starlens/ whitepaper

starlens: smaller images, with a receipt

An s2ar whitepaper · 2026-07-09

Cut 92–99% of your vision tokens — with a sealed, per-request certificate proving your model's answer didn't move. Every number in this document is measured, and every measurement replays from a public command. Don't trust us — re-run the seed.

The problem: images bill by dimensions, and nobody guarantees anything

Vision models charge for pixels, not bytes. Anthropic bills roughly one token per 750 pixels; OpenAI and Gemini bill per tile. Two consequences follow:

JPEG quality knobs are worthless here. We measured it: requantizing to quality 25 leaves answers intact — and saves exactly 0.0% of tokens, because dimensions didn't change. The knob the industry ships optimizes a number nobody bills on. Downscaling is what saves money.
Screenshots can't ride prompt caching. A fresh image per agent turn pays full price every turn — precisely where text-side caching saves nothing.

So: downscale. But how far? Every existing answer is an aggregate: "our method retains 95% benchmark accuracy on average." An average is not a guarantee about your image, compressed this far, read by your model. When the average is wrong, you find out in production.

The certificate

starlens compresses an image and returns a sealed fidelity certificate alongside it:

a deterministic witness measured what the compression changed in what the model reads — at the provider's own working resolution, not yours;
the certificate records the witness, the measured drift, the tolerance, the target model, the per-provider token savings, and a seed — sealed under a record_sha256 you can re-derive;
when no compression is safe, you get a certified refusal, not a degraded image. A refusal is information: this image's content is the signal, don't touch it.

Deterministic means re-runnable: the same input produces byte-identical output (which also keeps provider prompt caches warm), and /v1/verify replays any certificate from its hash. This is the same evidence discipline behind stardata's reward-quality audits — a measurement the customer can recompute is the only kind that can't be quietly fudged. A certificate is a subscript in both of that word's old senses: it underwrites what was written, and it is the last thing written.

Why a witness, and why it must be chosen carefully

"Witness" is the philologist's term, not the courtroom's: a manuscript that attests a reading. Witnesses differ; each has a known corruption profile (this one drops line-endings, that one is blind outside print); they are collated and weighed, not counted — and no witness is the text. That is exactly how starlens treats its witnesses: each attests what an image still says to a reader, each fails in a measured, characteristic way, and the certificate names which witness stood behind the verdict.

Pixel-error metrics are calibrated to human eyes, not machine readers. We measured what that costs, across eleven production models and 12123 sealed model calls — including a 110-item license-verified public corpus and a 175-item held-out split our tolerances never saw:

RMSE over-certifies small/dense text for every model we measured. On the worst item RMSE calls x0.051 "identical" while typical models stop extracting the right value at x0.2. On real held-out content the naive RMSE policy silently loses 42–50% of answers while shipping the biggest savings number on the board.
No single cheap witness is safe on every kind of content. Gradient energy is near-perfect on game frames and renders but over-certifies small text that slips the OCR gate; SSIM is the best general single witness but misses on charts. Their failure classes are disjoint — so starlens certifies with the collation: stable text gets the OCR witness, and everything else must satisfy gradient energy AND SSIM together. Two witnesses, weighed against each other, each with a known corruption profile — and every witness must first pass a stability self-test on your image before its verdict counts.
The composite is near-safe on every corpus we can measure (band-safety geomean 0.98–1.0; its residual misses are 2–3 chart items per model, and we say so).

Two numbers to keep. In-sample, the calibrated policy retains 100% of answers. Out-of-sample — on 175 held-out items the tolerances never saw — it retains 96–97%, converting what it cannot safely compress into certified refusals rather than silent losses. That second number is the one we'd put in a contract.

Calibrated to your model, not "models in general"

The same compressed image is fine for one reader and broken for another. We measured the isomorphic band per model, and the spread is real: tolerance scales run from 0.75 (Gemini Flash tier — the most compression-robust readers we measured) down to 0.5 (open-weights and Grok-class readers), every row now calibrated on the public mixed-content corpus. Typical measured savings across the eleven calibrated models: 86–96% of image tokens (area proxy; billed savings depend on the provider's tiling).

Cross-model transfer is one-directional. Compression certified for the most robust reader breaks other models down to 0.58 accuracy; compression certified for a fragile reader is safe for robust ones (≥0.96 everywhere we measured). That is why every certificate names its target model — and why a multi-model pipeline should certify for its weakest reader.

Receiver standards have a long record of being presumed instead of measured: computer graphics' first digital human standardized one pilot's body for every cockpit it would ever design, and nobody measured the pilots. The tiers table is the opposite bet — no canonical reader, a measured row per model, and a refusal wherever the measurement says no.

Calibration is cheap enough to track the model market: an adaptive band-finder needs ~50% fewer model calls and lands the same band 95% of the time, so measuring a newly released model costs tens of cents. The tolerance table is maintained, not owned: it stays true only while the weekly recalibration keeps walking it — models ship, providers change resizes, and an unwalked table quietly expires. When a new flagship ships, its measured row appears without a code change.

The tolerance is a dial, and the dial is priced. For the fully-measured models the tiers table ships a measured operating curve: loosen the tolerance and the held-out numbers move from 4% wrong / 43% refused / 22% billed savings (the shipped default for Claude Sonnet 4.6) to 10% / 31% / 35%, and on out to 23% / 12% / 57% — you choose the risk, and every point on the dial is a measurement on data we never fit to, not an extrapolation. We also tested the fashionable upgrade: conformal calibration, which promises "at most an α-fraction of certified items wrong." Measured honestly, the promise survives out-of-sample only at the tightest setting and only for readers whose content mix the witness fully sees — where it fails, it fails through the witness's blind spots. So the dial ships as measured numbers, not guarantee language; the preprint has the full verdict table.

What about detail:low?

OpenAI's detail:low is the strongest blind knob we measured: 85.0% savings at 96% accuracy retained on GPT-4o-mini. If you never send small text and only use OpenAI models, it's a good deal. Its limits are structural: one fixed operating point (no adaptivity to what's in the image), no per-request verdict, nothing equivalent on Anthropic or Gemini, and on third-party hosts the field can be silently ignored — which is the aggregate-average gamble again. starlens certifies per image, per model, on every provider, and tells you when the answer is "don't."

Using it

Three ways in, all live today:

The utility model — point an OpenAI-compatible client at https://api.s2ar.dev/v1, model stardata/starlens: send a message with images, get compressed images + certificates back, then send the small images to your real model every turn after. We see only the image — never your conversation or keys.
The LiteLLM hook — a drop-in async_pre_call_hook compresses inline images in-flight inside your own proxy. Your traffic never leaves your infra.
BYO-audit — already compressing? POST /v1/certify measures your pipeline's output and seals the verdict (including "this moved the answer").

The interactive demo at s2ar.dev replays real calibration data: drag the compression and watch each model's actual answer break at its measured cliff.

What we won't claim

Our synthetic corpora are small (26 text/UI, 23 game-frame, 13 render items); the public calibration corpus (110 items) and its held-out split (175 items) are better but still not a census. And whose reading got measured is itself a choice: ours is the agent workload (terminals, UIs, documents), and like every compression standard's calibration material — MP3's ear was tuned by a room of expert listeners whose names nobody kept — it becomes silently normative for everyone downstream. Per-model differences carry wide confidence intervals, so measurements only ever tighten a tolerance, never loosen it. The corpus and the intervals grow on a schedule.
Savings depend on the provider's billing shape. Anthropic's per-pixel billing yields the smooth 92–99% figures; tile-billed providers floor out (below a point, more compression buys zero tokens — so we stop there).
The per-request certificate is deterministic. The model-in-loop measurements behind the per-model tolerances are labeled deterministic:false on every certificate they inform — calibration evidence, not per-request proof.
Answer preservation is measured on extraction-style reads (the agent/OCR/UI workload), not open-ended image description.

The full methodology, statistics, and the negative results — including where our own pipeline initially fooled us and the guards that caught it — are in the working preprint. Every figure regenerates from the sealed cache at zero API cost.

s2ar — the trust and measurement layer. starlens extends the same primitive that audits RL reward functions to the inputs you pay for: a meaning-preserving transform, a witness, a tolerance, and a seal you can re-run.