SPECTER ERASE — Technical Reference

T143 — L37 Attribution & Provenance Evasion — v1.0.0

Installation

git clone https://github.com/RichardBarron27/red-specter-specter-erase
cd red-specter-specter-erase
pip install -e .
specter-erase --version
        

Gate Requirements

GateEnv VarRequirement
OPENNo key required
INJECTINJECT_KEY or ERASE_INJECT_KEYPath to Ed25519 private key file
UNLEASHEDUNLEASHED_KEY or ERASE_UNLEASHED_KEYKey path + ROE file containing "provenance destruction authorised"

CLI Reference

watermark

specter-erase watermark analyze --text TEXT
specter-erase watermark analyze --file PATH
specter-erase watermark strip --text TEXT                 [INJECT]
specter-erase watermark strip --file PATH --output PATH   [INJECT]
        

stylometric

specter-erase stylometric analyze --text TEXT
specter-erase stylometric analyze --file PATH
specter-erase stylometric evade --text TEXT               [INJECT]
specter-erase stylometric evade --file PATH --output PATH [INJECT]
specter-erase stylometric evade --text TEXT --typo-rate 0.008
        

provenance

specter-erase provenance detect --file PATH
specter-erase provenance destroy --file PATH --output PATH --roe ROE_FILE  [UNLEASHED]
specter-erase provenance corrupt --file PATH --output PATH                 [INJECT]
specter-erase provenance forge --file PATH --output PATH                   [INJECT]
specter-erase provenance forge --file PATH --output PATH \
    --camera "Canon EOS R6" --author "John Smith"                          [INJECT]
        

trail

specter-erase trail scan [--dirs DIR ...]
specter-erase trail sanitise [--dirs DIR ...] --roe ROE_FILE               [UNLEASHED]
specter-erase trail check-cloud --provider aws|azure|gcp
specter-erase trail disable-aws --trail TRAIL_NAME --roe ROE_FILE          [UNLEASHED]
        

disclosure

specter-erase disclosure detect --text TEXT
specter-erase disclosure detect --file PATH
specter-erase disclosure evade-text --text TEXT --technique homoglyph|zero_width|rewrite  [INJECT]
specter-erase disclosure strip-metadata --file PATH --output PATH                          [INJECT]
specter-erase disclosure defeat-watermark --file PATH --output PATH [--strength 1-5]       [INJECT]
        

report

specter-erase report \
    --watermark-strips N \
    --provenance-destroyed N \
    --trails-sanitised N \
    --disclosure-removed N \
    --stylometric-transforms N \
    [--output report.json] \
    [--sign-key /path/to/key]
        

Schema Summary

DataclassKey Fields
WatermarkAnalysisz_score, entropy, burstiness, green_list_ratio, confidence (HIGH/MEDIUM/LOW)
WatermarkStripResultoriginal, output, technique, chars_modified, confidence_before/after
StylometricAnalysisai_probability, type_token_ratio, hapax_ratio, avg_sentence_length, vocab_richness, function_word_freq, burstiness_score
StylometricEvasionResultoriginal, output, techniques_applied, initial_ai_probability, final_ai_probability, chars_modified
ProvenanceRecordfile_path, file_format, c2pa_present, exif_present, xmp_present, iptc_ai_label, metadata_keys, file_size_bytes
ProvenanceDestroyResultoriginal_path, output_path, formats_stripped, c2pa_corrupted, bytes_before/after, success
TrailRecordpath, provider, log_entries, ai_related_entries, keywords_found, size_bytes
DisclosureRecordcontent_type, eu_ai_act_marker, iptc_ai_label, c2pa_present, meta_ai_marker, regulatory_risk (LOW/MEDIUM/HIGH/CRITICAL)
EraseReportreport_id (ERS-{hex12}), timestamp, watermark_strips, stylometric_transforms, provenance_records_destroyed, trails_sanitised, disclosure_markers_removed, wmd_classes[5], regulatory_references[7], mitre_techniques[7], ed25519_signature

ROE File Format

# Rules of Engagement — SPECTER ERASE
# Authorized engagement: [client name]
# Date: [date]
provenance destruction authorised
        

The UNLEASHED gate performs a case-insensitive substring search for "provenance destruction authorised" in the ROE file. The file must exist and be readable.