Research proves that invisible image watermarks can be removed by generative AI

1. 01What problem does this paper attempt to solve?

   The authors propose a regeneration attack, argue that pixel-level invisible watermarks can be provably removed, and explore semantic watermarks as an alternative.

   Core question: Are invisible image watermarks necessarily non-robust—is there a fundamental trade-off between the invisibility of a watermark and its resistance to removal.

   • Problem setting: AI-generated images are realistic, and companies such as Google, Microsoft, and OpenAI have committed to adding watermarks to AI-generated images; invisible watermarks do not harm image quality and are not easy for ordinary people to remove, but malicious users will attempt to remove them, so watermarks must resist evasion attacks.
   • Shortcomings of existing methods: The authors divide existing attacks into two categories—destructive attacks (adjusting brightness, JPEG compression, adding Gaussian noise) can remove watermarks but cause large image quality loss; constructive attacks (Gaussian blur, BM3D, learned denoising) preserve image quality but are difficult to remove robust watermarks. Learned watermarks are trained against known attacks, and the authors question the endpoint of this attack-defense cycle.
   • Core observation: Advances in generative models have both created the need for watermarks and made watermark removal easier; combining destruction (adding noise) with construction (generative model reconstruction) may simultaneously achieve watermark removal and image quality preservation.
   • Threat model:
     • Attacker capability: Can only access the watermarked image; the watermark scheme Watermark, auxiliary information aux, and detection algorithm Detect are all unknown; cannot query Detect; can modify the image using any side information and computational power.
     • Attacker goal: Cause the detection algorithm to exhibit a high Type I error (false positive) or high Type II error (false negative), while the output image quality is comparable to the original image.
   • Proposed in the paper: A family of regeneration attacks, which can be instantiated as traditional denoisers, VAEs, or diffusion models; and a theoretical proof is given: for any invisible watermark that perturbs the image within ℓ2 distance (whether or not it has been invented), the attack can provably remove it; the paper also explores semantic watermarks (such as Tree-Ring) as an alternative defense.

   Collapse this answer

2. 02What related research exists?

   Related work covers image watermarking and steganography, deep generative models and purification, and concurrent generative-model-based watermark removal attacks.

   Image watermarking and steganography

   • Early handcrafted methods such as LSB embedding [62], as well as steganography techniques in the spatial domain [17] and frequency domain [24, 44].
   • Deep learning methods: SteganoGAN [66] uses a GAN for steganography; RivaGAN [67] introduces an attention mechanism to improve GAN watermark robustness; SSL watermarking [15] uses self-supervised features; Stable Signature [14] fine-tunes the Latent Diffusion decoder to add watermarks; Tree-Ring [60] proposes a semantic watermark.
   • The paper states that this work targets invisible watermarks rather than visible watermarks: visible watermarks are easy to locate, and their removal techniques have been extensively studied in [35, 21, 10].

   Deep generative models and purification

   • Generative models such as VAE [56, 55], GAN [18], flow models [46], and diffusion models [23, 47] can use latent representations for data purification.
   • The paper notes that the diffusion purification method of [43] is similar to one instance of this paper's regeneration attack, but serves a different purpose (purification is defense, de-watermarking is attack), and the authors claim this paper's theoretical guarantee for watermark removal is stronger.

   Concurrent generative-model de-watermarking attacks (Appendix B.2)

   • DiffWA [32]: uses a distance-guided conditional diffusion model to remove watermarks; the paper notes it applies only to low-resolution images and lacks theoretical guarantees.
   • [49]: trains a substitute classifier and performs a PGD attack to fool a black-box watermark detector; the paper notes it requires multiple queries to the target generator.
   • [37]: an adaptive attack that copies the secret watermark key via a differentiable surrogate key; the paper notes it assumes the attacker knows the watermarking method, a stronger assumption than this paper's.

   Baselines and benchmarks: The experiments compare 5 types of baseline attacks—brightness adjustment, contrast adjustment, JPEG compression, Gaussian noise, and Gaussian blur; the attacked targets are four pixel-level watermarks: DwtDctSvd, RivaGAN, StegaStamp, and SSL, with MS-COCO and SDP-generated images as datasets.

   The authors position this paper as a de-watermarking method that can handle high-resolution images, provides theoretical proof, and does not assume the attacker knows the watermarking algorithm.

   Collapse this answer

3. 03How does the paper address this problem?

   First add noise to disrupt the watermark embedding, then reconstruct the image with a generative model; the theory uses Gaussian differential privacy to provide provable removal and quality preservation.

   The overall idea is to combine destructive attacks with constructive attacks into a regeneration attack: first map the watermarked image to an embedding representation and add Gaussian noise to destroy the watermark, then use a regeneration algorithm to reconstruct the image from the noisy representation.

   Problem formalization

   • Invisible watermark (Definition 2.1): If dist(x, xw) ≤ ∆, the watermark is said to be ∆-invisible with respect to the original image x.
   • Detection (Definition 2.2): Detect outputs 0/1, Type I error ϵ1 is the false positive rate, Type II error ϵ2 is the false negative rate; the attack goal is to raise both simultaneously.
   • Decision threshold: The extracted message m′ is judged as detected if the number of matching bits with the original message m satisfies M(m, m′) ≥ τ; the null hypothesis is rejected at p < 0.01, requiring at least 23 correct bits for a 32-bit watermark (59 bits for 96 bits).

   Attack framework

   • Given an embedding function ϕ, a regeneration function A, and a noise level σ, the attack is x̂ = A(φ(x_w) + 𝒩(0, σ² I_d)), where the first half is destruction and the second half is construction.
   • The choice of ϕ and A affects empirical results but not the theoretical guarantee.

   Three instantiations

   • Instance 1 (identity embedding + denoising reconstruction): ϕ is the identity mapping, and A can use BM3D, TV-denoising, bilateral filtering, DnCNN, or a denoising autoencoder; the denoising autoencoder already adds noise itself, so no additional noise is needed.
   • Instance 2 (VAE): The encoder outputs the mean and variance of a Gaussian distribution and samples from it; noise is already injected in the encoding stage, so no additional noise is needed.
   • Instance 3 (diffusion model, Algorithm 1): xw is mapped to a latent representation z0, noised according to VP-SDE to time step t∗, denoised in reverse using a numerical solver to obtain ẑ0, and then decoded back to an image; the experiments use Stable Diffusion-v2.1 and PNDM sampling, with noise steps [10, 30, 50, 100, 150, 200] (corresponding to σ = [0.10, 0.17, 0.23, 0.34, 0.46, 0.57]).

   Theoretical guarantees

   • Provable removal (Theorem 4.3): Define f-Certified-Watermark-Free (f-CWF), meaning that after the attack any detection algorithm satisfies ϵ2 ≥ f(ϵ1). For a ∆-invisible watermark under ℓ2 distance, if ϕ satisfies the local watermark-specific Lipschitz property (∥ϕ(xw) − ϕ(x)∥ ≤ Lx,w∥xw − x∥), then the attack satisfies f(ϵ₁) = Φ(Φ⁻¹(1−ϵ₁) − L_x,wΔ/σ), meaning that after the attack, detection is no easier than distinguishing the two Gaussian distributions N(0,1) and N(Lx,w∆/σ, 1). The proof uses Gaussian differential privacy [12].
   • Quality preservation (Theorem 4.4): If the generative model can denoise the noised unwatermarked original image to within error ξ with probability at least 1 − δ, then the same model applied to the watermarked image achieves the same error with probability at least 1 − δ̃, where δ̃ is only slightly larger than δ (Corollary 4.5 gives δ̃ ≤ e^(L²∆²/σ²)·δ^(1/2)).
   • Parameter choice (Remark C.5): t∗ should be chosen between the two trivial cases so that Lx,w∆√(α(t∗)/(1−α(t∗))) is a small constant; the smaller the constant, the more thorough the watermark removal, and the larger it is, the higher the reconstruction fidelity.

   Alternative defenses

   • Semantic watermarks do not restrict ℓ2 perturbation, as long as the image content is similar; the paper takes Tree-Ring [60] as an example, which embeds a pattern in the Fourier space of the initial noise vector, and during detection inverts the diffusion process to retrieve the noise vector for verification.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Comparing eight attacks on four pixel-level watermarks, the regeneration attack achieves both a high removal rate and good image quality; the Tree-Ring semantic watermark resists but becomes more visible.

   Experimental setup

   • Watermark schemes tested: Four pixel-level methods: DwtDctSvd [41], RivaGAN [67], StegaStamp [53], and SSL watermark [15]; DwtDctSvd, RivaGAN, and SSL use k = 32 bits, and StegaStamp uses k = 96 bits.
   • Datasets: 500 real photographs randomly selected from MS-COCO; 500 images generated with Stable Diffusion-v2.1 using prompts from the SDP dataset. Experiments were conducted on an Nvidia A6000 GPU.
   • Baseline attacks: Brightness (factor 2–12), contrast (2–7), JPEG (quality 10–60), Gaussian noise (standard deviation 5–30), Gaussian blur (radius 2–12), 6 levels each.
   • Regeneration attack configurations: VAE uses CompressAI's Bmshj2018 and Cheng2020 pretrained compression models (compression factor 1–6); the diffusion attack uses Stable Diffusion-v2.1, noise steps [10, 30, 50, 100, 150, 200], PNDM sampling.
   • Metrics: Image quality uses PSNR, SSIM, FID; watermark robustness uses TPR@FPR=0.01; the detection threshold is correctly decoding 23/32 and 59/96 bits (the main text also mentions 32/48 bits), p < 0.01.
   • Number of repetitions: Not reported in the paper.

   Main results

   Without attack, all four watermarks can be detected 100% of the time (Table 1, TPR@FPR=0.01 all 1.000):

   Swipe horizontally to read the table

   Watermark	MS-COCO PSNR↑	MS-COCO SSIM↑	MS-COCO FID↓	SDP PSNR↑	SDP FID↓
   DwtDctSvd	39.38	0.983	5.28	37.73	9.62
   RivaGAN	40.55	0.978	10.83	40.64	13.56
   SSL	41.79	0.984	18.86	41.88	23.87
   StegaStamp	28.50	0.911	35.91	28.28	41.63

   (According to Table 1; TPR@FPR=0.01 is 1.000 on both datasets)

   • Removal effectiveness: The authors report that VAE-Bmshj2018, VAE-Cheng2020, and the diffusion attack all achieve removal rates exceeding 99% on the three watermarks DwtDctSvd, RivaGAN, and SSL (Figure 4, 7); StegaStamp is the most robust, and only the diffusion attack with large noise can effectively remove it.
   • Image quality: The introduction reports that for RivaGAN, the regeneration attack removes 98% of the watermark while PSNR remains above 30; VAE has higher PSNR/SSIM, but Figure 3 shows that VAE outputs are blurry, and the authors believe PSNR/SSIM are insensitive to blur, and the choice between diffusion and VAE should depend on application requirements.
   • Theoretical validation: Figure 2 shows that the empirical trade-off curve of the DwtDctSvd detector after the diffusion attack (σ = 1.16∆, L taken as the empirical upper bound 1, 500 MS-COCO images) lies outside the theoretically impossible region, and the authors state that the empirical detection performance is worse than the theoretical bound.

   Semantic watermark defense experiments

   • Setup: Tree-Ring adds a watermark during generation and requires text input, so MS-COCO captions and SDP user prompts are used as input, and then the same attacks are applied.
   • Results: Tree-Ring remains detectable under all tested attacks (Table 2): on MS-COCO, the lowest TPR@FPR=0.01 is 0.998 (VAE-Bmshj2018-3), and after the diffusion attack (Diffusion model-60) it is 1.000; on SDP, the lowest is 0.994 (JPEG-50, VAE-Bmshj2018-3, VAE-Cheng2020-3), and after the diffusion attack it is 0.998.
   • Cost: Figure 14 shows that the ℓ2 distances between Tree-Ring watermarked images and the original images in both pixel space and latent space are significantly larger than those of the four pixel-level watermarks, and the authors state that robustness comes at the cost of the watermark becoming more visible.

   Other ablations and analyses

   • Noise level: Figure 4, 7 show that increasing the noise level of the diffusion attack improves the removal rate for StegaStamp, while image quality decreases, consistent with the theory that "larger perturbations require more noise."
   • Embedding compression: Figure 5 shows that the ℓ2 distances of the four watermarks in latent space are smaller than in pixel space, and the authors state that neural embedding compresses the watermark perturbation; StegaStamp has the largest perturbation in both spaces.
   • RivaGAN theoretical validation: Figure 12 gives the theoretical and empirical trade-off curves for RivaGAN under a diffusion attack with σ = 0.57.
   • Exception: StegaStamp is the only watermark that cannot be effectively removed by the VAE attack, and the authors attribute this partly to its lower visual quality and larger perturbation (Table 1, Figure 5, 6).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors discuss open problems such as the Lipschitz upper bound of neural embeddings and the choice of noise mechanism, and point out that semantic watermarks trade visibility for robustness.

   Limitations and future directions noted by the authors

   • Uniform upper bound for neural embeddings (Appendix A): The guarantee of Theorem 4.3 relies on the local Lipschitz parameter Lx,w specific to the image and watermark; the authors believe that neural embeddings such as VAEs and diffusion models have a uniform upper bound, but due to the adversarial example phenomenon it may be ≫ 1 and too conservative to be practical.
   • Exception for adversarial watermarks (Appendix A): The authors believe that if the watermark perturbation is carefully designed to align with adversarial perturbations, the watermarked image will be more resistant to attacks that use neural embeddings (but not to attacks that do not use neural embeddings).
   • Theoretical applicability to VAEs (Remark C.6): Theorem 4.3 does not directly apply to VAEs because their noise variance depends on the input; it is necessary to manually perturb the input or latent vector to provide a provable guarantee, or to use techniques such as Smooth Sensitivity and Propose-Test-Release.
   • Choice of noise mechanism (Appendix A): Besides Gaussian noise, perturbation mechanisms from differential privacy and cryptography such as Laplace noise can also be used; the authors state that systematically studying the impact of noise choice (and stochastic quantization methods) is an interesting future direction.
   • Cost of semantic watermarks (Appendix E.2): The robustness of Tree-Ring comes at the cost of a larger difference between the image and the original, and the authors state that it is "not a perfect solution" and that the watermark becomes somewhat "visible."

   Scope of experiments

   • The pixel-level watermarks tested are 4 in total: DwtDctSvd, RivaGAN, StegaStamp, and SSL; only one semantic watermark defense, Tree-Ring, was evaluated (Appendix E).
   • The datasets are 500 real images from MS-COCO and 500 SDP images generated by Stable Diffusion-v2.1.
   • The regeneration attack is instantiated as three types: VAE (Bmshj2018, Cheng2020) and diffusion model (Stable Diffusion-v2.1); the baseline attacks are five categories: brightness, contrast, JPEG, Gaussian noise, and Gaussian blur.
   • The paper does not report the number of repetitions for each experimental condition, nor does it report attack time or computational cost figures.
   • The theoretical experiments (Figure 2, 12) were conducted on 500 MS-COCO images, with L taken as the empirical upper bound 1.

   Collapse this answer

6. 06Summarize the main content of the paper

   The regeneration attack combines noise addition with generative model reconstruction and can provably remove pixel-level invisible watermarks; semantic watermarks are a possible alternative direction.

   An attack paper on the robustness of invisible image watermarks, asking whether there is a fundamental trade-off between watermark invisibility and resistance to removal.

   • Problem: AI companies promise to add invisible watermarks to generated images to protect copyright and identify provenance, but existing destructive attacks degrade image quality, constructive attacks struggle to remove robust watermarks, and the attack-defense cycle has no end.
   • Method: The regeneration attack first maps the watermarked image to an embedding representation and adds Gaussian noise, then reconstructs the image using a denoising algorithm, VAE, or diffusion model; the attacker does not need to know the watermarking scheme and cannot query the detector. The theory uses Gaussian differential privacy to prove that for any ∆-invisible watermark within ℓ2 distance, no detection algorithm after the attack can simultaneously maintain a low false positive rate and a low false negative rate, and the reconstructed image is close to the unwatermarked original.
   • Results: On the three watermarks DwtDctSvd, RivaGAN, and SSL, the VAE and diffusion attacks achieve removal rates above 99%; for RivaGAN, 98% of the watermark is removed with PSNR above 30; StegaStamp is the most robust due to larger perturbations, and only the large-noise diffusion attack is effective. Empirical detection performance is consistent with the theoretical bound (Figure 2).
   • Alternative defense: The semantic watermark Tree-Ring remains detectable under all tested attacks (TPR@FPR=0.01 ≥ 0.998 on MS-COCO), but the watermarked images differ noticeably more from the originals.
   • Authors' conclusion: Pixel-level invisible watermarks are fragile under the regeneration attack, and the authors believe research and industry focus should shift from invisible watermarks to alternatives such as semantics-preserving watermarks.

   Collapse this answer

Related papers