mirror of https://github.com/wiltodelta/remove-ai-watermarks.git synced 2026-08-28 16:30:23 +02:00

Files

T

Victor KuznetsovandClaude Fable 4.5 ab528ec0e8 Ship the measured Meta Content Seal cohort with auto routing and --vendor override

Full Meta Muse Image support in the invisible-removal path:

- QWEN_ZIMAGE_META_STRENGTH = 0.1: derived by the standard
  worst-boundary-plus-cross-source-spread method over five oracle-bracketed
  generations (data/contentseal/manifest.csv)
- Auto mode: vendor_for_strength routes a file whose only provenance is the
  standalone AI IPTC trainedAlgorithmicMedia tag onto the meta cohort; C2PA
  issuers win first, so Google/OpenAI/Microsoft routing is unchanged. Muse
  WebP outputs place the XMP in a tail chunk, so the scan uses the shared
  chunk-aware metadata.scan_head rather than a plain head read
- Explicit override: --vendor on invisible/all/batch and
  InvisibleOptions.vendor name the cohort on stripped files; naming a cohort
  asserts the watermark is present, so the no-signal gate treats it like
  --force at both the CLI and API seams
- sdxl-zimage has no measured Meta rung: an explicit meta vendor falls to
  the conservative unknown 0.25 rather than inventing one
- identify emits a Content Seal caveat pointing at the removal path
- The legacy visible 'Imagined with AI' mark stays unregistered: a dedicated
  sample hunt (newsroom mockups, community posts, press screenshots, dead
  imagine.meta.com, broken Wayback captures) found no pixel-verifiable
  capture, and the registry rule forbids encoding a corner without one.
  erase --region remains its removal path; outcome recorded in the landscape

Co-Authored-By: Claude Fable 4.5 <noreply@anthropic.com>

2026-08-26 22:59:23 -07:00

5.0 KiB

Raw Blame History

Content Seal oracle corpus

Muse Image (muse-image-1.0) generations with externally verified Content Seal verdicts, produced through the Meta Model API on 2026-08-26 and checked against the public detector at https://meta.ai/identification (anonymous session, no login). Follows the data/synthid/originals pattern: binaries live in originals/, every derived variant is recorded in manifest.csv as a recipe plus hash and is not stored.

What this corpus establishes

The Meta Model API image endpoint (POST /v1/images/generations) stamps the same Content Seal pixel watermark as the consumer Meta AI app: all five generations verified positive with attribution "Muse Image 1 - Meta".
The detector response carries a per-generation ID and creation timestamp embedded in the watermark payload. Both survived a 512 px LANCZOS resize and a full-size JPEG q85 re-encode (same ID returned), so the payload is more robust than the detection threshold.
Center crops lose the seal: 50% and 33% linear center crops of two different images all returned "No AI signatures from Meta were found", consistent with the Reuters 2026-07-11 analysis (55% missed after cropping).
API outputs carry XMP iptcExt:DigitalSourceType = trainedAlgorithmicMedia, so local identify flags them via the existing Made-with-AI path. Metadata-stripping transforms fall back to unknown, and Content Seal has no local decoder in this project: the oracle is the only reader.
Drift finding: the 512 px resize of gen_fox_forest triggers a medium-confidence false positive "Tencent Yuanbao (visible 元宝 / AI生成 mark)" in this project's identify. Recorded here as a reproducible case.

Oracle limits and wire format

There is no public or documented checking API. Verified against the official developer documentation on 2026-08-26 (https://dev.meta.ai/docs/): the full Meta Model API reference lists only Responses, Chat Completions, Messages, Files, Images (/v1/images/generations, /v1/images/edits), and Models, with no identification, detection, or watermark endpoint, and the image-generation, Muse Image cookbook, and pricing pages never mention watermark, Content Seal, or provenance at all. The API applies the seal (every generation in this corpus carries it) while documenting nothing about it. The web tool drives an internal REST pair, captured from the browser network log on 2026-08-26:

POST https://rupload.meta.ai/gen_ai_document_gen_ai_tenant/<uuid> with the raw file bytes, x-entity-type, x-entity-length, ai_detector_upload: true, and an anonymous authorization: OAuth ecto1:<token> session token minted by the page.
POST https://meta.ai/api/ai-detector with Bearer ecto1:<token> and body {"media_id": "...", "fileName": "...", "mimeType": "..."}.

The rate limit is enforced at that endpoint, server-side, and keyed beyond the browser session: the API itself returns 429 {"errorType": "rate_limited"}, and clearing cookies and storage changed nothing, so driving the internal pair directly does not bypass it. The Meta Model API (api.meta.ai/v1, where the generation key works) has no identification endpoint; plausible paths all return 404. Rows with an empty oracle_verdict were transformed but not yet checkable. Read a verdict only from the settled page text after the result-complete state ("Upload another file"): a wait for a verdict string can match the previous upload's text, and the fresh-navigation protocol used for the calibration rows below is the race-free variant.

Strength floor calibration (qwen-zimage, seed 0)

The library resolves strength per vendor with measured floors (OpenAI 0.07675 / Google 0.27 / Microsoft InvisMark 0.15 in _internal/watermark_profiles.py). Meta Content Seal has no floor yet; the goal of these rows is to measure one by that same methodology: independent generations, each one's first-clean boundary, floor = worst boundary plus the observed cross-source spread.

Measured (2026-08-26/27, oracle meta.ai/identification):

Default pipeline clears Content Seal: tested samples came back clean at the default resolution-adaptive strength (~0.1305 at 2.56 MP), including the worst source.
Five independent generations bracketed. First-clean boundaries: lighthouse (0.0525, 0.06], fox (0.03, 0.0375], night_city (0.03, 0.0375], mug <= 0.03, text <= 0.015. Cross-source spread is wide (a factor of four between easiest and hardest).
Derived Meta floor by the existing worst-boundary-plus-cross-source-spread method: 0.06 + (0.0525 - 0.015) = 0.0975, rounded to 0.1.
Shipped as QWEN_ZIMAGE_META_STRENGTH: auto mode routes standalone-AI-IPTC files onto the cohort, and --vendor meta / InvisibleOptions.vendor names it explicitly on stripped files (implying the scrub runs).

Regeneration

API key is not stored in this repository. Regenerate with the script pattern from the session (env MUSE_API_KEY, endpoint https://api.meta.ai/v1/images/generations, model muse-image-1.0); prompts are recorded per file in manifest.csv.

5.0 KiB Raw Blame History