Beats screenshot + OCR and single-frame vision models, not a multi-frame optical-flow attack — see attacks. Demo verifies client-side; production must verify on the server.