Image Privacy Transform Evidence — Metadata Absence & Hashes

Fixed re-encode one to five inline JPEG, PNG, or WebP images and return count-only source metadata presence, verified output absence, Base64 output, dimensions, and SHA-256 evidence. Runtime network and filesystem operations are always zero.

Input is exactly images[].imageBase64 plus global targetFormat=png|jpeg|webp. Canonical standard Base64 is required. URLs, paths, quality, resize, crop, metadata overrides, unknown fields, animation, and other formats are rejected.

Privacy and safety boundary

• 5 images, 4 MiB decoded input total, 10,000 pixels per dimension
• 10 million decoded pixels total, checked from all headers before any full load
• single-frame JPEG/PNG/WebP only; 8 MiB output Base64 total
• magic/decoder match, strict verification/full decode, Pillow bomb warning/error rejection
• in-memory BytesIO only; no temporary file, network, Browser, Proxy, or Secret

Only fixed categories are returned: exif, gps, iptc, xmp, icc, comment, text, other, plus detectedCount. Source metadata values, tag/key names, thumbnails, and binary payloads are never returned or normally logged. Mandatory decoder structures are excluded by fixed Pillow 12.3.0 allowlists: JPEG 4, PNG 0, WebP 4.

EXIF orientation alone is applied to pixels, with only orientationApplied reported. Pixels are copied into a new RGB/RGBA image. Alpha-to-JPEG fails rather than guessing a background. Fixed profiles are PNG compression 9/optimize false, JPEG quality 90/4:2:0/progressive+optimize false, and WebP lossless/method 6. Output is reopened to verify format, dimensions, one frame, and absence of all eight metadata categories.

Warnings are limited to ORIENTATION_APPLIED, COLOR_MODE_CONVERTED, and LOSSY_JPEG_OUTPUT. inputHash, outputHash, imageId, and canonical manifestHash are deterministic for fixed input, dependency, and actor parser.

Visible pixels are retained. Faces, text, license plates, locations shown in pixels, and other PII or confidential content are not detected, blurred, removed, or anonymized. This is not a content-redaction product.

Official PyPI JSON checked 2026-08-15: Pillow==12.3.0, MIT-CMU, Python >=3.10, non-yanked CPython 3.14 Windows amd64 and manylinux x86_64 wheels, with no default runtime dependency. Synthetic BytesIO gate verified JPEG/ZLIB/WebP features, header-first bounds, bomb/truncation rejection, orientation, metadata presence without value logging, deterministic fixed encodes, and reopen absence.

..\..\.venv\Scripts\python.exe -m unittest discover -s tests -v
..\..\.venv\Scripts\python.exe tools/local_actor_smoke.py

Valid requests create one default Dataset item and one built-in apify-default-dataset-item; all failures create zero. Unapproved price hypothesis: $0.005 per successful summary item, maximum $0.005/run. Real-image accuracy, codec differences across platforms, Cloud resource/cost, demand, revenue, and profit remain null.