mirror of
https://github.com/wiltodelta/remove-ai-watermarks.git
synced 2026-08-10 08:00:32 +02:00
Victor KuznetsovandClaude Opus 5
1124c591be
The registries are raw substrings and the shortest tokens are four and five bytes (`Bria`, `Adobe`, `Canva`). Over a megabyte of compressed pixel data such a sequence turns up by chance: `Bria` matched inside the entropy-coded scan of 4 of 14,707 corpus JPEGs, in none of which the manifest names Bria. The rate is what a four-byte pattern predicts on that corpus, and the Bria entry asserts AI, so a chance match can declare an image AI-generated rather than merely mislabel its signer. `_metadata_region` gives the registry scans the container's metadata: JPEG marker segments before the coded scan, PNG chunks other than IDAT, both trailers, and whatever `scan_head` appended past the window. Every other check keeps the full buffer -- their markers are long and distinctive. A container that does not parse is returned whole, since dropping real evidence to avoid a chance match is the wrong trade. `c2pa_marker_in` already refuses a bare `c2pa` substring for this reason; this is the same defence for the registries. Verified the way the rules require for a change that MOVES a verdict: over all 48,905 corpus images, exactly one file changed, the one named in advance, from "C2PA Content Credentials (Bria Artificial Intelligence)" to "(unknown signer)". Record-path parity is 0 disagreements, down from 75 when this work started. The audit's own baseline comparison is fixed here too. It compared confidence and signals only, and so reported "0 changed" for the run whose single intended correction was a watermark line -- the change it exists to show. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>