remove-ai-watermarks/data/fixtures/README.md

# Provenance fixtures

These files exercise real container, metadata, and pixel-provenance formats.
They are test inputs, not evaluation corpora.

## OpenRouter metadata survey

The following files are original byte streams returned by OpenRouter's Image
API on 2026-09-02. Each request used a repository-maintainer account, the same
neutral still-life prompt, one 1:1 output, and no image reference. The prompt
was `A documentary photograph of three smooth river stones on pale linen beside
a small blue glass vase, soft natural daylight, plain uncluttered background,
no text, no logos`.

| File | Model | Cost | SHA-256 | Expected metadata result |
| --- | --- | --- | --- | --- |
| `recraft-v3.webp` | `recraft/recraft-v3` | USD 0.04 | `e94c99ab50410092dbb601c8269ce812879e2271e18c7880021d2118666542ae` | Valid C2PA; `recraft.ai`; `trainedAlgorithmicMedia` |
| `krea-2-medium-turbo.png` | `krea/krea-2-medium-turbo` | USD 0.015 | `ee1302c01e8da8e316e6563b0f9d36d511b9048fb2f70b8851eeeda98c5fb6a0` | No locally readable provenance |

Both were paid API generations. Recraft grants ownership for paid-plan output,
and Krea states that users own compliant outputs. They are distributed under
the repository license.

- Recraft terms: <https://www.recraft.ai/docs/plans-and-billing/commercial-rights-and-ownership>
- Krea terms: <https://www.krea.ai/krea-2-licensing>

The same survey generated `sourceful/riverflow-v2-fast` output and found no
locally readable metadata. It is not committed because Riverflow's terms
restrict redistribution and using results to test or improve machine-learning
systems. Its measured SHA-256 was
`d4d7e80a3ed450129a0e77bdf330a83eb7de1e287d5b2b737cd26a011194a270`;
OpenRouter recorded a USD 0.02 request cost.

## WaveSpeedAI metadata survey

The following measurements came from original byte streams returned by the
WaveSpeedAI API on 2026-09-03. Each request used a repository-maintainer
account and the same neutral still-life prompt recorded above. The account
balance moved from USD 12.00 to USD 11.82 for the four successful requests.

| File | WaveSpeedAI model | SHA-256 | Expected metadata result |
| --- | --- | --- | --- |
| `qwen-image.png` | `wavespeed-ai/qwen-image/text-to-image` | `5b6d832834397498d0587b9b2536f88c75e923195c43c2b71d9f7f3c5422b4f1` | No provenance signal; one non-provenance PNG `job-id` text field |
| `hunyuan-image-3.png` | `wavespeed-ai/hunyuan-image-3` | `6ae2ac073ac79b02b0934c905364f200420c2ff60fea232bd9e0a5fca785cc09` | Valid C2PA from `fal.ai` naming `fal-ai/hunyuan-image`, plus Adobe TrustMark Variant P, schema 0 |
| `kling-image-v3.png` | `kwaivgi/kling-image-v3/text-to-image` | `501ab865b47ba59b64bc0f68118300744b0d5c7be2fa4e2ecbb3a78de5d8a82b` | TC260 PNG `AIGC` field naming producer `001191110108335469089C10100`; no visible Kling mark |
| `seedream-v4.jpg` | `bytedance/seedream-v4` | `9ec6af1fc0509d74e264b9631a6cddd2ce7ce20146347fe418e9306032beb759` | No locally readable provenance |

All four original byte streams are committed. Section 11.1 of WaveSpeedAI's
terms assigns its rights in Customer Data, explicitly including Outputs, to the
customer. The live catalog records used for these requests expose no additional
license, terms URL, attribution requirement, territory restriction, or
commercial-use restriction. The maintainer therefore distributes these paid,
neutral-prompt outputs under the repository license. This conclusion applies
to these WaveSpeedAI API transactions; it does not import unrelated terms from
the vendors' direct consumer services.

- WaveSpeedAI terms: <https://wavespeed.ai/static/terms>
- WaveSpeedAI commercial-use policy: <https://wavespeed.ai/docs/commercial-use-policy>
- Qwen-Image license: <https://github.com/QwenLM/Qwen-Image/blob/main/LICENSE>

## Qwen Create consumer output

`qwen-create-qwen-image-2.png` is the original 2048 x 2048 PNG downloaded from
an authenticated Qwen Create generation on 2026-09-03. It was generated by
`Qwen-Image 2.0` at 1:1 using the neutral still-life prompt recorded above.
The current global consumer surface differs from the Chinese Qwen text mark: it
places a small Qwen symbol at the bottom right, not `千问AI生成`. The Qwen
engine has separate text and symbol templates; the symbol path scores 0.848 on
this fixture while the text path alone scores 0.178.

- SHA-256: `60c39ed8aedb081193c62289be549785e74d31fc8d071961003fabd74712429d`
- Expected metadata signal: TC260 AIGC label
- Expected `ContentProducer`: `001191440101MA9Y9T4H7A00000`
- Expected visible result: Qwen symbol detected and removable under the `qwen`
  registry key
- License: repository license; generated and explicitly cleared by the
  maintainer
- Qwen Create terms: <https://terms.alicdn.com/legal-agreement/terms/c_end_product_protocol/20260519200335649/20260519200335649.html>

## Open DWT-DCT

`sdxl-dwt-dct.png` is a real AI-generated carrier with the public 48-bit SDXL
watermark embedded by ShieldMnt's `invisible-watermark` encoder using its
`dwtDct` method. The carrier is the original `kling-image-v3.png` WaveSpeedAI
output documented above, not a procedurally generated test texture. Encoding
was lossless to PNG and removed the source container metadata; the resulting
fixture contains only the expected open DWT-DCT signal.

- Source carrier SHA-256: `501ab865b47ba59b64bc0f68118300744b0d5c7be2fa4e2ecbb3a78de5d8a82b`
- Fixture SHA-256: `9ec3dcbfea19e4651b898f98ada28a1c81f054d63621a0bba2d484aa77da251a`
- Payload: `0b101100111110110010010000011110111011000110011110`
- Expected signal: open DWT-DCT, `Stable Diffusion XL`
- Verification: 48/48 payload bits recovered by both the upstream decoder and
  the in-tree decoder; `identify` reports the expected high-confidence signal
- Encoder: <https://github.com/ShieldMnt/invisible-watermark>
- License: repository license; the encoder is MIT-licensed

## Microsoft InvisMark

### Microsoft Paint

`microsoft-paint-invismark.png` is the original byte stream supplied directly
by Xusheng Li on 2026-09-02 after his reverse-engineering research documented
Paint's pixel watermark and its matching C2PA soft binding. He authorized public
redistribution of the fixture under the MIT license. The neutral image was
generated by Microsoft Paint from the prompt `a cobalt blue circle above a tiny
orange square`.

- Source research: <https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/>
- SHA-256: `74eda22d210d534fcb5b75bedf8acd3bd110b48a95f4b9e546cd34f546effc05`
- Dimensions: 1254 x 1254 RGB PNG
- Expected signal: C2PA soft binding `com.microsoft.invismark.1`
- Expected watermark ID: `a4ed421e-7c37-4409-998e-f8788c564572`
- Expected platform: `Microsoft (Copilot / Designer)`
- Expected C2PA result: valid asset binding and signature
- License: MIT, reproduced in `../licenses/xusheng-li-paint-invismark-MIT.txt`

### Microsoft MAI-Image through OpenRouter

`microsoft-invismark.png` is the original byte stream returned by OpenRouter's
Image API for `microsoft/mai-image-2.5-pro` on 2026-09-02. The request used a
repository-maintainer account and asked for one 1:1 image. OpenRouter routed
the request to Microsoft Azure. Microsoft states that it does not claim
ownership of AI-service output; the maintainer distributes this output under
the repository license.

- SHA-256: `be27ac7c351e7f381dc69e140ca3611ecd9db81e40926c68050ceffdd0ce6c04`
- Expected signal: C2PA soft binding `com.microsoft.invismark.1`
- Expected watermark ID: `19b070a1-23f0-40eb-826c-cade306337eb`
- Expected platform: `Microsoft (Copilot / Designer)`
- Request cost recorded by OpenRouter: USD 0.110757
- License: repository license
- Terms: <https://www.microsoft.com/en/servicesagreement/>

### Microsoft MAI-Image through Bing Image Creator

`microsoft-bing-image-creator.jpg` is the original download produced without
sign-in by Microsoft's public Bing Image Creator on 2026-09-03. The page named
the model `MAI-Image-2.5-Flash`; it used the neutral still-life prompt recorded
above and the 3:2 aspect ratio. The downloaded image has no visible AI badge,
so it does not close the separate visible Microsoft-badge fixture request.

- SHA-256: `55cad5355b6eeeb25f84ea074f85c0ea55b82d63c27f43e3429bb75f28734ac7`
- Dimensions: 1248 x 832 RGB JPEG
- Expected signal: valid C2PA plus soft binding `com.microsoft.invismark.1`
- Expected watermark ID: `aec9a34e-665f-4549-9c02-9d29337a5de6`
- Expected platform: `Microsoft (Copilot / Designer)`
- License: repository license
- Terms: <https://www.microsoft.com/en/servicesagreement/>

## Adobe TrustMark

`adobe-trustmark-p.png` is Adobe's official `images/ghost_P.png` Variant P
example from [`adobe/trustmark`](https://github.com/adobe/trustmark) at commit
`0ed40cbe8188f664fd9cbbeacd969807de27440a`.

- Source: `https://raw.githubusercontent.com/adobe/trustmark/0ed40cbe8188f664fd9cbbeacd969807de27440a/images/ghost_P.png`
- SHA-256: `e58c5825ed7e5d9fb04710ea541b61bd55879cad65554c0d46260aa24b3d0755`
- Expected signal: TrustMark Variant P, schema 1
- License: MIT, reproduced in `../licenses/adobe-trustmark-MIT.txt`


## Ideogram C2PA attribution

`ideogram-c2pa.png` is a SYNTHETIC signed manifest, not a vendor download: a
64x64 flat PNG carrying a C2PA claim (`trainedAlgorithmicMedia`,
`claim_generator "Ideogram/3.0"`) signed by a throwaway test CA whose leaf
certificate subject is `O=Ideogram, Inc, CN=Ideogram, Inc`. It exercises the
issuer-to-platform ATTRIBUTION path end to end through the real reader; the
signer is deliberately untrusted (no trust anchors ship), which is also the
fixture's second assertion: attribution and signer trust are separate
dimensions.

- Expected signal: C2PA, platform `Ideogram`, `ai_from_metadata` True
- Expected signer: `untrusted` (test CA; attribution must not imply trust)
- Recipe (no keys are committed): create a CA and an ES256 leaf with
  `digitalSignature` key usage and subject `CN=Ideogram, Inc`, then
  `c2pa.Builder.from_json(...).sign_file(png, out, Signer.from_info(
  C2paSignerInfo(b"es256", leaf_pem + ca_pem, pkcs8_key, None)))`.
- No third-party image and no Ideogram artifact contributes pixels or bytes.