This piece examines how content reuploading works at the technical layer, and where each detection defence actually fails. Every figure carries its experimental conditions — dataset, reference-library size, transform type, evaluation protocol. A single number without those conditions means nothing in this field. Sources are first-hand wherever possible: arXiv papers, open-source repositories, platform engineering write-ups, and standards text. Each conclusion is graded: [Paper] peer-reviewed empirical, [Open-source] independently checkable, [Vendor] self-reported, [Mechanism] reasoned. This piece describes mechanisms and public benchmarks; it does not provide steps anyone could follow to evade detection.
1. The limitation Shazam wrote down in 2003
The construction is not complicated. Take the local maxima of a spectrogram, link them into a constellation, pair each anchor with points in a target zone, and pack each pair into a 32-bit hash; a match is declared only when the hash hits line up along a diagonal in relative time offset. [Paper] On a 10,000-song test database, 250 queries, 8kHz mono, a 15-second sample reaches 50% recognition at −9 dB SNR; run the whole thing through a GSM codec and that retreats to −3 dB. Under heavy distortion roughly 1–2% of the generated hashes surviving is enough.
For all that tolerance, the author drew a boundary in the same paper: the method targets "sound files that are already present in the database," is "not expected to generalize to live recordings," and is "very sensitive to which particular version of a track has been sampled."
Twenty years on, neural fingerprinting changed the implementation and kept the premise. [Paper] Chang et al., on a library of 100,000 songs and roughly 56 million segments, report top-1 accuracy of 62.2% for a 1-second query and 95.6% at 10 seconds. Remove data augmentation from training and every query length falls to 0.0%. The invariance is fed in through noise, reverberation and time offsets — and "perform it again" was never in that augmentation distribution.
The whole family of signal methods shares one premise: the copy under test is a degraded version of the original signal. Re-encoding satisfies it, because the residual is still there. Regeneration does not, because the output pixels and spectrum are no longer a function of the original signal.
That single fact has driven the last two years of technical development. The cost arithmetic is available too: speech transcription at $0.006 a minute, full-video translation with lip sync at roughly $0.24 a minute, against localization vendors' published rates of $50 to $200 per finished minute of human dubbing. Replacing the voice and the mouth costs far less at the margin than regenerating the whole thing, and in detection terms the two are equivalent — once the audio track and the mouth pixels are swapped, neither the original voice fingerprint nor the original frame hashes match.
2. Which transforms get caught, and which do not
In 2023 Meta ran a video similarity challenge that put numbers on this for the first time. [Paper] The test set sends 8,015 queries against a 40,318-video reference library, and 77% of those queries have no corresponding copy at all, which is what makes it a needle-in-haystack task. The self-supervised descriptor baseline scored 60.5% μAP; the winner reached 87.2%.
The organizers then added a rare sentence to their paper: the winner's edit-detection module exploits dataset bias, since every copied query in the set contains temporal edits, and it would fail against harder transforms such as small spatial and temporal crops. It is not, they wrote, a realistic real-world solution. The winner's own scores bear this out, falling from 0.9176 in phase one to 0.8717 in phase two.
The difficulty ordering is clear. Easiest to catch are speed changes and inserted repeats — purely temporal transforms — because every submitted method is built on per-frame descriptors, so moving the time axis does not change what any single frame looks like. Hardest are blending several videos into one frame, and the geometric transforms that add or remove picture area, such as overlaying onto a screenshot and cropping.
The harder boundary is generalization. [Paper] AnyPattern trains on 90 base transform patterns and tests on 10 unseen ones; against a one-million-image reference library, mainstream descriptors fall from 72–77 μAP in-distribution to 13.7–16.2. Piling up to 90 training patterns only recovers 39.79, and adding in-context prompting reaches 56.65 — still far below in-distribution. Sealing off the transform space with one round of training does not work, arithmetically.
In early 2025 a replication study found a different class of problem: the sampling schedule is itself an attack surface. [Paper] Mainstream methods take one frame per second, so the sampling points are deterministic and public. Blacking out the middle frame of each second drops μAP from 0.9343 to 0.3705, a change that is close to invisible. The authors' fix moves sampling off the fixed time grid and onto the extrema of the inter-frame difference curve, which restores 0.8835 under the same attack. The same paper independently found that the winner's edit-detection module classifies completely unedited copies as non-copies.
Scores on real edits are lower still. [Paper] Ant Group's VCSL collects 160,000 real infringing video pairs and 280,000 annotated copied segments; running four frame features against five temporal alignment algorithms, the best segment-level F1 in 2022 was 61.46, improving to 71.6 by 2024 — still close to thirty percent error. Dynamic time warping recalls only 29.34%, because it requires a monotonic one-to-one alignment of the time axis while real reuploads are often multiple discontinuous segments in scrambled order. The hard cases the paper names are picture-in-picture from variety shows and heavily cropped remix videos.
For perceptual hashing, the vendor states the boundary in its own documentation. [Open-source] Meta's open-sourced TMK+PDQF README says plainly that it is "weak at matching clips," and lists what it does not detect: cropping, added borders, heavier logos, and a two-minute clip embedded in an hour-long video. Its stated role is honest — whole-video approximate matching, or a cheap pre-filter for more expensive algorithms.
3. Watermarking should have caught regeneration. It was disproved instead
Fingerprints identify one rendition; watermarks identify the generating end. On that reasoning, watermarking is the one class of signal that should survive regeneration.
Theory answered first. [Paper] A 2024 result proves that strong watermarking is impossible under a natural assumption — that the attacker has access to a quality oracle and a perturbation oracle — and demonstrates removal on three existing schemes with only slight quality loss.
The engineering numbers are blunter. [Paper] W-Bench evaluates eleven watermarking schemes on 10,000 edited images at 512×512. After a single pass through Stable Video Diffusion, TPR@0.1%FPR falls below forty percent for all of them: MBRS 13.55%, StegaStamp 30.85%, TrustMark 39.60%, and VINE-Robust — trained specifically to resist editing — reaches only 36.33%. In the same table, VINE-Robust withstands stochastic regeneration at 99.66%.
Resisting noise and resisting regeneration are two different capabilities. The first does not imply the second.
The most widely deployed family looks worse. [Paper] The frequency-domain watermark called by default in Stable Diffusion 1.x through SDXL scores 1.00 bit accuracy on clean images across the three benchmarks in the TrustMark paper, and 0.52 after one pass of ordinary combined noise. Random guessing is 0.50.
Vendor numbers and attack numbers are two different rulers, and the protocol matters. [Vendor] Google's SynthID-Image reports aggregated TPR@0.1%FPR of 99.98% across 30 non-adversarial transform classes, with a worst combination of 98.06%, and says it has watermarked over ten billion images and video frames. The same paper states its goal precisely: not perfect security, but making black-box attacks computationally infeasible at scale. [Paper] In August 2026, an attack using on-manifold latent manipulation pushed bit accuracy on multiple schemes down to 53.14% with no visible quality loss, naming that system explicitly.
The other route is content credentials. [Open-source] C2PA's hard binding is a hash of the asset bytes, and the specification itself states that re-encoding produces a new rendition and necessarily breaks that binding; the remedy, called a Durable Content Credential, uses a fingerprint or watermark as a soft binding to retrieve the manifest from a repository. Its resistance to reuploading is therefore capped by the resistance of that soft binding layer — the layer already shown above to be breakable. Empirically, a 2026 Twitter image dataset reports that X's CDN strips content credentials systematically on upload.
One direction is more troubling than removal. [Paper] Since 2024 there have been mature forgery attacks: a single watermarked reference image is enough to stamp that watermark onto arbitrary images using a diffusion model unrelated to the target system. A theoretical result places robustness, unforgeability and public detectability in one framework and finds that no existing scheme achieves all three. The practical consequence: a positive watermark detection can only mean "suspected," never attribution on its own — the cost of missing one reuploader and the cost of pinning authorship on the wrong person are not symmetric.
4. Two more structural limits
The first is in the index, and it is arithmetic. [Open-source] At the challenge's compliance budget of one 512-dimensional descriptor per second, a library of one million hours is 3.6 billion vectors. Raw storage is 7.37 TB; a graph index by the published memory formula needs 8.29 TB; compressing to 64 bytes per vector brings it to about 259 GB, and that compression comes directly out of recall. What rescues it is temporal redundancy: the decision score is the maximum inner product over frame pairs, so at 30% single-frame recall and a 10-second copied segment, the upper bound on segment-level recall reaches 97%. This is why aggressive compression still works on long copies, and why short segments are always the first thing missed.
The second is cross-modal. [Open-source] Video turned into text-and-images, or speech transcribed and then rewritten, is caught by none of the three layers of infrastructure: Content ID matches audio and video files, ISCC generates its content code per modality, and C2PA's soft binding covers only derivations and re-renderings of the same asset. Not one of them defines cross-modal derivation. Public evaluation levels do not meet the need either — the winner of the 2023 end-to-end video text recognition benchmark scored 22.44% MOTA. Transcription is the one bridge that works, at $0.04 per audio hour, but after transcription the problem becomes rewriting, which is where the text detectors already fail.
A note on broadcast conditions. [Paper] The BAF benchmark tests background music inside video — 74 hours of production music against 57 hours of TV recordings, with roughly 80% of annotated duration being background — and every public system scores below 0.47 F1 at second-level resolution. Deciding whether a video used a given song is a harder problem, by an order of magnitude, than deciding what song is playing near someone's phone.
5. No endgame, only a change of shape
Put the results together and this contest has no stable equilibrium, though the shape of the equilibrium is shifting. The early goal was one defence that could not be broken. The goal now is two other things: make attack cost rise with scale, and make the act of laundering leave traces.
[Paper] Forensic work in 2026 found that six mainstream watermark removers actually substitute one detectable signal for another, and an independent forensic detector separates laundered images from clean ones at over 98% true-positive rate. The original mark may be unrecoverable, but the fact that someone worked on it is detectable on the benchmark. A parallel route is cross-layer auditing — flagging the contradiction between what a content credential claims and what the pixels' watermark says — reported at 100% accuracy on 3,500 images, provided the manifest is still attached, which it is not for anything a CDN has stripped.
Both are 2026 preprints, both offline benchmarks, with third-party replication and cross-generator generalization still open. The cadence here runs in months, and "we can detect it" usually leads the attack by one version.
For anyone who makes content, these technical facts point at an uncomfortable conclusion. What gets caught automatically is the reuploading nobody bothered to modify. Straight re-uploads, simple speed changes, an added border — fingerprints still find those. Once someone is willing to spend a few dollars of model inference regenerating the material, the entire family of signal methods has no structural reason to match. What remains is semantic retrieval, which scores 70% to 87% on hundred-thousand-scale libraries: enough to produce candidates for review, not enough to act on automatically.
Primary sources: Wang, "An Industrial-Strength Audio Search Algorithm" (ISMIR 2003); Chang et al., "Neural Audio Fingerprint for High-Specific Audio Retrieval" (arXiv:2010.11910); Pizzi et al., "The 2023 Video Similarity Dataset and Challenge" (arXiv:2306.09489) and "A Self-Supervised Descriptor for Image Copy Detection" (arXiv:2202.10261); Wang, Sun and Yang, "AnyPattern" (arXiv:2404.13788); Fojcik and Syga, "Counteracting temporal attacks in Video Copy Detection" (arXiv:2501.11171); He et al., VCSL (arXiv:2203.02654) and "Self-Supervised Video Copy Localization" (ECCV 2024); Meta ThreatExchange TMK+PDQF and PDQ documentation; Zhao et al., "Invisible Image Watermarks Are Provably Removable" (NeurIPS 2024) and "Watermarks in the Sand" (ICML 2024); W-Bench / VINE (arXiv:2410.18775, ICLR 2025); TrustMark (arXiv:2311.18297); SynthID-Image (arXiv:2510.09263); MarkNull (arXiv:2608.10166, USENIX Security 2026); C2PA Specification 2.2/2.4 and the c2pa-rs repository; "Black-Box Forgery Attacks on Semantic Watermarks" (CVPR 2025); "On the Difficulty of Constructing a Robust and Publicly-Detectable Watermark" (arXiv:2502.04901); "The Faiss library" (arXiv:2401.08281) and the Faiss index-selection guidelines; "BAF: An Audio Fingerprinting Dataset for Broadcast Monitoring" (ISMIR 2022); ICDAR 2023 DSText; "Removing the Watermark Is Not Enough" (arXiv:2605.09203); "Authenticated Contradictions from Desynchronized Provenance and Watermarking" (arXiv:2603.02378). Every load-bearing conclusion was independently re-verified; all figures carry their experimental conditions and should not be extrapolated beyond them.