remove-ai-watermarks/data/contentseal/README.md

Content Seal oracle corpus

Muse Image (muse-image-1.0) generations with externally verified Content Seal verdicts, produced through the Meta Model API on 2026-08-26 and checked against the public detector at https://meta.ai/identification (anonymous session, no login). Follows the data/synthid/originals pattern: binaries live in originals/, every derived variant is recorded in manifest.csv as a recipe plus hash and is not stored.

What this corpus establishes

• The Meta Model API image endpoint (POST /v1/images/generations) stamps the same Content Seal pixel watermark as the consumer Meta AI app: all five generations verified positive with attribution "Muse Image 1 - Meta".
• The detector response carries a per-generation ID and creation timestamp embedded in the watermark payload. Both survived a 512 px LANCZOS resize and a full-size JPEG q85 re-encode (same ID returned), so the payload is more robust than the detection threshold.
• Center crops lose the seal: 50% and 33% linear center crops of two different images all returned "No AI signatures from Meta were found", consistent with the Reuters 2026-07-11 analysis (55% missed after cropping).
• API outputs carry XMP iptcExt:DigitalSourceType = trainedAlgorithmicMedia, so local identify flags them via the existing Made-with-AI path. Metadata-stripping transforms fall back to unknown, and Content Seal has no local decoder in this project: the oracle is the only reader.
• Drift finding: the 512 px resize of gen_fox_forest triggers a medium-confidence false positive "Tencent Yuanbao (visible 元宝 / AI生成 mark)" in this project's identify. Recorded here as a reproducible case.

Oracle limits and wire format

There is no public or documented checking API. Verified against the official developer documentation on 2026-08-26 (https://dev.meta.ai/docs/): the full Meta Model API reference lists only Responses, Chat Completions, Messages, Files, Images (/v1/images/generations, /v1/images/edits), and Models, with no identification, detection, or watermark endpoint, and the image-generation, Muse Image cookbook, and pricing pages never mention watermark, Content Seal, or provenance at all. The API applies the seal (every generation in this corpus carries it) while documenting nothing about it. The web tool drives an internal REST pair, captured from the browser network log on 2026-08-26:

1. POST https://rupload.meta.ai/gen_ai_document_gen_ai_tenant/<uuid> with the raw file bytes, x-entity-type, x-entity-length, ai_detector_upload: true, and an anonymous authorization: OAuth ecto1:<token> session token minted by the page.
2. POST https://meta.ai/api/ai-detector with Bearer ecto1:<token> and body {"media_id": "...", "fileName": "...", "mimeType": "..."}.

The rate limit is enforced at that endpoint, server-side, and keyed beyond the browser session: the API itself returns 429 {"errorType": "rate_limited"}, and clearing cookies and storage changed nothing, so driving the internal pair directly does not bypass it. The Meta Model API (api.meta.ai/v1, where the generation key works) has no identification endpoint; plausible paths all return 404. Rows with an empty oracle_verdict were transformed but not yet checkable. Read a verdict only from the settled page text after the result-complete state ("Upload another file"): a wait for a verdict string can match the previous upload's text, and the fresh-navigation protocol used for the calibration rows below is the race-free variant.

Strength floor calibration (qwen-zimage, seed 0)

The library resolves strength per vendor with measured floors (OpenAI 0.07675 / Google 0.27 / Microsoft InvisMark 0.15 in _internal/watermark_profiles.py). Meta Content Seal has no floor yet; the goal of these rows is to measure one by that same methodology: independent generations, each one's first-clean boundary, floor = worst boundary plus the observed cross-source spread.

Measured (2026-08-26/27, oracle meta.ai/identification):

• Default pipeline clears Content Seal: tested samples came back clean at the default resolution-adaptive strength (~0.1305 at 2.56 MP), including the worst source.
• Five independent generations bracketed. First-clean boundaries: lighthouse (0.0525, 0.06], fox (0.03, 0.0375], night_city (0.03, 0.0375], mug <= 0.03, text <= 0.015. Cross-source spread is wide (a factor of four between easiest and hardest).
• Derived Meta floor by the existing worst-boundary-plus-cross-source-spread method: 0.06 + (0.0525 - 0.015) = 0.0975, rounded to 0.1.
• Not shipped as a constant: no provenance signal routes Muse outputs onto a vendor cohort, so the default curve stays authoritative and 0.1 is recorded as the floor to encode if an explicit Meta override is ever added.

Regeneration

API key is not stored in this repository. Regenerate with the script pattern from the session (env MUSE_API_KEY, endpoint https://api.meta.ai/v1/images/generations, model muse-image-1.0); prompts are recorded per file in manifest.csv.