Open-source · MIT licensed
Leaked intimate content spreads to mirror sites within hours, and the person it was taken from has no way to find it. Sniffer fingerprints one image, finds every copy it can across an independent corpus of collected media, and produces a per-domain takedown notice with the evidence attached. Free to use. Auditable end to end.
600
media assets fingerprinted
across 59 domains
26
assets found on 2+ domains
26/26 byte-identical
71.4%
detection rate on alterations
16 misses published, not hidden
0 bytes
of media stored
1.86 MB index footprint
Reproduced from data/reports/ by scripts in the repository. Not projections. Full measured report
The problem
Finding a lawyer is not the hard part. Describing what was done to you, to a stranger, in a form that gets acted on — that is the wall. Every step of the existing process asks the victim to do labour that software can do.
01
Discover
Search dozens of unrelated sites by hand. Most victims never find all the copies — and the ones they miss get re-uploaded.
02
Document
Screenshot each occurrence, record timestamps, keep the evidence organised enough to be useful to someone else.
03
Attribute
Work out who actually hosts each domain and which abuse channel reaches a human.
04
Escalate
File separately per platform, each with a different form, contact and legal basis. Repeat for every copy.
How it works
Most people assume these are the same question. They are not, and conflating them is why existing tools either miss copies or accuse the wrong person.
Question one
Is this file manipulated?
Forensics on pixels. Six explainable signals, a C2PA provenance read, and a deepfake checkpoint that is only allowed to corroborate.
This is the pipeline behind /verify/upload and the report.
Question two
Has this exact file been copied elsewhere?
A database lookup, not an inference. A 64-bit perceptual hash against an independently collected corpus, then structural confirmation of the candidates it returns.
This is the pipeline behind /matcher and the takedown pack.
The privacy consequence of splitting them: the index stores hashes, dimensions and URLs — never image bytes. Discovery does not crawl 90-odd domains per request, does not put load on third-party servers, and does not require retaining the material it exists to help remove. The cost is that coverage is frozen at collection time.
Technical moat
Most tools in this space are a model wrapper. A model cannot explain itself, cannot be audited, and — as we measured — will confidently call an authentic photograph fake. Ours is capped, damped, and outranked by cryptographic provenance.
Model contribution ceiling
model_contribution = model_prob × 0.30 × (0.40 + 0.60 × classical_support)
0 of 3 signals fire
x0.40
max 12 points
1 of 3
x0.60
max 18 points
2 of 3
x0.80
max 24 points
3 of 3
x1.00
max 30 points
Why the cap exists: at 95% weight the checkpoint returned a 0.84 “Deepfake” verdict on a known-authentic photograph. So the explainable signals carry the verdict and the model may only corroborate, with the ceiling falling to 12 points when nothing observable fires. A reference image discounts model evidence further by 0.6 — a genuine photograph of the victim cannot also be model-synthesised.
C2PA provenance
weight 0–15 pts · needs: nothing
Reads the signed manifest the producer embedded. A validated AI-generation declaration is treated as a fact about origin, not a statistical opinion.
Why it earns its weight — A producer signing their own output is the strongest evidence available. It outranks every pixel statistic we compute.
Error Level Analysis
weight 0.18 · needs: nothing
Re-saves at JPEG q90 and measures per-pixel difference. Edited regions recompress differently and surface as residual.
Why it earns its weight — Catches local compositing and retouching, which leave the rest of the frame statistically clean.
DCT double-compression
weight 0.05 · needs: JPEG only
Coefficient of variation of per-8x8 block variance. A second quantisation pass leaves a regular grid.
Why it earns its weight — Deliberately weak weight. Double compression is near-universal in JPEGs, so it corroborates and never convicts. On a PNG it reports undefined, not clean.
PRNU noise
weight 0.30 / 0.10 · needs: nothing
Fisher kurtosis of the noise residual. Camera noise is spatially correlated; generated noise is near-white.
Why it earns its weight — Threshold 4.5, against an observed 3–4 for real sensors. A structural constant from the signal definition, not a fitted value.
FFT grid
weight 0.50 / 0.15 · needs: nothing
2D power spectrum, Hann-windowed. Latent-space upsampling leaves periodic peaks real photographs do not.
Why it earns its weight — Catches the upsampling step common to most generative pipelines.
Chromatic aberration
weight 0.20 / 0.05 · needs: nothing
Spatial offset between red and blue channels at high-contrast edges. Real lenses disperse; synthesis does not.
Why it earns its weight — A physical property of glass. Threshold 0.4px.
SSIM · colour · noise · ORB · pHash
weight 0.30 / 0.15 / 0.10 / 0.05 / 0.15 · needs: a reference image
Structural similarity, histogram KL divergence, sensor-noise consistency, keypoint matching, perceptual hash consensus.
Why it earns its weight — The heaviest weight in the system belongs to SSIM, because a comparison against a known-authentic original is the strongest pixel evidence available.
Validation
Cross-domain validation re-fetches every stored URL and compares hashes independently. Transformation resistance applies 56 synthetic modifications to real assets. Both scripts are in the repository and re-runnable, and the full generated report is published at /metrics.html.
Recorded results
Cross-domain assets with 2+ copies
26
Byte-identical on independent re-fetch
26 / 26
Merely perceptually similar (differing bytes)
0
Repeated fetches stable
14 / 14
pHash survives JPEG re-encode
14 / 14
pHash survives PNG re-encode
14 / 14
pHash survives half-size resize
12 / 14
pHash survives overlaid text
0 / 14
SHA-256 survives any modification
0 / 56
The failure rows are the interesting ones. SHA-256 survives nothing, because it is a byte comparison and any re-encode defeats it — which is precisely why perceptual hashing exists. And pHash, while it absorbs re-encoding completely, fails outright on overlaid text. A victim whose copy has been watermarked is not being served by this tool today.One caveat we will not soften: 71.4% is measured on synthetic variants generated from fetched posters, not on real reposts. Real-world recall is unknown and is probably lower. Heavily branded sites under-report rather than fail loudly, which is the worse failure mode.
Known limits
A tool that decides whether to tell someone their intimate image was tampered with has a duty to be legible about its own reach. These are the current boundaries, stated before a user finds them.
Overlaid text defeats perceptual matching
0 of 14 in recorded testing. A copy stamped with a channel name is invisible to the current pipeline. This is the single most important gap to close, and it is stated here rather than discovered by a user.
Video is proxied by poster frames
There is no video-file fingerprinting. A re-encode that yields a different poster is a miss.
The scoring weights are not yet fitted
The referenceless parameters are reasoned starting points, not values derived from a labelled benchmark. This is why the system reports its signals and declines to assert a verdict on referenceless evidence alone. Fixing it is a known, bounded piece of work.
Coverage is bounded by what we could reach
47 of 106 collectable domains yielded nothing. Cloudflare, DNS failures, parking pages, CDN 403s. We do not bypass any of them, so 55.7% is the honest ceiling of the current corpus.
Nothing assesses a person's age
No signal in the pipeline looks at whether a depicted person is a minor. Age-indeterminate content is an analyst-reviewed matter for the relevant authority, never a classifier output.
Business model
Pricing below is a proposal, not a validated result. We have not yet run a pricing experiment and we are not going to present a projection as a measurement. Infrastructure cost is roughly ₹5,000 per month at current scale, against a 4 vCPU host, an Atlas cluster, a logo API and an SMTP relay.
Survivor
For individuals seeking help
₹0forever
Always free. We hold hashes and URLs, never image bytes.
Most used by caseworkers
Professional
For lawyers, paralegals and NGO caseworkers
₹499per month
One recovered case pays for the year.
Enterprise
For NGOs, helplines and platform trust & safety teams
₹9,999per month
Used by cybercrime cells, women's helplines and legal aid clinics.
Landscape
StopNCII (UK government + Meta)
They
Free hash submission, Meta platforms only
Sniffer
Independent of any platform. Fingerprint search over a collected corpus spanning unrelated mirror networks.
Commercial takedown firms
They
Service fee per case, no scanning — manual investigation
Sniffer
Automated discovery and notice generation in one flow, free at the entry tier.
A paralegal with a browser
They
Hours per case, scales linearly with caseload
Sniffer
One query returns every known copy, with the evidence attached.
Demo
Each step is chosen to show a different property, not a different feature. The fourth is the one that matters most to a trust and safety reviewer.
Show the cross-domain result
Upload one image at /verify/upload. It returns two exact 99% matches on two unrelated domains, expanded so both URLs are actionable. The lead is the point: most copies live on sites nobody has heard of.
Show that evidence is on demand
/matcher makes zero evidence requests on load. One click re-fetches one image so a human confirms it by eye. Nothing is preloaded and no third-party host is hotlinked in the victim's browser.
Show provenance outranking statistics
Load an image carrying a C2PA manifest. The verdict follows the signed declaration, not the model checkpoint — and the report says plainly when the certificate is unanchored and needs analyst confirmation.
Show the tool refusing to conclude
An image with no manifest and no reference returns signals and an explicit abstention, not a confident number. For a tool that decides whether to tell someone their image was tampered with, silence beats a guess.
Show the notice
The takedown notice cites the correct legal basis, requests log preservation for the affected person, and makes no age allegation. A false accusation of child abuse material would cost the sender legally and cost us the team that would otherwise act within hours.
Roadmap
Corpus, matcher, report, notices
Fitted calibration against a labelled benchmark, lifting the referenceless abstention
Text-overlay-robust matching to close the 0/14 gap
Coverage expansion against priority domains
Video-file fingerprinting to replace poster proxying
Durable case storage, role-based access, institutional API
Responsible use
A forensic tool for abuse victims has an obvious misuse direction. These are the constraints we built in rather than the ones we were asked for.
No signal in the pipeline assesses whether a depicted person is a minor. Nothing in this product asserts a person's age, and no feature may be added that would generate such a claim from a classifier output or a URL string. Age-indeterminate content is an analyst-reviewed matter for the relevant authority.
The collector is bound by the same rules as the manual matcher: robots.txt enforced, per-host throttled, homepage-only, capped, fully audited. We do not spoof referrers, defeat challenges, or circumvent rate limits to raise a coverage number.
Evidence is fetched only on explicit request, is never persisted, and is served no-store so a screenshot cannot outlive the check. The index holds hashes and URLs, never media.
Notices are drafted for a person to send. We do not auto-submit takedowns, and we do not represent ourselves as a legal representative.
A victim who is told a copy was confirmed, when the tool only guessed, has spent her one afternoon of credibility on a lead that goes nowhere. So every claim Sniffer makes is labelled with how it was established, every score shows its arithmetic, and where the system cannot justify a conclusion it says so and stops.
Sniffer · Impic Labs · Open source, MIT licensed