{ "generatedAt": "2026-05-09", "rows": [ { "id": "ai-inpainting", "transform": "AI inpainting", "category": "ai_generation", "realWorldNarrative": "Generative editing tools repaint regions of an image. The modal AI-laundering attack; mask coverage typically 20–50% in real-world re-uploads.", "sourceFile": "tests/benchmarks/results/inpaint_watermark_survival.json", "measuredOn": "2026-05-09", "scores": { "hallmark": { "kind": "pass", "value": 0.95, "metric": "bit_acc", "condition": "30% mask" }, "photodna_pdq": { "kind": "n_a", "reason": "hash-based system; generative editing not in stated scope" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "ai-upscaling", "transform": "AI upscaling", "category": "ai_generation", "realWorldNarrative": "Diffusion-class enhancement is the most-cited \"AI cleanup\" laundering step. Counter-intuitively, the homogenization often sharpens the embedded signal rather than removing it — bit recovery rises from 0.65 raw capture to 0.75 after AI enhancement.", "sourceFile": "tests/benchmarks/results/realworld_watermark_extract.json", "measuredOn": "2026-05-09", "scores": { "hallmark": { "kind": "pass", "value": 0.75, "metric": "bit_acc", "condition": "post AI-enhancement (illustrative single-sample case)" }, "photodna_pdq": { "kind": "n_a", "reason": "hash-based; generative cleanup not in stated scope" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "ai-video-regeneration", "transform": "AI video regeneration", "category": "ai_generation", "realWorldNarrative": "Video-diffusion pipelines (Stable Video Diffusion class) re-encode the entire clip. Threshold detection survives even when pixel similarity collapses; the tier classifier honestly downgrades the match to \"minor section\" rather than claiming perfect duplication.", "sourceFile": "tests/benchmarks/results/svd_smoke_n2_cpu.json", "measuredOn": "2026-05-08", "scores": { "hallmark": { "kind": "pass", "value": 1.0, "metric": "f1", "condition": "n=2 pairs" }, "photodna_pdq": { "kind": "n_a", "reason": "hash-based; video diffusion not in stated scope" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "screen-recapture", "transform": "Screen recapture", "category": "capture", "realWorldNarrative": "Phone-of-screen capture is the analog-hole laundering step that defeats every metadata system. We perspective-rectify before scoring; the recapture preserves a faithful copy of the in-pixel signature.", "sourceFile": "tests/benchmarks/results/cofs_classifier.json", "measuredOn": "2026-05-09", "scores": { "hallmark": { "kind": "pass", "value": 1.0, "metric": "detection_rate", "condition": "specificity (zero false positive on legitimate content); after perspective rectification" }, "photodna_pdq": { "kind": "fail", "value": 0.0, "metric": "detection_rate", "condition": "screen_capture_realistic survival per pdq_aug_survival.json" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "heavy-jpeg-reencode", "transform": "Heavy JPEG re-encode (Q30)", "category": "compression_reencoding", "realWorldNarrative": "Every social platform recompresses uploads. Q30 is more aggressive than the typical platform floor (Q40); we still recover top-1 cleanly because the signature is distributed across the entire visual field rather than localized.", "sourceFile": "tests/benchmarks/results/hard_4i_sscd.json", "measuredOn": "2026-05-05", "scores": { "hallmark": { "kind": "pass", "value": 1.0, "metric": "r_at_1" }, "photodna_pdq": { "kind": "unpublished", "footnoteId": "photodna_pdq" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "multi-platform-chain", "transform": "Multi-platform chain", "category": "compression_reencoding", "realWorldNarrative": "The laundering chain creators actually see: upload to one platform, screenshot from another, re-upload elsewhere. Multiple recompressions stacked with realistic platform-shaped augmentation.", "sourceFile": "tests/benchmarks/results/realworld_hard_extended.json", "measuredOn": "2026-05-06", "scores": { "hallmark": { "kind": "pass", "value": 0.78, "metric": "r_at_1", "condition": "realworld_combined aug; n=50" }, "photodna_pdq": { "kind": "unpublished", "footnoteId": "photodna_pdq" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "mirror-crop", "transform": "Mirror + crop", "category": "geometric", "realWorldNarrative": "The simplest laundering attack: horizontal flip plus a 10–20% crop. StopNCII (PhotoDNA + PDQ) fails completely because the perceptual hash diverges; our tile-refs path holds.", "sourceFile": "tests/benchmarks/results/mirror_only_tilerefs.json", "measuredOn": "2026-05-07", "scores": { "hallmark": { "kind": "pass", "value": 0.96, "metric": "r_at_1" }, "photodna_pdq": { "kind": "fail", "value": 0.0, "metric": "detection_rate", "condition": "mirror_crop_0.7 survival per pdq_aug_survival.json" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "picture-in-picture", "transform": "Picture-in-picture", "category": "composition", "realWorldNarrative": "TikTok and Instagram re-embed creator work inside a larger reaction frame. The original asset becomes ~20% of pixel coverage; our multi-tile scorer recovers it cleanly (the full-frame scorer would have failed at 0.20 R@1).", "sourceFile": "tests/benchmarks/results/4v_fast_multitile.json", "measuredOn": "2026-05-09", "scores": { "hallmark": { "kind": "pass", "value": 1.0, "metric": "r_at_1", "condition": "multi-tile path" }, "photodna_pdq": { "kind": "unpublished", "footnoteId": "photodna_pdq" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } }, { "id": "split-screen", "transform": "Split-screen", "category": "composition", "realWorldNarrative": "Side-by-side 2-tile composition (reaction-content pattern). Original asset is half the frame; full-frame scoring would fail at 0.30 R@1, multi-tile path finds the match.", "sourceFile": "tests/benchmarks/results/4v_fast_multitile.json", "measuredOn": "2026-05-09", "scores": { "hallmark": { "kind": "pass", "value": 1.0, "metric": "r_at_1", "condition": "multi-tile path" }, "photodna_pdq": { "kind": "unpublished", "footnoteId": "photodna_pdq" }, "hive": { "kind": "unpublished", "footnoteId": "hive" }, "reality_defender": { "kind": "unpublished", "footnoteId": "reality_defender" }, "vermillio": { "kind": "unpublished", "footnoteId": "vermillio" } } } ], "footnotes": { "hive": { "source": "https://bsky.social/about/transparency-report-2025", "body": "Hive has not published adversarial-robustness numbers for any of the listed transforms as of 2026-05-28. Their integration in Bluesky's pipeline is publicly confirmed in Bluesky's 2025 transparency report without performance figures." }, "reality_defender": { "source": "https://www.realitydefender.com", "body": "Reality Defender's published materials describe deepfake detection capabilities without specific adversarial-transform robustness numbers." }, "vermillio": { "source": "https://vermillio.com/traceid", "body": "Vermillio's TraceID product page lists capabilities without per-transform robustness benchmarks. Sony Music investor disclosure confirms scale (\"2 trillion items scanned yearly\") but not per-transform performance." }, "photodna_pdq": { "source": "tests/benchmarks/results/pdq_aug_survival.json", "body": "PhotoDNA + PDQ together form StopNCII (the federal compliance default per the May 2026 TAKE IT DOWN Act enforcement). Hallmark measured PDQ as a prefilter on the DISC21 + UCF101 test set: confirmed failure on screen_capture_realistic and mirror_crop (0% survival), partial failure on letterbox (48%). PhotoDNA itself is Microsoft's SaaS endpoint; we did not benchmark that service directly — only the open-source PDQ implementation. Transforms not in pdq_aug_survival.json (e.g. pip_corner, splitscreen) show as \"unpublished\" rather than \"fail\"." } } }