First public release. Layer 1 (steganographic payload destruction) is production ready. Layer 2 (typographic injection) ships as research and is labelled as such.
What it does
Sanitizes images before they reach a multimodal model. Rather than detecting a payload, it destroys the channel the payload lives in, so it does not depend on recognising the encoding an attacker chose.
Layer 1: measured
99.84% of hidden payloads destroyed across 108,015 samples, mean output SSIM 0.925.
| technique | n | destroyed | SSIM |
|---|---|---|---|
| LSB | 60,005 | 99.88% | 0.939 |
| DCT | 24,005 | 99.57% | 0.904 |
| metadata | 24,005 | 100.0% | 0.909 |
Ground truth is verifiable rather than asserted. The real stego covers have a zeroed LSB plane, so a stego image's 1-bits are the payload, and destruction is measured as residual payload correlation below 0.10, which is independent of the base rate. For synthetic cases a known payload goes in and the check is whether it is still extractable afterward. Per-sample results ship in benchmarks/2026-07-06_layer1_108k/ so the headline number is recountable, and the reproduction command is in that README.
Sources: Kaggle Stego-Images dataset (real stego binaries) plus BOSSBase and ALASKA#2 covers.
Scope
Covered: LSB (spatial), DCT-coefficient (frequency), and EXIF-metadata steganography.
Not covered: adversarial pixel perturbations, audio, and video. These are out of scope rather than untested, and the README says so rather than implying broader coverage.
Costs
Output is not visually lossless. Mean SSIM is 0.925 and lower on textured cover sets, around 0.90 on the ALASKA and BOSSBase DCT path. Measure this on your own images before deploying.
Single-image latency is roughly 110 to 145ms at 512px, unloaded. The benchmark's aggregate p95 of 332ms is inflated by CPU contention during the run and should not be used as an SLA.
Roughly 1.0% of samples were unscored and excluded from the denominator rather than counted as successes.
Layer 2: research, not product
Typographic injection defense is included but not production ready. Against 450 attacks per arm on Qwen2-VL with a HarmBench judge across nine adaptive variants: undefended 0.484, blanket redaction 0.000, selective redaction at threshold 0.90 0.149, with 89% utility on held-out real documents.
It leaks about one attack in seven at the useful threshold, runs at roughly 4.9 seconds per image which is too slow to sit inline, and has unfixed weak spots on curved and severely rotated text. The 0.000 should be read as below roughly 0.8% at 95% confidence, not proven zero. Evidence in benchmarks/2026-07-20_layer2_v7/.
Install
pip install -e .
Security
Vulnerability reporting process in SECURITY.md. Sanitizer bypass is the highest severity class.