# Proofmark

Proofmark is a Manifest V3 Chrome extension that automatically checks webpage images for signs of AI generation and blurs likely-AI images by default. Inference runs inside Chrome with WebAssembly. It has no backend, no API key, and no upload path.

The visible result is intentionally simple: every analyzed image receives an **AI probability** badge. At the bounty's required default threshold, scores of **65% or more** are labeled “Likely AI” and blurred. The popup can switch the treatment to **hide** or **label only** immediately. Opening a badge shows the visual-model score, embedded generator traces, provenance records, watermark markers, image format, dimensions, runtime, elapsed time, and a reveal/reapply control.

On the untouched 1,749-image final set, the production JavaScript path reached **94.6% balanced accuracy** on originals and **91.4%** after web-style degradation. Mean local inference was **136–143 ms per image** on the benchmark Mac CPU. Full per-generator results, uncertainty, and leakage checks are in [`BENCHMARK.md`](./BENCHMARK.md).

## How it works

1. A content script observes ordinary webpage `<img>` elements as they enter view.
2. A Chrome offscreen document reads the image bytes locally and runs Proofmark's quantized Community Forensics-based ViT through Transformers.js and ONNX Runtime Web.
3. A forensic pass examines encoded bytes for Stable Diffusion parameters, ComfyUI workflows, generator names, C2PA / Content Credentials, SynthID labels, and known embedded watermark markers.
4. Weak bounded pixel statistics calibrate—but cannot overrule—the learned model. Explicit generator metadata can strengthen the final result. Watermark and provenance labels are surfaced as clues, not treated as cryptographic verification.
5. A badge is positioned over the source image. Likely-AI images receive a reversible CSS blur or hide treatment; the original image bytes and DOM node are never replaced or uploaded.

## Requirements

- Node.js 20 or newer
- npm 10 or newer
- Google Chrome 116 or newer
- Internet access once, while installing npm packages

## Reproducible build

```bash
git clone https://github.com/Dyno-man/Dino-ImageGen-Ext.git
cd Dino-ImageGen-Ext
npm ci
npm run build:fresh
```

The repository bundles the 23 MB `Proofmark/proofmark-webwild-v3` Q8 model. It keeps the ViT backbone from the MIT-licensed [`OwensLab/commfor-model-384`](https://huggingface.co/OwensLab/commfor-model-384) checkpoint at revision `6076002bf0d9dd37537f965ee2f06f826c333b61` and uses Proofmark's small locally trained nonlinear head:

- `config.json`
- `preprocessor_config.json`
- `onnx/model_quantized.onnx` — SHA-256 `ed17ceb332bef84d0adcc2fa537eef85ed3ac6fb32c30393c326321fbbe54683`

The source checkpoint SHA-256 is `b89f36275f3bf5e2b040eee36597a8f19db051bff9a473a9cf7b2466284fb387`. [`scripts/export-community-forensics.py`](./scripts/export-community-forensics.py), [`scripts/train-community-head.py`](./scripts/train-community-head.py), and the pinned Python requirements reproduce the backbone export, head training, and browser-safe MatMul-only Q8 quantization. The completed `dist/` directory contains the model, WebAssembly runtime, and all UI code. It makes no model or inference-related downloads after installation and has no local-server runtime dependency.

## Install locally

1. Build the extension.
2. Open `chrome://extensions`.
3. Enable **Developer mode**.
4. Choose **Load unpacked** and select this repository's `dist/` directory.
5. The setup page opens automatically. Select **Run local readiness check**.
6. Visit a normal `http` or `https` page containing images. Proofmark checks images as they enter view.

To prove offline operation, complete steps 1–5, disconnect the computer from the network, open a previously cached/local test page, and scan again. The classifier and forensic analysis remain functional.

## Test without model tokens

The test suite never calls an LLM or image-generation API.

```bash
npm test             # metadata, watermark, calibration, and settings tests
npm run test:policy  # fails on hard-coded remote inference calls
npm run build        # verifies local weights and creates the MV3 distribution
npm run check        # all of the above
npm run test:e2e     # launches isolated test Chromium; no model/API tokens
```

For detector quality, place a labeled image set in two folders and run the included offline benchmark:

```text
benchmark/
├── ai/       # or fake/, synthetic/, generated/
└── real/     # or authentic/, human/
```

```bash
npm run benchmark -- ./benchmark
```

The command reports AI recall, real recall, balanced accuracy, and mean inference time at the same fixed 65% threshold used by the extension. It exits successfully only at Proofmark's 80% release gate or better (override with `PROOFMARK_REQUIRED_ACCURACY` when reproducing another protocol). For a fair result, use a held-out, generator-diverse set with screenshots, crops, and recompressed web images—not samples used to train this model.

Two deterministic public-dataset preparation commands are included:

```bash
npm run benchmark:prepare-cifake -- /path/to/test.parquet /private/tmp/proofmark-cifake/sample-1000 500
npm run benchmark:prepare-tiny-genimage -- /path/to/validation.parquet /private/tmp/proofmark-tiny-genimage/sample-1000 500
```

The second command uses Tiny-GenImage's documented `0 = real`, `1 = fake` mapping and prints the selected generator-source distribution. Dataset images remain outside the repository and retain their upstream licenses.

The end-to-end test needs Playwright's test Chromium once per machine:

```bash
npx playwright-core install chromium
npm run test:e2e
```

It loads `dist/` as an unpacked extension in a disposable browser profile, initializes the bundled model, visits a local two-image fixture, verifies that both images receive scores, confirms that the likely-AI image is blurred automatically, exercises reveal/reapply, and checks that explicit generator metadata appears in the evidence panel. It does not contact an inference service or generate images.

## Privacy and network policy

- Production runtime sets `allowRemoteModels = false`.
- There is no telemetry, analytics, cloud inference, localhost service, or API key.
- The extension fetches an image only from the URL already displayed by the current webpage so it can read cross-origin image bytes under Chrome's extension permissions.
- No image bytes, scores, page history, or URLs are transmitted to Proofmark or another analysis service.
- Settings stay in `chrome.storage.local`.

## Model, split, and license

Proofmark source, head changes, and the upstream Community Forensics checkpoint are released under MIT. The upstream backbone was trained on Community Forensics; Proofmark then froze that backbone and fitted a compact 384→32→1 head. Training inputs retain their source licenses: Real vs AI Corpus samples are CC BY 4.0, and Tiny-GenImage samples are CC BY-NC-SA 4.0. Dataset images are not included in the repository or extension package. See [`MODEL_CARD.md`](./MODEL_CARD.md) for attribution and intended-use details.

There is no cosmetic 80/20 claim. The workflow used separate training (4,614 records), calibration (1,104), development (2,499), and untouched final-test (1,749) roles. The final test came from a fourth parquet shard, and a cross-split audit found zero exact or perceptual near-duplicate matches against 8,115 prior files. At the frozen 65% threshold, it scored 94.6% balanced accuracy on originals and 91.4% after web-like transformations. See [`BENCHMARK.md`](./BENCHMARK.md) for confusion matrices, generator results, uncertainty, failure history, and hashes.

No detector is universally reliable. New generators, aggressive JPEG compression, crops, screenshots, and heavy edits can change scores. Proofmark's UI says “likely” on purpose; it should not be the sole basis for a consequential decision.

## Project map

```text
src/
├── analysis/     encoded metadata, watermark, pixel, and score fusion
├── background/   MV3 orchestration and result cache
├── content/      automatic image discovery, badges, and evidence panel
├── offscreen/    local ONNX inference runtime
├── options/      setup, readiness check, controls, and disclosure
├── popup/        current-page summary
└── shared/       settings, model identity, and message contracts
scripts/
├── assemble-webwild-benchmark.mjs
├── audit-cross-split.mjs
├── benchmark-folder.mjs
├── check-policy.mjs
├── download-model.mjs
├── train-community-head.py
└── verify-model.mjs
```

The exact bounty-to-implementation checklist is in [`SCOPE.md`](./SCOPE.md), and the fixed public-dataset results and reproduction protocol are in [`BENCHMARK.md`](./BENCHMARK.md).