mirror of
https://github.com/wiltodelta/remove-ai-watermarks.git
synced 2026-08-31 09:40:38 +02:00
Victor Kuznetsov
d8fcd0f79b
A manifest that names its own forensic soft-binding algorithm carries that vendor's mark; the generic watermark-action vendor-token inference must not add a second, differently-attributed invisible watermark from the same bytes. Microsoft Designer manifests triggered exactly that: signed by Microsoft, watermarked by InvisMark, with the generation agent named "Azure OpenAI ImageGen" - the OpenAI issuer token inside that service name plus the InvisMark watermarked action satisfied the OpenAI SynthID-evidence rule, and identify reported one forensic mark as two paid pixel watermarks. Three changes, one rule at every inference site (the verdict-scan comment's own lesson: a rule that lives in only one copy is a rule the others silently lack): - c2pa.py structured path: SynthID evidence now scopes to the signer/generator identity strings only (signature issuer, claim generator), never the raw chain, and is suppressed entirely when a soft-binding algorithm is named. - c2pa.py byte fallback and metadata.py synthid_source: suppressed when the scan names a soft-binding algorithm. - identify.py verdict scan: same suppression. Gemini and ChatGPT originals keep their provenance-asserted SynthID strings; the Designer regression is pinned by test_designer_synthid_suppression.py (agent name alone is not the vendor's provenance, and a named soft binding suppresses the inference).
86 lines
3.5 KiB
Python
86 lines
3.5 KiB
Python
"""Regression: a manifest that names its own forensic soft binding must not
|
|
also report a SynthID watermark from the generic vendor-token inference.
|
|
|
|
Microsoft Designer manifests sign as Microsoft, carry the InvisMark
|
|
``c2pa.watermarked`` action, and name their generation agent
|
|
"Azure OpenAI ImageGen". The OpenAI issuer token inside that agent name plus
|
|
the watermarked action used to satisfy the OpenAI SynthID-evidence rule,
|
|
double-counting one forensic mark as two pixel watermarks.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from remove_ai_watermarks._internal.c2pa import c2pa_info_from_manifest_store
|
|
|
|
DESIGNER_STORE = {
|
|
"active_manifest": "designer",
|
|
"manifests": {
|
|
"designer": {
|
|
"signature_info": {"issuer": "Microsoft Corporation", "common_name": "Microsoft Corporation"},
|
|
"claim_generator_info": [{"name": "Microsoft Responsible AI Provenance", "version": "1.0"}],
|
|
"assertions": [
|
|
{
|
|
"label": "c2pa.actions",
|
|
"data": {
|
|
"actions": [
|
|
{
|
|
"action": "c2pa.created",
|
|
"softwareAgent": {"name": "Azure OpenAI ImageGen"},
|
|
"digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
|
|
},
|
|
{"action": "c2pa.watermarked"},
|
|
]
|
|
},
|
|
},
|
|
{
|
|
"label": "c2pa.soft-binding",
|
|
"data": {"alg": "com.microsoft.invismark.1", "blocks": [{"value": "bf7a2993-cc1f-47e1-b1f0-cd8839aabb22"}]},
|
|
},
|
|
],
|
|
}
|
|
},
|
|
}
|
|
|
|
|
|
def test_named_soft_binding_suppresses_generic_synthid_evidence() -> None:
|
|
info = c2pa_info_from_manifest_store(DESIGNER_STORE)
|
|
assert info["ai_source_kind"] == "generated"
|
|
assert info["soft_binding_algorithm"] == "com.microsoft.invismark.1"
|
|
assert info.get("synthid_watermark") is None
|
|
assert info.get("synthid_vendors") is None
|
|
|
|
|
|
def test_vendor_agent_name_alone_is_not_the_vendors_provenance() -> None:
|
|
"""The identity-scoped inference must not fire on a service name either.
|
|
|
|
Same manifest without the soft binding: the "Azure OpenAI ImageGen" agent
|
|
is not an OpenAI signature or claim generator, so no OpenAI SynthID
|
|
evidence may be derived from it.
|
|
"""
|
|
store = {
|
|
"active_manifest": "designer",
|
|
"manifests": {
|
|
"designer": {
|
|
"signature_info": {"issuer": "Microsoft Corporation", "common_name": "Microsoft Corporation"},
|
|
"claim_generator_info": [{"name": "Microsoft Responsible AI Provenance", "version": "1.0"}],
|
|
"assertions": [
|
|
{
|
|
"label": "c2pa.actions",
|
|
"data": {
|
|
"actions": [
|
|
{
|
|
"action": "c2pa.created",
|
|
"softwareAgent": {"name": "Azure OpenAI ImageGen"},
|
|
"digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
|
|
},
|
|
{"action": "c2pa.watermarked"},
|
|
]
|
|
},
|
|
}
|
|
],
|
|
}
|
|
},
|
|
}
|
|
info = c2pa_info_from_manifest_store(store)
|
|
assert info.get("synthid_watermark") is None
|