mirror of
https://github.com/wiltodelta/remove-ai-watermarks.git
synced 2026-10-14 13:30:55 +02:00
* Add rigorous SynthID research and evaluation harness * Record SynthID cross-epoch validation results * Reset SynthID detector hypotheses to paired training * Add paired wavelet and spectral SynthID probes * Record closed-corpus SynthID detector ablations * Add registered SynthID phase probing * Add periodic SynthID tile probing * Add calibrated SynthID pixel detector * Harden scale-registered SynthID detection * Record SynthID phase and channel rescue findings * Add production SynthID routing and OpenAI verification * Reframe periodic pixel route as pipeline lattice; confirm and harden detection The frozen periodic experts read an origin-anchored generation-pipeline lattice destroyed by a crop off the tile grid, not the crop-robust SynthID mark. Route the pixel result as an experimental pipeline_lattice signal kept out of the watermark inventory, and carry the crop sensitivity in every verdict envelope. Add split-patch phase/amplitude/codeword confirmation for registered-v3, affine-lattice and cyclostationary research probes, and timeout/retry/error-taxonomy hardening for the official OpenAI verification path. * Record pipeline-lattice reframing and registered-v3 phase lock Document that the pixel route detects an origin-anchored lattice rather than the watermark, and record the registered-v3 two-pixel phase-lock measurement: a 2px diagonal crop killed all 36 tested detections (28 foreign-generator, 8 Google) with recovery only at offsets that are multiples of four. Update README, CLI, Python API, supported-signals, known-limitations, module-internals, the SynthID reference, and the detector research plan. * Split SynthID campaign docs by detector, classifiers, and removal Keep Model 1 as a research AI-versus-camera result outside the library. Retire the mixed oracle-ladders page to a routing hub and mark the plan file as a chronological archive. * Keep 2026-08-22 SynthID campaign results in research docs only Drop Bayer, Model 1, and lattice re-check numbers from user guides and module internals. The library surface is unchanged. * Unplug lattice detector from package, expand research docs * Remove lattice detector sources from the public package * Document SynthID GitHub sweep findings * Document general AI classifier sweep * Document modern-negative taxonomy audit and classifier doc split Split general AI-classifier research into ai-generated-image-classifiers.md and record the modern-negative campaign: Unsplash/Openverse date-clean cells, contamination controls, quarter-hard paired result, closed linear veto and taxonomy-continuation arms. pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix (same triage as main); core checks separately green (ruff, format, pyright, 1564 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - split references updated everywhere, none stale; 4) CLAUDE.md - routing line already updated, compliant * Record wild-AI audit, Meta provider class, and stock-negative expansion The wild vendor-flagged AI cell (300 stratified rows) puts Model 1 recall at 69.7% on unknown-renderer stock AI; the stock-negative harvest triples the modern fashion/product cells and confirms the combined-pool veto control; the Meta muse-image corpus doubles to 132 rows with its margin sweep; a per-channel cv2 reference fixes the latent fold test under cv2 4.10.0. pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks separately green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - new run references point at the gitignored research store, none stale; 4) CLAUDE.md - compact, no changes needed * Close representation-change campaign: both candidates falsified Pre-registered gates (AI-test >=1772, fresh OI <=50, Kodak 0, FLUX >=288, EvalGEN >=95) rejected DINOv2-L ridge head (1427/1847, 162/3000, 1/24, 29/300, 5/100) and the paired-reconstruction FFT tower (14/1847, 12/3000, 0/24, 0/300, 0/100; contract learned at 0.949 pairwise separation but no transfer to production generators). Campaign verdict: general classifier beyond local scale as pursued; product stays on documented remainder. pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks green minutes ago (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - verdict mirrored in data/research/REPRESENTATION-CAMPAIGN.md, no stale refs; 4) CLAUDE.md - no changes * Record full failure map, H2 router falsification, and H3 process detector closure 20 measured negative domains with batch-2 (memes, whiteboards, tickets, book pages). H2 domain router falsified: 97.9% of AI-test looks structured, every family 94-100%. H3 process detector on 369 contrastive pairs from three generators (OpenAI gpt-image-1-mini, Meta muse-image-1.0, Gemini flash-image) achieves 0.909 pairwise AUC on training pairs but transfers at AUC 0.55-0.60 to production AI; human receipts score higher than any AI family. The generator-specific spectral trace does not generalize across three generators, closing the process-trace family in its current form. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs + research scripts, single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes * Record H4-H6 research hypotheses: MLP probe, spectral invariant, TTA voting H4 (MLP on frozen CLIP): 98.6% AI-test recall but 15.8% photo FPR — same trade-off curve as quarter-hard. H5 (spectral invariant from CVPR 2025): 2.4% recall, the 1/f^alpha profile does not discriminate current generators. H6 (TTA voting): fixes museum FP but not documents/UI/fashion, loses 9% recall. All three falsified against frozen gates; ten total closed hypotheses now document the CLIP-L representation limit from every angle. Also records the provider cascade across all 20 domains (69.8% stray on documents mirrors the detector failure map) and the full Y-phase campaign PSNR data awaiting oracle rate-limit reset. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes * Fix Y-phase frequency convention, record H4-H6 and campaign results The initial Y-phase campaign targeted FFT bins 16-32 instead of spatial periods 16-32 px (1/32 to 1/16 cycles/px). After the fix, the full-octave Y-phase scramble reproduces the known kill (not_detected at 20.5 dB on s1 at native 1122x1402). Partial sub-bands are visually invisible (42.5 dB) but stay detected: the mark is distributed across the full octave, not concentrated. Point intervention is not viable within this frequency band. H4 MLP probe: 98.6% recall, 15.8% FPR (same trade-off wall). H5 spectral invariant: 2.4% recall (1/f^alpha does not discriminate). H6 TTA voting: fixes museum FP but not documents/UI/fashion. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (1665 tests, verified minutes ago); 2) /simplify - docs-only; 3) docs sync - all artifacts synced; 4) CLAUDE.md - no changes * Add TC260 fifth class and per-class margin calibration to provider cascade Five-head cascade (openai/google/tc260/meta/no_ai): openai 68.8%, google 76.6%, tc260 63.8%, meta 71.8% mean recall at uniform margin 0.50. Per-class margins calibrated against 1.67% photo budget: openai 0.31, google 0.29, tc260 0.39, meta 0.55. TC260 test recall 71.4% at calibrated margins on 196 held-out images. Chinese-AIGC is a viable pixel class. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified within the hour); 2) /simplify - research script, single pass; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Record universal detector v3-v8: diverse training shifts the curve Fresh MLP on frozen CLIP embeddings with 49 negative domains (12,258 images) and 5,043 AI positives achieves 93.0% AI-test recall with 39/49 domains at zero false positives. Digital art FP dropped from 99.3% (Model 1) to 24.8%, fashion from 62-71% to 12%, UI from 99.3% to 12%. Photo FPR 0.7%. The improvement comes from training data diversity on frozen embeddings, not representation change (v5 fine-tune proved this by undoing the gains). Also adds .local-eval to ruff exclude so the gate covers only tracked files. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - all artifacts in data/research/; 4) CLAUDE.md - no changes * Add three-tier ensemble detector: DEFINITELY/POSSIBLY/LIKELY_HUMAN Combines Model 1 and v8 into calibrated confidence tiers. DEFINITELY_AI (both models agree) achieves 79.6% recall at 0.50% photo FPR with 46/49 domains at zero FP. The union reaches 93.3% recall at 1.80% photo FPR with Kodak 0/24. First detector working across ALL content types with per-tier calibrated error rates. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + ensemble; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Add provider v2: diversity training eliminates document leakage Same diversity-training insight applied to the provider cascade. Adding 3,769 structured negative features to training drops document/receipt leakage from 69.8% to 5.1%, UI from 10% to 4.3%, fashion from 5-15% to 0-3%. AI recall improves: OpenAI 84% (was 75%), Google 88.8% (was 79%). Photo leakage 1.4%. Worst regression: memes 47.9% (was 27%). pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - provider v2; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Add universal v11: full taxonomy, 136 domains, 124 at zero FP Master data plan mapped 148 visual domains. Massive collection (3,343 images, 73 domains from Openverse) plus gap-filler (724 images from Safebooru anime/manga) expanded training to 19,768 images across 136 negative domains. Universal v11 (MLP-512 + Model 1 ensemble): DEFINITELY 90.3% recall at 0.50% photo FPR, ANY 95.6% recall, 124/134 domains at exactly 0% FP, worst FP 13.8% (digital art). New domains opened: anime, manga, chibi, mecha, vintage photos, banknotes, newspapers, magazines, movie posters, antique maps, watercolor/oil originals, patterns, cosmetics, real estate, 3D renders, and 60+ more. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Confirm representation limit: v12 fine-tune destroys structured FP despite 6x data Fine-tuning CLIP tower on 19,518 images achieves 95.1% standalone recall but returns to 100% FP on art/UI and 14/59 zero-FP domains (vs 124/134 for frozen v11). This is a representation property, not a data issue. Frozen CLIP + MLP (v11) is the only working architecture. Also records provider v3 trained on all negative domains. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes * Document v13 plateau: 128/136 zero FP, frozen-CLIP ceiling confirmed v13 with top-plan expansion (1,169 new images) improves domain coverage to 128/136 at zero FP and reduces fashion FP to 5.3%, but DEFINITELY recall plateaus at 89.6% and art FP at 15.9%. The frozen CLIP + MLP architecture has reached its ceiling. pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified minutes ago, 1731 tests); 2) /simplify - docs-only; 3) docs sync - v13 recorded; 4) CLAUDE.md - no changes * Document the 2026-08-31 photo-classifier freeze. Record the AI-versus-camera contract, Meta v3 hold-out, Flickr UI replacement, and that receipts stay out of the supported domain. * Scrub Spaces catalog details from classifier research docs * Record receipt layout-gate probe for the universal detector
229 lines
9.2 KiB
Python
229 lines
9.2 KiB
Python
"""Probe complex cross-spectral coupling at preregistered carrier shifts."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import logging
|
|
import math
|
|
from dataclasses import asdict, dataclass
|
|
from pathlib import Path
|
|
from typing import TYPE_CHECKING, Any
|
|
|
|
import click
|
|
import cv2
|
|
import numpy as np
|
|
from synthid_affine_lattice_probe import (
|
|
_canonical_pixels,
|
|
_opponent_channels,
|
|
_patch_origins,
|
|
template_harmonics,
|
|
)
|
|
from synthid_pixel_attack import load_rgb
|
|
|
|
if TYPE_CHECKING:
|
|
from numpy.typing import NDArray
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
_OFF_CARRIER_OFFSETS = ((1, 0), (-1, 0), (0, 1), (0, -1), (1, 1), (-1, -1))
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class CyclostationaryScore:
|
|
"""Complex carrier-versus-neighbor contrast on disjoint patch groups."""
|
|
|
|
selection_carrier: float
|
|
selection_off_carrier_median: float
|
|
selection_contrast: float
|
|
confirmation_carrier: float
|
|
confirmation_off_carrier_median: float
|
|
confirmation_contrast: float
|
|
joint_contrast: float
|
|
harmonic_count: int
|
|
selection_patches: int
|
|
confirmation_patches: int
|
|
|
|
|
|
def _patch_cyclic_matrices(
|
|
pixels: NDArray[Any],
|
|
harmonics: NDArray[Any],
|
|
*,
|
|
tile_size: int,
|
|
denoise_sigma: float,
|
|
band_min: float,
|
|
band_max: float,
|
|
) -> NDArray[Any]:
|
|
"""Return normalized complex cross-channel matrices for one patch."""
|
|
patch_size = pixels.shape[0]
|
|
if pixels.shape[:2] != (patch_size, patch_size) or patch_size % tile_size:
|
|
raise ValueError("cyclostationary patches must be square multiples of the tile size")
|
|
channels = _opponent_channels(np.asarray(pixels, dtype=np.float64))
|
|
for channel in range(channels.shape[2]):
|
|
residual = channels[:, :, channel]
|
|
channels[:, :, channel] = residual - cv2.GaussianBlur(
|
|
residual,
|
|
(0, 0),
|
|
sigmaX=denoise_sigma,
|
|
sigmaY=denoise_sigma,
|
|
borderType=cv2.BORDER_REFLECT_101,
|
|
)
|
|
window_1d = np.hanning(patch_size)
|
|
window = window_1d[:, None] * window_1d[None, :]
|
|
spectrum = np.fft.fft2(channels * window[:, :, None], axes=(0, 1))
|
|
frequency_y = np.fft.fftfreq(patch_size)[:, None]
|
|
frequency_x = np.fft.fftfreq(patch_size)[None, :]
|
|
radius = np.sqrt(frequency_y * frequency_y + frequency_x * frequency_x)
|
|
base_mask = (radius >= band_min) & (radius <= band_max)
|
|
|
|
offset_values = ((0, 0), *_OFF_CARRIER_OFFSETS)
|
|
matrices = np.empty((len(harmonics), len(offset_values), 3, 3), dtype=np.complex128)
|
|
for harmonic_index, (signed_row_value, signed_column_value) in enumerate(harmonics):
|
|
alpha_y = round(float(signed_row_value) * patch_size / tile_size)
|
|
alpha_x = round(float(signed_column_value) * patch_size / tile_size)
|
|
for offset_index, (offset_y, offset_x) in enumerate(offset_values):
|
|
shift_y = alpha_y + offset_y
|
|
shift_x = alpha_x + offset_x
|
|
shifted = np.roll(spectrum, shift=(-shift_y, -shift_x), axis=(0, 1))
|
|
mask = base_mask & np.roll(base_mask, shift=(-shift_y, -shift_x), axis=(0, 1))
|
|
base_values = spectrum[mask]
|
|
shifted_values = shifted[mask]
|
|
normalizer = math.sqrt(float(np.sum(np.abs(base_values) ** 2)) * float(np.sum(np.abs(shifted_values) ** 2)))
|
|
if normalizer <= 1e-12:
|
|
matrices[harmonic_index, offset_index] = 0.0
|
|
else:
|
|
matrices[harmonic_index, offset_index] = shifted_values.T @ np.conj(base_values) / normalizer
|
|
return matrices
|
|
|
|
|
|
def _group_score(values: list[NDArray[Any]], harmonic_weights: NDArray[Any]) -> tuple[float, float, float]:
|
|
if not values:
|
|
raise ValueError("cyclostationary score needs at least one patch")
|
|
mean_matrices = np.mean(np.stack(values), axis=0)
|
|
coherence = np.linalg.norm(mean_matrices, axis=(2, 3))
|
|
carrier = float(np.sum(coherence[:, 0] * harmonic_weights))
|
|
off_scores = [
|
|
float(np.sum(coherence[:, offset_index] * harmonic_weights)) for offset_index in range(1, coherence.shape[1])
|
|
]
|
|
off_median = float(np.median(off_scores))
|
|
return carrier, off_median, carrier - off_median
|
|
|
|
|
|
def score_cyclostationary(
|
|
pixels: NDArray[Any],
|
|
template: NDArray[Any],
|
|
*,
|
|
period: float,
|
|
patch_size: int = 256,
|
|
grid_size: int = 4,
|
|
harmonic_count: int = 8,
|
|
denoise_sigma: float = 1.0,
|
|
band_min: float = 0.05,
|
|
band_max: float = 0.35,
|
|
) -> CyclostationaryScore:
|
|
"""Measure split-confirmed complex spectral coupling at one period."""
|
|
if pixels.ndim != 3 or pixels.shape[2] != 3:
|
|
raise ValueError("pixels must have shape (height, width, 3)")
|
|
if not math.isfinite(period) or period <= 0.0:
|
|
raise ValueError("period must be finite and positive")
|
|
if not (0.0 < band_min < band_max < 0.5):
|
|
raise ValueError("frequency band must satisfy 0 < min < max < 0.5")
|
|
if not math.isfinite(denoise_sigma) or denoise_sigma <= 0.0:
|
|
raise ValueError("denoise sigma must be finite and positive")
|
|
|
|
canonical = _canonical_pixels(pixels, template, period)
|
|
tile_size = template.shape[0]
|
|
harmonics, channel_weights, _coefficient_units = template_harmonics(template, harmonic_count)
|
|
harmonic_weights = np.linalg.norm(channel_weights, axis=1)
|
|
harmonic_weights /= np.sum(harmonic_weights)
|
|
grouped_values: dict[int, list[NDArray[Any]]] = {0: [], 1: []}
|
|
for origin_y, origin_x, group in _patch_origins(*canonical.shape[:2], patch_size, grid_size):
|
|
aligned_y = (origin_y // tile_size) * tile_size
|
|
aligned_x = (origin_x // tile_size) * tile_size
|
|
patch = canonical[aligned_y : aligned_y + patch_size, aligned_x : aligned_x + patch_size]
|
|
grouped_values[group].append(
|
|
_patch_cyclic_matrices(
|
|
patch,
|
|
harmonics,
|
|
tile_size=tile_size,
|
|
denoise_sigma=denoise_sigma,
|
|
band_min=band_min,
|
|
band_max=band_max,
|
|
)
|
|
)
|
|
selection_carrier, selection_null, selection_contrast = _group_score(grouped_values[0], harmonic_weights)
|
|
confirmation_carrier, confirmation_null, confirmation_contrast = _group_score(grouped_values[1], harmonic_weights)
|
|
return CyclostationaryScore(
|
|
selection_carrier=selection_carrier,
|
|
selection_off_carrier_median=selection_null,
|
|
selection_contrast=selection_contrast,
|
|
confirmation_carrier=confirmation_carrier,
|
|
confirmation_off_carrier_median=confirmation_null,
|
|
confirmation_contrast=confirmation_contrast,
|
|
joint_contrast=min(selection_contrast, confirmation_contrast),
|
|
harmonic_count=len(harmonics),
|
|
selection_patches=len(grouped_values[0]),
|
|
confirmation_patches=len(grouped_values[1]),
|
|
)
|
|
|
|
|
|
def _load_template(path: Path) -> NDArray[Any]:
|
|
with np.load(path, allow_pickle=False) as artifact:
|
|
template = np.asarray(artifact["template"], dtype=np.float64)
|
|
if template.shape != (16, 16, 3) or not np.all(np.isfinite(template)):
|
|
raise ValueError("template artifact does not contain a finite 16x16 RGB template")
|
|
return template
|
|
|
|
|
|
@click.command()
|
|
@click.argument("template_path", type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.argument("images", nargs=-1, required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
|
|
@click.option("--period", type=click.FloatRange(min=1.0), required=True)
|
|
@click.option("--input-scale", type=click.FloatRange(min=0.01), default=1.0, show_default=True)
|
|
@click.option("--report-out", type=click.Path(dir_okay=False, path_type=Path), required=True)
|
|
def main(
|
|
template_path: Path,
|
|
images: tuple[Path, ...],
|
|
period: float,
|
|
input_scale: float,
|
|
report_out: Path,
|
|
) -> None:
|
|
"""Score IMAGES for complex cross-spectral carrier coupling."""
|
|
logging.basicConfig(level=logging.INFO, format="%(message)s")
|
|
template = _load_template(template_path)
|
|
rows = []
|
|
for path in images:
|
|
try:
|
|
pixels = load_rgb(path)
|
|
if input_scale != 1.0:
|
|
width = max(1, round(pixels.shape[1] * input_scale))
|
|
height = max(1, round(pixels.shape[0] * input_scale))
|
|
interpolation = cv2.INTER_AREA if input_scale < 1.0 else cv2.INTER_CUBIC
|
|
pixels = cv2.resize(pixels, (width, height), interpolation=interpolation)
|
|
score = score_cyclostationary(pixels, template, period=period)
|
|
except ValueError as error:
|
|
rows.append({"path": str(path), "status": "unsupported", "reason": str(error)})
|
|
log.warning("%s: unsupported: %s", path, error)
|
|
continue
|
|
rows.append({"path": str(path), "status": "scored", "score": asdict(score)})
|
|
log.info("%s: joint contrast=%.6f", path, score.joint_contrast)
|
|
report_out.parent.mkdir(parents=True, exist_ok=True)
|
|
report_out.write_text(
|
|
json.dumps(
|
|
{
|
|
"schema_version": 1,
|
|
"template": str(template_path),
|
|
"period": period,
|
|
"input_scale": input_scale,
|
|
"records": rows,
|
|
},
|
|
indent=2,
|
|
)
|
|
+ "\n",
|
|
encoding="utf-8",
|
|
)
|
|
log.info("Wrote %d cyclostationary records: %s", len(rows), report_out)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|