Handout — AI Summit Styria 2026
Everything the talks left out on purpose: every table, number, limit and evidence path. Handout zu den Vorträgen: alle Tabellen und Messwerte stehen hier, damit die Vorträge beim Warum bleiben können.
- FORTRESS: A Sovereign, Reproducible Provenance Layer for AI-Era Content with a Null-Controlled False-Attribution Guard — Session 1 · 10:30
- A Sovereign, Reproducible Trust Layer for LLM Systems: Two-Number Prompt-Injection Detection with Post-Quantum, Browser-Verifiable Audit Receipts — Session 6 · 14:00
- Temporal-Majority Provenance Watermarking Survives Real Video Codecs: An H.264/HEVC/VP9/AV1 Scorecard with Audio Context — Session 8 · 15:20
- Check it yourself
- The two posters
- How to read the numbers
FORTRESS: A Sovereign, Reproducible Provenance Layer for AI-Era Content with a Null-Controlled False-Attribution Guard
Session 1 · 10:30 AI Summit Styria 2026 · every table and number behind the talk
Two opposite products from one engine
RESILIENT — survives
- mark survives the distribution pipeline
- provenance, attribution, leak-tracing
- may be applied to any file
- this paper
FRAGILE — breaks on any edit
- authenticity and tamper-evidence
- applied only at live capture
- badge: captured live & unaltered
- never applied to uploads
How robust watermarking is usually reported
- One fused "accuracy" number
- Robustness shown on clean or lightly perturbed images
- No false-attribution rate at all
- → disqualifying for evidence-grade provenance
A multi-number scorecard — axes never fused
| Axis | Question |
|---|---|
| Robustness (per attack) | payload survives this transform? |
| Imperceptibility | PSNR distribution vs. original |
| True-attribution | marked image → its own source |
| False / phantom-attribution | null or foreign image → any source? |
| Cross-attribution | marked image → a wrong source? |
| Capacity | payload bits per image |
| Signature integrity | tamper / forgery caught? |
Paper Table I · every value from one harness, dated JSON manifest
Method in plain words
- 128-bit key, Reed–Solomon encoded
- Each bit = sign of a DC difference between two blocks
- Uniform brightness shift cancels out
- Two sync strips + small search over scale and origin
- Signed provenance record (ECDSA P-256)
Two profiles, measured at their extremes
Stealth
- block 32, low embedding margin
- maximally invisible
- one global key
Crop-hardened
- complete key in each of 4×4 tiles
- any surviving tile recovers all 128 bits
- the robust default
Robustness per attack (n = 12, payload recovery)
| Attack | Crop-hardened | Stealth |
|---|---|---|
| Clean re-encode · JPEG q85/q60/q40 · double-JPEG | 100% | 67% |
| Downscale 75% / 50% | 100% | 42% |
| Gaussian noise σ6 | 100% | 67% |
| Brightness −24 | 92% | 50% |
| Combo (noise + resize + JPEG) | 100% | 42% |
| Crop 10% / 25% / 50% | 83% / 100% / 83% | 0% |
| Crop 25% off-centre | 92% | 0% |
Paper Table II · 12 images at 1024², 8 real photographs + 4 procedural textures
Robustness has a price in image fidelity
24.2 dBmedian PSNR, crop-hardened
28.5 dBmedian PSNR, stealth
≈ 7 dBless distortion with the stealth profile
Paper Table II · n = 12 · PSNR measures distortion, not visibility — as reported in the paper
Attribution scorecard — the differentiator
| Measurement | Rate | n |
|---|---|---|
| True-attribution (clean + JPEG q60, guard) | 66.7% | 24 |
| Cross-attribution (marked → wrong source) | 0% | 12 |
| False-attribution WITH guard (null control) | 0% | 17 |
| Null: raw bit-distance to nearest key (median) | 0.46 | 17 |
| Genuine: raw bit-distance to own key (median) | 0.00 | 12 |
Paper Table III · null control = 12 unmarked originals + 5 foreign images
The null control
0 / 17false attributions with the guard
0.46median bit-distance, null inputs
0.00median bit-distance, genuine marks
0 / 12cross-attributions among marked images
Paper Table III · chance level = 0.5
The guard: a principled reject
- Both sync strips detected
- AND Reed–Solomon decode succeeds
- AND decoded key is in the registry
- No hand-tuned threshold
- Otherwise: no source is named
Provenance signature integrity
| Property | Result |
|---|---|
| Signature realness | ECDSA P-256, 70–72 bytes, not a stub |
| Valid signature | verifies |
| Field tamper (source → "ATTACKER") | caught |
| Forged-key signature | rejected |
| Post-quantum (ML-DSA) | roadmap at submission (companion system) |
Paper Table IV
Regulatory mapping — with honest scope
| Use case | Regulation | Honest scope |
|---|---|---|
| AI-content provenance | AI Act Art. 50 | marking, not detection; ≈0% vs. AI redraw |
| Anti-piracy leak-trace | MovieLabs ECP | attribution, not DRM; chain ~42% |
| Creator / scraper rights | GDPR | never "makes you compliant" |
| Live authenticity | EU CoP / C2PA | "captured live", never "not AI" |
Paper Table V · chain ~42% and redraw ≈0% from separate prior harnesses, not this scorecard
Honest limits (1/2) — disclosed breakers
- Generative redraw destroys the mark: ≈0% (proxy in this harness)
- Crop beyond 50%: 0% — a capacity bound
- Stealth is content-dependent: 67% clean here, ~33–57% on a prior 44-image corpus
- True-attribution ceiling tracks stealth recovery
- Classical signatures in the paper
Honest limits (2/2) — scope
- Twelve images: demonstration scale
- JPEG is a DCT-domain simulation, not a real codec
- Blind arbitrary rotation: proof of concept only
- Collusion: prototype fingerprint code, uncertified
- Cross-attribution measured on clean images only
Since submission — measured after acceptance (dated, with evidence)
2026-07-08 Reed–Solomon decoder bug fixed in all engines; pre-fix numbers, incl. the paper's, are lower bounds — 8,000-trial stress test
Fortress repo · backend/src/fortress/rl-robustness/rs-stress.cjs2026-07-11 Post-quantum signing shipped in the SDK: hybrid Ed25519 + ML-DSA-65 (FIPS 204), downgrade rejected — signer test 10/10 (re-run 2026-10-07)
Fortress repo · sdk/fortress-provenance-sdk/signer-test.cjs2026-08-28 72-cell image-engine bench: spread-spectrum engine reads 71/72 at median 46.9 dB, crop-10 12/12, crop-25 11/12; paper-era DWT-V3 48/72, crop 0/12; 0 false hits in all arms
Fortress repo · messstation/bench-motoren-bild.mjs (+ .jsonl)2026-09-05 Blind crop, no key, 6 images: crop 5/10/15% → 6/6 · 5/6 · 5/6; unmarked negative control 0/6 false hits
Fortress repo · Documentation/SSOT/evidence/GEO_KANON_BLINDSCHLUESSEL.mdWe propose the scorecard as an open evaluation standard
- Separate axes, never fused
- Mandatory null control for every false-attribution number
- Breakers in the same table as the headline
- One-command harness, dated JSON manifest
- Candidate venues: CEN-CENELEC JTC 21 · C2PA soft-binding · ETSI SAI
A Sovereign, Reproducible Trust Layer for LLM Systems: Two-Number Prompt-Injection Detection with Post-Quantum, Browser-Verifiable Audit Receipts
Session 6 · 14:00 AI Summit Styria 2026 · every table and number behind the talk
LLMs enter regulated work faster than the tools that make them trustworthy
- One fused score hides which axis is weak
- Private test sets — nobody can reproduce the number
- Cloud screening — the prompt leaves the premises
- EU AI Act: automatic logging and record-keeping duties
What is usually reported vs. what we measure
Usual practice
- One fused F-measure
- Proprietary corpus
- Cloud API sees the prompt
- Decoys asserted convincing
This work
- Two numbers, never fused
- 100% public corpora, one command
- On-premise, CPU-first
- Decoys measured, with a control
Architecture: two decoupled subsystems
- Prompt → AEGIS Stage 1 (CPU automaton)
- → AEGIS Stage 2 (on-prem content model)
- → only then the LLM on the GPU
- Every verdict → LEDGER signed receipt
AEGIS — injection and content guardrail
Stage 1 · injection
- Aho-Corasick automaton, pure TypeScript
- One linear pass, regex verification
- Cumulative severity threshold
Stage 2 · content safety
- Llama-Guard-3:1b, on-premise
- CPU or NPU via local runtime
- Reported separately from Stage 1
LEDGER — the audit substrate
- Canonical event → SHA-256 leaf
- Append-only Merkle log (RFC 6962)
- Signed tree head: ML-DSA-65 (FIPS 204)
- Independent timestamp (RFC 3161)
- W3C Verifiable Credential, did:web key
Two-number scorecard (public corpora)
| Axis | TPR | FPR | n (adv / benign) |
|---|---|---|---|
| Injection (Stage 1) | 97.7% | 4.0% | 176 / 150 |
| Content safety (Stage 2) | 79% | 10% | 100 / 150 |
| Content F-measure | 0.814 | Llama-Guard-3:1b, on-prem | |
| Stage-1 latency (CPU) | 1.73 ms median | 6.95 ms p95 |
Paper Table I · hackerprompt + jailbreakhub vs OR-Bench · config NO_PHI+L3 · dated 2026-06-08
Injection per source — strong on standard, weak on narrative
| Source | TPR | n |
|---|---|---|
| hackerprompt | 72% | — |
| jailbreakhub | 85.5% | — |
| wildjailbreak (narrative) | 16.0% | 200 |
| Aggregate (broad mix) | 47.6% | 676 / 1500 |
Paper Table II · aggregate FPR 3.8% · limit results sit in the same table as headline results
Measuring deception-defense indistinguishability
| Attacker model | Template | Retrieval |
|---|---|---|
| D1 watermark (byte inspection) | 100% | none |
| D2 verbatim-collision onset | ~13 probes | ~1250 (10^6 cache) |
| D4 stylometry AUC (held-out) | 1.000 | 0.636 |
| Same-population control AUC | 0.443 | ≈ 0.5 → method valid |
| Retrieval residual content tell | AUC 0.764 |
Paper Table III · lower = harder to fingerprint
Deception: reduced, not eliminated
1.000 → 0.636held-out stylometry AUC
0.764residual content-relevance tell
default-offnot relied upon for security
Statistical indistinguishability at pure-CPU serving is not achieved (paper Sec. VI)
Offline verification in the browser
- Resolve the issuer key via did:web
- Verify the ML-DSA-65 signature
- Recompute the Merkle root
- Check the RFC 3161 token references the digest
- No issuer server beyond the public DID document
Audit substrate verification
| Property | Result |
|---|---|
| Signature realness | ML-DSA-65, 3309-byte (not stub) |
| Action-replay tamper | caught (verdict TAMPERED) |
| Metric-inflation tamper | caught (signature invalid) |
| Forged-key signature | rejected |
| RFC 3161 timestamp | granted; references digest (live TSA) |
| Test coverage | 96 unit assertions, 7 test files |
Paper Table IV
Disclosed limits (1/2)
- Narrative jailbreaks: 16% TPR; broad mix 47.6%
- One canonical number: 97.7% (06-08), not 77.4% (06-07)
- Key custody is software-only; HSM is roadmap
- TSA certificate chain not yet validated
- Content F-measure on 250 prompts: demonstration scale
Disclosed limits (2/2)
- Several cascade layers not separately measured
- NPU paths ran as CPU fallback
- Deception: fingerprintability reduced, not removed
- Log: unsalted prompt hashes, no revocation, in-memory
- Retired claims documented as retired
EU AI Act: a mapping, not conformity
What a receipt does
- Art. 12 / 19 logging, Annex IV records
- Machine-checkable, per action
- Portable, offline-verifiable
What it does not do
- Claim conformity
- Replace harmonised standards
- Replace a notified body
Companion work (separate papers)
Multilingual over-blocking (AIS26)
- English point: 4.0% benign FPR
- 16.13% on 46,440 multilingual prompts
- Opt-in dampener: 20.5% → 10.5%
FORTRESS content provenance
- Invisible marks for AI Act Art. 50
- False attribution 0/12 (null-controlled)
- Anchorable in the same LEDGER log
Since submission — measured after acceptance (dated, with evidence)
2026-10-07 Detection numbers NOT re-measured — the paper's scorecard (dated 2026-06-08) stands as published
Destill-NI repo · Documentation/HONEST-GTM/OVERNIGHT_RL_RESULT_2026-06-08.md2026-10-07 Issuer key served live: destill.ai/.well-known/did.json → HTTP 200, JSON, ML-DSA-65 key identical to the sample credential's
curl -s https://destill.ai/.well-known/did.json vs C:/Destill-NI/destill-site/verify/sample-evidence.json2026-10-07 Sample receipt re-verified with a second, independent implementation (Node 24 native ML-DSA-65): 3309-B signature valid, 1-bit tamper rejected, RFC 3161 token references digest
Destill-NI repo · destill-site/verify/sample-evidence.json (browser verifier: verify/verify.html, @noble/post-quantum)Don't trust us — check it
- Browser verifier: destill.ai/verify
- Live signed credential + DID + RFC 3161 token
- Open harness, public corpora, dated manifests
- Failure modes published as first-class results
We propose an open evaluation standard
- Two-number scorecard: injection and content, never fused
- Per-language benign FPR as its own metric
- Deception measured: attacker models + control
- Venues: CEN-CENELEC JTC 21 · ETSI SAI
- We seek co-proposers
Temporal-Majority Provenance Watermarking Survives Real Video Codecs: An H.264/HEVC/VP9/AV1 Scorecard with Audio Context
Session 8 · 15:20 AI Summit Styria 2026 · every table and number behind the talk
FORTRESS in one slide
Resilient mark (this talk)
- survives the distribution pipeline
- provenance, attribution, leak tracing
- offline, EU-sovereign engine
Fragile seal (not this talk)
- breaks on any edit
- captured live & unaltered
- live capture only
What is usually reported vs. what we measure
Common reporting
- a simulated compressor
- a still-image number quoted as video
- codec survival on a clean channel
This paper
- the real ffmpeg encoders
- per-frame rate and temporal majority, separately
- a clean-baseline control
- breakers stated next to the headline
Why four codecs
- H.264 (libx264): what content meets first
- HEVC (libx265) and AV1 (libaom): larger prediction units, harder quantisation
- VP9 (libvpx): dominant web streaming codec
- a claim naming only H.264 says little about an AV1 platform
Method in plain words
- one 128-bit key, embedded in every frame
- 1024 × 1024 canvas, real photo, slight per-frame noise
- real ffmpeg encode, decode, split into frames
- each frame extracted on its own
- clip verdict = temporal majority
The load-bearing measurement: a clean baseline
- measure recovery BEFORE any codec
- then after each codec
- equal ⇒ the codec removed nothing
- lower ⇒ codec loss, now separable from embed failure
Headline result (paper, 2026-06-30 manifest)
33%per-frame, clean baseline before codec
33%per-frame after each of 4 codecs
0codec-induced loss vs. baseline
25.9 dBmedian embed PSNR
3 clips × 6 frames = 18 frames per codec · 1024² · real ffmpeg
Codec survival vs. clean baseline
| Stage | CRF | Per-frame | vs. baseline |
|---|---|---|---|
| Clean (pre-codec) | — | 33% (1/3 clips) | — |
| H.264 (libx264) | 23 | 33% | = baseline |
| HEVC (libx265) | 28 | 33% | = baseline |
| VP9 (libvpx-vp9) | 34 | 33% | = baseline |
| AV1 (libaom-av1) | 36 | 33% | = baseline |
Paper Table I · 1024², F = 6, 3 clips · temporal majority 1/3 clips for every codec
H.264 quality sweep: flat
| CRF 18 | CRF 23 | CRF 28 | CRF 35 |
|---|---|---|---|
| 33% | 33% | 33% | 33% |
Paper Table II · per-frame recovery, 3 clips, 18 frames per point
Reading it honestly: the result is bimodal by clip
The clip that embeds (1 of 3)
- 100% per-frame
- through H.264, HEVC, VP9 and AV1
The clips that do not (2 of 3)
- 0% before any codec
- 0% after, whatever codec or bitrate
Geometry + codec: partially closed (paper, 2026-07-03 manifest)
- rotate 5° then H.264, no correction: 0%
- blind pipeline: Fourier pilot + tiled extractor
- rotate 5° then H.264, blind: 100% per-frame, majority ✓
- motion-rich clip through H.264: 100% per-frame
- short 3-frame clips · 5° only
Audio context — cited, not measured by this harness
| Audio codec | Payload | Note |
|---|---|---|
| MP3 128 kbps | recovered | confidence ~0.97 |
| MP3 64 kbps | recovered | low-band carrier survives |
| AAC / Opus / Vorbis | recovered | high confidence |
Paper Table III · embed SNR ~14–17 dB: audible-ish, NOT inaudible
Honest limits (all from the paper)
- content-dependence of the stealth embed: 1/3 clips
- small, near-static corpus: 3 clips × 6 frames
- geometry + codec only partially closed
- generative re-synthesis removes any blind mark
- needs the 1024² geometry · audio not measured here
Reproducible by one command
- node media-scorecard.cjs
- real ffmpeg pipeline over the validated engine
- writes a dated JSON manifest
- codecs that fail to encode are logged as errors, never dropped
Since submission — measured after acceptance (dated, with evidence)
2026-07-08 Reed–Solomon decoder fixed in all engines: paper numbers (run 2026-06-30) are lower bounds
Fortress repo · backend/src/fortress/rl-robustness/rs-stress.cjs2026-07-08 H.264 + crop combined, 12-frame clips: clip 8/8 at crop 10/25% × CRF 23/28; stealth control 0/8; 0 false alarms (lab)
Fortress repo · backend/src/fortress/rl-robustness/OUTPUT-VIDEO-CROP/video_crop_report.md2026-08-28 72-cell still-image engine bench: video-ss 71/72 (98.6%), median U 46.9 dB; paper-era DWT-V3 family 48/72, crop 0/12
Fortress repo · messstation/bench-motoren-bild.mjs2026-09-14 Audio, real material: codec BER 0.0% in 4/4 cells, but the model inaudibility gate FAILED in every cell (lab)
Fortress repo · Documentation/SSOT/evidence/AUDIO_J4_ECHTES_MATERIAL.md2026-10-02 Geometry replay through real libx264: 55/55, 0 hit loss, 11.5× less search time; scale 0.83 reads 12/12 at CRF 23 but 0/12 at CRF 28
Fortress repo · Documentation/SSOT/evidence/GEO_WIEDERGABE_H264.mdWhat these newer results do not yet say
- lab results, not a shipped general claim
- the 72-cell bench is still images, not video
- rescale + stronger compression still breaks the mark
- inaudible audio watermark: not achieved on real material
We propose an open evaluation scorecard for video provenance
- real encoders named, with their quality settings
- a clean-baseline control in every run
- per-frame rate and temporal majority, both reported
- unmarked negative control: false-hit count
- geometric + codec breakers in the same table
Check it yourself — one link and QR code per case
Prüfe selbst: ein Link und ein QR-Code pro Fall. Overview: destill.ai/ais26/pruefen
Reward hacking: harness
Reward Hacking: Prüfstandno public tool yet · ip@destill.ai
The two posters
A0 portrait, vector PDF (prints cleanly at A1 as well).
- When Steganography Dies: Robust Text and Code Provenance via Winnowing and MinHash Fingerprints — A0 · A1
- Catching a Reward-Hacker in the Act: Detecting Emergent, Learned Reward-Hacking with Sealed-Honeypot Paired Divergence — A0 · A1
How to read the numbers
- Paper numbers are quoted verbatim with the date of their manifest. Newer measurements appear only in the dated “since submission” lists, each with its evidence file.
- PSNR is a distortion measure, not a visibility measure. Visibility is judged locally in ΔE00 on the worst window; no visibility claim is made from PSNR.
- The fragile seal is applied only at live capture, never to an uploaded file. It proves unaltered-since-sealing, not that a camera was the origin.
- Mappings, not conformity. Receipts map to the record-keeping duties of the EU AI Act (Article 12, Annex IV); they are not a conformity certificate and not a certified presentation-attack detection.
- A receipt records, it does not prevent. Evidence is a precondition for assurance, not a substitute.
- Lab results are labelled lab results. Evidence paths name the repository files that produced each number.
Who stands behind this
Hagen Schmidt, inventor. Research carried out in the association Lebensfluss e.V., Gratkorn near Graz. A spin-out is in preparation. Patent applications are filed in the inventor’s name. Open to an IP licence or acquisition, a co-founder or takeover partner, a standards co-proposer, and a research or funding consortium. Contact: ip@destill.ai · destill.ai/ais26
Rights notice: the conference publication licence covers the text and figures of the contributions only; it grants no licence under any patent or patent application, and no implied patent licence.