Experiment: adversarial jamming (FFT-band noise / phase subtraction) as a quality-preserving SynthID-disruption vector

[atomantic]

Summary

Scientific-curiosity experiment (not a product commitment): explore whether adversarial jamming — injecting structured noise targeted at the frequency bands SynthID rides in — can push a SynthID detector's correlation below its threshold with less image degradation than a diffusion round-trip. The motivating idea: light, frequency-targeted perturbation + minimal/no diffusion might preserve quality (especially text) better than a heavier diffusion pass.

This is a follow-up to #1763 (Image Cleaner composable pipeline), which ships the diffusion + ignore-zone path. Jamming is deliberately kept out of that issue.

Background

From docs/plans/2026-06-05-synthid-removal-eval.md:

• SynthID's invisible carriers live at resolution-dependent FFT bins; the most sophisticated tool we evaluated (aloshdenny/reverse-SynthID) includes an FFT phase-subtraction stage on top of the spatial vectors. We shipped the cheap spatial pieces (resize-squeeze, color nudge) but not the FFT phase work.
• Hard constraint on this whole space: Google's SynthID Detector is limited-access with no public API, so we have no oracle to confirm a jam actually worked. Any result here is measured by proxy (pixel-delta/PSNR fidelity + whatever open detectors/heuristics exist), not by ground-truth detector clearance. Frame all findings accordingly.

Idea space to explore

• FFT-band noise injection — add low-amplitude structured noise in the frequency bands SynthID is believed to occupy; sweep amplitude vs. fidelity (PSNR) and visual quality.
• FFT phase subtraction — the reverse-SynthID stage we skipped; estimate and subtract the watermark phase signature.
• Jamming + minimal diffusion — test whether a light jam followed by (or preceding) a very-low-strength VAE round-trip beats a single heavier diffusion pass on the quality/disruption frontier.
• Text preservation — whether frequency-domain jamming degrades glyphs less than spatial resize-squeeze (the comic-dialog problem from Image Cleaner: composable opt-in pipeline (metadata/C2PA, median+sharpen, local diffusion SynthID pass) + remove 40MB cap + resolution-aware diffusion #1763).

Explicitly NOT in scope

• "Add our own / a second watermark to overwhelm SynthID" — rejected: you can't embed a real Google SynthID (proprietary model/keys), and watermarks are designed to coexist, so a competing mark won't cancel it. An intentional PortOS provenance watermark is a separate feature idea, not a defeat mechanism.

Deliverable

A research note in docs/plans/ (or docs/decisions/) recording the experiments, the fidelity/quality measurements, and a recommendation on whether any jamming stage is worth promoting into the real pipeline. Code, if any, stays behind a flag / experimental until there's evidence it helps. No detector-verified claims unless we gain detector access.

Honesty guardrail

Because we cannot verify against Google's detector, this issue must not produce UI copy or changelog claims that imply guaranteed SynthID removal. Keep language at "disrupt / best-effort / experimental."