Which container survives everyday handling?
The same 1,579-byte SMS model in seven containers, put through transformations a normal workflow applies: re-save, re-encode, transcode, resize, rotate, rewrite, strip metadata. Green means the model still decodes. Red means it does not. This is a survival test, not a security proof.
The matrix
| operation | result | detail |
|---|---|---|
| Loading survival.json… | ||
What survives
- XLSX and single HTML are the best archival carriers. The model is in the
content — cells in the workbook, examples in the HTML — not in metadata a tool might
drop. An
openpyxlre-save kept all 483 model cells and 3 formulas. A sanitizer that strips<script>kills the HTML classifier. - PDF is the best document workflow, not an editable document. A
pypdfrewrite kept/Keywordsand/TinyAISHA256; rebuilding the PDF without its Info dictionary — a proxy for print-to-PDF — lost both. Treat the PDF as an artifact, not a scratch document. - PNG and WAV are lossless only. A PNG re-save and a metadata strip keep the pixels; JPEG q80 and a 16×16 resize lose the model. PCM and FLAC keep the samples; MP3 128k and Opus 32k turn the length prefix into garbage.
- QR is the most robust image. The 2,158-byte URL still decoded after a
downscale to 10% (161×161), JPEG q5, a 4-pixel blur and a 20° rotation. Drop the
#fragmentand it is gone: only client-side URL handling preserves the model. - SVG is text, so it survives a copy but not a rasterizer. The XML and its
<metadata id="tinyai">element survive byte copies; stripping the metadata or flattening the image to PNG removes the model. - A prompt is not a container. It is tiny, but it depends on a shared base; it does not travel alone.
What this means
Pick the container for the workflow, not for the demo:
- Archive / hand to a colleague: single HTML or XLSX.
- Human-readable provenance: PDF, with the understanding that metadata is fragile.
- Physical sharing: QR; the image survives print-size abuse, but long URLs do not survive chat or server-side redirects.
- Images and audio: only if the platform keeps the original bytes. Most social and chat pipelines do not.
The demo PDF carries a full SHA-256 in /TinyAISHA256; the
JSON includes the same digest. The PDF viewer checks it. It detects a changed model; it
does not prevent a rewrite, and it is not a signature.
Reproduce
python demo/survival_test.py writes
survival.json. It uses clean digital transformations only;
no phone camera, no Excel/LibreOffice, no Google Sheets, no PDF/A converter.
Machine, date and model hash
Model: 1,579-byte int8 Complement NB, 93.54% on 1,115 held-out SMS. See the Minimum-Bit Table for the caveats.
The containers
3.7 KB PDF · 175 KB PDF · 4.9 KB SVG · 1.5 KB favicon · 1.6 KB WAV · 10.5 KB spreadsheet · 2.2 KB QR · single HTML · train your own