A single CNN can veto every other forensic signal in a naive image classifier. SpotFakeImage_AI exists because that defect is representative of a deeper problem: most AI image detectors answer one question (is this AI-generated?) when the 2026 problem requires two (is this AI-generated, and was this specific region locally edited?). The tool ships five detection layers, each addressing a different evidence domain, fused in logit space with a veto-proof rule and a CNN share cap.
Layer 0 is C2PA provenance. The previous version scored C2PA presence as P(AI)=0.98, which is inverted: Pixel, Leica, Nikon, and Sony cameras attach C2PA to real photos, while OpenAI and Google attach C2PA to AI output. The signal is the assertion, not the presence. The v0.2 rewrite parses C2PA with a real library, classifies the issuer, and routes through OpenAI Verify when an OpenAI-signed issuer is present. Layer 1 is TruFor localization: a tamper map, integrity score, and reliability map become first-class report outputs. A LOCAL_EDIT flag requires a coherent tamper blob, not just a heat-map highlight. Layer 2 is B-Free (nonprofit weights) as the whole-image authority, with an optional Organika SDXL-specialist vote. Layer 3 is AEROBLADE, a training-free reconstruction probe using the official autoencoder trio (Stable Diffusion 1, Stable Diffusion 2, Kandinsky 2.1). Layer 4 is the residual battery: ELA, quantization tables, resolution analysis, frequency spectrum, smoothness, NPR (Tan, CVPR 2024), SPAI, and PRNU.
Transport-aware demotion is the design selection carried forward from v0.1: images that have passed through messaging apps (Signal, WhatsApp, iMessage) get their ELA, spectrum, quantization table, NPR, PRNU, and B-Free signals demoted because the transport layer re-encodes the image in ways that destroy the forensic evidence those methods depend on. A CNN cannot force a LIKELY REAL PHOTO verdict on a transported file.
“The 2026 problem is not ‘is this AI?’ It is ‘was this specific region locally edited?’”
— v0.2 Architecture Contract
LLM watermarks are a privacy problem disguised as an accountability feature. A user-attribution mark embedded in model output can identify who prompted the text. BleachMark treats watermarking as what it is: covert-channel steganography. The tool detects watermarks and steganographic carriers in ASCII and Markdown text from large language models, then bleaches those signals while preserving meaning.
The detection engine splits into four tracks. The carrier engine scans for post-hoc carriers: zero-width characters, Unicode Tags block (ASCII smuggling), variation-selector runs, homoglyphs, whitespace manipulation, Markdown-level carriers, and bidirectional overrides. The statistical engine handles keyless corpus detection, comparing outputs across runs and models to surface possible watermark bias. The keyed engine runs green/red-list z-tests and SynthID-Text tournament sampling when keys are available. The comparison detectors look for attribution marks by correlating patterns across multiple samples from the same user session.
The bleach engine is equally layered. Carrier normalization strips post-hoc carriers without touching content. Token-level edits replace watermarked token choices with equivalent alternatives. Model paraphrase rewrites flagged passages through a meaning gate that rejects rewrites whose semantic distance exceeds a calibrated threshold. Attribution defeat specifically targets multi-bit user-identification payloads. Local inference runs through llama.cpp, keeping the entire pipeline local-first. Every detection score reports a calibrated false-positive rate.
SpotFakeImage_AI includes a self-contained adversarial arena that generates attacks, runs detection, and evolves both sides. The arena edits real photos via local SDXL inpainting, generates photo-like synthetic images, and scores each against the full detection stack. After each round, it trains a local detection head and a local tamper map from the results. The SSIM floor is 0.80: any edit that drops below that threshold is too visually obvious and gets discarded. The arena ships with both a diffusers backend (local SDXL on GPU) and a fallback backend for CPU-only machines. Research dataset integration (Chameleon, COCO-Inpaint) is wired; dataset request emails were sent on August 18th.
RatCatcher_AI, the RPi 5 bird-feeder detection system introduced in May, received four commits in late August integrating the Hailo AI Hat+ NPU accelerator directly onto the Raspberry Pi. The previous version used the standalone Hailo-8L module; the AI Hat+ is Raspberry Pi’s official M.2 HAT that mounts the Hailo-8L directly on the Pi’s PCIe bus. Microphone support was added alongside the hardware integration, enabling audio-based species identification to complement the existing video detection pipeline.
The security culture game theory paper received an updated review pass in August. The work models organizational security behavior as a hybrid Public Goods-Stag Hunt game enhanced with behavioral insights: social norms, bounded rationality, information asymmetry, and adaptive learning. The five-level simulation framework progresses from basic game theory validation through parameter space analysis, advanced organizational modeling, behavioral extensions (with an extended payoff function incorporating social norms and information quality), to empirical validation against real-world datasets. That final level validates against KnowBe4 data (800,000+ employees across 4,078 organizations), CybSafe global data (7,000+ individuals across 7 countries), and a meta-analysis of 2,210+ cybersecurity behavior studies, achieving 88.5% overall accuracy.
The MCP Firewall received four commits in early August, updating MCP functionality, documentation, and model support. The project continues to mature past its July MVP with expanded documentation and broader model compatibility.
The autonomous astronomical discovery pipeline received updates to its evolutionary parameter optimization and compositional pipeline evolution. The system scans star fields across nine detection domains (gravitational lenses, morphology anomalies, interaction signatures, stellar distributions, kinematics, time-domain variability, multi-scale features, stellar populations, and emergent patterns) using a 72-gene genome and LLM-as-strategist architecture for token-efficient closed-loop discovery.
··· “Frustrating adversaries since the dial-up era” · GitHub: rondilley · 56 Repositories and Counting ···
Three of August’s projects form a stack aimed at the same problem from different angles. SpotFakeImage_AI examines whether an image is what it claims to be. BleachMark examines whether text carries hidden signals its author did not intend. Bulwarkai examines whether a tool call is what it claims to be. Each operates at a different layer (pixels, tokens, protocol messages), each uses a layered detection architecture rather than a single classifier, and each is designed to fail closed rather than guess optimistically. The common discipline is forensic: report what the evidence supports, demote signals that transport or context has corrupted, and never let a single strong vote override contradictory evidence from other layers.
The OIR Review and STE100 skills, featured in July’s chronicle, were published as standalone git repositories in August with their own version histories. The OIR Review skill gained its deterministic linter (ICD 203 lexicon, legal-exposure vocabulary, stacked-hedge detection) as a standalone script. The STE100 skill codifies the eleven rules from ASD-STE100 Simplified Technical English that catch most errors in technical documentation.
August 1–4: Bulwarkai MCP updates, StarPattern enhancements. August 10: Security culture paper review. August 11–12: BleachMark created and shipped (12,900 lines in two days). August 16–22: SpotFakeImage v0.2 (13,377 lines in seven days, 15 commits). August 23–24: RatCatcher AI Hat+ integration. Five substantive projects in four weeks, each starting from zero or near-zero and shipping tested code by week’s end.
Each layer emits a probability. Fusion converts each to log-odds, weights by layer reliability (calibrated per transport context), sums, and converts back. The veto-proof rule prevents any single CNN from overriding the sum: a Layer 2 CNN score below 0.1 that would flip the verdict is capped at its share of the total evidence. Transport-aware demotion zeroes the weights of signals known to be unreliable after messaging-app re-encoding.
Model-based bleaching rewrites flagged passages to remove watermark signal. The meaning gate compares the original and rewritten text using sentence-embedding cosine similarity. Rewrites whose semantic distance exceeds the calibrated threshold are rejected and the original is kept, watermark intact, rather than risk changing the author’s meaning. The gate is the mechanism that distinguishes bleaching from paraphrasing: the goal is to remove the hidden signal, not to rewrite the text.
The AI Hat+ mounts the Hailo-8L directly on the Raspberry Pi 5’s PCIe bus via an M.2 HAT, eliminating the USB bottleneck of the standalone module. The integration commits restructure the inference pipeline to use the PCIe-attached accelerator, gaining lower latency on the object detection path. Microphone support adds a second sensor modality for species identification alongside the existing camera feed.