StegoGuard - O11
Detects and disrupts steganographic payloads in images before they reach AI APIs.


WHAT IT DOES
------------

Steganographic embedding hides malicious prompt-injection instructions inside
image files - in pixel values, DCT frequency coefficients, or transparency
channels - in ways that are invisible to human reviewers but are faithfully
processed by vision-language models.

StegoGuard re-encodes every uploaded image through a lossy JPEG round-trip
that unpredictably alters the exact pixel values the payload depends on,
degrading or destroying the hidden instructions. An optional Gaussian blur
step (Sigma > 0) can be layered on top to further disrupt spatial-domain
payloads that survive frequency-domain recompression. It also runs a
per-channel LSB analysis on the original image and returns a detection audit
so you can log what was found.


SECURITY PIPELINE POSITION
--------------------------

Layer 1, Priorities 2 and 3 - run after FileMetadataStrip and before
sending to any vision-capable AI model.

    RawImage
      -> FileMetadataStrip.StripFileMetadata()   [remove EXIF/IPTC/XMP]
      -> StegoGuard.RecompressImage()            [disrupt pixel stego +
                                                    Gaussian filter + audit]
      -> AI API


SERVER ACTION - RecompressImage
-------------------------------

Inputs:

  RawImage       Binary Data   Raw image bytes. Recognised formats include
                              JPEG, PNG (+ alpha), GIF, BMP, TIFF, WebP,
                              APNG, AVIF, HEIC, JXL, JPEG 2000, PSD, and
                              camera RAW. Non-image inputs pass through
                              unchanged with IsPassthrough = True.

  Quality       Integer       JPEG quality 1-100. Recommended: 85.
                              0 defaults to 85. Applies to every output
                              format (controls the intermediate JPEG encode
                              that drives the disruption).

  OutputFormat   Text          ""     preserve original format (default)
                               "JPEG" force JPEG (max disruption; alpha
                                      flattened)
                               "JPG"   same as JPEG
                               "PNG"   force PNG
                              Any other value preserves the input format.

  Sigma         Decimal       Gaussian blur sigma applied after
                              recompression.
                              0   (default) or negative disables the filter
                              0.5 general use
                              1.0 high-security contexts


Output structure - StegoGuardResult:

  CleanImage       Binary Data       Re-encoded image, safe for AI APIs.
  OriginalFormat   Text             Detected input format (Jpeg, Png, Gif,
                                     ...). PSB reports as Psd; J2C/J2K
                                    report as Jp2. Empty when
                                    IsPassthrough.
  OutputFormat     Text             Actual output format. Matches input by
                                    default; forced to Jpeg or Png when
                                    the parameter is set; Jpeg for camera-
                                    RAW and HEIC inputs (transcoded on
                                    write).
  IsPassthrough   Boolean           True when input is not a recognised
                                    image.
  ProcessingError Text             Non-empty when recompression failed.
  StegoAudit       StegoAuditResult Detection audit (nested, see below).


Nested structure - StegoAuditResult:

  DetectedType         Text     "RGB pixel LSB", "Alpha-channel LSB",
                                 "RGB + Alpha pixel LSB", or empty.
  Confidence           Decimal 0.0 - 1.0. Above 0.7 indicates likely
                                LSB stego.
  RedLsb1Fraction       Decimal Fraction of Red pixels with LSB=1.
                                Near 0.5 = suspicious.
  GreenLsb1Fraction     Decimal Same for Green.
  BlueLsb1Fraction     Decimal Same for Blue.
  AlphaLsb1Fraction     Decimal Same for Alpha. -1.0 = no alpha channel.
  GaussianSigmaApplied Decimal Sigma actually applied. 0.0 when Sigma
                                was 0 or negative, or when IsPassthrough
                                is True.


SUPPORTED FORMATS
-----------------

Recompressed (52 formats):
  JPEG, PNG (with alpha), PNG subformats (Png8/24/32/48/64/00), GIF,
  animated GIF, BMP, DIB, TIFF, multi-frame TIFF, WebP, animated WebP,
  APNG, AVIF, HEIC (transcoded to JPEG), JXL, JPEG 2000 (JP2 + J2C code
  stream), UHDR, PSD, PSB, DDS, DPX, CIN, DCX, EXR, FITS, HDR, MNG, MPO,
  MSVG, SVG, QOI, SGI, SUN, PCX, XPM, XBM, Netpbm (PBM/PGM/PPM/PNM), and
  camera RAW (DNG, CR2, NEF, ARW, ORF, PEF).

Returned as passthrough on the current Magick.NET-Q8-AnyCPU build
(14 formats):
  HEIF mif1, AI (Adobe Illustrator), TGA, DCM, ICO, JBIG, JXR/WDP, PCD,
  PICT, RAF, WBMP, WMF, X3F, XCF.

Non-image inputs (returned unchanged with IsPassthrough = True):
  PDF, DOCX/XLSX/PPTX, ODT/ODS/ODP, RTF, EPUB, audio (MP3/WAV/FLAC/OGG/
  M4A/AIFF), video (MP4/MOV/MKV/AVI/WMV), plain text, JSON, XML, CSV.

Animated GIFs, animated WebPs, and multi-frame TIFFs are fully supported:
the JPEG round-trip disruption is applied to every frame, and animation
metadata (delay, iterations, disposal method) is preserved.


COMPATIBILITY
---------------------------------

Works on standard OutSystems 11 servers
including the OutSystems Personal Environment sandbox
(outsystemscloud.com), via a two-engine architecture:

Primary engine - Magick.NET.
  On healthy O11 hosts, image recompression uses Magick.NET-Q8-AnyCPU
  and delivers the full 52-format matrix. The XIF ships the Microsoft
  VC++ 2015-2022 x64 runtime and four BCL shim assemblies alongside
  Magick.Native-Q8-x64.dll, and preloads the native library from an
  absolute path with LOAD_WITH_ALTERED_SEARCH_PATH on first use, to
  maximise the set of hosts on which the primary engine initialises
  successfully.

Fallback engine - System.Drawing (GDI+).
  On hosts where Magick.Native-Q8-x64.dll cannot initialise despite
  those mitigations (host-side native-code loader policy on the
  Personal Environment sandbox is the currently known case), the
  extension catches the System.TypeInitializationException on first
  use, latches a static AppDomain-scoped flag, and switches every
  subsequent RecompressImage call to a pure-managed GDI+ pipeline.
  GDI+ (gdiplus.dll) is a Windows built-in KnownDLL and is not subject
  to the VC++ / EDR / WDAC restrictions that block the native
  ImageMagick runtime. No host-side configuration is required.

  The fallback engine partitions every call into one of three
  deterministic outcomes:

    Passthrough       Input is not a recognised image (plain text,
                      PDF, arbitrary bytes). IsPassthrough = True,
                      ProcessingError = "". Identical to the primary
                      engine on non-image inputs.

    Actively processed Input is a recognised image in a GDI+-supported
                      format: JPEG, PNG, GIF (including animated
                      multi-frame), BMP, TIFF (multi-page). JPEG
                      round-trip, optional Gaussian filter, and per-
                      channel LSB audit all applied normally.

    Error result       Input is a recognised image in a format GDI+
                      cannot decode: WebP, HEIC, HEIF, AVIF, JXL,
                      JPEG 2000, camera RAW, PSD/PSB, DDS, DPX, CIN,
                      EXR, FITS, HDR, MNG, MPO, MSVG, SVG, QOI, SGI,
                      SUN, PCX/DCX, XPM, XBM, PBM/PGM/PPM/PNM, JBIG,
                      XCF, WMF, JXR/WDP, AI, ICO, and all other exotic
                      formats. IsPassthrough = False, CleanImage =
                      original bytes, ProcessingError = "Image format
                       'X' is not supported by the GDI+ fallback
                      engine...". The caller receives an explicit
                      failure signal instead of a silent passthrough.

  Known limitation of the actively-processed path: animated GIF frames
  are recompressed but per-frame delay metadata is not preserved -
  the output uses default GIF timing.

The fallback engine is inactive on hosts where Magick.NET initialises
normally, and behaviour there is unchanged. No separate installation
or configuration steps are needed on any host.


REQUIREMENTS
------------

  OutSystems 11
  .NET Framework 4.8


DEPENDENCIES
------------

  Magick.NET-Q8-AnyCPU                     14.15.0   Apache 2.0
  System.Memory                             4.6.3     MIT
  System.Buffers                           4.6.1     MIT
  System.Runtime.CompilerServices.Unsafe   6.1.2     MIT
  System.Numerics.Vectors                   4.6.1     MIT

The four System.* assemblies are BCL shims that Magick.NET.Core
(netstandard2.0) requires at runtime on .NET Framework 4.8. They ship
inside the XIF at xif/StegoGuard/Source/NET/Bin/ and are referenced by
the XIF's csproj; no separate installation is needed on the O11 server.
The Microsoft VC++ 2015-2022 x64 runtime DLLs (vcruntime140,
vcruntime140_1, msvcp140, msvcp140_1, msvcp140_2, vcomp140, concrt140)
are also bundled inside the XIF so the primary engine can initialise
on hosts where the OS-level VC++ runtime is missing or blocked.