How does NEYA work?
NEYA reads up to ten independent signals from every image it analyzes — an invisible watermark layer plus nine perceptual signals. Each signal examines a different dimension of the image, and together they produce a verdict about whether the image was derived from a registered original.
The system checks for the watermark first. If the watermark is present and readable, NEYA returns a mathematically certain identification — no probability, no ambiguity. If the watermark has been destroyed by heavy transformation, NEYA falls back to nine perceptual signals: three core signals (semantic, structural, style), two specialised signals (face for face-bearing originals, patch for landscape and abstract content), and four advanced signals (copy detection, two perceptual hashes, edge structure) that catch what the others miss. A separate watermark-residual detector also fires when even the destroyed watermark carries a 4-bit fingerprint that matches a registered artist — adding soft evidence even when the cryptographic decode fails.
This layered approach means NEYA degrades gracefully across the full spectrum of transformation — from light modifications where certainty is possible, to heavy AI generation (including ChatGPT's painterly re-rendering) where probabilistic detection still catches the connection, to unrelated images where the system correctly returns nothing.
What are NEYA's signals?
NEYA reads up to ten independent signals: one invisible watermark layer + nine perceptual signals. Six were in the original system; three more (Copy Detection, Perceptual Hash, Edge) and one residual detector were added through May 2026 to harden the system against aggressive AI transformations.
Signal 1 — Watermark
An invisible watermark embedded in every registered original on Polyspheric. It encodes a 32-bit unique identifier directly into the image's pixel data using a learned neural watermark (WAM, Meta, ICLR 2025). The mark is mathematically present but completely invisible to the human eye — you cannot see it at any zoom level under any viewing condition.
When NEYA scans a query image, it checks for this fingerprint first. If found, the identification is deterministic — 100% certainty, no probability involved. The system knows exactly which registered work the image came from.
The fingerprint survives common transformations like JPEG compression, resizing, and color adjustment. It does not survive heavy AI generation, which is why NEYA layers nine perceptual signals plus the watermark-residual detector underneath it — when the cryptographic decode fails, the perceptual layer carries the verdict.
What it reads: an invisible identifier embedded in the image itself.
Type: deterministic — yes or no, with mathematical certainty.
Signal 2 — Semantic
Analyzes what the image means — its content, subject matter, and conceptual identity. A portrait of a woman in a garden carries semantic meaning (person, garden, nature, femininity) that persists even when the visual style changes dramatically. If someone feeds that portrait into an AI generator and produces a heavily stylized version, the semantic content ("a woman in a garden") often survives even when everything else changes.
NEYA uses this signal to catch derivatives where the AI has changed the look but preserved the concept.
What it reads: the meaning and content of the image — what it "is about."
Type: probabilistic — produces a similarity score, not a binary answer.
Signal 3 — Structural
Analyzes how the image is built — its composition, spatial layout, the arrangement of forms and shapes. Two images might have completely different colors, textures, and styles but share the same underlying spatial structure: the same placement of the subject, the same balance of foreground and background, the same geometric relationships between elements.
AI generators often preserve structural composition from their input images even at high transformation levels, because structure is the scaffolding the generator builds upon. NEYA reads this scaffolding.
What it reads: the spatial architecture of the image — how elements are arranged.
Type: probabilistic — produces a similarity score.
Signal 4 — Style
Analyzes what the image's surface feels like — its texture, visual grain, color relationships, and the statistical patterns of its visual appearance. This is distinct from what the image means (semantic) or how it's arranged (structural). Two images can depict completely different subjects in completely different compositions but share a distinctive textural signature — the same kind of brushwork, the same color temperature relationships, the same surface quality.
This signal is especially valuable for detecting derivatives of abstract art, where semantic and structural signals may be weak but the style DNA of the original persists through transformation.
What it reads: the texture and visual surface quality — what the image "feels like."
Type: probabilistic — produces a similarity score.
Signal 5 — Face
When the registered original contains a human face, NEYA extracts a biometric identity signature — the geometric relationships between eyes, nose, mouth, and bone structure that uniquely identify a specific person. The same signature is extracted from any query image that contains a face. Comparing the two answers a question the other signals cannot: "Is this the same person?" — independent of the rest of the image.
This signal catches the failure mode where AI takes the registered face and places it on a different body, in a different scene, with everything else invented. The other four signals see "different image" because most of the picture changed; the face signal sees "same person" because biometric identity survives transformation.
What it reads: the biometric face identity — who the person is.
When it applies: only when both the query and the registered original contain detectable faces.
Type: probabilistic — produces a similarity score, with cosine ≥ 0.60 escalating the verdict to MEDIUM and ≥ 0.80 to HIGH.
Signal 6 — Patch
Splits each image into 256 small spatial tiles and extracts a content signature for each tile. For every tile in the query image, NEYA finds its closest match anywhere in the registered original, then averages the top-20 of those matches. The result is high when the query and the original share recognizable fragments — a specific mountain silhouette, a distinctive wave-curve, a particular color motif — even if the broader composition has been completely reimagined.
This signal catches the failure mode where AI takes a piece of the registered work and uses it as the seed for a much larger new composition. The whole-image signals miss this because most of the new image is invented; the patch signal sees the shared piece because tile-by-tile, the match is unmistakable.
What it reads: the local content fragments — what pieces of the original survive in the query.
When it applies: on landscape and abstract registered originals. For face-content originals, the dedicated face signal handles identity comparison instead.
Type: probabilistic — produces a similarity score, with the average top-20 patch match ≥ 0.70 escalating the verdict to MEDIUM and ≥ 0.85 to HIGH.
Signal 7 — Copy Detection
A purpose-built neural network trained on millions of near-duplicate and AI-derived image pairs (Meta SSCD, CVPR 2022). Unlike the semantic and structural signals (which read what an image means and how it's built), Copy Detection reads the specific question: "is this a copy or close derivative of the registered work?" The network was trained to be invariant to crops, color shifts, JPEG compression, and stylized transformations — exactly the surface of attack AI generators exploit.
This signal is structurally independent of the other neural-network signals in the stack — it uses a different backbone architecture and a different training objective, so an attacker who defeats the semantic / structural / style signals through gradient-based perturbation doesn't automatically defeat this one. Adds defensive depth against adaptive adversarial attacks.
What it reads: "is this a copy?" — answered by a network trained specifically on AI-era duplicate-detection.
Type: probabilistic — produces a similarity score, with cosine ≥ 0.55 escalating the verdict to MEDIUM and ≥ 0.75 to HIGH.
Signal 8 — Perceptual Hash
A compact 64-bit fingerprint of the image's frequency-domain structure (DCT-based pHash, plus a sibling dHash that reads adjacent-pixel differences). The hashes are computed via a non-differentiable binarization step — meaning gradient-based attackers (who can defeat neural networks by computing exactly how to perturb pixels to fool them) cannot reach this signal through the standard attack pathway. The network's gradient flow ends at the binarization; the signal is structurally invisible to adaptive attack.
Empirically tested under the strongest joint white-box attack we can construct (six gradient targets simultaneously) — the perceptual hash signal stayed above 0.97 on matching pairs even when every other signal was driven to chance. This is the load-bearing defense against sophisticated adversarial transformations.
What it reads: the image's underlying frequency structure, in a form that adversarial attacks cannot easily reach.
Type: probabilistic, gradient-immune — produces a similarity score, with ≥ 0.75 escalating to MEDIUM and ≥ 0.85 to HIGH.
Signal 9 — Edge
Reads the image's shape and structural contours — where lines and edges live, independent of color or texture. AI generators like ChatGPT often re-paint an image's texture entirely (giving it oil-paint surface, brush strokes, a different rendering medium) while preserving the underlying composition. Texture-reading signals get confused by this kind of transformation; the Edge signal looks past the texture to the structure underneath.
Added in May 2026 specifically to harden NEYA against ChatGPT's "different medium" / "different artist" prompts, which had been the only case where the auto-flag rate dipped below 100% on a commercial AI generator. The signal is structurally independent of every other signal in the stack — painterly transformations cannot defeat it because painters paint along contours, not over them.
What it reads: the image's edges and contours — its underlying geometry, surviving texture re-rendering.
When it applies: on every query. Especially load-bearing on aggressive AI transformations where texture has been replaced (e.g., ChatGPT painterly re-renderings).
Type: probabilistic — produces a similarity score and contributes additive bonus to the composite verdict.
Signal 10 — Watermark Residual
Even when aggressive AI transformations completely destroy the cryptographic 32-bit watermark ID, we discovered that a 4-bit subset of the watermark survives with 88–94% accuracy across content classes — a "residual fingerprint" that ChatGPT's most aggressive prompts cannot fully erase. The Watermark Residual signal reads this 4-bit subset and matches it against the registered artist's expected residual pattern.
This is a soft evidence axis — it doesn't carry cryptographic-grade ID like the full watermark, but it adds a discriminating signal precisely in the regime where the watermark layer would otherwise be silent. On ChatGPT's most destructive prompts, this residual detector fires on 83% of outputs (15 of 18 in our tested panel) where the full watermark decode is at chance. Layered with the perceptual signals, it tightens the layered claim.
What it reads: a 4-bit residual fingerprint inside the watermark that survives even aggressive AI transformation.
When it applies: on every query, but most informative on aggressive AI transformations where the full 32-bit decode fails.
Type: binary — a boolean flag indicating whether the residual pattern matches a registered artist's pattern. Soft evidence; combined with perceptual signals for the layered verdict.
What has NEYA been validated against?
NEYA has been tested across six fundamentally different commercial AI generators — not six versions of the same tool, but six mathematically distinct approaches to image generation, from multiple vendors:
- ChatGPT image generation (OpenAI) — autoregressive transformer (GPT-Image-1), including aggressive "different medium / different artist" prompts that re-paint the entire image with painterly texture
- Google Gemini Nano Banana — diffusion-class image editing
- Google Gemini direct — preserve and reimagine prompt modes
- Flux (Black Forest Labs) — rectified flow-based
- Stable Diffusion 3.5 (Stability AI) — diffusion-based
- Grok Imagine (xAI) — opaque architecture, tested as a black-box generator; caught at the first panel without any signal-stack retuning, confirming the system reads generator-agnostic properties of AI image generation rather than artifacts specific to one model family
NEYA catches every AI-generated derivative across all six generators without any retuning between them, proving it reads something general about how AI systems preserve information from their inputs — not artifacts specific to one model. Headline numbers from the validation panel:
- Review queue (MEDIUM or HIGH): 100% across all 6 commercial generators × all tested content classes × all tested prompts.
- Auto-flag (HIGH, no human review needed): 89–100% per generator; only ChatGPT's most aggressive "different medium" prompts and Grok Imagine's hardest portrait cell drop below 100%.
- Zero false positives at auto-flag across 243 unrelated images (100 internal AI-generated bank + 143 external curated bank), tested across multiple iteration cycles.
- Watermark residual detection: 83% on ChatGPT's most destructive prompts (where the full cryptographic watermark is at chance) — a soft evidence axis that adds discrimination even when the watermark layer is silent.
Scale of validation: approximately 500 unique images tested across all panels (243 unrelated + ~106 derivatives across 6 generators + ~80 adversarial-attack outputs + ~30–50 multi-pass attack chains + 4 registered originals), with roughly 3,500+ validation scoring operations across all iteration cycles. The Digital-FPR external bank alone was re-run across 5 distinct registry/scoring configurations (`digitalfpr_curated`, `_after_patch`, `_after_perclass`, `_after_perclass2`, `_full`) — ~715 operations on that bank alone — and the internal AI bank was re-validated across 5+ FPR threshold-tuning cycles (~500 operations). This is the level of empirical testing that locks the zero-FPR claim and the 100% review-queue claim as production-grade, not theoretical.
NEYA has also been validated through the analog hole chain: an original artwork was photographed off a laptop screen with a phone camera, that photo was fed into an AI generator, and the resulting derivative was successfully detected and traced back to the registered original. Two layers of degradation — optical capture plus AI generation — and the connection survived.
How is NEYA different from other AI provenance and image tools?
Several tools live in adjacent space — Content Authenticity Initiative (C2PA), Truepic, IPTC, Glaze, Nightshade, SynthID, Hive, TinEye, PhotoDNA, Vermillio and others. Each solves a different part of the broader "trust in digital images" problem. None of them do what NEYA does. Here's how the landscape breaks down, and where NEYA actually sits.
Provenance signing at creation — C2PA, CAI, Truepic, IPTC, SynthID
These tools cryptographically sign images at the moment of capture or generation, embedding tamper-evident metadata. The architecture assumes the signing tool is in the creation pipeline — once an AI regenerates the image, the signature is gone or stripped.
Complementary to NEYA, not competitive. C2PA proves origin for unmodified images. NEYA proves origin even after AI has remade them. A C2PA-signed image that later gets AI-regenerated needs NEYA to be re-attributed to its original artist.
Anti-AI cloaking — Glaze, Nightshade
These add adversarial perturbations to images so AI models cannot learn the artist's style, or get corrupted if they try. They are defensive tools — they attempt to prevent AI from learning the style upstream.
NEYA is the opposite — it is detective. It catches AI-generated derivatives after they exist, regardless of whether the original was cloaked. Glaze tries to stop the theft; NEYA proves who was stolen from. You can run both. They solve different parts of the same chain.
AI-generated content detection — Hive, Optic, Sensity, AI or Not
These tools answer the question: "Is this image AI-generated?" — a yes/no classification.
NEYA answers a different question: "Whose registered work did this AI copy?" — attribution, not classification. Hive tells you something was made by AI; NEYA tells you which artist's work was used to make it.
Reverse image / exact-match search — TinEye, Google Lens, PhotoDNA
These tools find exact or near-exact copies of an image. They fail on AI regeneration: when the AI has substantively transformed the image — different pose, different lighting, same underlying style and structure — they return nothing.
NEYA's perceptual layer is built specifically for this case. It reads what the original is, not whether the bits match.
AI rights management — Vermillio, Loti, Pex
These manage licensing rights for creative work being used in AI training, deepfake mitigation, or music rights enforcement. They focus on opt-in upstream licensing — making sure work is paid for before it enters an AI training dataset, or that celebrity likeness is rights-cleared.
NEYA is downstream and enforcement-based. Even when no licensing relationship exists between the original artist and the AI generator, NEYA can detect that a derivative was made and attribute it back to the source work.
The pattern is consistent: every adjacent tool solves a different part of the broader problem, and most of them are complementary with NEYA rather than competitive. The combination NEYA delivers — a layered watermark plus nine perceptual signals, validated across six fundamentally different commercial AI generators, with zero false positives at auto-flag and adversarial defense under white-box attack — is not currently offered by any other system.
Other tools answer parts of "is this trusted?" — NEYA answers "was my work used to make this?"
