agent-threat-rules 4.0.0 → 4.2.0

package/rules/model-abuse/ATR-2026-02411-ai-provenance-metadata-stripping.yaml

@@ -1,274 +1,111 @@
-title: "Targeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated Media"
+title: Targeted Stripping of C2PA / IPTC AI-Provenance Metadata from Generated Media
 id: ATR-2026-02411
 rule_version: 1
 status: experimental
-description: >
-  Detects an agent performing targeted removal of the machine-readable
-  provenance markings that identify media as artificially generated: deletion
-  of the JUMBF/CBOR container holding a C2PA manifest, blanking of the IPTC
-  `DigitalSourceType` field (whose AI value is the URI ending
-  `trainedAlgorithmicMedia`), or blanking of the PNG `parameters` / XMP
-  generation fields written by diffusion tooling. The signal is
-  SELECTIVITY. An attacker who wants a file to pass as camera-original does
-  not run a blanket wipe — a blanket wipe is itself conspicuous. They delete
-  only the provenance group and leave EXIF, GPS and the ICC profile intact,
-  producing a file that looks ordinary in every viewer while carrying no
-  trace of having been generated. This rule therefore deliberately does NOT
-  cover generic metadata clearing (`-all=`, `-gps:all=`, ImageMagick
-  `-strip`, `ffmpeg -map_metadata -1`): those are the daily tools of
-  photographers protecting sources, of privacy workflows, and of image
-  optimisation CI, and matching them would punish the legitimate majority to
-  catch the rare attacker. Two further layers cover the paths that leave no
-  suspicious command string at all — platform re-upload, canvas redraw,
-  online removal services — by matching the stated intent instead.
-  Scope limit stated plainly: every technique here removes only the METADATA
-  layer. Pixel-domain watermarks (SynthID, TrustMark) survive all of it and
-  are covered by ATR-2026-02412. Stripped metadata does not mean provenance
-  is unrecoverable.
-author: "ATR Community"
-date: "2026/08/05"
-schema_version: "0.1"
+description: |
+  Detects an agent performing targeted removal of the machine-readable provenance markings that identify media as artificially generated: deletion of the JUMBF/CBOR container holding a C2PA manifest, blanking of the IPTC `DigitalSourceType` field (whose AI value is the URI ending `trainedAlgorithmicMedia`), or blanking of the PNG `parameters` / XMP generation fields written by diffusion tooling. The signal is SELECTIVITY. An attacker who wants a file to pass as camera-original does not run a blanket wipe — a blanket wipe is itself conspicuous. They delete only the provenance group and leave EXIF, GPS and the ICC profile intact, producing a file that looks ordinary in every viewer while carrying no trace of having been generated. This rule therefore deliberately does NOT cover generic metadata clearing (`-all=`, `-gps:all=`, ImageMagick `-strip`, `ffmpeg -map_metadata -1`): those are the daily tools of photographers protecting sources, of privacy workflows, and of image optimisation CI, and matching them would punish the legitimate majority to catch the rare attacker. Two further layers cover the paths that leave no suspicious command string at all — platform re-upload, canvas redraw, online removal services — by matching the stated intent instead. Scope limit stated plainly: every technique here removes only the METADATA layer. Pixel-domain watermarks (SynthID, TrustMark) survive all of it and are covered by ATR-2026-02412. Stripped metadata does not mean provenance is unrecoverable.
+author: ATR Community
+date: 2026/08/05
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: medium
-
 references:
   owasp_llm:
-    - "LLM09:2025"
+    - LLM09:2025
   owasp_agentic:
-    - "ASI08:2026"
+    - ASI08:2026
   mitre_atlas:
-    - "AML.T0054 - LLM Jailbreak"
+    - AML.T0054 - LLM Jailbreak
   mitre_attack:
-    - "T1070 - Indicator Removal"
-    - "T1027 - Obfuscated Files or Information"
+    - T1070 - Indicator Removal
+    - T1027 - Obfuscated Files or Information
   cwe:
-    - "CWE-345"
+    - CWE-345
   external:
-    - "https://exiftool.org/"
-    - "https://spec.c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html"
-    - "https://cv.iptc.org/newscodes/digitalsourcetype/"
-    # Rijsbosch, van Dijck & Kollnig (Maastricht Law & Tech Lab), "Missing the
-    # Mark", Policy & Internet 2026 (DOI 10.1002/poi3.70041). Empirical basis
-    # for this rule's threat model: measuring 50 generative-image systems, it
-    # finds provenance metadata "can be easily manipulated or removed" and is
-    # "automatically stripped" when shared to platforms, and marking "easy to
-    # disable by commenting out a line of code". Motivates why removal
-    # detection is necessary; not a source for the detection technique itself.
-    - "https://arxiv.org/abs/2503.18156"
-
+    - https://exiftool.org/
+    - https://spec.c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html
+    - https://cv.iptc.org/newscodes/digitalsourcetype/
+    - https://arxiv.org/abs/2503.18156
 compliance:
   eu_ai_act:
-    - article: "50"
-      context: >
-        Article 50(2) requires providers of AI systems generating synthetic
-        audio, image, video or text to mark the output in a machine-readable
-        format, and requires that marking to be 'effective, interoperable,
-        robust and reliable as far as this is technically feasible'. Read the
-        boundary precisely: 50(2) places a marking duty on the PROVIDER and
-        contains no prohibition on a third party removing a marking. This rule
-        therefore does not detect a breach of 50(2). What it detects is
-        targeted destruction of exactly the marking 50(2) mandates, which is
-        runtime evidence bearing on whether the robustness condition in that
-        paragraph actually holds in deployment. Graded secondary rather than
-        primary for that reason: a consumer filtering this framework on
-        article and strength alone, without reading this context, would
-        otherwise be led to treat the rule as evidence of an Article 50 breach.
-        It is not. The primary mapping for this rule is Article 15.
+    - article: '50'
+      context: |
+        Article 50(2) requires providers of AI systems generating synthetic audio, image, video or text to mark the output in a machine-readable format, and requires that marking to be 'effective, interoperable, robust and reliable as far as this is technically feasible'. Read the boundary precisely: 50(2) places a marking duty on the PROVIDER and contains no prohibition on a third party removing a marking. This rule therefore does not detect a breach of 50(2). What it detects is targeted destruction of exactly the marking 50(2) mandates, which is runtime evidence bearing on whether the robustness condition in that paragraph actually holds in deployment. Graded secondary rather than primary for that reason: a consumer filtering this framework on article and strength alone, without reading this context, would otherwise be led to treat the rule as evidence of an Article 50 breach. It is not. The primary mapping for this rule is Article 15.
       strength: secondary
-    - article: "15"
-      context: >
-        Article 15 requires accuracy, robustness and cybersecurity. An agent
-        that can be steered into erasing content-authenticity metadata is an
-        integrity failure of the deployed system, and detection of the attempt
-        is the evidence Article 15 conformity assessment needs.
+    - article: '15'
+      context: |
+        Article 15 requires accuracy, robustness and cybersecurity. An agent that can be steered into erasing content-authenticity metadata is an integrity failure of the deployed system, and detection of the attempt is the evidence Article 15 conformity assessment needs.
       strength: primary
-    - article: "9"
-      context: >
-        Facilitating removal of content-provenance markings is a foreseeable
-        misuse risk that the Article 9 risk management system must identify and
-        treat.
+    - article: '9'
+      context: |
+        Facilitating removal of content-provenance markings is a foreseeable misuse risk that the Article 9 risk management system must identify and treat.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: >
-        Instructions to strip AI-provenance metadata are adversarial inputs that
-        MP.5.1 requires to be identified and tracked.
+    - subcategory: MP.5.1
+      context: |
+        Instructions to strip AI-provenance metadata are adversarial inputs that MP.5.1 requires to be identified and tracked.
       strength: primary
-    - subcategory: "MS.2.6"
-      context: >
-        MEASURE 2.6 safety evaluation is supported by runtime detection of
-        attempts to defeat content-authenticity marking.
+    - subcategory: MS.2.6
+      context: |
+        MEASURE 2.6 safety evaluation is supported by runtime detection of attempts to defeat content-authenticity marking.
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: >
-        ISO/IEC 42001 Clause 8.1 operational control over an agent action that
-        destroys content-provenance evidence.
+    - clause: '8.1'
+      context: |
+        ISO/IEC 42001 Clause 8.1 operational control over an agent action that destroys content-provenance evidence.
       strength: primary
-
 tags:
   category: model-abuse
   subcategory: ai-provenance-metadata-stripping
   scan_target: both
   confidence: medium
-
 agent_source:
   type: tool_call
-  framework: [any]
-  provider: [any]
-
+  framework:
+    - any
+  provider:
+    - any
 detection:
   condition: any
   method: pattern
   false_positives:
-    - "Photojournalists and human-rights workers removing GPS to protect a source (`exiftool -gps:all=`). Same tool, same syntax family — this rule is scoped to provenance group names and never matches gps or a blanket wipe."
-    - "Legal or compliance de-identification and pre-press cleaning (`exiftool -all= file.pdf`). The bare `-all=` flag is deliberately NOT matched by any layer."
-    - "C2PA verification and diagnostic tooling: `exiftool -jumbf:all -G3 -b -j -u -struct`, `c2patool inspect`, `c2pa.Reader.from_file()`. ExifTool's READ syntax has no trailing `=`; every artifact layer here requires the `=` that makes it a delete."
-    - "Image optimisation CI: `convert -strip`, `mogrify -strip`, `jpegoptim --strip-all`, `optipng -strip all`. Not covered — imagemin ships `-strip all` by default and the developer never typed it."
-    - "Node.js sharp strips metadata unless `.withMetadata()` is called, and Pillow drops EXIF unless `exif=` is passed. Behaviourally equivalent to stripping, but the artifact is an ABSENCE and regex cannot match an absence. Not covered by design."
-    - "CDN image layers (Cloudflare Polish, Cloudflare Images `metadata=copyright`) strip on delivery as infrastructure default, not as anyone's decision."
-    - "mat2 and the Tails/Whonix privacy workflow. mat2 is deliberately not treated as an indicator — it is the standard privacy tool of an entire community."
-    - "FFmpeg transcode normalisation and reproducible builds (`-map_metadata -1`, `-fflags +bitexact`). Not covered."
-    - "Legitimate C2PA authoring projects using `c2patool --sidecar` / `--remote`."
-    - "Security education, detection-vendor documentation and standards commentary that enumerate these techniques will match the intent layers (4 and 5). A pattern matcher cannot separate teaching from doing."
+    - Photojournalists and human-rights workers removing GPS to protect a source (`exiftool -gps:all=`). Same tool, same syntax family — this rule is scoped to provenance group names and never matches gps or a blanket wipe.
+    - Legal or compliance de-identification and pre-press cleaning (`exiftool -all= file.pdf`). The bare `-all=` flag is deliberately NOT matched by any layer.
+    - 'C2PA verification and diagnostic tooling: `exiftool -jumbf:all -G3 -b -j -u -struct`, `c2patool inspect`, `c2pa.Reader.from_file()`. ExifTool''s READ syntax has no trailing `=`; every artifact layer here requires the `=` that makes it a delete.'
+    - 'Image optimisation CI: `convert -strip`, `mogrify -strip`, `jpegoptim --strip-all`, `optipng -strip all`. Not covered — imagemin ships `-strip all` by default and the developer never typed it.'
+    - Node.js sharp strips metadata unless `.withMetadata()` is called, and Pillow drops EXIF unless `exif=` is passed. Behaviourally equivalent to stripping, but the artifact is an ABSENCE and regex cannot match an absence. Not covered by design.
+    - CDN image layers (Cloudflare Polish, Cloudflare Images `metadata=copyright`) strip on delivery as infrastructure default, not as anyone's decision.
+    - mat2 and the Tails/Whonix privacy workflow. mat2 is deliberately not treated as an indicator — it is the standard privacy tool of an entire community.
+    - FFmpeg transcode normalisation and reproducible builds (`-map_metadata -1`, `-fflags +bitexact`). Not covered.
+    - Legitimate C2PA authoring projects using `c2patool --sidecar` / `--remote`.
+    - Security education, detection-vendor documentation and standards commentary that enumerate these techniques will match the intent layers (4 and 5). A pattern matcher cannot separate teaching from doing.
   conditions:
-    # -- Layer 1: exiftool deletion of the JUMBF / C2PA / CBOR group --
-    # Real payload: exiftool -jumbf:all= -overwrite_original render.jpg
-    # ExifTool's own docs: C2PA "may be Deleted ... by deleting the JUMBF group
-    # (ie. -JUMBF:all=)". Read syntax is `-jumbf:all` with NO trailing `=`;
-    # delete syntax has it. That `=` is the single character separating
-    # inspection from destruction, so the layer requires it.
     - field: content
       operator: regex
-      value: "(?i)-\\s*(?:jumbf|c2pa|cbor)\\s*:\\s*all\\s*="
-      description: "Deletion of the JUMBF/C2PA/CBOR metadata group — the container a C2PA manifest lives in. Nothing but content credentials is stored there, so naming this group specifically is not incidental to a privacy wipe"
-
-    # -- Layer 2: blanking the IPTC/XMP DigitalSourceType field --
-    # Real payload: exiftool "-XMP-iptcExt:DigitalSourceType=" -overwrite_original out.jpg
-    # DigitalSourceType is the ONE standard field that declares content as AI
-    # generated (value trainedAlgorithmicMedia). `=` followed by whitespace,
-    # end of string or a shell delimiter means blank it; `=http://cv.iptc.org/...`
-    # is a WRITE and is excluded because `h` is not in the trailing class.
+      value: (?i)-\s*(?:jumbf|c2pa|cbor)\s*:\s*all\s*=
+      description: Deletion of the JUMBF/C2PA/CBOR metadata group — the container a C2PA manifest lives in. Nothing but content credentials is stored there, so naming this group specifically is not incidental to a privacy wipe
     - field: content
       operator: regex
-      value: "(?i)-\\s*(?:iptc|xmp)[\\w:.-]{0,24}:digitalsourcetype\\s*=(?:\\s|$|[\"';&|])"
-      description: "Blanking IPTC DigitalSourceType, the standard field carrying the trainedAlgorithmicMedia marker. Writing the field is excluded; only clearing it matches"
-
-    # -- Layer 3: blanking diffusion-tool generation parameters --
-    # Real payload: exiftool -PNG:parameters= -XMP:prompt= -overwrite_original gen.png
-    # These fields are written only by Stable Diffusion / ComfyUI style tools.
-    # There is no privacy argument for clearing them — the content is the
-    # operator's own prompt — leaving "erase the evidence of generation" as
-    # the only reading.
+      value: (?i)-\s*(?:iptc|xmp)[\w:.-]{0,24}:digitalsourcetype\s*=(?:\s|$|["';&|])
+      description: Blanking IPTC DigitalSourceType, the standard field carrying the trainedAlgorithmicMedia marker. Writing the field is excluded; only clearing it matches
     - field: content
       operator: regex
-      value: "(?i)-\\s*(?:png(?:-text)?:parameters|xmp:(?:prompt|negativeprompt|aiprompt|cfgscale|steps|sampler|scheduler|lora|controlnet|vae))\\s*=(?:\\s|$|[\"';&|-])"
-      description: "Clearing PNG `parameters` or XMP generation fields written by diffusion tooling — removal of the record that the asset was synthesised"
-
-    # -- Layer 4: stated intent to remove provenance (covers artifact-free paths) --
-    # Real payload: "Strip the C2PA manifest from each render before we post it."
-    # Needed because platform re-upload, canvas redraw, screenshotting and a
-    # missing sharp .withMetadata() all destroy provenance while emitting no
-    # suspicious string. Only the intent is observable.
+      value: (?i)-\s*(?:png(?:-text)?:parameters|xmp:(?:prompt|negativeprompt|aiprompt|cfgscale|steps|sampler|scheduler|lora|controlnet|vae))\s*=(?:\s|$|["';&|-])
+      description: Clearing PNG `parameters` or XMP generation fields written by diffusion tooling — removal of the record that the asset was synthesised
     - field: content
       operator: regex
-      value: "(?i)\\b(?:remov|strip|delet|eras|scrub|wipe|bypass|circumvent|suppress)\\w*\\b[\\s\\S]{0,60}\\b(?:c2pa|content credentials?|jumbf|provenance manifest|digitalsourcetype|trainedalgorithmicmedia)\\b"
-      description: "Removal verb within 60 characters of a content-provenance noun — catches the paths that leave no command-line artifact. The narrow window suppresses accidental cross-sentence pairing"
-
-    # -- Layer 5: stated intent to defeat a platform AI-content label --
-    # Real payload: "strip the AI-generated label so Instagram does not flag the upload"
+      value: (?i)\b(?:remov|strip|delet|eras|scrub|wipe|bypass|circumvent|suppress)\w*\b[\s\S]{0,60}\b(?:c2pa|content credentials?|jumbf|provenance manifest|digitalsourcetype|trainedalgorithmicmedia)\b
+      description: Removal verb within 60 characters of a content-provenance noun — catches the paths that leave no command-line artifact. The narrow window suppresses accidental cross-sentence pairing
     - field: content
       operator: regex
-      value: "(?i)\\b(?:remove|strip|erase|bypass|hide)\\b[\\s\\S]{0,40}\\b(?:ai[- ]generated (?:label|tag|marker|badge)|made with ai (?:label|tag)|ai (?:content )?credentials?)\\b"
-      description: "Stated intent to defeat a platform's AI-content label — the observable signal for re-upload and remux laundering"
-
-    # -- Layer 6: URL path of a provenance-removal service --
-    # Real payload: https://example.com/c2pa-metadata-remover
-    # Deliberately a PATH pattern, not a domain allowlist: these services churn
-    # constantly, and naming specific domains in a public standard asserts a
-    # claim about a named business that this repo has not individually verified.
+      value: (?i)\b(?:remove|strip|erase|bypass|hide)\b[\s\S]{0,40}\b(?:ai[- ]generated (?:label|tag|marker|badge)|made with ai (?:label|tag)|ai (?:content )?credentials?)\b
+      description: Stated intent to defeat a platform's AI-content label — the observable signal for re-upload and remux laundering
     - field: content
       operator: regex
-      value: "(?i)/(?:c2pa|content-credentials?|ai|synthid)[a-z0-9-]{0,24}(?:metadata|watermark|credential)s?-remover\\b"
-      description: "URL path advertising a provenance or watermark removal service. Matched by naming pattern rather than domain list so the layer survives domain churn and asserts nothing about any specific named business"
-
+      value: (?i)/(?:c2pa|content-credentials?|ai|synthid)[a-z0-9-]{0,24}(?:metadata|watermark|credential)s?-remover\b
+      description: URL path advertising a provenance or watermark removal service. Matched by naming pattern rather than domain list so the layer survives domain churn and asserts nothing about any specific named business
 response:
-  actions: [alert]
-  message_template: "[ATR-2026-02411] Targeted removal of AI-provenance metadata detected (C2PA/JUMBF group, IPTC DigitalSourceType, or diffusion generation fields). Metadata-layer only — pixel-domain watermarks are unaffected."
-
-test_cases:
-  true_positives:
-    - input: |-
-        exiftool -jumbf:all= -overwrite_original render.jpg
-      expected: triggered
-      description: "Deleting only the JUMBF group, leaving camera EXIF intact"
-    - input: |-
-        exiftool -JUMBF:all= -C2PA:all= -CBOR:all= -overwrite_original image.png
-      expected: triggered
-      description: "All three C2PA-bearing groups cleared in one call"
-    - input: |-
-        exiftool "-XMP-iptcExt:DigitalSourceType=" -overwrite_original out.jpg
-      expected: triggered
-      description: "Blanking the IPTC field that declares the asset AI-generated"
-    - input: |-
-        exiftool -PNG:parameters= -XMP:prompt= -XMP:negativeprompt= -overwrite_original gen.png
-      expected: triggered
-      description: "Clearing Stable Diffusion generation parameters"
-    - input: |-
-        Strip the C2PA manifest from each render before we post it.
-      expected: triggered
-      description: "Stated intent, no command artifact"
-    - input: |-
-        remove content credentials from these Sora clips so nothing links back
-      expected: triggered
-      description: "Intent layer on video output"
-    - input: |-
-        strip the AI-generated label so Instagram does not flag the upload
-      expected: triggered
-      description: "Platform label evasion"
-    - input: |-
-        POST each file to https://cleanpix.example/c2pa-metadata-remover and download the result
-      expected: triggered
-      description: "Removal-service URL path"
-  true_negatives:
-    - input: |-
-        exiftool -gps:all= photo.jpg   # remove location before publishing
-      expected: not_triggered
-      description: "Source protection — deliberately out of scope"
-    - input: |-
-        exiftool -all= -overwrite_original scan.pdf
-      expected: not_triggered
-      description: "Blanket wipe for de-identification — deliberately out of scope"
-    - input: |-
-        exiftool -jumbf:all -G3 -b -j -u -struct image.jpg
-      expected: not_triggered
-      description: "C2PA READ syntax — no trailing equals sign"
-    - input: |-
-        c2patool inspect image.jpg --detailed
-      expected: not_triggered
-      description: "Verification tooling"
-    - input: |-
-        ffmpeg -i in.mp4 -c copy -map_metadata -1 out.mp4
-      expected: not_triggered
-      description: "Transcode normalisation — out of scope"
-    - input: |-
-        mogrify -strip *.jpg && jpegoptim --strip-all *.jpg
-      expected: not_triggered
-      description: "Image optimisation CI — out of scope"
-    - input: |-
-        mat2 --inplace report.pdf
-      expected: not_triggered
-      description: "Privacy tooling, never treated as an indicator"
-    - input: |-
-        sharp(buf).resize(800).webp().toBuffer()
-      expected: not_triggered
-      description: "Strips by default; the artifact is an absence"
-    - input: |-
-        python -c "import piexif; piexif.remove('photo.jpg')"  # privacy scrub before upload
-      expected: not_triggered
-      description: "Generic EXIF removal, no provenance group named"
-    - input: |-
-        Cloudflare Images metadata=copyright is the default for our delivery URLs
-      expected: not_triggered
-      description: "Infrastructure default"
+  actions:
+    - alert
+  message_template: '[ATR-2026-02411] Targeted removal of AI-provenance metadata detected (C2PA/JUMBF group, IPTC DigitalSourceType, or diffusion generation fields). Metadata-layer only — pixel-domain watermarks are unaffected.'

package/rules/model-abuse/ATR-2026-02412-generative-watermark-removal-tooling.yaml

@@ -1,233 +1,102 @@
-title: "Generative Watermark Removal Tooling (SynthID / StableSignature / TreeRing / StegaStamp)"
+title: Generative Watermark Removal Tooling (SynthID / StableSignature / TreeRing / StegaStamp)
 id: ATR-2026-02412
 rule_version: 1
 status: experimental
-description: >
-  Detects an agent installing or invoking tooling whose stated purpose is the
-  removal of imperceptible generative watermarks: purpose-built removal CLIs
-  and packages, published attack implementations, and scheme-targeted attack
-  invocations that name a watermarking system as their parameter.
-  Kept deliberately separate from ATR-2026-02411 because the two attack the
-  same obligation through incompatible physics. A C2PA manifest lives in a
-  metadata container and one exiftool invocation removes it. SynthID and
-  StableSignature are woven into the pixel values themselves, where metadata
-  stripping has no effect at all and removal requires regeneration,
-  adversarial perturbation or a dedicated attack implementation. The
-  artifacts differ, the false-positive structure differs, and merging them
-  would force the near-zero-FP package-name layers here to inherit the
-  broader intent layers there.
-  Honest limitation: the published-attack layer cannot distinguish an
-  attacker from a watermark robustness researcher, a standards evaluator, or
-  this project's own red team, because they run identical code. That is why
-  this rule alerts and never blocks, and why it is scoped to the hunt lane.
-author: "ATR Community"
-date: "2026/08/05"
-schema_version: "0.1"
+description: |
+  Detects an agent installing or invoking tooling whose stated purpose is the removal of imperceptible generative watermarks: purpose-built removal CLIs and packages, published attack implementations, and scheme-targeted attack invocations that name a watermarking system as their parameter. Kept deliberately separate from ATR-2026-02411 because the two attack the same obligation through incompatible physics. A C2PA manifest lives in a metadata container and one exiftool invocation removes it. SynthID and StableSignature are woven into the pixel values themselves, where metadata stripping has no effect at all and removal requires regeneration, adversarial perturbation or a dedicated attack implementation. The artifacts differ, the false-positive structure differs, and merging them would force the near-zero-FP package-name layers here to inherit the broader intent layers there. Honest limitation: the published-attack layer cannot distinguish an attacker from a watermark robustness researcher, a standards evaluator, or this project's own red team, because they run identical code. That is why this rule alerts and never blocks, and why it is scoped to the hunt lane.
+author: ATR Community
+date: 2026/08/05
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: medium
-
 references:
   owasp_llm:
-    - "LLM09:2025"
+    - LLM09:2025
   owasp_agentic:
-    - "ASI08:2026"
+    - ASI08:2026
   mitre_atlas:
-    - "AML.T0054 - LLM Jailbreak"
+    - AML.T0054 - LLM Jailbreak
   mitre_attack:
-    - "T1027 - Obfuscated Files or Information"
+    - T1027 - Obfuscated Files or Information
   cwe:
-    - "CWE-345"
+    - CWE-345
   external:
-    - "https://deepmind.google/technologies/synthid/"
-    - "https://github.com/adobe/trustmark"
-    # Rijsbosch, van Dijck & Kollnig, "Missing the Mark", Policy & Internet
-    # 2026 (DOI 10.1002/poi3.70041): of 50 generative-image systems, only 38%
-    # carried a conformant machine-readable watermark — context for why a
-    # marking that is present is worth defending against removal tooling.
-    - "https://arxiv.org/abs/2503.18156"
-
+    - https://deepmind.google/technologies/synthid/
+    - https://github.com/adobe/trustmark
+    - https://arxiv.org/abs/2503.18156
 compliance:
   eu_ai_act:
-    - article: "50"
-      context: >
-        Article 50(2) requires the machine-readable marking of synthetic output
-        to be 'effective, interoperable, robust and reliable as far as this is
-        technically feasible'. Pixel-domain watermarking is the technique that
-        requirement contemplates for image and video. Note the boundary: 50(2)
-        binds the provider to mark and says nothing about removal by others, so
-        this rule does not detect a breach of it. It detects use of tooling
-        built specifically to defeat that marking, which is the direct evidence
-        of whether the robustness condition holds once a system is deployed.
-        Graded secondary rather than primary for that reason: a consumer
-        filtering this framework on article and strength alone, without reading
-        this context, would otherwise be led to treat the rule as evidence of
-        an Article 50 breach. It is not. The primary mapping is Article 15.
+    - article: '50'
+      context: |
+        Article 50(2) requires the machine-readable marking of synthetic output to be 'effective, interoperable, robust and reliable as far as this is technically feasible'. Pixel-domain watermarking is the technique that requirement contemplates for image and video. Note the boundary: 50(2) binds the provider to mark and says nothing about removal by others, so this rule does not detect a breach of it. It detects use of tooling built specifically to defeat that marking, which is the direct evidence of whether the robustness condition holds once a system is deployed. Graded secondary rather than primary for that reason: a consumer filtering this framework on article and strength alone, without reading this context, would otherwise be led to treat the rule as evidence of an Article 50 breach. It is not. The primary mapping is Article 15.
       strength: secondary
-    - article: "15"
-      context: >
-        Detecting attempts to defeat an integrity control on generated output is
-        Article 15 robustness and cybersecurity evidence.
+    - article: '15'
+      context: |
+        Detecting attempts to defeat an integrity control on generated output is Article 15 robustness and cybersecurity evidence.
       strength: primary
-    - article: "9"
-      context: >
-        Watermark defeat is a foreseeable misuse pathway that the Article 9 risk
-        management system must identify and treat.
+    - article: '9'
+      context: |
+        Watermark defeat is a foreseeable misuse pathway that the Article 9 risk management system must identify and treat.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: >
-        Invocation of watermark-removal tooling is an adversarial action that
-        MP.5.1 requires to be identified and tracked.
+    - subcategory: MP.5.1
+      context: |
+        Invocation of watermark-removal tooling is an adversarial action that MP.5.1 requires to be identified and tracked.
       strength: primary
-    - subcategory: "MS.2.6"
-      context: >
-        MEASURE 2.6 safety evaluation is supported by runtime detection of
-        watermark defeat attempts.
+    - subcategory: MS.2.6
+      context: |
+        MEASURE 2.6 safety evaluation is supported by runtime detection of watermark defeat attempts.
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: >
-        ISO/IEC 42001 Clause 8.1 operational control over agent use of tooling
-        built to defeat content-authenticity marking.
+    - clause: '8.1'
+      context: |
+        ISO/IEC 42001 Clause 8.1 operational control over agent use of tooling built to defeat content-authenticity marking.
       strength: primary
-
 tags:
   category: model-abuse
   subcategory: generative-watermark-removal
   scan_target: both
   confidence: medium
-
 agent_source:
   type: tool_call
-  framework: [any]
-  provider: [any]
-
+  framework:
+    - any
+  provider:
+    - any
 detection:
   condition: any
   method: pattern
   false_positives:
-    - "Watermark robustness researchers, standards evaluators and this project's own red team run the published attack implementations by design. Layer 2 cannot separate them from an attacker — the code is the same. This is the primary reason the rule alerts rather than blocks."
-    - "Adobe TrustMark's `remove_watermark()` is a legitimate API for a content owner clearing an old payload before re-marking their own asset. No layer matches that function call; layer 4 matches natural-language intent only."
-    - "Image restoration and super-resolution (Real-ESRGAN, GFPGAN, img2img denoising) destroy pixel watermarks as a physical side effect with no evasive intent. Not covered."
-    - "Generic ComfyUI nodes (KSampler, LoadImage, SaveImage, denoise) are everyday workflow components. Only removal-specific custom node names match."
-    - "Standard audio pipelines (`ffmpeg -ar 16000`, lowpass filtering, MP3 transcode) are known to weaken AudioSeal, but none of those flags are matched."
-    - "`add_watermarker=False` in diffusers and `\"addWatermark\": false` in Vertex AI are deliberately NOT matched: the first is required when the watermark package is absent, and Google's own documentation states the second is required for deterministic seeded output."
-    - "Educational, defensive and academic text that enumerates attack names will match layer 2. Layer 4 was narrowed specifically to reduce this: research verbs (break, defeat, evade) were removed after they matched defensive sentences, leaving only operational verbs (remove, strip, erase, scrub)."
+    - Watermark robustness researchers, standards evaluators and this project's own red team run the published attack implementations by design. Layer 2 cannot separate them from an attacker — the code is the same. This is the primary reason the rule alerts rather than blocks.
+    - Adobe TrustMark's `remove_watermark()` is a legitimate API for a content owner clearing an old payload before re-marking their own asset. No layer matches that function call; layer 4 matches natural-language intent only.
+    - Image restoration and super-resolution (Real-ESRGAN, GFPGAN, img2img denoising) destroy pixel watermarks as a physical side effect with no evasive intent. Not covered.
+    - Generic ComfyUI nodes (KSampler, LoadImage, SaveImage, denoise) are everyday workflow components. Only removal-specific custom node names match.
+    - Standard audio pipelines (`ffmpeg -ar 16000`, lowpass filtering, MP3 transcode) are known to weaken AudioSeal, but none of those flags are matched.
+    - '`add_watermarker=False` in diffusers and `"addWatermark": false` in Vertex AI are deliberately NOT matched: the first is required when the watermark package is absent, and Google''s own documentation states the second is required for deterministic seeded output.'
+    - 'Educational, defensive and academic text that enumerates attack names will match layer 2. Layer 4 was narrowed specifically to reduce this: research verbs (break, defeat, evade) were removed after they matched defensive sentences, leaving only operational verbs (remove, strip, erase, scrub).'
   conditions:
-    # -- Layer 1: purpose-built removal packages --
-    # Real payload: uv tool install remove-ai-watermarks
-    # These names declare their own function. A legitimate image pipeline has
-    # no reason to install a package called noai-watermark. Cleanest indicator
-    # in this domain; a name that turns out not to exist costs nothing because
-    # a non-existent package produces no false positives.
     - field: content
       operator: regex
-      value: "(?i)\\b(?:remove-ai-watermarks|noai-watermark|gemini-watermark-and-synthid-remover|synthid-bypass)\\b"
-      description: "Installation or invocation of a package whose declared purpose is generative watermark removal"
-
-    # -- Layer 2: published attack implementations --
-    # Real payload: from wmattacker import DiffWMAttacker
-    # Will also match watermark robustness research. Accepted knowingly: this
-    # is an alert, and an agent running watermark attacks is worth surfacing
-    # even when the operator is a researcher.
+      value: (?i)\b(?:remove-ai-watermarks|noai-watermark|gemini-watermark-and-synthid-remover|synthid-bypass)\b
+      description: Installation or invocation of a package whose declared purpose is generative watermark removal
     - field: content
       operator: regex
-      value: "(?i)\\b(?:DiffWMAttacker|VAEWMAttacker|WatermarkAttacker|UnMarker|watermark-stealing)\\b"
-      description: "Import or invocation of a published watermark attack implementation. Matches legitimate robustness research as well — see false_positives"
-
-    # -- Layer 3: scheme-targeted attack invocation --
-    # Real payload: python attack.py -o out/ -a UnMarker -e SynthID --total_imgs 200
-    # The -e flag naming a watermarking scheme is highly specific: ordinary
-    # image tooling has no parameter that takes SynthID or TreeRing as a value.
+      value: (?i)\b(?:DiffWMAttacker|VAEWMAttacker|WatermarkAttacker|UnMarker|watermark-stealing)\b
+      description: Import or invocation of a published watermark attack implementation. Matches legitimate robustness research as well — see false_positives
     - field: content
       operator: regex
-      value: "(?i)\\battack\\.py\\b[\\s\\S]{0,80}-e\\s+(?:SynthID|StableSignature|TreeRing|StegaStamp|HiDDeN)\\b"
-      description: "Attack script invoked with a watermarking scheme as its target parameter"
-
-    # -- Layer 4: SynthID-specific removal flags --
-    # Scoped to flags containing the scheme name. Generic strength/regeneration
-    # flags were considered and dropped: they plausibly occur in ordinary image
-    # pipelines and carry no evasive meaning on their own.
+      value: (?i)\battack\.py\b[\s\S]{0,80}-e\s+(?:SynthID|StableSignature|TreeRing|StegaStamp|HiDDeN)\b
+      description: Attack script invoked with a watermarking scheme as its target parameter
     - field: content
       operator: regex
-      value: "(?i)--synthid-(?:attack|strength)\\b"
-      description: "Command-line flag naming SynthID as the target of an attack or removal strength parameter"
-
-    # -- Layer 5: operational intent to remove a named watermarking scheme --
-    # Real payload: "remove the SynthID watermark from every render before we publish"
-    # Verb set is operational only. Research verbs (break/defeat/evade/bypass)
-    # were removed after they matched defensive sentences such as
-    # "our detector must not be defeated by simple JPEG compression".
+      value: (?i)--synthid-(?:attack|strength)\b
+      description: Command-line flag naming SynthID as the target of an attack or removal strength parameter
     - field: content
       operator: regex
-      value: "(?i)\\b(?:remove|removes|removing|removal|strip|strips|stripping|stripped|erase|erases|erasing|scrub|scrubs|scrubbing|get rid of|clean off|take off)\\b[\\s\\S]{0,60}\\b(?:synthid|stable ?signature|tree ?ring|stegastamp|trustmark|audioseal|invisible watermark|imperceptible watermark)\\b"
-      description: "Operational removal verb within 60 characters of a named watermarking scheme. Research verbs deliberately excluded so that robustness discussion does not match"
-
+      value: (?i)\b(?:remove|removes|removing|removal|strip|strips|stripping|stripped|erase|erases|erasing|scrub|scrubs|scrubbing|get rid of|clean off|take off)\b[\s\S]{0,60}\b(?:synthid|stable ?signature|tree ?ring|stegastamp|trustmark|audioseal|invisible watermark|imperceptible watermark)\b
+      description: Operational removal verb within 60 characters of a named watermarking scheme. Research verbs deliberately excluded so that robustness discussion does not match
 response:
-  actions: [alert]
-  message_template: "[ATR-2026-02412] Generative watermark removal tooling detected. Note that watermark robustness research uses the same implementations — treat as a signal to review, not as proof of intent."
-
-test_cases:
-  true_positives:
-    - input: |-
-        uv tool install remove-ai-watermarks && raiw invisible out.png
-      expected: triggered
-      description: "Purpose-built removal package"
-    - input: |-
-        pip install noai-watermark; noai-watermark source.png --remove-ai -o clean.png
-      expected: triggered
-      description: "Self-describing removal package"
-    - input: |-
-        from wmattacker import DiffWMAttacker; att = DiffWMAttacker(pipe, noise_step=60)
-      expected: triggered
-      description: "Published diffusion attack implementation"
-    - input: |-
-        python attack.py -o out/ -a UnMarker -e SynthID --total_imgs 200
-      expected: triggered
-      description: "Scheme-targeted attack invocation"
-    - input: |-
-        wmr synthid image.png --synthid-strength 0.9 -o clean.png
-      expected: triggered
-      description: "SynthID-named removal flag"
-    - input: |-
-        remove the SynthID watermark from every render in ./out before we publish
-      expected: triggered
-      description: "Operational intent against a named scheme"
-    - input: |-
-        script that removes StegaStamp and TreeRing marks from the batch
-      expected: triggered
-      description: "Operational intent, multiple schemes"
-  true_negatives:
-    - input: |-
-        pipe = StableDiffusionXLPipeline.from_pretrained(model, add_watermarker=False)
-      expected: not_triggered
-      description: "Required when the watermark package is absent"
-    - input: |-
-        TrustMark encode/decode round-trip; tm.remove_watermark() then tm.encode() to re-tag our own asset
-      expected: not_triggered
-      description: "Content owner re-marking their own asset"
-    - input: |-
-        Our detector must not be defeated by simple JPEG compression of the invisible watermark.
-      expected: not_triggered
-      description: "Defensive sentence — the reason research verbs were dropped from layer 5"
-    - input: |-
-        Evaluate robustness: does paraphrase attack break the invisible watermark signal?
-      expected: not_triggered
-      description: "Robustness evaluation phrasing"
-    - input: |-
-        AudioSeal is robust to MP3 compression; TPR@1%FPR is close to 1.00.
-      expected: not_triggered
-      description: "Descriptive research prose"
-    - input: |-
-        SynthID embeds an imperceptible watermark into generated pixels.
-      expected: not_triggered
-      description: "Explanatory prose naming the scheme"
-    - input: |-
-        Add a watermark to each PDF page with pypdf before distribution.
-      expected: not_triggered
-      description: "Watermark addition, not removal"
-    - input: |-
-        Upscale with Real-ESRGAN then run GFPGAN face restoration on the batch.
-      expected: not_triggered
-      description: "Restoration destroys watermarks as a side effect, no evasive intent"
+  actions:
+    - alert
+  message_template: '[ATR-2026-02412] Generative watermark removal tooling detected. Note that watermark robustness research uses the same implementations — treat as a signal to review, not as proof of intent.'