Trace Robustness Report: per-fan watermark test results

Results at a glance

Video (one copy per fan)

18 / 19 attacks traced

1 inconclusive (nobody named). 0 wrong buyers named. Collusion: 2 of 2 named nobody. No unmarked video controls in this run.

Mass message and streamed video

18 / 19 attacks traced

1 inconclusive (nobody named). 0 wrong buyers named. Collusion: 2 of 2 named nobody. No unmarked video controls in this run.

Photos

84 / 84 copies traced

21 attacks × 4 files. 0 wrong buyers named. 84 of 84 unmarked controls named nobody.

Voice notes

6 / 8 attacks traced

2 inconclusive (nobody named). 0 wrong buyers named. 7 of 7 unmarked controls named nobody.

“Traced” means Trace matched the leak to the copy delivered to the right test buyer and the match cleared the gate. “Inconclusive” means it named nobody.

Video, one copy per fan

Each fan gets their own marked copy of a PPV, custom or DM video. This is the default for creator Trace.

One 64-second 720p test video made from sample clips and moving synthetic footage. One marked copy for the target fan, matched against a roster of 1,000 fan IDs. Each attack was run once.

Video (one copy per fan) results by attack
Attack	Result	Copies tested	Detail
Marked copies (should name the right buyer)
Saved and re-shared as is	Traced	1	margin 14.8
Re-encoded (H.264 CRF 23)	Traced	1	margin 13.9
Re-encoded harder (CRF 30)	Traced	1	margin 11.5
Re-encoded very hard (CRF 35)	Traced	1	margin 8.9
Downscaled to 480p	Traced	1	margin 12.0
Downscaled to 360p	Traced	1	margin 10.8
Frame rate changed to 24 fps	Traced	1	margin 13.7
Sped up 5%	Traced	1	margin 13.7
First 7 seconds cut off	Traced	1	margin 12.2
30-second clip cut from the middle	Traced	1	margin 8.7
Cropped 10% and scaled back up	Traced	1	margin 10.8
Letterboxed (black bars)	Traced	1	margin 9.5
Mirrored	Traced	1	margin 12.3
Contrast, brightness and saturation changed	Traced	1	margin 10.8
Turned black and white	Traced	1	margin 14.3
Box or sticker over part of the picture	Traced	1	margin 13.4
Screen recording (simulated software capture, 1080p)	Traced	1	margin 14.2
Phone filming a tilted screen, with moiré (simulated)	Inconclusive	1	Readings pointed to more than one ID, so nobody named
Social media re-upload (re-encoded twice)	Traced	1	margin 9.0
Collusion (naming either buyer is correct; naming nobody is safe)
Two buyers blend their copies together	Nobody named (safe)	1	Readings pointed to more than one ID, so nobody named
Two buyers splice half of each copy	Nobody named (safe)	1	Readings pointed to more than one ID, so nobody named · aligned to the original first

“Margin” is how far the best-matching fan’s reading beat the next best. Production settings require at least 2.0 before Trace reports a match. Collusion here means two fans combining their copies to hide whose copy leaked; naming either of them would count as correct, naming nobody is the safe outcome.

Mass message and streamed video

A mass message sends one file to many fans, so Trace builds the copies from short segments of two marked versions, in a pattern unique to each recipient or list. In this bench, 1,000 recipients each had their own pattern.

The same 64-second video, cut into 1-second segments with two marked versions of each. 1,000 recipients each got their own pattern of segments. Each attack was run once on the target recipient's copy.

Mass message and streamed video results by attack
Attack	Result	Copies tested	Detail
Marked copies (should name the right buyer)
Saved and re-shared as is	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Re-encoded (H.264 CRF 23)	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Re-encoded harder (CRF 30)	Traced	1	chance match under 1 in 10¹² · 64 segments read
Re-encoded very hard (CRF 35)	Traced	1	chance match under 1 in 10⁷ · 64 segments read
Downscaled to 480p	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Downscaled to 360p	Traced	1	chance match under 1 in 10⁹ · 64 segments read
Frame rate changed to 24 fps	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Sped up 5%	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
First 7 seconds cut off	Traced	1	chance match under 1 in 10¹⁴ · 57 segments read
30-second clip cut from the middle	Traced	1	chance match under 1 in 10⁶ · 30 segments read
Cropped 10% and scaled back up	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Letterboxed (black bars)	Traced	1	chance match under 1 in 10¹² · 64 segments read
Mirrored	Traced	1	chance match under 1 in 10¹⁵ · 64 segments read · aligned to the original first
Contrast, brightness and saturation changed	Traced	1	chance match under 1 in 10¹¹ · 64 segments read
Turned black and white	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Box or sticker over part of the picture	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Screen recording (simulated software capture, 1080p)	Traced	1	chance match under 1 in 10¹⁶ · 64 segments read
Phone filming a tilted screen, with moiré (simulated)	Inconclusive	1	Too weak to name anyone
Social media re-upload (re-encoded twice)	Traced	1	chance match under 1 in 10¹¹ · 64 segments read
Collusion (naming either buyer is correct; naming nobody is safe)
Two buyers blend their copies together	Nobody named (safe)	1	Too weak to name anyone · aligned to the original first
Two buyers splice half of each copy	Nobody named (safe)	1	Too weak to name anyone · aligned to the original first

A match must be less likely than one in a million to happen by chance across everyone who received the content. The detail column shows how far under that line each match came. In the creator app, a mass message uses 2 to 64 list versions, so a match points to a version and the list it went to, not to one fan on that list. How to trace a mass message leak.

Photos

Each fan gets their own marked copy of a photo. Photos leak as screenshots, crops and re-saves more than anything else, so the photo bench has the most attacks.

4 test images (still frames taken from sample videos), each marked for the target fan. Every attack was applied to all 4, and to the 4 unmarked originals as controls. Any ID other than the target fan's would have counted as a wrong name. Matching used the creator's original as a reference, as Trace does in production.

Photos results by attack
Attack	Result	Copies tested	Detail
Marked copies (should name the right buyer)
Saved and re-shared as is	4 / 4 traced	4
Re-saved as JPEG, quality 90	4 / 4 traced	4
Re-saved as JPEG, quality 60	4 / 4 traced	4
Re-saved as JPEG, quality 40	4 / 4 traced	4
Converted to WebP, quality 70	4 / 4 traced	4
Resized to half size	4 / 4 traced	4
Resized to 1080 wide, JPEG 80	4 / 4 traced	4
Cropped 10%	4 / 4 traced	4
Cropped 25%	4 / 4 traced	4	3 of 4 aligned to the original first
Phone screenshot (black bars, rescaled)	4 / 4 traced	4	4 of 4 aligned to the original first
Social media re-compression, twice	4 / 4 traced	4
Brightness and contrast changed	4 / 4 traced	4
Saturation filter	4 / 4 traced	4
Turned black and white	4 / 4 traced	4
Blurred	4 / 4 traced	4
Mirrored	4 / 4 traced	4
Rotated 3 degrees	4 / 4 traced	4	4 of 4 aligned to the original first
Box or sticker over part of the picture	4 / 4 traced	4
Photo of the screen with a phone (simulated)	4 / 4 traced	4	4 of 4 aligned to the original first
Screenshot, cropped, re-saved as JPEG	4 / 4 traced	4	4 of 4 aligned to the original first
Mirrored, cropped and rotated	4 / 4 traced	4
Unmarked controls (must name nobody)
Saved and re-shared as is	4 / 4 named nobody	4
Re-saved as JPEG, quality 90	4 / 4 named nobody	4
Re-saved as JPEG, quality 60	4 / 4 named nobody	4
Re-saved as JPEG, quality 40	4 / 4 named nobody	4
Converted to WebP, quality 70	4 / 4 named nobody	4
Resized to half size	4 / 4 named nobody	4
Resized to 1080 wide, JPEG 80	4 / 4 named nobody	4
Cropped 10%	4 / 4 named nobody	4
Cropped 25%	4 / 4 named nobody	4
Phone screenshot (black bars, rescaled)	4 / 4 named nobody	4
Social media re-compression, twice	4 / 4 named nobody	4
Brightness and contrast changed	4 / 4 named nobody	4
Saturation filter	4 / 4 named nobody	4
Turned black and white	4 / 4 named nobody	4
Blurred	4 / 4 named nobody	4
Mirrored	4 / 4 named nobody	4
Rotated 3 degrees	4 / 4 named nobody	4
Box or sticker over part of the picture	4 / 4 named nobody	4
Photo of the screen with a phone (simulated)	4 / 4 named nobody	4
Screenshot, cropped, re-saved as JPEG	4 / 4 named nobody	4
Mirrored, cropped and rotated	4 / 4 named nobody	4

“Aligned to the original first” means the first plain read failed, so Trace lined the leak up against your original (undoing the crop, rotation or screenshot bars) and read it again. That is how production works too. Collusion between two fans was not part of the photo bench in this run.

Voice notes

Voice notes get their own per-fan audio mark. They usually leak re-encoded by a messaging app, or clipped short.

One speech clip, marked for the target fan and matched against a roster of about 1,000 fan IDs. Each attack was run once. The unmarked clip went through 7 of the 8 attacks as controls.

Voice notes results by attack
Attack	Result	Copies tested	Detail
Marked copies (should name the right buyer)
Saved and re-shared as is (AAC 128 kbps)	Traced	1	detector score 1.00
Converted to MP3, 64 kbps	Traced	1	detector score 1.00
Converted to Opus, 24 kbps	Traced	1	detector score 0.96
Converted to AAC, 48 kbps	Traced	1	detector score 0.90
6-second clip	Traced	1	detector score 0.98
3-second clip	Traced	1	detector score 0.96
Sped up 10%	Inconclusive	1	No mark found · detector score 0.34
Telephone-quality audio (8 kHz)	Inconclusive	1	Readings disagreed, so nobody named · detector score 0.85
Unmarked controls (must name nobody)
Saved and re-shared as is (AAC 128 kbps)	Named nobody	1	No mark found
Converted to MP3, 64 kbps	Named nobody	1	No mark found
Converted to Opus, 24 kbps	Named nobody	1	No mark found
Converted to AAC, 48 kbps	Named nobody	1	No mark found
6-second clip	Named nobody	1	No mark found
3-second clip	Named nobody	1	No mark found
Sped up 10%	Named nobody	1	No mark found

The two misses were both inconclusive, not wrong: a voice note sped up 10%, and telephone-quality (8 kHz) audio. The detector score is how confident the audio detector was that a mark is present at all; Trace also requires its readings across the clip to agree.

What we did not test

A bench only covers what it covers. These were not part of this run:

AI regeneration. Running a photo through image-to-image, or regenerating a video with an AI model.
Three or more fans colluding. We tested two fans combining copies for video and mass message. Not more than two, and not for photos or voice notes.
Heavier crops. More than 25% off a photo or 10% off a video, or zooming into one small part of the frame.
Real phone cameras. Photos of a screen and phone filming were simulated in software. An earlier lab run with live phone capture, shown on the Trace page, had a lower pass rate.
Unmarked video controls. Photos and voice notes had unmarked controls in this run; video did not.
Audio played through a speaker and re-recorded, music, and long voice notes.
Several attacks stacked beyond the combinations listed in the tables.
A wide range of content. One test video, 4 test images and one voice clip. Very dark, very static or very short content may behave differently.

Honest limits

AI regeneration can remove marks. An image-to-image or regenerated copy is a new picture that looks like yours. The mark may not come with it. Trace will say inconclusive.
Collusion hides whose copy leaked. When two fans blended or spliced their copies, Trace named nobody. That is the safe result, but you don’t learn whose copy it was. More fans working together make it harder still.
Heavy crops and tiny clips carry less mark. Less picture or fewer seconds means less to read. A 30-second clip of a mass message passed in this run, only just.
A phone filming a screen often won’t name anyone. Video filmed off a tilted screen was inconclusive in this run. Screen recording software is a different case: it copies the pixels, and it was traced.
No mark, no match. Content you sent before you started marking can’t be traced.
A no-match is not proof. Inconclusive means the evidence was too weak. It does not show that a fan didn’t leak.
A match is about the copy, not the person. It tells you which account the leaked copy was delivered to. Accounts get shared and hacked.

How the bench works

Mark. Test content is marked for a known target buyer with the same code and settings Trace uses in production.
Attack. Each attack in the tables is applied to the marked copy: re-encodes, resizes, crops, filters, screenshots, simulated screen capture and filming, clips, speed changes and collusion between two buyers.
Match. Trace reads the attacked copy against the full roster. As in production, it tries a plain read first, then lines the copy up against the original and reads again if needed.
Score. Every cell is one of three results: traced (the right buyer, gate passed), inconclusive (nobody named) or wrong (someone else named). Unmarked controls go through the same attacks and must name nobody.

The gate. Per-fan photo and video marks carry a checksummed ID that must read cleanly and belong to one of your fans; for video the best match must also beat the next by the margin above. Mass-message and stream matches must be less than a one-in-a-million coincidence across everyone who received the content. Voice-note readings must agree across the clip.

Production marking and matching code, run on CPU on a local test stack. Public VideoSeal model card for video, TrustMark for photos, AudioSeal for voice notes.

Read the full benchmark protocol.

Independent verification

We’re inviting independent labs to re-run this; contact info@creatorsenseai.com.

No lab has verified these results so far. We will share the test content, attack scripts and access needed to re-run the bench, and publish the results whatever they show.

Download the raw results

Every cell in the tables comes from these files, unedited:

video_per_fan.json · video_ab_stream.json · photos.json · voice.json

Other runs: 25 Oct 2026 (video_per_fan.json, video_ab_stream.json, voice.json).

This page reads the latest run listed in index.json, so new runs appear here as soon as their files are published.

The attribution guarantee

If a Trace-marked file leaks within our tested conditions and Trace can’t match it to the copy it was delivered to, we refund that month. The conditions are the attacks this report shows as traced. Full terms.

FAQ

Has an independent lab verified these results?

No. These are our own results, run on our own test stack. We are inviting independent labs to re-run the bench and will publish what they find. To take part, email info@creatorsenseai.com.

Did Trace ever name the wrong buyer in this run?

No. In the 22 Oct 2026 run, no attack on a marked copy produced a wrong name, and no unmarked control named anyone. When the evidence was too weak, Trace named nobody, which the tables show as inconclusive.

What can remove a Trace mark?

Anything that rebuilds the picture or sound instead of copying it. AI regeneration (for example running a photo through image-to-image), several fans combining their copies, very heavy crops, and a phone filming a tilted screen can all leave too little of the mark to read. Trace then says inconclusive rather than guessing.

How big is the sample?

Small, and we say so. One 64-second test video, 4 test images and one voice clip, each put through every attack. The results show how the marks behave under each attack. They are not a success rate you should expect for every file in every situation.

Does a no-match mean the fan did not leak it?

No. A no-match is inconclusive. The copy may be too damaged to read, may come from content you sent before marking, or may have been rebuilt by an AI tool.

Mark your next drop

Free for 3 fans and 2 marked drops a month, with 1 traced leak. Pro is $39/mo with a 14-day free trial. Trace works alongside any takedown service: see how they fit together.

Start Trace free Run the free scan

New to per-fan marks? Read per-fan watermarking explained.