A benchmark for document authenticity

SDB-26 defines reproducible evaluation for synthetic, edited, and screen-recaptured artifacts in operational conditions — transparent metrics and schema-valid outputs your MLRO can cite, not a vendor slide.

Canonical spec: STANDARD.md · Methodology: METHODOLOGY.md

What we measure

SDB-26 is built around comparable, defender-oriented outcomes:

Reference: STANDARD.md (§4.5 preview metrics), METHODOLOGY.md, results_schema.json.

Three escalating attack classes

• L1 — Standard Generation: direct AI-generated documents, no post-processing.
• L2 — Advanced Diffusion: fine-tuning, editing, metadata manipulation scenarios.
• L3 — Screen Recapture: synthetic/edited files recaptured through display pipelines.

L3 is a foundation layer in the methodology because recapture can remove or distort provenance cues while preserving plausible visual content — the failure mode most KYC stacks under-report.

FRC & agent-era traceability

SDB-26 includes FRC and the FRC A2A Extension (FRC_A2A_EXTENSION.md, v0.5.2) for auditable decisions across human-direct, agent-assisted, and managed-agent channels.

Core links

• FRC_OVERVIEW.md
• FRC_A2A_EXTENSION.md
• FRC_A2A_DEPLOYMENT_MAPPING.md

Highlights in v0.5.2

• Compound routing combines document FRC with an agent_verdict posture, including INSUFFICIENT × PARTIALLY_ATTESTED → REVIEW and INSUFFICIENT × SUSPICIOUS → ESCALATE — a bad capture plus a risky agent path is not reduced to “upload again”.
• Normative L0 → agent_verdict mapping so PARTIALLY_ATTESTED is not an informal catch-all.
• Confidence split: verdict_confidence (core payload) = document layer only; compound_confidence (envelope) = joint compound_verdict; composition IDs (CC_MIN / CC_DOC_ONLY / CC_CUSTOM) support comparable benchmarks.
• A2A Protocol alignment: optional a2a_correlation and schemas/a2a_v1_surfaces.json follow Task / TaskState shapes from the Agent2Agent specification.
• Threat model adds T6 (shadow connector / FRC-L0-CONNECTOR-OUT-OF-POLICY) and T7 (opaque secret–workload binding / FRC-L0-SECRET-BINDING-UNKNOWN).

Together this bridges document authenticity to agent-era traceability (instrumentation_trace, L0/L0-D, ABR / ACG / TCR / HAR where applicable).

Machine-validatable artifacts

• schemas/frc_schema_v1_1_0.json — current document-layer FRC.
• schemas/frc_a2a_envelope_v0_2_1.json — audit envelope (agent_verdict, compound_verdict, compound_confidence, optional agent_layer_confidence, a2a_correlation).
• schemas/a2a_v1_surfaces.json — A2A type surfaces for correlation fields.
• examples/frc/, scripts/validate_frc_schemas.py — examples and validation.

Defender-oriented benchmark

Public artifacts focus on taxonomy, measurement contracts, schema surfaces, and redacted examples that improve defensive evaluation quality.

Operational evasion playbooks and attack-enabling parameter detail are intentionally excluded from open release.

• RESPONSIBLE_RELEASE_POLICY.md
• examples/l2e/ (redacted fixture examples only)
• schemas/l2e_fixture_schema_v0_1_0.json

From spec to corpus

• Forensic packet collection workflow (collect_forensic_packet.py) for repeatable corpus acquisition pipelines.
• Schema-valid decision artifacts using FRC/FRC A2A outputs and fixtures in this repository.

Related repo artifacts: examples/frc/ · tests/frc/ · CHANGELOG.md

Measurement contract for the agent era

As AI generation quality and agent-mediated onboarding velocity rise, trust controls must move from static checks to measurable, reproducible evidence chains.