04 · Metadata detector
Metadata
Examines metadata that travels alongside content: HTTP headers, EXIF data, container fields, embedded URIs. Often carries signal that the content body alone does not.
What it processes
Examines metadata that travels alongside content: HTTP headers, EXIF data, container fields, embedded URIs. Often carries signal that the content body alone does not.
Adversarial patterns it is tuned to catch
- URLs embedded in EXIF or container metadata that point at known-bad domains
- Mismatches between declared MIME type and actual content shape
- Tracking and re-routing payloads embedded in delivery envelopes
- Stripped or spoofed provenance fields
Contribution to the ensemble verdict
Acts as both a primary signal and a router: certain metadata patterns route content through stricter detector configurations.
Per-detector outputs are not a final verdict. The ensemble layer reads all nine and decides; the per-detector contribution is preserved in the evidence trace so the verdict remains auditable.