H5 spectral invariant: 2.4% recall (1/f^alpha does not discriminate).
H6 TTA voting: fixes museum FP but not documents/UI/fashion.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (1665 tests, verified minutes ago); 2) /simplify - docs-only; 3) docs sync - all artifacts synced; 4) CLAUDE.md - no changes

* Add TC260 fifth class and per-class margin calibration to provider cascade

Five-head cascade (openai/google/tc260/meta/no_ai): openai 68.8%, google
76.6%, tc260 63.8%, meta 71.8% mean recall at uniform margin 0.50.
Per-class margins calibrated against 1.67% photo budget: openai 0.31,
google 0.29, tc260 0.39, meta 0.55. TC260 test recall 71.4% at calibrated
margins on 196 held-out images. Chinese-AIGC is a viable pixel class.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified within the hour); 2) /simplify - research script, single pass; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Record universal detector v3-v8: diverse training shifts the curve

Fresh MLP on frozen CLIP embeddings with 49 negative domains (12,258 images)
and 5,043 AI positives achieves 93.0% AI-test recall with 39/49 domains at
zero false positives. Digital art FP dropped from 99.3% (Model 1) to 24.8%,
fashion from 62-71% to 12%, UI from 99.3% to 12%. Photo FPR 0.7%. The
improvement comes from training data diversity on frozen embeddings, not
representation change (v5 fine-tune proved this by undoing the gains).
Also adds .local-eval to ruff exclude so the gate covers only tracked files.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - all artifacts in data/research/; 4) CLAUDE.md - no changes

* Add three-tier ensemble detector: DEFINITELY/POSSIBLY/LIKELY_HUMAN

Combines Model 1 and v8 into calibrated confidence tiers. DEFINITELY_AI
(both models agree) achieves 79.6% recall at 0.50% photo FPR with 46/49
domains at zero FP. The union reaches 93.3% recall at 1.80% photo FPR
with Kodak 0/24. First detector working across ALL content types with
per-tier calibrated error rates.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + ensemble; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Add provider v2: diversity training eliminates document leakage

Same diversity-training insight applied to the provider cascade. Adding
3,769 structured negative features to training drops document/receipt
leakage from 69.8% to 5.1%, UI from 10% to 4.3%, fashion from 5-15% to
0-3%. AI recall improves: OpenAI 84% (was 75%), Google 88.8% (was 79%).
Photo leakage 1.4%. Worst regression: memes 47.9% (was 27%).

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - provider v2; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Add universal v11: full taxonomy, 136 domains, 124 at zero FP

Master data plan mapped 148 visual domains. Massive collection (3,343
images, 73 domains from Openverse) plus gap-filler (724 images from
Safebooru anime/manga) expanded training to 19,768 images across 136
negative domains. Universal v11 (MLP-512 + Model 1 ensemble):
DEFINITELY 90.3% recall at 0.50% photo FPR, ANY 95.6% recall,
124/134 domains at exactly 0% FP, worst FP 13.8% (digital art).

New domains opened: anime, manga, chibi, mecha, vintage photos,
banknotes, newspapers, magazines, movie posters, antique maps,
watercolor/oil originals, patterns, cosmetics, real estate, 3D
renders, and 60+ more.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Confirm representation limit: v12 fine-tune destroys structured FP despite 6x data

Fine-tuning CLIP tower on 19,518 images achieves 95.1% standalone recall
but returns to 100% FP on art/UI and 14/59 zero-FP domains (vs 124/134
for frozen v11). This is a representation property, not a data issue.
Frozen CLIP + MLP (v11) is the only working architecture. Also records
provider v3 trained on all negative domains.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Document v13 plateau: 128/136 zero FP, frozen-CLIP ceiling confirmed

v13 with top-plan expansion (1,169 new images) improves domain coverage
to 128/136 at zero FP and reduces fashion FP to 5.3%, but DEFINITELY
recall plateaus at 89.6% and art FP at 15.9%. The frozen CLIP + MLP
architecture has reached its ceiling.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified minutes ago, 1731 tests); 2) /simplify - docs-only; 3) docs sync - v13 recorded; 4) CLAUDE.md - no changes

* Document the 2026-08-31 photo-classifier freeze.

Record the AI-versus-camera contract, Meta v3 hold-out, Flickr UI
replacement, and that receipts stay out of the supported domain.

* Scrub Spaces catalog details from classifier research docs

* Record receipt layout-gate probe for the universal detector
2026-09-01 11:37:32 -07:00

345 lines
13 KiB
Python

"""Independently evaluate a numeric reverse-SynthID V3 NPZ codebook.
The loader accepts only the documented dense or sparse numeric format-v2 arrays
and disables pickle. It does not import or execute third-party code. Scores are
exploratory: the external reference provenance and labels still require
independent oracle validation before this can support a SynthID detector claim.
"""
from __future__ import annotations
import json
import logging
from dataclasses import asdict, dataclass
from pathlib import Path
import click
import numpy as np
from PIL import Image
from synthid_phase_registration import (
MAX_TRANSLATION_SHIFT,
extract_frequency_values,
phase_adjustment,
register_phase_translations,
)
log = logging.getLogger(__name__)
LOG_2 = np.log(2.0)
@dataclass(frozen=True)
class V3CarrierModel:
"""Selected numeric bins from one exact-resolution V3 profile."""
height: int
width: int
rows: np.ndarray
columns: np.ndarray
channels: np.ndarray
phases: np.ndarray
weights: np.ndarray
expected_magnitudes: np.ndarray
@dataclass(frozen=True)
class V3Score:
"""Phase-alignment scores for one image."""
path: str
phase_score: float
axial_phase_score: float
active_weight_fraction: float
peak_count: int
@dataclass(frozen=True)
class V3RegisteredScore:
"""Best phase-alignment score across a bounded translation search."""
path: str
phase_score: float
axial_phase_score: float
active_weight_fraction: float
peak_count: int
row_shift: int
column_shift: int
@dataclass(frozen=True)
class _CarrierCandidates:
"""Selected numeric carrier arrays from one V3 profile."""
weights: np.ndarray
rows: np.ndarray
columns: np.ndarray
channels: np.ndarray
phases: np.ndarray
magnitudes: np.ndarray
def _load_sparse_channel(artifact: np.lib.npyio.NpzFile, prefix: str, channel: int) -> tuple[np.ndarray, ...]:
"""Load one sparse channel without reconstructing full image-sized arrays."""
indices = np.asarray(artifact[f"{prefix}idx_{channel}"], dtype=np.uint32)
log_magnitudes = np.asarray(artifact[f"{prefix}mag_{channel}"])
phases = np.asarray(artifact[f"{prefix}phase_{channel}"])
coherence = np.asarray(artifact[f"{prefix}cons_{channel}"], dtype=np.float64) / 255.0
if not (indices.shape == log_magnitudes.shape == phases.shape == coherence.shape):
raise ValueError("sparse profile arrays have inconsistent shapes")
return indices, log_magnitudes, phases, coherence
def _top_positions(selection: np.ndarray, tie_breaker: np.ndarray, peak_count: int) -> np.ndarray:
"""Return deterministic descending positions for the strongest candidates."""
if len(selection) < peak_count:
raise ValueError(f"profile exposes only {len(selection)} eligible bins")
cutoff = np.partition(selection, -peak_count)[-peak_count]
stronger = np.flatnonzero(selection > cutoff)
tied = np.flatnonzero(selection == cutoff)
remaining = peak_count - len(stronger)
if remaining < len(tied):
tied = tied[np.argpartition(tie_breaker[tied], -remaining)[-remaining:]]
positions = np.concatenate((stronger, tied))
order = np.lexsort((-tie_breaker[positions], -selection[positions]))
return positions[order]
def _dense_candidates(
artifact: np.lib.npyio.NpzFile,
prefix: str,
*,
height: int,
width: int,
min_radius: float,
peak_count: int,
) -> _CarrierCandidates:
"""Select candidate arrays from one dense numeric profile."""
shape = (height, width // 2 + 1, 3)
log_magnitudes = np.asarray(artifact[f"{prefix}mag"])
phases = np.asarray(artifact[f"{prefix}phase"])
coherence = np.asarray(artifact[f"{prefix}cons"], dtype=np.float64) / 255.0
if not (log_magnitudes.shape == phases.shape == coherence.shape == shape):
raise ValueError("dense profile arrays have inconsistent shapes")
rows = np.arange(height)
signed_rows = np.where(rows > height // 2, rows - height, rows)
columns = np.arange(shape[1])
radius = np.sqrt(np.square(signed_rows[:, None]) + np.square(columns[None, :]))
valid_spatial = (radius >= min_radius) & (columns[None, :] > 0)
valid = np.broadcast_to(valid_spatial[:, :, None], shape)
flat_valid = np.flatnonzero(valid)
selection = (np.square(coherence) * log_magnitudes * LOG_2).ravel()[flat_valid]
positions = _top_positions(selection, flat_valid, peak_count)
selected = flat_valid[positions]
selected_rows, selected_columns, selected_channels = np.unravel_index(selected, shape)
return _CarrierCandidates(
weights=selection[positions],
rows=selected_rows,
columns=selected_columns,
channels=selected_channels,
phases=np.asarray(phases.ravel()[selected], dtype=np.float64),
magnitudes=np.exp2(np.asarray(log_magnitudes.ravel()[selected], dtype=np.float64)) - 1.0,
)
def _sparse_candidates(
artifact: np.lib.npyio.NpzFile,
prefix: str,
*,
height: int,
width: int,
min_radius: float,
peak_count: int,
) -> _CarrierCandidates:
"""Select candidate arrays from one sparse numeric profile."""
half_width = width // 2 + 1
selections: list[np.ndarray] = []
candidate_rows: list[np.ndarray] = []
candidate_columns: list[np.ndarray] = []
candidate_channels: list[np.ndarray] = []
candidate_phases: list[np.ndarray] = []
candidate_log_magnitudes: list[np.ndarray] = []
for channel in range(3):
indices, log_magnitudes, phases, coherence = _load_sparse_channel(artifact, prefix, channel)
rows, columns = np.unravel_index(indices, (height, half_width))
signed_rows = np.where(rows > height // 2, rows - height, rows)
radius = np.sqrt(np.square(signed_rows) + np.square(columns))
valid = (radius >= min_radius) & (columns > 0)
selections.append((np.square(coherence) * log_magnitudes * LOG_2)[valid])
candidate_rows.append(rows[valid])
candidate_columns.append(columns[valid])
candidate_channels.append(np.full(np.count_nonzero(valid), channel, dtype=np.int8))
candidate_phases.append(phases[valid])
candidate_log_magnitudes.append(log_magnitudes[valid])
selection = np.concatenate(selections)
rows = np.concatenate(candidate_rows)
columns = np.concatenate(candidate_columns)
channels = np.concatenate(candidate_channels)
tie_breaker = np.ravel_multi_index((rows, columns, channels), (height, half_width, 3))
selected = _top_positions(selection, tie_breaker, peak_count)
return _CarrierCandidates(
weights=selection[selected],
rows=rows[selected],
columns=columns[selected],
channels=channels[selected],
phases=np.asarray(np.concatenate(candidate_phases)[selected], dtype=np.float64),
magnitudes=np.exp2(np.asarray(np.concatenate(candidate_log_magnitudes)[selected], dtype=np.float64)) - 1.0,
)
def load_v3_model(
path: Path,
*,
height: int,
width: int,
peak_count: int = 256,
min_radius: float = 15.0,
) -> V3CarrierModel:
"""Load top phase-consistent bins from a numeric V3 codebook profile."""
prefix = f"{height}x{width}/"
with np.load(path, allow_pickle=False) as artifact:
if int(artifact["format_version"]) != 2:
raise ValueError("only numeric V3 format version 2 is supported")
loader = _sparse_candidates if bool(int(artifact[f"{prefix}sparse"])) else _dense_candidates
candidates = loader(
artifact,
prefix,
height=height,
width=width,
min_radius=min_radius,
peak_count=peak_count,
)
return V3CarrierModel(
height=height,
width=width,
rows=np.asarray(candidates.rows, dtype=np.int32),
columns=np.asarray(candidates.columns, dtype=np.int32),
channels=np.asarray(candidates.channels, dtype=np.int8),
phases=candidates.phases,
weights=candidates.weights / np.sum(candidates.weights),
expected_magnitudes=candidates.magnitudes,
)
def _load_profile_rgb(path: Path, model: V3CarrierModel) -> np.ndarray:
"""Load PATH and resize only when it does not match the profile geometry."""
with Image.open(path) as source:
image = source.convert("RGB")
if image.size != (model.width, model.height):
image = image.resize((model.width, model.height), Image.Resampling.LANCZOS)
return np.asarray(image, dtype=np.float64)
def _frequency_values(path: Path, model: V3CarrierModel) -> np.ndarray:
"""Return the selected complex coefficients from PATH."""
pixels = _load_profile_rgb(path, model)
return extract_frequency_values(pixels, model.rows, model.columns, model.channels)
def _score_values(
values: np.ndarray,
model: V3CarrierModel,
phase_offsets: np.ndarray | float = 0.0,
) -> tuple[float, float, float]:
"""Return phase, axial-phase, and active-weight scores for VALUES."""
phase_difference = np.angle(values) - model.phases
magnitude_gate = np.minimum(np.abs(values) / (model.expected_magnitudes + 1e-12), 1.0)
active_weights = model.weights * magnitude_gate
active_weight = float(np.sum(active_weights))
if active_weight == 0.0:
phase_score = 0.0
axial_score = 0.0
else:
adjusted = phase_difference + phase_offsets
phase_score = float(np.sum(active_weights * np.cos(adjusted)) / active_weight)
axial_score = float(np.sum(active_weights * np.cos(2.0 * adjusted)) / active_weight)
return phase_score, axial_score, active_weight
def score_image(path: Path, model: V3CarrierModel) -> V3Score:
"""Score PATH against selected V3 phase bins."""
phase_score, axial_score, active_weight = _score_values(_frequency_values(path, model), model)
return V3Score(
path=str(path),
phase_score=phase_score,
axial_phase_score=axial_score,
active_weight_fraction=active_weight,
peak_count=len(model.rows),
)
def score_translations(path: Path, model: V3CarrierModel, *, max_shift: int = 4) -> V3RegisteredScore:
"""Return the best score after compensating bounded integer translations."""
values = _frequency_values(path, model)
registration = register_phase_translations(
values,
phases=model.phases,
weights=model.weights,
expected_magnitudes=model.expected_magnitudes,
rows=model.rows,
columns=model.columns,
height=model.height,
width=model.width,
max_shift=max_shift,
)
selected_adjustment = phase_adjustment(
model.rows,
model.columns,
height=model.height,
width=model.width,
row_shift=registration.row_shift,
column_shift=registration.column_shift,
)
phase_score, axial_score, active_weight = _score_values(values, model, selected_adjustment)
return V3RegisteredScore(
path=str(path),
phase_score=phase_score,
axial_phase_score=axial_score,
active_weight_fraction=active_weight,
peak_count=len(model.rows),
row_shift=registration.row_shift,
column_shift=registration.column_shift,
)
@click.command()
@click.argument("codebook", type=click.Path(exists=True, dir_okay=False, path_type=Path))
@click.argument("images", nargs=-1, required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
@click.option("--height", type=click.IntRange(min=64), required=True)
@click.option("--width", type=click.IntRange(min=64), required=True)
@click.option("--peak-count", type=click.IntRange(min=1), default=256, show_default=True)
@click.option("--max-shift", type=click.IntRange(min=0, max=MAX_TRANSLATION_SHIFT), default=0, show_default=True)
@click.option("--report-out", type=click.Path(dir_okay=False, path_type=Path), required=True)
def main(
codebook: Path,
images: tuple[Path, ...],
height: int,
width: int,
peak_count: int,
max_shift: int,
report_out: Path,
) -> None:
"""Score IMAGES against one exact-resolution profile from CODEBOOK."""
model = load_v3_model(codebook, height=height, width=width, peak_count=peak_count)
scores = (
[asdict(score_image(image, model)) for image in images]
if max_shift == 0
else [asdict(score_translations(image, model, max_shift=max_shift)) for image in images]
)
payload = {
"codebook": str(codebook),
"height": height,
"width": width,
"peak_count": peak_count,
"max_shift": max_shift,
"scores": scores,
}
report_out.parent.mkdir(parents=True, exist_ok=True)
report_out.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
log.info("Wrote V3 score report: %s", report_out)
if __name__ == "__main__":
logging.basicConfig(level=logging.INFO, format="%(message)s")
main()