Known Attacks

G.2 Tested Attacks

G.2.1 Crop to Quadrants

The attack: Slice a provenance-marked image into quadrants. Save each independently. Use the fragments separately.

Result: Individual quadrants carry a fraction of the original markers. Detection is marginal to absent depending on marker distribution. Attribution is broken because the matching service cannot correlate fragment coordinates against the full-image fingerprint without the crop offset, and the search space for offset recovery is unbounded for unknown source dimensions.

Assessment: Crop is an effective attack against attribution. This is a known limitation, not a problem to solve in the signal layer. The mitigation is external: reverse image search connects fragments to originals, and the original carries full provenance. The scheme plus visual search handles crop. The scheme alone does not.

G.2.2 Slice and Stitch

The attack: Slice into quadrants, re-encode each, stitch back together.

Result (2048×2048, 557 markers): The stitched image recovers detection (3.6× ratio, p = 1.2 × 10⁻³) and fingerprint (Jaccard 0.56 against intact). Stitch seams are forensically visible at 2–3× the interior pixel difference. After an additional JPEG Q75 re-encode, detection still holds (3.4×, p = 2.7 × 10⁻³, Jaccard 0.50).

Assessment: Self-defeating attack. Reassembly restores the coordinate space, which restores the fingerprint. The independently encoded quadrants leave stitch scars that are themselves forensic evidence. The only winning move is to keep the pieces separate, which reduces to the crop attack.

G.2.3 Flips

The attack: Horizontal, vertical, or combined flip.

Result: Pure coordinate remap. No interpolation. No value damage. With corrected positions, detection is identical to baseline (3.3×, p ≈ 10⁻⁴²). Without corrected positions, detection fails. The search space for flip state is four possibilities, trivially enumerable.

Assessment: Not a meaningful attack. The detector tries all four flip states at negligible cost.

G.2.4 Small Rotations (1°–15°)

The attack: Arbitrary rotation by a small angle, forcing pixel interpolation via bicubic or Lanczos kernel.

Table G2. Small rotation survival. Signal survives 1°–3° cleanly, degrades at 5°–7°, and fails above 10°. Uncorrected original positions surprisingly outperform corrected positions at small angles.

Unexpected finding: At small angles (1°–7°), detection using the original marker positions on the rotated image outperforms detection using geometrically corrected positions. The likely cause: coordinate correction introduces rounding error when mapping to integer pixel positions, while at small angles many markers near the image center have not moved far enough from their original positions to lose their perturbation signal.

Assessment: Small rotations (≤ 5°) do not kill the signal. Large rotations (≥ 15°) do. In practice, no platform pipeline applies arbitrary small rotations as part of standard processing. The adversary who deliberately rotates 15° has visibly damaged the image. The damage is the evidence.

G.2.5 The Full Chain (Rotate, Flip, Rotate, Flip)

The attack: Rotate 5°, flip horizontal, rotate 7°, flip vertical. Two interpolation passes, two coordinate remaps. A deliberate multi-step geometric attack.

Result: After the full chain with corrected positions: 4.2× ratio, p = 9.2 × 10⁻⁵². After an additional JPEG Q85 re-encode: 4.0× ratio, p = 1.3 × 10⁻⁵¹. The signal not only survived the chain but emerged strongly.

Assessment: This result requires further investigation. The recovery after the second rotation is stronger than expected and may reflect position correction accuracy in the specific geometric configuration tested. The result should not be generalized without additional testing across varied rotation angle combinations.

G.4 Anticipated but Untested Attacks

G.4.1 Targeted Local Smoothing

The attack: An adversary who knows the scheme applies Gaussian blur at every eligible position to destroy the perturbation specifically where markers might exist.

Expected cost: O(n) per position per image. At corpus scale, this is a computational campaign with discoverable infrastructure.

Expected evidence: A grid of locally smoothed pixels at grid-aligned positions is itself forensically detectable. Natural images do not have anomalously low variance at regular spatial intervals. The suppression creates an inverted signal — State D.

G.4.2 Adversarial Re-embedding

The attack: Download a provenance-marked image. Embed a second provenance layer with the adversary’s own seed. Register the adversary’s fingerprint before the original creator registers theirs.

Expected defense: Multi-layer stratigraphy (Addendum F). The adversary’s layer is pristine (200/200 match quality). The original creator’s layer is degraded (185/200). The degradation direction reveals the layering order: the adversary’s layer is on top, proving it was applied second. The timestamp race is real but the stratigraphic evidence is independent of timestamps.

G.4.3 High-Saturation Overwrite

The attack: Embed at maximum density — thousands of markers — to overwrite as many of the original creator’s positions as possible.

Expected evidence: High saturation itself is detectable. Natural images do not have 30% of eligible positions showing variance anomaly. The overwrite density is evidence of deliberate interference. State D.

G.4.4 AI-Based Content Reconstruction

The attack: Use an image-to-image AI model (inpainting, style transfer, super-resolution) to reconstruct the content. The output is a new image generated by the model, not a transform of the original pixels.

Expected result: The provenance signal is destroyed. The model generates new pixels from a latent representation that does not preserve per-pixel perturbation structure. This is the nuclear option: it works, but the output is a different image. The adversary must accept that the AI reconstruction may introduce artifacts, alter fine details, and produce an image that is perceptibly different from the original. For high-fidelity use cases (e-commerce product photos, medical imaging, legal evidence), this is unacceptable. For casual social media sharing, it is overkill.

Assessment: AI reconstruction is the one attack that the scheme cannot survive by design. It is not a transformation of the file. It is the creation of a new file that resembles the old one. The defense is not in the signal. The defense is that the attack is expensive, lossy, and produces output that is forensically distinguishable from a photograph (AI-generated image detection is a parallel research area).

G.6 The Attack Economics

Every attack in this addendum falls into one of three economic categories:

Free but self-defeating: Slice-and-stitch, flips, 90° rotations. The attack costs nothing but either undoes itself on reassembly or is trivially corrected by the detector. The attacker gains nothing.

Cheap but detectable: Crop, small rotations, same-codec recompression. The attack partially degrades the signal but leaves forensic evidence of the transformation. The attacker gains partial signal reduction at the cost of evidence.

Expensive and destructive: Targeted smoothing, high-saturation overwrite, AI reconstruction. The attack destroys the signal but at high computational cost, visible image damage, or both. The attacker gains signal destruction at the cost of image quality, compute budget, and discoverable campaign infrastructure.

No attack is free AND effective AND undetectable. This is the fundamental tradeoff. The adversary’s spreadsheet must account for all three dimensions. The scheme is designed so that every movement in one dimension costs the adversary in at least one other.

The signal is not fragile. The ambiguity is. Fix the ambiguity and you have something real. Break the signal and you have evidence.

All empirical results from synthetic test images. Pending validation on real photographs.

The attacks we have not imagined will be found by others. That is the point.

Jeremy Pickett — March 2026