0 Fork 0

mirror of https://github.com/wiltodelta/remove-ai-watermarks.git synced 2026-10-14 13:30:55 +02:00

Files

T

Victor Kuznetsov 07b07634cf Merge the docs/arxiv-paper-review research line into main (#95 )

* Add rigorous SynthID research and evaluation harness

* Record SynthID cross-epoch validation results

* Reset SynthID detector hypotheses to paired training

* Add paired wavelet and spectral SynthID probes

* Record closed-corpus SynthID detector ablations

* Add registered SynthID phase probing

* Add periodic SynthID tile probing

* Add calibrated SynthID pixel detector

* Harden scale-registered SynthID detection

* Record SynthID phase and channel rescue findings

* Add production SynthID routing and OpenAI verification

* Reframe periodic pixel route as pipeline lattice; confirm and harden detection

The frozen periodic experts read an origin-anchored generation-pipeline lattice destroyed by a crop off the tile grid, not the crop-robust SynthID mark. Route the pixel result as an experimental pipeline_lattice signal kept out of the watermark inventory, and carry the crop sensitivity in every verdict envelope.

Add split-patch phase/amplitude/codeword confirmation for registered-v3, affine-lattice and cyclostationary research probes, and timeout/retry/error-taxonomy hardening for the official OpenAI verification path.

* Record pipeline-lattice reframing and registered-v3 phase lock

Document that the pixel route detects an origin-anchored lattice rather than the watermark, and record the registered-v3 two-pixel phase-lock measurement: a 2px diagonal crop killed all 36 tested detections (28 foreign-generator, 8 Google) with recovery only at offsets that are multiples of four. Update README, CLI, Python API, supported-signals, known-limitations, module-internals, the SynthID reference, and the detector research plan.

* Split SynthID campaign docs by detector, classifiers, and removal

Keep Model 1 as a research AI-versus-camera result outside the library.
Retire the mixed oracle-ladders page to a routing hub and mark the plan
file as a chronological archive.

* Keep 2026-08-22 SynthID campaign results in research docs only

Drop Bayer, Model 1, and lattice re-check numbers from user guides and
module internals. The library surface is unchanged.

* Unplug lattice detector from package, expand research docs

* Remove lattice detector sources from the public package

* Document SynthID GitHub sweep findings

* Document general AI classifier sweep

* Document modern-negative taxonomy audit and classifier doc split

Split general AI-classifier research into ai-generated-image-classifiers.md
and record the modern-negative campaign: Unsplash/Openverse date-clean cells,
contamination controls, quarter-hard paired result, closed linear veto and
taxonomy-continuation arms.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix (same triage as main); core checks separately green (ruff, format, pyright, 1564 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - split references updated everywhere, none stale; 4) CLAUDE.md - routing line already updated, compliant

* Record wild-AI audit, Meta provider class, and stock-negative expansion

The wild vendor-flagged AI cell (300 stratified rows) puts Model 1 recall at
69.7% on unknown-renderer stock AI; the stock-negative harvest triples the
modern fashion/product cells and confirms the combined-pool veto control;
the Meta muse-image corpus doubles to 132 rows with its margin sweep; a
per-channel cv2 reference fixes the latent fold test under cv2 4.10.0.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks separately green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - new run references point at the gitignored research store, none stale; 4) CLAUDE.md - compact, no changes needed

* Close representation-change campaign: both candidates falsified

Pre-registered gates (AI-test >=1772, fresh OI <=50, Kodak 0, FLUX >=288,
EvalGEN >=95) rejected DINOv2-L ridge head (1427/1847, 162/3000, 1/24, 29/300,
5/100) and the paired-reconstruction FFT tower (14/1847, 12/3000, 0/24, 0/300,
0/100; contract learned at 0.949 pairwise separation but no transfer to
production generators). Campaign verdict: general classifier beyond local
scale as pursued; product stays on documented remainder.

pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks green minutes ago (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - verdict mirrored in data/research/REPRESENTATION-CAMPAIGN.md, no stale refs; 4) CLAUDE.md - no changes

* Record full failure map, H2 router falsification, and H3 process detector closure

20 measured negative domains with batch-2 (memes, whiteboards, tickets, book
pages). H2 domain router falsified: 97.9% of AI-test looks structured, every
family 94-100%. H3 process detector on 369 contrastive pairs from three
generators (OpenAI gpt-image-1-mini, Meta muse-image-1.0, Gemini flash-image)
achieves 0.909 pairwise AUC on training pairs but transfers at AUC 0.55-0.60
to production AI; human receipts score higher than any AI family. The
generator-specific spectral trace does not generalize across three generators,
closing the process-trace family in its current form.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs + research scripts, single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes

* Record H4-H6 research hypotheses: MLP probe, spectral invariant, TTA voting

H4 (MLP on frozen CLIP): 98.6% AI-test recall but 15.8% photo FPR — same
trade-off curve as quarter-hard. H5 (spectral invariant from CVPR 2025):
2.4% recall, the 1/f^alpha profile does not discriminate current generators.
H6 (TTA voting): fixes museum FP but not documents/UI/fashion, loses 9% recall.
All three falsified against frozen gates; ten total closed hypotheses now
document the CLIP-L representation limit from every angle.

Also records the provider cascade across all 20 domains (69.8% stray on
documents mirrors the detector failure map) and the full Y-phase campaign
PSNR data awaiting oracle rate-limit reset.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes

* Fix Y-phase frequency convention, record H4-H6 and campaign results

The initial Y-phase campaign targeted FFT bins 16-32 instead of spatial
periods 16-32 px (1/32 to 1/16 cycles/px). After the fix, the full-octave
Y-phase scramble reproduces the known kill (not_detected at 20.5 dB on s1
at native 1122x1402). Partial sub-bands are visually invisible (42.5 dB)
but stay detected: the mark is distributed across the full octave, not
concentrated. Point intervention is not viable within this frequency band.

H4 MLP probe: 98.6% recall, 15.8% FPR (same trade-off wall).
H5 spectral invariant: 2.4% recall (1/f^alpha does not discriminate).
H6 TTA voting: fixes museum FP but not documents/UI/fashion.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (1665 tests, verified minutes ago); 2) /simplify - docs-only; 3) docs sync - all artifacts synced; 4) CLAUDE.md - no changes

* Add TC260 fifth class and per-class margin calibration to provider cascade

Five-head cascade (openai/google/tc260/meta/no_ai): openai 68.8%, google
76.6%, tc260 63.8%, meta 71.8% mean recall at uniform margin 0.50.
Per-class margins calibrated against 1.67% photo budget: openai 0.31,
google 0.29, tc260 0.39, meta 0.55. TC260 test recall 71.4% at calibrated
margins on 196 held-out images. Chinese-AIGC is a viable pixel class.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified within the hour); 2) /simplify - research script, single pass; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Record universal detector v3-v8: diverse training shifts the curve

Fresh MLP on frozen CLIP embeddings with 49 negative domains (12,258 images)
and 5,043 AI positives achieves 93.0% AI-test recall with 39/49 domains at
zero false positives. Digital art FP dropped from 99.3% (Model 1) to 24.8%,
fashion from 62-71% to 12%, UI from 99.3% to 12%. Photo FPR 0.7%. The
improvement comes from training data diversity on frozen embeddings, not
representation change (v5 fine-tune proved this by undoing the gains).
Also adds .local-eval to ruff exclude so the gate covers only tracked files.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - all artifacts in data/research/; 4) CLAUDE.md - no changes

* Add three-tier ensemble detector: DEFINITELY/POSSIBLY/LIKELY_HUMAN

Combines Model 1 and v8 into calibrated confidence tiers. DEFINITELY_AI
(both models agree) achieves 79.6% recall at 0.50% photo FPR with 46/49
domains at zero FP. The union reaches 93.3% recall at 1.80% photo FPR
with Kodak 0/24. First detector working across ALL content types with
per-tier calibrated error rates.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + ensemble; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Add provider v2: diversity training eliminates document leakage

Same diversity-training insight applied to the provider cascade. Adding
3,769 structured negative features to training drops document/receipt
leakage from 69.8% to 5.1%, UI from 10% to 4.3%, fashion from 5-15% to
0-3%. AI recall improves: OpenAI 84% (was 75%), Google 88.8% (was 79%).
Photo leakage 1.4%. Worst regression: memes 47.9% (was 27%).

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - provider v2; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Add universal v11: full taxonomy, 136 domains, 124 at zero FP

Master data plan mapped 148 visual domains. Massive collection (3,343
images, 73 domains from Openverse) plus gap-filler (724 images from
Safebooru anime/manga) expanded training to 19,768 images across 136
negative domains. Universal v11 (MLP-512 + Model 1 ensemble):
DEFINITELY 90.3% recall at 0.50% photo FPR, ANY 95.6% recall,
124/134 domains at exactly 0% FP, worst FP 13.8% (digital art).

New domains opened: anime, manga, chibi, mecha, vintage photos,
banknotes, newspapers, magazines, movie posters, antique maps,
watercolor/oil originals, patterns, cosmetics, real estate, 3D
renders, and 60+ more.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Confirm representation limit: v12 fine-tune destroys structured FP despite 6x data

Fine-tuning CLIP tower on 19,518 images achieves 95.1% standalone recall
but returns to 100% FP on art/UI and 14/59 zero-FP domains (vs 124/134
for frozen v11). This is a representation property, not a data issue.
Frozen CLIP + MLP (v11) is the only working architecture. Also records
provider v3 trained on all negative domains.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes

* Document v13 plateau: 128/136 zero FP, frozen-CLIP ceiling confirmed

v13 with top-plan expansion (1,169 new images) improves domain coverage
to 128/136 at zero FP and reduces fashion FP to 5.3%, but DEFINITELY
recall plateaus at 89.6% and art FP at 15.9%. The frozen CLIP + MLP
architecture has reached its ceiling.

pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified minutes ago, 1731 tests); 2) /simplify - docs-only; 3) docs sync - v13 recorded; 4) CLAUDE.md - no changes

* Document the 2026-08-31 photo-classifier freeze.

Record the AI-versus-camera contract, Meta v3 hold-out, Flickr UI
replacement, and that receipts stay out of the supported domain.

* Scrub Spaces catalog details from classifier research docs

* Record receipt layout-gate probe for the universal detector

2026-09-01 11:37:32 -07:00

16 KiB

Raw Blame History

Supported signals

This page describes the current support boundary. A check mark means that the repository contains a corresponding code path. It does not guarantee detection or removal on every future vendor version.

Visible marks

The visible command registers these mark keys:

Key	Mark	Expected area	Important limit
`gemini`	Google Gemini visible watermark (sparkle)	Usually bottom right	Detection includes a false positive gate.
`doubao`	`豆包AI生成`	Bottom right	Vendor specific text detector.
`jimeng`	`★ 即梦AI`	Bottom right	Vendor specific text detector.
`qwen`	`千问AI生成`	Bottom right	Strict visual gate.
`kling`	`可灵AI 3.0`	Bottom right	Only calibrated variants are covered.
`yuanbao`	`元宝` over `AI生成`	Bottom right	Standard two-line variant only.
`samsung`	`✦ Contenuti generati dall'AI`	Bottom left	Calibrated for the Italian text variant.
`runninghub`	`RunningHub AI生成`	Top left	Strict visual and position gates.
`baidu`	`百度 AI生成`	Bottom right	Detector and extended removal footprint.
`liblib`	`LiblibAI`	Bottom center	Includes a minimum image size gate.
`microsoft`	One Microsoft white AI-badge variant	Top right	Strict uses the visual gate; auto can use Microsoft provenance for the measured relaxed gate. Other documented icon, text, and position variants are not covered.
`jimeng_pill`	`AI生成` pill	Top left	Weak detector with additional product and background gates.

--mark auto evaluates all registered marks and removes every selected match. Known marks are localized to a mask, then the selected fill backend reconstructs the masked area.

Marks from other vendors are not detected automatically. Use erase --region when you can select the affected area yourself.

Synthetic examples for every registered image and video mark live in the visible-mark gallery. They demonstrate the detectors' canonical geometry and house style, not vendor raster fidelity.

Visible video marks

Key	Mark	Motion	Important limit
`sora`	Sora 2 mascot and wordmark	Moves among frame positions	Requires a temporally recurring visual match; the older Sora Turbo corner swirl is a different unsupported mark.
`veo`	Current four-point diamond and legacy `Veo` text	Fixed bottom-right corner	Uses separate silhouettes and requires a recurring match; learned fill is preferable on structured backgrounds.
`doubao`	`豆包AI生成` text run	Fixed bottom-right corner	Reuses the image engine's synthetic alpha as the template; a stable 12-frame run above 0.35 is required.
`seedance`	Boxed `AI` label	Fixed bottom-right corner	Requires an anchored recurring match; the full localized box is filled because a thinner synthetic shape mask leaves the real translucent rim behind.
`dola`	`Dola AI` text	Fixed bottom-right corner	Requires an anchored recurring match; ByteDance or BytePlus provenance can relax only an existing visual run.
`hailuo`	`MINIMAX \| hailuo AI` composite label	Fixed lower edge	Uses a synthetic waveform, text, separator, and ring silhouette; the complete recurring label box is filled. A TC260 label naming MiniMax as producer can relax only an existing stable run.
`kling`	Kling AI swirl, `KLING AI`, version, and optional `PRO` suffix	Fixed bottom-right edge	Combines a synthetic logo rescue with font variants, an edge gate, a white-label gate, and anchored temporal recurrence.

video identify, video visible, and video all share this registry and the same temporal arbiter. It is separate from the image registry because selection is made over a sequence rather than one raster. The default auto mode scans all six entries in one decode pass and selects the first temporally stable match in table order; an explicit mark restricts the scan to that row. Accepted fills are motion-aligned across adjacent frames by default. The prior fill contributes only where its warped mask covers the current removal mask and nearby source context agrees. Scene cuts or disjoint marks retain the independent frame fill.

Fill backends

Backend	Install	Behavior
`cv2`	`remove-ai-watermarks[visible]`	Classical OpenCV inpainting
`migan`	`remove-ai-watermarks[migan]`	MI-GAN through ONNX Runtime; practical learned CPU video tier
`lama`	`remove-ai-watermarks[lama]`	big-LaMa through ONNX Runtime; offline video quality tier
`auto`	Depends on installed extras	Selects LaMa, then MI-GAN, then OpenCV

The learned backends download model files on first use.

Metadata and provenance

The inspection and stripping code handles signals in these groups:

C2PA Content Credentials and supported cloud manifest references;
EXIF and XMP generator fields;
exact app-export provenance and AIGC disclosures from supported ByteDance-family products, with product-only provenance excluded from the generated-image verdict;
IPTC AI disclosure fields;
PNG text chunks and embedded generation parameters;
China TC260 AIGC labels in supported image placements and the normative MP4/MOV moov.udta.meta.keys/ilst, MKV/WebM Segment.Tags.Tag.SimpleTag, AVI LIST/INFO/AIGC, and FLV script.onMetaData.AIGC placements;
xAI and Grok EXIF signature fields;
Samsung AI editing markers;
Hugging Face job metadata;
open Stable Diffusion style DWT-DCT watermarks with the detect extra;
Adobe TrustMark Variant P schemas 0-2 with the trustmark extra. Variant Q needs a different model, while schema 3 is deliberately rejected because it produced persistent false positives on unrelated generators.

identify combines detected signals into a ProvenanceReport. It reports unknown when evidence is absent. It never treats missing metadata as proof that an image is human made. C2PA presence alone is not a verified identity: the report distinguishes asset binding, claim signature, signer trust, and signer validity. High-confidence C2PA attribution requires an intact asset binding and claim signature; signer trust and certificate expiry are reported as their own dimensions and as caveats, since no trust anchor list ships to evaluate them. Fallback claims, which validate nothing, remain medium-confidence, while a failed binding or signature or a revoked credential contributes no origin verdict.

File and container formats

Pixel based image commands discover these extensions:

PNG;
JPEG;
WebP;
HEIC and HEIF;
AVIF.

HEIC, HEIF, and AVIF pixel decoding requires the independent heif extra in addition to the selected pixel feature. Metadata scanning does not.

Metadata inspection and removal additionally have container paths for:

JPEG XL metadata;
MP4, MOV, M4V, and M4A;
WebM, MKV, MKA, AVI, FLV, MP3, WAV, FLAC, OGG, OGA, Opus, and AAC when ffmpeg is available.

JPEG image metadata stripping removes targeted metadata segments without re-encoding the entropy coded image scan. PNG and WebP removal preserves pixel values through lossless output paths. HEIC, HEIF, AVIF, and other containers use their format specific paths.

Invisible watermarks

The invisible command uses diffusion regeneration. It targets watermark patterns by changing the image rather than decoding and deleting a known payload.

Current pipeline values, all CUDA-only:

qwen-zimage, the default;
sdxl-zimage, the same recipe and the same face stage on an SDXL global pass;
chroma-zimage, the same face stage on a Chroma1 global pass;
auto, chroma-zimage for OpenAI and Microsoft provenance, otherwise qwen-zimage.

The controlnet, sdxl, qwen and default values were removed. A retired name is rejected at parse time rather than remapped onto a surviving profile.

Google does not publish the SynthID payload decoder. This package does not ship a local pixel detector for that watermark. Research on a periodic lattice expert is in synthid-detector-research.md and scripts/synthid_runtime/.

The tool recognizes presence from supported provenance: Google AI C2PA under Google's all-media watermark policy, and current OpenAI C2PA carrying an explicit c2pa.watermarked.* action. Legacy OpenAI C2PA without that action does not assert SynthID.

The optional verify-openai-synthid command is a separate official remote verifier for supported OpenAI watermarks. It strips AI provenance metadata from a temporary PNG, JPEG, or WebP copy, proves that decoded RGBA pixels are unchanged, and uses only the API's SynthID result. It is therefore independent of C2PA for its decision, but it is not local: the sanitized raster is uploaded to OpenAI after explicit acknowledgement. It is intentionally excluded from identify and its negative result remains inconclusive.

Microsoft Paint can name com.microsoft.invismark.1 in a C2PA soft-binding assertion. Inspection reports both that exact algorithm and its signed value, which Paint uses as the identifier carried by the pixel watermark, and emits an additive invismark signal so callers can select pixel removal without parsing the generic soft_binding detail. Photos uses a parallel local writer path. Metadata stripping removes only the embedded manifest; invisible and all guarantee the supported InvisMark removal contract by regenerating the pixel layer as well. The project has no validated local InvisMark decoder, so local inspection cannot independently verify the output. Microsoft's official Content Provenance Detection API is the external oracle: it reports pixel Watermark and embedded C2PA results separately; a control-positive, output-negative pair is the available per-file verification path. The API needs Azure credentials; the page a human can check without an account is https://ai.azure.com/nextgen/validate. Its verdict is weaker than the API's: it collapses watermark and C2PA into one rendered result and tops out at Inconclusive rather than a watermark-negative, so treat Inconclusive on a processed file as "not confirmed", not as "detected still".

Meta Muse Image stamps every output with Content Seal, a proprietary invisible pixel watermark, and ships no visible mark (the legacy Imagined with AI corner mark belongs to the pre-2026 Imagine pipeline and is not registered). This project has no local Content Seal decoder. Meta Model API outputs and Meta CDN copies carry an XMP iptcExt:DigitalSourceType = trainedAlgorithmicMedia companion tag, which identify reports through the existing Made-with-AI path; that IPTC code is a standard, not a Meta-exclusive signal, so it cannot key a strength cohort the way the C2PA issuer does. Since 0.33.0 a standalone AI digital-source tag (no C2PA manifest) additionally emits the additive content_seal signal - the strength router's Meta bet as evidence, medium confidence, with the same caveat - so clients select pixel removal from the signal list exactly the way InvisMark is additive over soft_binding. It is an attribution, never a decode. The external oracle is https://meta.ai/identification: anonymous, no login, accepts image, video, and audio, enforces an unspecified daily identification limit, and answers with model attribution (Muse Image 1 - Meta) plus a per-generation ID and creation timestamp read from the watermark payload. No identification endpoint exists in the Meta Model API itself (the reference at dev.meta.ai documents only generation and edits for images), and the official documentation never mentions the seal. The default qwen-zimage profile clears Content Seal at the default resolution-adaptive strength (oracle-verified on 2.56 MP generations); measured strength boundaries are recorded in data/contentseal/manifest.csv and module internals. The derived Meta floor (0.1 by the standard spread method) ships as a measured cohort: auto mode routes a file whose only provenance is the standalone AI IPTC tag to it (the tag is not Meta-exclusive; other tag users ship no invisible watermark this profile targets, and Google/OpenAI/Microsoft C2PA evidence always wins first), and invisible --vendor meta (also all and batch, and InvisibleOptions.vendor in the API) names the cohort explicitly on stripped files. An explicit vendor implies the scrub runs: naming the cohort asserts the pixel watermark is present. The seal survives resizing, JPEG recompression, and metadata stripping; it dies to center crops of a third to a half, matching the Reuters 2026-07-11 finding that Meta's detector missed 55% of cropped Muse images.

For MP4, MOV, and M4V, video invisible or the explicit video all --invisible option can regenerate the video through a VAE and strip source metadata. The shipped profile is oracle-certified, but it is not a local decoder. A fresh source-positive, output-negative pair from Gemini's built-in SynthID verifier is an optional per-file audit. A normal Gemini answer may instead infer from a visible logo or metadata; asking it to reinterpret a completed verifier result is not a second oracle run.

The optional detect extra is different: it provides a local decoder for the open DWT-DCT watermark used by some Stable Diffusion, SDXL, and FLUX workflows. That signal is carrier and transformation sensitive, so a negative is still not a universal clean verdict.

Provider overview

Provider or family	Visible	Invisible path	Metadata or provenance
Google Gemini	Sparkle	Diffusion regeneration	C2PA and related source signals
Google Veo video	Veo diamond and legacy text	Oracle-certified VAE removal for SynthID	C2PA and related source signals
OpenAI image generators	None registered	Diffusion regeneration for supported invisible signals	C2PA and generator provenance
Meta Muse Image	None on Muse output (legacy `Imagined with AI` unregistered)	Diffusion regeneration for Content Seal, oracle-verified on the default profile	XMP IPTC `trainedAlgorithmicMedia` companion tag; no local Content Seal decoder
Microsoft Paint and Photos	None registered	External Microsoft oracle for InvisMark; no validated local decoder	Paint C2PA soft-binding algorithm and identifier
Microsoft image outputs (measured variant)	One top-right white AI-badge variant	No registered pixel decoder	C2PA attribution
Stable Diffusion and SDXL	None registered	Diffusion regeneration; optional open decoder	Embedded parameters and text metadata
FLUX	None registered	Diffusion regeneration; optional open decoder	C2PA for supported sources
Adobe Firefly	None registered	Optional TrustMark Variant P decoder	C2PA
Midjourney	None registered	No registered pixel decoder	EXIF, XMP, and IPTC signals
Luma AI	None registered	No registered pixel decoder	PNG text generator tags (Uni-1)
ByteDance generators	Doubao and Jimeng marks	No registered pixel decoder	TC260 AIGC, supported C2PA, and exact app-export AIGC disclosures
Qwen	Qwen mark	No registered pixel decoder	TC260 AIGC
Kling AI	Kling AI image and video marks	No registered pixel decoder	TC260 AIGC
Hailuo AI / MiniMax video	Hailuo AI composite video label	No registered pixel decoder	TC260 AIGC where present
Baidu	Baidu mark	No registered pixel decoder	TC260 AIGC
LiblibAI	LiblibAI mark	No registered pixel decoder	TC260 AIGC
RunningHub	RunningHub mark	No registered pixel decoder	TC260 AIGC
Samsung Galaxy AI	One locale specific mark	No registered pixel decoder	C2PA and Samsung markers

For detector thresholds, measured limits, and incident history, see module internals and known limitations.

16 KiB Raw Blame History