The ETI scoring program applies median blur and JPEG before decoding, so an
attack only wins if the watermark stays dead under ordinary handling. Our
removal paths are structural, so no driving question exists today; the note
records the hour-sized handling arm over removed-state artifacts as the
follow-up if removal durability under platform re-encoding ever becomes a
real question. Also records that participant attack code was never
published.
Victor Kuznetsov
ee19173338