BlueMask recovery tests and limitations
Can a published image-restoration model recover a hidden synthetic code?
BlueMask tested twelve synthetic eight-digit codes, rendered in one font at one size, with the same mask position on every image. The experiment compared generated Gaussian blur with PNGs produced by BlueMask's secure-masking renderer.
- Tested
- 6 September 2026
- Current build
d13b8b632e64- Release status
- Release candidate · 25 September 2026
DPIR / DRUNet result
| Input | Before restoration | After restoration |
|---|---|---|
| Unredacted control | 12 / 12 | Not applicable |
| Gaussian blur, sigma 3 | 9 / 12 | 12 / 12 |
| BlueMask secure mask | 0 / 12 | 0 / 12 |
DPIR with DRUNet grayscale is a published 2021 baseline. For the blur controls, it was given the same Gaussian kernel that created the blur. It recovered every tested code from the sigma 3 Gaussian control after restoration. It did not recover the known codes from the secure-mask inputs under the same reported settings.
The sigma 3 row is the informative blur control. A sigma 2 Gaussian control was already 12 / 12 before restoration and 12 / 12 after. Both controls are generated Gaussian blur. They are not BlueMask's cosmetic blur, which is three passes of a box filter. DPIR was not run on cosmetic-blur exports.
The unredacted images were not sent through DPIR. Their “after restoration” cell is not applicable.
Why this is not twelve independent secure-mask challenges
The twelve secure exports were byte-identical. The selected region was replaced with the same fixed pixels at the same position, so the restoration model received one repeated secure-mask input. Identical inputs were processed once for each assumed kernel and reused.
This supports the claim that those published pixels did not distinguish the twelve tested originals. It is one repeated masked input, not twelve independent adversarial tests.
DarkIR result
DarkIR, a 2025 low-light restoration model, was run on the same fixtures. On the sigma 3 Gaussian control, exact reads fell from 9 / 12 to 0 / 12. Its failure on the secure masks is therefore not evidence that it mounted a capable recovery attempt against them.
The failed control remains in the evidence package. It is not presented as a BlueMask success, and it is excluded from any strong resistance claim.
What the experiment does not establish
- every current or future model, including frontier models that were not run
- face recognition or face reconstruction
- real documents and photographs
- pixelation, inpainting, or dictionary search
- BlueMask's own cosmetic blur
- information left outside the mask
- context, reflections, logos, timestamps, or mask geometry
- guesses constructed from external information
- several differently masked versions of the same image
OCR failure does not prove that no information remains. A human or a different model may still read something the OCR measurement missed. Review the fixtures, outputs, transcriptions, model provenance, hashes, and reproduction instructions in the evidence archive.
The archive does not include model weights. Repeating the model run requires the checkpoints and local environment named there. The secure-mask renderer in this build matches the renderer that produced the fixtures. One harness file in the current repository, scripts/browser.mjs, has changed since the archive was packaged, so packing the archive again from the current repository would not reproduce its hash.
Downloads and verification
- Download the model-evidence archive
- Download the source archive
- Build manifest and hashes
- Public source repository
Changelog: no public changelog or GitHub release is published.
Source available. No license has been selected for the application or the evidence dataset. Do not call either one open source. Bundled fonts remain under their SIL Open Font License. Retained upstream model code keeps its own license notices.