We can no longer trust what we see.
AI images can now pass for photographs, and anyone can copy, edit and repost anything. This is already causing real harm.
Fake news
Fabricated photos of wars, disasters and politicians spread faster than any correction.
Scams and fraud
Fake IDs, receipts, insurance claims and impersonations, made in seconds.
Stolen work
Photographers and artists see their work cropped, reposted and sold, with no way to prove it is theirs.
Real evidence, denied
Genuine photos are dismissed as “probably AI.” When anything could be fake, real evidence gets ignored.
Why today’s tools don’t solve it.
Vereye answers three questions from the image alone.
Who made it?
An invisible key in the pixels names the registered owner of a copy, or no one at all.
Is it exactly the original?
An exact match means every pixel matches the sealed original, checked with SHA-512.
What no longer matches?
Area by area, where the copy no longer matches what was registered: the seal, the fine detail and the colour. No original needed, no AI.
Written into the pixels.
A unique 64-bit key is written invisibly into the image. To the eye, it looks the same.
Copied and changed, everywhere.
Copies are cropped, screenshotted, compressed and edited as they travel. The key repeats across the whole image.
Read from the copy alone.
Vereye reads the key without the original, names the owner, and shows where the copy no longer matches.
Computed or measured. Never guessed.
Two numbers are computed: the chance of a false exact match and of naming a wrong owner. The rest are measured on public protocols; the methods and full results are in the paper.
An exact match means every pixel matches the sealed original, checked with SHA-512. For a different image to pass, someone would have to break SHA-512: even crafting a colliding pair takes about 2256 attempts, out of reach of any computer.
The chance that a read names the wrong owner, computed (not sampled) for a registry of 100 billion images, with the reader’s cap on candidates per read, under a stated assumption on its 24-bit check (paper, Section 4.5). If it ever happened, the report would also show that the copy is far from that owner’s photo.
197 of 200 edits found from the copy alone, on our tamper set of 40 photographs: pasted objects, small pastes, removals, recolouring and added text. No untouched copy was flagged.
No owner was named on any of 46,467 attacked copies of 800 unmarked photos. Measured; the wrong-owner bound above is computed.
Measured on public benchmark protocols and on our tamper set; methods and full results in the paper.
Public benchmarks. Scored the hard way.
Every number below is measured by us on public test protocols, with Meta’s and Adobe’s open watermarks re-run on the same photos. Google’s SynthID is closed, so its numbers are Google’s own.
Copies identified after an attack
29 attacks (compression, crops, rotations, blur, colour changes, overlays and more), each at a random strength.
Found under attack, and false alarms
| Method | Geometric attacks | Colour & compression | Exact message recovered | False alarms at each method’s own threshold |
|---|---|---|---|---|
| Vereye COCO | 98.3% | 99.0% | 98.74% | 0.0%0 of 7,000 |
| Vereye DIV2K, 2K | 98.9% | 99.1% | 99.05% | 0.0%0 of 3,467 |
| WAM (Meta) COCO | 94.8% reported 99.3% | 96.3% reported 100% | 70.3% | 2.3%162 of 7,000 |
| WAM (Meta) DIV2K | 87.8% reported 96.1% | 95.3% reported 100% | 71.3% | 0.9%33 of 3,500 |
| TrustMark (Adobe) COCO | 26.1% reported 36.3% | 91.5% reported 90.1% | 66.7% | 2.5%178 of 7,000 |
| TrustMark (Adobe) DIV2K | 26.3% | 91.9% | 67.0% | 2.7%93 of 3,500 |
Each method is scored by its own rule. False alarms are counted on the identically attacked unmarked copies, at each method’s published threshold.
More on how it was measured
Without any attack, all three find 100%. Per attack, WAM’s detector fires more often than Vereye names the owner on 18 of the 35 COCO attacks and 15 of the 35 DIV2K attacks, mostly by one or two points, at WAM’s own looser false-alarm rate; every attack is in the paper. Vereye’s DIV2K row is the 2K run (reader of 27 October 2026; later changes affect only small images; 3,436 of 3,469 attacked copies; 31 of the 3,500 planned copies were not run); its COCO row is a run with the reader of 31 October 2026 (6,912 of 7,000 attacked copies).
Edits found from the copy alone
How much the image changes
TrustMark changes the image least, but survives geometric attacks only about a quarter of the time. Vereye sits close to TrustMark’s invisibility with far more robustness: on Meta’s benchmark it names the owner of 99.05% of attacked copies, against 71.29% for WAM and 66.97% for TrustMark.
Full benchmark package on request (SHA-256 of its file list: fd5015c1e9b2ed7a88aa37df13e94d2b9bbd32937d4e35daa7b5f3d36ef0e0b5). Sources: S. Gowal et al., SynthID-Image, arXiv:2510.09263 (2025). T. Sander et al., Watermark Anything, arXiv:2411.07231 (2024). Full method, attack lists and per-attack results are in our paper.
One seal that answers all three.
Each existing approach answers part of the question. Vereye answers all three from the copy alone: who sealed it, whether it is an exact match, and where it no longer matches.
| What it does | Vereye | AI watermarks | C2PA metadata | AI detectors |
|---|---|---|---|---|
| Names the owner of a copy | Yes. Exact registered key | Partly. A short message, no bound on the wrong owner | Partly. Only while metadata survives | No. |
| Proves an exact match to the original | Yes. Every pixel, SHA-512 | No. | Partly. Only while metadata survives | No. |
| Shows where a copy no longer matches | Yes. Area by area, measured | Partly. Where the mark reads (WAM) | No. | No. |
| Wrong-owner rate has a computed bound | Yes. 5.7 × 10−13 bound | No. Measured false alarms | No. | No. Probabilistic |
| Survives screenshots and re-saving | Yes. | Yes. | No. Stripped by one screenshot | Yes. |
| Robustness to everyday attacks | Yes. On Meta’s benchmark, 99.05% exact owner against 71.29% (WAM) and 66.97% (TrustMark) | Yes. | No. | Yes. |
| Works on content that was never marked | No. | No. | No. | Yes. By estimating |
What it can’t do, said plainly.
Every result on this page is measured or computed. So are these limits.
No watermark survives everything
Not ours, not anyone’s. Someone set on destroying a seal can: extreme blur or downscaling, or regenerating the picture with AI. Vereye is built for the copies people really make: crops, screenshots, compression, filters and edits.
A seal can be copied. The registry cannot.
A sophisticated attacker might lift a seal onto another picture. They cannot add a record in someone else’s name or change one: records are signed and kept in an append-only log. And the report shows how far that copy is from the registered photo: its fine detail, colour and brightness, measured against the record.
Not finding is not proof
When Vereye cannot read a seal, it says exactly that. It does not mean the image was never sealed: too little of the seal may be left to read.
Sealed content only
Vereye proves things about images that were sealed. It does not judge unsealed images, and it does not guess whether something was made by AI.
An early proof of concept: results vary with the content of each image, and a few copies at the limits do not read. The paper lists every limit we measured.
The full method, in writing.
Blind owner identification and tamper localization, with an analytic false-owner bound.
Image watermarks are usually judged as detectors: is some mark present? Provenance needs more from a copy alone: who owns the image, where it no longer matches its registration, and a computed bound on ever naming a wrong owner. The paper describes how Vereye answers all three without machine learning, and reports the full benchmarks.
Writing about Vereye?
The story, facts, images and logos, ready to publish.
Let’s talk.
Investors, AI and device partners, researchers and press: write to adam@vereye.ai, or use the form.
See it on a real copy.
Pick one of our sealed photos, or edit one in any app and drop it in. Vereye reads it from the copy alone.