Source: docs/PLAN.md (v4) + decision log from HANDOFF.md. Working title: In-Pixel Signed Provenance with Robust Content Binding. Follow-up to DKiS.
Embed an invisible, forgery-resistant watermark into a real photograph at capture time, on a phone NPU or camera ISP, such that:
H publicly.| risk | how addressed |
|---|---|
| Denial of verification via benign edits | Verifier outputs three-way answer (valid / unverifiable / tampered) but cannot always distinguish the last two. |
| Catastrophic crop failure | Whole-image hashing makes any crop an authentication failure, not graceful partial-verification. Trade for simplicity + smaller payload. |
| Privacy exposure | Embedding gps, timestamp, device_id in pixels is a legal/privacy liability in some jurisdictions (GDPR). Mitigation: optional fields; minimum signed M = just H(image). |
Minimal Whole-Image Provenance. Internal label A-tolerant. Single headline design. B/C/D below are labeled future-work corners.
[ H (128 b) | sig (512 b) | pk (256 b) ] โ data, 896 b
H = RobustHash(image) 128 b content fingerprint
sig = Ed25519.Sign(sk_device, H) 512 b authenticator over H
pk = Ed25519 public key 256 b device identity
Channel coded with BCH(127,99) Slepian-Wolf on H + RS(128,100) over GF(2^8)
โ 1024 b embedded in pixels
That is all. No M beyond H. No device_id, timestamp, gps. No cert chain. No OCSP. No per-tile hashes.
| stage | step |
|---|---|
| Offline pixels + verifier only | 1. Extract (H, sig, pk) from pixels |
2. Compute H' = RobustHash(received_image) | |
3. Check Hamming(H', H) < ฯ โ pixels match signed content | |
4. Ed25519.Verify(pk, H, sig) โ signature valid | |
5. "Image carries a valid Ed25519 signature from pk over content H" | |
| Online registry lookup | 6. registry.lookup(pk) โ device metadata + status |
| 7. If active + trusted manufacturer โ "valid provenance from device X" |
Offline stage proves signature-content binding. Online stage upgrades that to trustworthy provenance. Split is explicit in the paper โ fully-offline trust is not claimed.
| novelty | closes |
|---|---|
| Pixel-content hash vs semantic caption | caption-collision forgery (MetaSeal) |
pk in pixels, no C2PA manifest | manifest-strip attack (TrustMark+C2PA) |
| Asymmetric Ed25519 signatures | DKiS symmetric-key (no public verification) |
| TrustMark-scale encoder | MetaSeal's on-camera infeasibility (~1.5 s/image) |
| label | payload | change vs A-tolerant | status |
|---|---|---|---|
| A-tolerant (MWIP) | 896 b | โ | โ headline |
| B | 1152 b | + basic metadata (device_id, ts, gps, nonce) | ๐ก future |
| C | ~1792 b | + short-lived offline cert (flat hierarchy, revocation by expiry) | ๐ก future |
| D | ~4100 b | + EXIF-extended M + H_tiles + 2-level cert chain | ๐ก future |
All three of B/C/D fall into the โฅ 1024 b regime where Exp 0 showed the encoder stalls at current architecture. Contingent on bottleneck widening (16ร16ร3 โ 32ร32ร3) + longer training. Not demonstrated in this paper.
Demonstrate H robustness under benign transforms and resistance to known prior attack methodologies (NeuralHash-style optimization, pHash collision algorithms). Adaptive-collision security explicitly flagged as open. Most defensible in the 10-week timeline. Path 1 adaptive red-team becomes a candidate follow-up paper, not a gating Exp 5.
| # | name | goal | status |
|---|---|---|---|
| 0 | Image-level payload capacity | Find where the CNN encoder's payload capacity stalls. Sweep p โ {100, 256, 512, 1024, 2048}. | done p256 ~ comfortable; p512 marginal (0.795); p1024+ stalls. Architectural cliff confirmed. |
| 1 | Robust hash H design + eval | Design H: image โ 128 b with benign-transform robustness + adversarial-collision resistance under Path 2. |
in flight pHash baseline implemented; perturbation/collision tests pending |
| 2 | End-to-end verification | Integrate Exp 0 encoder + Exp 1 hash + Ed25519 sign/verify into a full pipeline. Eval pass rate on DIV2K + COCO val. | pending |
| 3 | MetaSeal caption-collision forgery | Demonstrate MetaSeal succumbs to caption-collision forgery; our scheme does not. ~200 caption-matched image pairs. | pending |
| 4 | Camera deployment feasibility | ONNX/CoreML/TFLite export + int8 quantize + benchmark on Hailo-8 / Apple Neural Engine. Target โค 100 ms for 12 MP. | in flight ONNX export scaffolding; fp16 validation pending |
| 5 | Adaptive attack red-team | (Path 1 only.) Targeted collision via PGD constrained to JPEG survivability. Budgets 2^20 / 2^30 / 2^40. | deferred Path 2 committed โ potential follow-up paper |
| weeks | work |
|---|---|
| Now โ Week 1 | Exp 0 completes; report generated. Exp 1 scaffolding in parallel (candidate hashes implemented). |
| Week 1โ3 | Exp 1 (robust hash training + benign-transform evaluation). Path 1/2/3 decision. |
| Week 4 | Exp 2 integration + e2e benign-transform evaluation. |
| Week 5 | Exp 3 (MetaSeal forgery comparison). |
| Week 6 | Exp 4 (camera deployment benchmark). |
| Week 7 | Exp 5 (if Path 1 committed) โ adaptive attack red-team. |
| Week 8โ9 | Writeup, ablations, revisions. |
| Week 10 | Submission. |
Ranked for this paper's framing (key-bound + content-side + PDQ-drift + INN backbone, 896 b whole-image payload). Prestige = broad CS recognition / h5-index. Fit = how strongly the reviewer pool values threat model + applied coding theory over architecture novelty (5 = ideal, 1 = poor). h5 figures are approximate (Google Scholar Metrics, recent).
| # | Venue | Tier | h5 | Fit | Next deadline | One-liner |
|---|---|---|---|---|---|---|
| 1 | IEEE S&P (Oakland) | Big-4 security | ~110 | 5 | ~1 Sept 2026 (cyc 2) | Top security venue most receptive to applied-crypto + watermarking + info-theory crossover. Best prestige ร fit. |
| 2 | NDSS | Big-4 security | ~85 | 5 | ~early July 2026 (fall) | Same top-4 tier, slightly higher accept rate (~17%) and nearer deadline. Best risk-adjusted bet. |
| 3 | USENIX Security | Big-4 security | ~110 | 4 | ~early Sept 2026 (cyc 1) | Equal prestige to S&P; reviewer pool leans systems but applied-crypto papers land regularly. |
| 4 | IEEE TIFS | Top journal (sec/forensics) | ~80 | 5 | rolling | Gold standard within watermarking. Lower CS-wide h5; punches above weight in this subfield. |
| 5 | NeurIPS | Top ML | ~330 | 3 | ~mid-May 2026 (likely closed) | Home of recent watermarking landmarks (Tree-Ring, Gaussian Shading). Reviewers engage with coding theory. Needs ML-flavored reframing. |
| 6 | ACM CCS | Big-4 security | ~110 | 3 | ~Jan 2027 | Same top-4 tier as S&P/USENIX but reviewer pool skews formal/protocol crypto; watermarking can feel off-topic. |
| 7 | ICCV | Top CV | ~270 | 2 | ~March 2027 (biennial) | Stable Signature landed here. Reviewers anchor on architecture novelty; coding theory and threat model get skimmed. |
| 8 | CVPR | Top CV | ~440 | 2 | ~early Nov 2026 | Highest h5 of any CS venue. Worst fit for coding-theory / threat-model contributions; heavy reframe required. |
| 9 | ACM MM | Top multimedia | ~75 | 3 | ~April 2026 (passed) | Decent fit, clear half-tier below Big-4 security or top CV/ML. Reasonable fallback. |
| 10 | WIFS / IH&MMSec | Specialized workshops | ~25โ30 | 4 | ~July 2026 / ~Feb 2027 | Strong fit, fast cycle. Use only as resubmission target โ lowest prestige of the list. |
H being formally collision-resistant.
idea097_design001 to imagehide-demo
chain_wechat at 0.955). Lives in sibling autohide project.
chain_wechat dropped
INNCodec.subnet_type default โ "light"; INN_BLOCKS โ 8. Mobile variant (0.167 M params) is now the default. chain_wechat (resize 0.3 โ Q50) past resize-tolerance bound โ removed from live attack suite. Live suite now 12 attacks.
56391691 NaN'd at 40k
bit_acc โ 1.0 / PSNR โ 28 dB through step 40,000; NaN at 40,200; decoder froze (val PSNR pinned 11.09 dB) by step 60k. Cancelled. Different failure mode from the curriculum-transition collapses; multi-res sampler is the new variable.
src/multi_res_dataset.py with an 18-entry (H, W) pool and MultiResBatchSampler deriving batch size from a fixed pixel budget. New args --manifest_dims, --pixel_budget.
num_blocks 16 โ 8; subnet rdb โ light. 24ร fewer params, 24ร fewer FLOPs. Empirically the lighter architecture survived the ฮฑ-ramp without modification.
secret_rec_rms diagnostic (added same-day) confirmed the recovered secret was driven 5,000ร toward zero in 1,200 steps. Curriculum smoothing alone insufficient. Threat model narrowed and Bernoulli ramp added.
[ H(128) | sig(512) | pk(256) ]. Tolerant-H mode (Hamming threshold before Ed25519); strict mode rejected as crypto-unsound. Path 2 committed for H security (non-adaptive). Canonical-delivery scope made load-bearing.
56197028
| risk | likelihood | mitigation | trigger |
|---|---|---|---|
H fails benign-transform robustness |
medium | swap candidate; accept higher ฯ | Exp 1 FR > 10% at JPEG q=50 |
H broken by prior attack |
medium | narrow claims; Path 1 adaptive defense becomes follow-up | collision succeeds under named prior method |
| 896 b doesn't train to bit_acc โฅ 0.98 | medium | targeted long-run at 896 b; widen bottleneck if needed | Exp 0 follow-up at 896 b stalls below 0.95 |
| Crop/resize complaints from reviewers | medium | canonical-delivery scope documented; verifier rejects | reviewer pushback on social-media pipeline realism |
| MetaSeal caption-collision attack rate low | medium | pivot narrative to manifest-strip defense as headline | Exp 3 forgery rate < 5% |
| Camera latency > 100 ms | low | accept edge-server deployment; reframe | Exp 4 fails latency target |
| Online registry DoS | low | not a crypto attack; affects liveness not forgery | reviewer pushback |
H. Historical record is bad โ NeuralHash broken in 11 days, pHash broken by standard attacks, every published robust hash has been collision-attacked. We must design an H that either beats this or honestly scopes the claim to non-adaptive attacks (Path 2 commitment).
| cut | why |
|---|---|
| Ed25519 only | Post-quantum signatures (Dilithium, Falcon) out of scope. |
| One device key per camera | No multi-key, no rotation. |
| Canonical-delivery assumption | Verifier rejects images whose decoded dimensions violate the declared canonical profile. Crop/resize/rotate/flip = authentication fails (by design, not a bug). |
| Online registry lookup required | Offline content-binding is proven from pixels alone. Fully offline device trust = future-work C/D. |
| No metadata fields in pixels | device_id, timestamp, gps, nonce are future-work (variant B+). |
| No per-tile localization ยท no tamper localization | Whole-image signature only. H_tiles is a D-only future-work feature. |
| Video deferred | โ |
| Re-photograph attacks not defended | Inherited C2PA scope. |
| Device key extraction not defended | Inherited hardware-root-of-trust assumption. |
| No hardware attestation claim | Future variants with device_id/timestamp/gps treat those as signed application fields, not sensor-grounded. |
pk now embedded in pixels (no C2PA manifest required). Threat model sharpened. Three security paths proposed; decision deferred. Venue target recalibrated from S&P/CCS to IH&MMSec/WiFS/TIFS. Exp 2 (per-tile INN retrain) dropped; Exp 5 (adaptive red-team) added contingent on Path 1.