Watermark Attacks Watermark: Re-Watermarking as a General Removal Strategy

The researchers propose re-watermarking to attack existing watermarks, and verify on 96 combinations of datasets, victim watermarks and attack watermarks that the original watermark signal can be reliably suppressed. The method does not require gradients, surrogate models or detection keys. The authors also propose a simple classifier to identify the presence and identity of existing watermarks in images, reporting overall accuracy of 0.878 to 0.953. Combining watermark identification with re-watermarking reduces bit accuracy by at least 25% and at most 48%. The authors consider this a low-cost, general and effective attack pipeline, and raise questions about the reliability of existing watermarking schemes.