DeMark: A query-free black-box attack against deepfake watermark defenses

The researchers propose DeMark, a query-free black-box attack framework against deepfake image watermark defenses. The method exploits the weaknesses of encoder-decoder watermark models in the latent space, suppressing the watermark signal through compressed-sensing-based sparsification while preserving the perceptual and structural quality of the image. On eight state-of-the-art watermarking schemes, DeMark reduces watermark detection accuracy from 100% to 32.9% on average while maintaining natural visual quality, outperforming existing attacks. The paper also evaluates three defense strategies—image super-resolution, sparse watermarking, and adversarial training—and finds them largely ineffective, indicating that current encoder-decoder watermarking schemes remain vulnerable to latent space manipulation.