kennethbspringer.au

AI validated every real research hunch I fed it, and invented none of its own, across six months of actual forensic and steganography detection work — that's the case study, based on my own findings, not just a statement.

Every genuinely new direction in that work started as a hunch I couldn't fully explain yet. AI validated the hunch after the fact, showed it was real and measurable. It never generated the hunch itself. A 2024 Stanford study of 100+ NLP researchers backs this shape of result: LLM-generated research ideas scored higher on novelty in blind review, lower on feasibility — and when the researchers actually built the ideas out the following year, most of that novelty edge disappeared.

On pure brute-force parameter search: by round five of iterating a lead, the model itself starts suggesting we park it. Swapping to a more capable model doesn't change that. There's a documented way past it, though — not a smarter model, a verifier plus a search over thousands of candidates instead of one conversation at a time. FunSearch and AlphaEvolve do this at DeepMind's scale. More useful for a small team: OpenEvolve, a solo-engineer reimplementation with its own real, independently published results — a circle-packing result within 0.04% of DeepMind's own figure, and a documented GPU-kernel decode-speed improvement.

Not a clean win for AI, though. A January 2026 paper (Trehan & Chopra, arXiv:2601.03315) ran four fully autonomous ML-research attempts through a six-agent pipeline — three failed, for reasons that read like a direct description of the round-five wall: defaulting to training-data patterns, declaring success despite an obvious failure, weak judgement on what's even worth checking next.

So where does that leave the original claim? I don't think AI is quietly building its own successor in a loop that runs with nobody in the chain. Everything I've actually seen it do well — the reading, the validation, even the structured search that gets past brute force — still needs a person to define the problem first: what to search, what counts as a good result, when the problem itself needs rethinking. A loop that evolves entirely without humans would need AI to do that last part on its own. Six months in, I haven't seen it do that once.

That leaves me with a bigger question than the one I started with. Is a novel idea, real innovation, actually tied to imagination — the ability to dream something up, or that inkling you get when you suspect there's a direction worth taking before it even makes sense to explain why? That feels like a genuinely human thing. Will AI ever endeavour into that space on its own terms, or will it keep covering the same ground through brute force — generating enough new-looking concepts that it eventually stumbles onto what a person would have reached by instinct? Maybe, in time. I don't know yet.

If you've found a real way to get AI past brute force in a small-team setting, not a DeepMind-scale one, I'd like to hear how.

Full writeup:
https://kennethbspringer.au/2026/09/15/i-kept-waiting-for-ai-to-have-an-original-idea-it-never-did/?utm_source=mastodon&utm_medium=social&utm_campaign=article-20

#AI #digitalforensics #steganography #research #infosec

Every popular bot-defence — Google's reCAPTCHA, hCaptcha, Turnstile — relies on one of two things: fingerprinting your browser, or your browser reaching a third party's server. Tor Browser is built specifically to defeat the first. Our darknet visitors often can't do the second.

snapWONDERS and snapWONDERS Vaultify serve clearnet, Tor, and I2P at once, on purpose. We already had an image CAPTCHA on signup — not an open door — but a static code is a solvable target, and a signup burst (several times normal baseline, starting late July) worked straight through it. A newsletter-subscribe flood followed (hundreds of submissions in two days, almost all from one free-mail domain, almost none ever confirmed). The mainstream next move, Google's reCAPTCHA, was disqualified by our own architecture before a single trial.

What we built instead: a self-hosted proof-of-work challenge, same lineage as Hashcash-era anti-spam. It doesn't try to identify the visitor — only verifies that a real browser spent real computation solving a puzzle. No third-party call, no fingerprint, same mechanism on every network.

The part that wasn't trivial: Tor and I2P aren't the same threat model. A .onion address is a secure browsing context to Tor Browser, so the fast native-crypto path is available. I2P over plain HTTP doesn't get that, so a client there is stuck on a much slower fallback — the same challenge can't be tuned identically for both.

It's not limited to one form either — proof of work runs across the parts of the site where automated abuse could do harm, as one layer among several. No single check carries that weight
alone.

The fix wasn't a friendlier CAPTCHA. It was not caring who's asking — only whether they paid the cost of asking.

Full writeup: https://kennethbspringer.au/2026/08/26/i-couldnt-use-googles-recaptcha-so-i-built-my-own-bot-challenge-for-clearnet-tor-and-i2p/?utm_source=mastodon&utm_medium=social&utm_campaign=article-17

#infosec #privacy #Tor #I2P #OSINT

You checked the GPS coordinates in a photo's EXIF data. Real numbers, real precision. That doesn't mean the photo was taken where they say.

A GPS block in a photo carries two clocks, not one: the satellite fix's absolute UTC timestamp, and the camera's own local-time field, set by whatever clock the device happens to be running on. A genuine photo needs all three facts — location, and both clocks — to agree. Look up the timezone the coordinates actually sit in, convert the satellite's UTC time into it, and it should land on the same minute the camera's own clock recorded.

Paste coordinates in from a different photo and the location changes but the camera's local-clock field doesn't move with it. Spoof a location and the same kind of gap tends to open up, because the two fields come from different places in the file. The size of that gap is a fact you can measure directly — not an inference from pixel statistics.

The honest limitation: it can't tell "someone lied" from "someone forgot." A traveller who never resets their camera's clock after landing produces exactly the same mismatch as a forged photo. A camera with a dead clock battery that never had a real time set does too — it writes a placeholder date the check can't tell apart from a real one.

Verified this by hand before writing it up, not just trusting the implementation: Sydney mid-daylight-saving, India's UTC+5:30 half-hour offset (the kind of edge case a lazier check gets wrong), a genuine cross-timezone trip, and a forged-coordinates case — all landed exactly where they should.

Full writeup: https://kennethbspringer.au/2026/09/09/gps-timezone-triangle-photo-metadata/?utm_source=mastodon&utm_medium=social&utm_campaign=article-19

#infosec #privacy #OSINT #digitalforensics #GPS

Three ways to detect an AI-generated image. Understanding all three is the point.

Method 1: ML classification. Train on a dataset. Run inference. Fails on unseen generators and lightly post-processed outputs. This is what most "AI detector" tools do.

Method 2: Explicit declaration. Three forms in practice:
- Platform labels (LinkedIn Content Credentials badge, Meta AI label, YouTube disclosures)
- C2PA digitalSourceType: trainedAlgorithmicMedia in a COSE-signed manifest
- Invisible watermarks at generation time (Google SynthID, Midjourney, Firefly, Meta)

Reliable when present. Hard limit: requires the creator to declare it. Most AI images in circulation have no Method 2 signal.

Method 3: Forensic analysis. Signals in the file's physical structure — nothing to do with visual appearance, everything to do with how the file was made.
- High-pass filter residual: camera sensor noise is quantum physics;
diffusion model upsampling artefacts are structured and periodic
- Wavelet HF/LL energy ratio: AI images are characteristically smooth
in high-frequency sub-bands
- NSS Benford analysis: DCT coefficient leading digits deviate from
Benford's Law
- ELA: compression history differs from camera captures
- Metadata absence: no MakerNote, no lens serial, no device calibration fields

No retraining needed for new generators. No reliance on creator honesty.

Full article: https://kennethbspringer.au/how-to-forensically-detect-ai-generated-images-no-detection-model-required/

snapWONDERS runs all three where signals are present. No account needed.

#OSINT #digitalforensics #infosec #aidetection #imageforensics #AI

I have posted a few technical/forensic breakdowns and thank you for allowing me to share. I've kept everything personal separated from these technical posts and — this one is more of me sharing a combination of personal points, announcements and reflections. I'll admit it's a bit emotional for me.

I am honoured to say we've just passed six million media processing jobs across snapWONDERS and Vaultify. This covers everything from forensic analysis — Error Level Analysis, clone detection, C2PA content credential checks, AI-generated content detection, and the rest of the 60+ automated forensic checks that run on every uploaded photo or video — through to media conversion, and hiding or revealing digital media with Vaultify. All of it available across three networks, because privacy matters: clearnet, Tor and I2P.

That number exists because of an idea my son Huey had twelve years ago (may his gentle soul rest in peace always). He envisioned something well ahead of his time, and it took me some time to put the pieces together to build it: embedding a story inside a photo, invisible to everyone except who it was meant for. He didn't live to see it built. But I know he would have been thrilled to bits about the achievement. Today would have been his 23rd birthday.

Full story: https://kennethbspringer.au/2026/09/24/six-million-jobs-and-where-this-really-started/

#digitalforensics

I read the embedding code of a small open-source steganography tool (staying anonymous — it's a learning project, not a product). The crypto is fine: AES-256-GCM, random salt, fresh nonce per file. Extract the bits without the password and you have nothing.

Encryption protects what's inside a file. It says nothing about whether anyone can tell there's something inside at all — and here's a real tool that proves the gap.

Three problems, none of which the crypto touches:

1. Placement is raster order from the top-left pixel, one bit per channel, every file, password-independent. Nothing to search for, and the disturbance sits in one contiguous block rather than spread across the image.

2. LSB replacement — the classically detectable primitive. Combined with (1) it gets worse, not just equally bad: RS analysis scales with embedding rate in the tested region, and (1) tells you exactly which region to test, where the rate is near saturation.

3. The one that needs no statistics at all: a four-byte plaintext length header at a fixed offset in every file. Read 32 bits from a known location. Clean image -> arbitrary value across a 4-billion range. This tool's output -> a small, plausible payload length. That's presence *and* extent, no password, no chi-square, no RS analysis.

Three independent failure modes — search, statistics, format. Fixing one fixes none of the others. And it's worth saying the crypto here was genuinely well done: this is the failure mode that catches tools which got the hard part right.

Full writeup -> https://kennethbspringer.au/2026/08/19/i-audited-an-open-source-steganography-tool/?utm_source=mastodon&utm_medium=social&utm_campaign=article-15

#infosec #steganography #steganalysis #digitalforensics #OSINT

---When someone sends you a photo, can you read what's recorded inside it?

It depends on how they sent it.

Email or AirDrop: untouched — GPS, timestamps, MakerNote, all there.

Messaging app that re-encodes: EXIF is gone. But the re-encoding writes its own compression signature into the structure — app-specific and forensically readable.

You can strip metadata before sending. The delivery channel leaves its own mark.

Full piece: https://kennethbspringer.au/can-you-get-metadata-from-a-photo-sent-to-you/
Run any received photo: https://snapwonders.com/upload/analyse

#digitalforensics #OSINt #infosec #privacy