# Third-party notices for the Safe Image Content layer

This directory ships pre-built third-party JavaScript and pre-trained
machine-learning model weights that power the optional, opt-in image
blurring layers (gated by `IMAGE_BLUR_LEVEL` / the legacy
`SAFE_IMAGE_CONTENT_CHECK_ENABLE` and `BLUR_ALL_PAGE_IMAGES_ENABLE`
policies, with the active classifiers selected by
`IMAGE_BLUR_CATEGORIES`). The layer runs entirely client-side in an
offscreen document and never sends thumbnail bytes or classifier
output off the device.

Two classifiers are shipped: the NSFWJS MobileNetV2 adult/sexual model
(vendored offline in full) and an optional Vision Transformer violence
classifier. The violence model's runtime (Transformers.js + ONNX
Runtime Web) is vendored offline here; only the violence model
*weights* are downloaded at runtime from Hugging Face, at a pinned
immutable commit and verified against the SHA-256 recorded below before
the first inference.

The components below retain their original licenses; the iboss Cloud
Connector is not relicensing them. Consumers and auditors can verify
the upstream sources and license texts at the references provided.

---

## TensorFlow.js (`tf.min.js` is bundled inside `nsfwjs.min.js`)

- Project: TensorFlow.js
- Upstream: https://github.com/tensorflow/tfjs
- Pinned version: `4.22.0`
- License: **Apache License 2.0**
- License text: https://github.com/tensorflow/tfjs/blob/master/LICENSE

> Copyright 2017-present The TensorFlow Authors. All Rights Reserved.

This product includes software developed at The TensorFlow Authors
(https://www.tensorflow.org/). Redistribution and use in source and
binary forms, with or without modification, are permitted under the
terms of the Apache License, Version 2.0.

A copy of the Apache License, Version 2.0 may be obtained at
http://www.apache.org/licenses/LICENSE-2.0. Unless required by
applicable law or agreed to in writing, software distributed under the
License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied. See the License
for the specific language governing permissions and limitations
under the License.

---

## NSFWJS library (`nsfwjs.min.js`)

- Project: NSFWJS
- Upstream: https://github.com/infinitered/nsfwjs
- Pinned version: `4.3.0`
- License: **MIT License**

> MIT License
>
> Copyright (c) 2019 Infinite Red, Inc.
>
> Permission is hereby granted, free of charge, to any person obtaining a copy
> of this software and associated documentation files (the "Software"), to deal
> in the Software without restriction, including without limitation the rights
> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> copies of the Software, and to permit persons to whom the Software is
> furnished to do so, subject to the following conditions:
>
> The above copyright notice and this permission notice shall be included in all
> copies or substantial portions of the Software.
>
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
> SOFTWARE.

---

## NSFWJS MobileNetV2 model weights (`model.min.js`, `group1-shard1of1.min.js`)

- Project: NSFWJS pre-trained MobileNetV2 model
- Upstream: https://github.com/infinitered/nsfwjs
  (model artifacts shipped alongside the `nsfwjs` 4.3.0 npm release)
- License: **MIT License** (same MIT grant as the NSFWJS library above,
  per the upstream project's README and license file)
- Classes returned by the model: `Drawing`, `Hentai`, `Neutral`,
  `Porn`, `Sexy`. Of these, the Safe Image Content layer treats
  `(CONTENT_CHECK_MULTIPLIER * Porn) + Sexy + Hentai` as the weighted
  combined adult/sexual confidence score (with `Porn` weighted by the
  managed-policy `CONTENT_CHECK_MULTIPLIER`, validated to 1-10 and
  defaulting to 3) and ignores `Drawing` and `Neutral`. A tile is
  blocked only when that combined score meets or exceeds
  `SAFE_IMAGE_CONTENT_LOCAL_THRESHOLD` AND a signal-strength guard
  passes: `Sexy > 0`, `Hentai > 0`, or `Porn > CONTENT_CHECK_DETECT_LEVEL`
  (validated to 0-100 and defaulting to 25). The guard suppresses
  false-positive blocks on tiles where the model emits a weak Porn
  signal in isolation.

The model weights are derived from MobileNetV2 (Sandler et al., 2018)
re-trained by Infinite Red on a labeled adult/sexual-content dataset.
The weights are redistributed here under the MIT grant published with
the upstream `nsfwjs` release.

---

## Transformers.js (`transformers.min.mjs`)

- Project: Transformers.js (`@huggingface/transformers`)
- Upstream: https://github.com/huggingface/transformers.js
- Pinned version: `3.8.1`
- License: **Apache License 2.0**
- License text: https://github.com/huggingface/transformers.js/blob/main/LICENSE
- Vendored file SHA-256 (lowercase hex):
  - `transformers.min.mjs`:
    `aa5002b70e789798da263f5f99c62bd3e8fcd0c119258a493c40c180648365fa`

> Copyright 2023-present The HuggingFace Inc. team.

Distributed under the Apache License, Version 2.0
(http://www.apache.org/licenses/LICENSE-2.0). Distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND. This file
is the upstream `dist/transformers.min.js` ES-module build, renamed to
`.mjs` so the production minifier passes it through verbatim. It is
loaded only when the `violence` category is enabled.

---

## ONNX Runtime Web (`ort/ort-wasm-simd-threaded.jsep.mjs`, `ort/ort-wasm-simd-threaded.jsep.wasm`)

- Project: ONNX Runtime Web (`onnxruntime-web`)
- Upstream: https://github.com/microsoft/onnxruntime
- Pinned version: `1.22.0-dev.20250409-89f8206ba4`
  (the build pinned by `@huggingface/transformers` 3.8.1)
- License: **MIT License**
- License text: https://github.com/microsoft/onnxruntime/blob/main/LICENSE
- Vendored file SHA-256 (lowercase hex):
  - `ort/ort-wasm-simd-threaded.jsep.mjs`:
    `08fb86ec433c78bfb032c5d84a68b8e8e5a8d81268fa39e24314179a5767a5b9`
  - `ort/ort-wasm-simd-threaded.jsep.wasm`:
    `c46655e8a94afc45338d4cb2b840475f88e5012d524509916e505079c00bfa39`

> Copyright (c) Microsoft Corporation. All rights reserved.
>
> Permission is hereby granted, free of charge, to any person obtaining a copy
> of this software and associated documentation files (the "Software"), to deal
> in the Software without restriction, including without limitation the rights
> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> copies of the Software, and to permit persons to whom the Software is
> furnished to do so, subject to the following conditions:
>
> The above copyright notice and this permission notice shall be included in all
> copies or substantial portions of the Software.
>
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
> SOFTWARE.

The ORT WebAssembly runtime is vendored offline (no runtime CDN);
`offscreen.js` points ORT at this `ort/` directory via
`env.backends.onnx.wasm.wasmPaths`.

---

## Violence detection ViT model weights (downloaded at runtime, not bundled)

- Project: ViT Base Violence Detection (ONNX export)
- Model repo: https://huggingface.co/onnx-community/vit-base-violence-detection-ONNX
- Source model: https://huggingface.co/jaranohaal/vit-base-violence-detection
  (fine-tuned from `google/vit-base-patch16-224-in21k` on the
  "Real Life Violence Situations" dataset)
- Pinned revision (immutable commit): `c04818d`
- Quantization used (chosen per execution backend):
  - WebGPU: `q4f16` (`onnx/model_q4f16.onnx`, 49,432,077 bytes) - 4-bit
    weights with fp16 activations, the GPU-native compute path (fastest
    on the WebGPU EP, and the smallest file).
  - WASM/CPU fallback: `q4` (`onnx/model_q4.onnx`, 56,228,702 bytes) -
    4-bit weights with fp32 activations (fp16 is poorly supported on the
    WASM EP).
  The int8/uint8/quantized variants are intentionally avoided: they
  export the ViT patch-embedding as a `ConvInteger` op that ONNX Runtime
  Web's WASM backend does not implement, so the session fails to create.
  Both q4/q4f16 keep the Conv floating-point (4-bit weights via
  `MatMulNBits`).
- License: **Apache License 2.0**
- License text: https://www.apache.org/licenses/LICENSE-2.0
- Downloaded-file SHA-256 (lowercase hex), verified before first use:
  - `onnx/model_q4f16.onnx` @ `c04818d`:
    `9d02ee64e98f59804094b349302c71301bcb959dea2374b68de99c274c74d780`
  - `onnx/model_q4.onnx` @ `c04818d`:
    `6346ef0c159b3dd99861d339206ab081f29cb2300be74bf69dc48483ddabd5ff`

> Copyright the model authors (jaranohaal / onnx-community).

Distributed under the Apache License, Version 2.0. These weights are
**not** bundled in the extension package; they are fetched from Hugging
Face at the pinned commit the first time the `violence` category is
used, cached locally by Transformers.js, and SHA-256 verified against
the value above before any inference runs. On mismatch the cached bytes
are purged and the violence classifier refuses to run. The model emits
two classes (`LABEL_0` = non-violent, `LABEL_1` = violent, per the
source dataset's alphabetical class ordering); the layer blocks an
image when the violent-class confidence meets the per-tier
`VIOLENCE_CONTENT_THRESHOLD`.

---

## Scope and what is **not** covered

The classifiers bundled/loaded here cover adult/sexual imagery (NSFWJS
MobileNetV2) and violence (ViT). Illegal-drug / substance-abuse imagery
remains explicitly out of scope: no acceptably-licensed pre-trained
on-device model exists today for that category. Adding it in the future
would require either a commercial Vision API, a new iboss
image-moderation endpoint, or a from-scratch in-house model with a
separately licensed training set.

---

## Attribution policy

This file is mirrored into the production zip during `build-prod.sh`
and ships at `services/safeImageContent/LICENSES.md` inside the
extension package, satisfying the Apache 2.0 §4(d) "NOTICE text file
distributed as part of the Derivative Works" requirement and the MIT
"included in all copies" requirement.