Disclosure: I wrote the original of this text in Chinese. English is not my first language, so I used an AI tool (Claude) to polish the English version.
Inspiration
A few months ago I came across a report on a Stanford model that works out where a photo was taken better than all but the top 0.01 percent of players of a location-guessing game [1, 2], and by 2025 ordinary chatbots were doing the same trick on request [3]. I went back to my own photos with that in mind: family pictures, trips, the view from a hotel window, all posted without a second thought. The question I could not shake was whether someone could take what my family and I had already shared and work out where we live.
The obvious place for such a check would be the social network itself, and that is exactly the wrong place. To run the check, you have to hand over at least the photos, or even your street, your house number etc.. If a platform did that for me, I would be uploading the most sensitive things I own to a device that is not mine. The check only makes sense if nothing leaves my own hardware.
My phone can strip GPS data and blur a face, but reading forty photos with a vision model and comparing them with everything else I have ever shared is more than a phone does well. A local machine, e.g. a NAS in my opinion should be the right compromise. It already holds the whole library, it has the compute to run a vision model locally, and UGREEN's NAS already indexes faces, text in photos and capture times. It also sits upstream of every channel: The photos reach the family group chat, the school chat, Instagram and the print shop by the same route, phone or camera first, then NAS, the risk is detected before published.
What it does
One photo can be enough. A readable street sign in the background, a house number on the door, a hotel's name on a napkin: each of these alone can place a photo. But I was at least as worried about combinations. The door photo from March says little by itself. The street sign in the background of a photo from July says little by itself. Posted together, they are an address. The same is true on holiday: a window view in one photo and the hotel's logo in another tell a stranger where the family is sleeping this week.
So PieceTogether does two things before you share. First, every photo gets a risk index from 0 to 100, which is my estimate of how far a stranger could get from that photo alone. A readable street sign scores 85 on its own. Second, the whole set gets an index, which rises above the best single photo only when photos combine: a house number in one and the street in another, a window view in one and a landmark in another (a view from a window is enough for map-matching tools to recover the camera position and heading [4]), or a caption you posted years ago that names the street. For the last case, you can put your own Instagram or Facebook export on the NAS and the Skill treats everything in it as already public.
The report then lists the photos that are a risk on their own and removes photos one at a time, showing how the set index falls, for example "without photo 9: 95 to 45". That tells you exactly which pictures to leave out. If you say yes, it tags those photos and collects them in a review album. It never edits, moves or deletes a photo, and nothing leaves the NAS.
How I built it
PieceTogether is a Uliya Skill. Uliya is the assistant built into UGREEN's AI NAS, and a Skill is a Markdown instruction package that tells Uliya how to carry out a workflow with the NAS's own experts; it contains no code. The Skill asks those experts to do the work: the photo expert lists the album, reads metadata, runs OCR and the vision model; the file expert reads an export; the knowledge expert saves the report. The Skill itself holds the rules: what counts as a clue, how a clue turns into a score, when two photos together are worse than either alone. Those rules are adapted from recent work on photo geolocation and privacy: the risk levels of DoxBench [5], the disclosure levels of VLM-GeoPrivacyBench [6], the clue types of GeoCloak [7] and the attribute list of VISPR [8], all cited inside the package as well.
I want to be exact about who did what. The idea for this Skill, the decision to put it on the NAS, the two-layer scoring (every photo on its own, then the set) and every product call in this story are mine. The concrete construction leaned heavily on Claude Code running Anthropic's Fable 5.1 model: it wrote the SKILL.md and its references under my direction, built the local test harness and the image scripts, ran the case studies and the blind test, and did most of the fact checking, including finding and verifying the papers cited below. I reviewed every file and every number before it went into this submission, and where the model and I disagreed, the version you are reading is mine.
I did not have a NAS while building it, so a local test harness was built that uses real EXIF data, an offline OCR engine and a 4B vision model of the same class as the one on the NAS. Five albums went through it, two of them real photos, and the Skill was revised seven times on the strength of those runs. We also ran a blind test: twelve geotagged street photos with their titles hidden from me. A frontier model placed four of them within 300 m, every time from text visible in the frame; the 4B model placed two within a kilometre. Nothing in the Skill is trained. The rules are calibrated from that test, the on-device model only reads text and labels scenes, and the Skill does the reasoning.
Challenges I ran into
A 4B model takes words literally. One of my clue labels was "plate", meaning a vehicle plate, and the model filed a dinner plate under it, then a chain was built from the dinner plate. The label is now "vehicle plate". The model refused to flag Tower Bridge until the instruction said that public landmarks count, and it labelled a restaurant as a private interior until the instruction said that public interiors do not. It read a weathered street sign correctly but at low confidence. The chain only formed once I allowed a low-confidence clue to count when its text matches the user's own street, because a model is unlikely to misread a sign into exactly your street name.
The first version of the report printed a surname from a mailbox in two places while masking it in a third. And my first pitch said "one photo is harmless, two are an address". My own blind test said otherwise, so the product now scores every photo on its own before it scores the set.
Accomplishments that I'm proud of
The output is a decision rather than a warning: this photo is 85 on its own, and without it the album drops from 95 to 45. Facts such as GPS and OCR hits are never mixed with the model's findings in the report. The Skill passes the official checker with zero errors and zero warnings. And every number in this story comes from my own runs.
What I learned
Readable text is the whole game at street level. Architecture and street furniture give away the country almost every time and the city often, so "city at best" is a floor, never a safe outcome. A bigger model is not a better attacker by itself: on my blind set the 8B model was more cautious than the 4B, not more accurate. What the frontier model adds is small-text reading and world knowledge, which is why a miss by the on-device model is never reassurance.
What's next for PieceTogether
Run it on a real UGREEN NAS and tune the scores against real family photos instead of synthetic ones. Then publish it on the UGREEN Skills Hub, add extra German and Chinese support, and let users flag false alarms so the scoring improves from real use.
References
- Haas, L., Skreta, M., Alberti, S., Finn, C. PIGEON: Predicting Image Geolocations. CVPR 2024. https://arxiv.org/abs/2307.05845
- PetaPixel, 28 December 2023. This AI Can Geolocate Photos Faster and More Accurately Than Any Human. https://petapixel.com/2023/12/28/this-ai-can-geolocate-photos-faster-and-more-accurately-than-any-human
- TechCrunch, 17 April 2025. The latest viral ChatGPT trend is doing "reverse location search" from photos. https://techcrunch.com/2025/04/17/the-latest-viral-chatgpt-trend-is-doing-reverse-location-search-from-photos
- Sarlin, P.-E., DeTone, D., Yang, T.-Y., Avetisyan, A., Straub, J., Malisiewicz, T., Bulo, S. R., Newcombe, R., Kontschieder, P., Balntas, V. OrienterNet: Visual Localization in 2D Public Maps with Neural Matching. CVPR 2023. https://arxiv.org/abs/2304.02009
- Luo, W., Lu, T., Zhang, Q., Liu, X., Hu, B., Zhao, Y., Zhao, J., Gao, S., McDaniel, P., Xiang, Z., Xiao, C. Doxing via the Lens: Revealing Location-related Privacy Leakage on Multi-modal Large Reasoning Models. ICLR 2026. https://arxiv.org/abs/2504.19373
- Yang, R., Mendes, E., Wang, A., Hays, J., Das, S., Xu, W., Ritter, A. Do Vision-Language Models Respect Contextual Integrity in Location Disclosure? 2026. https://arxiv.org/abs/2602.05023
- Wu, Y., Li, M., Shen, Y., Backes, M., Zhang, Y. GeoCloak: An Agentic Framework for Semantics-Preserving Geolocation Privacy via Peripheral Clue Manipulation. 2026. https://arxiv.org/abs/2610.20055
- Orekondy, T., Schiele, B., Fritz, M. Towards a Visual Privacy Advisor: Understanding and Predicting Privacy Risks in Images. ICCV 2017. https://arxiv.org/abs/1703.10660
Log in or sign up for Devpost to join the conversation.