Watermarking has emerged as a key defense against the misuse of machine-generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost-effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.
Figures & tables
Figure 1. Overview of HIDE&SEEK . Compared to existing attacks that introduce global modification to the watermarked image so as to remove the embedded watermark, HIDE&SEEK locates the vulnerable pixels and modifies them to purge the watermark while preserving high visual quality.
Symbols
Definitions
X,X~
The original/reconstructed image
Lpix
The pixel loss
Lfrq
The frequency loss
Lpct
The perceptual loss
Lsmt
The semantic loss
C,c
The number/index of channels
Table 1. Notations
Figure 2. HIDE&SEEK Naive Workflow . The adversary first masks the watermarked image with a mask using a strategy and a ratio. Those visible patches are then encoded by the encoder and concatenated with the masked patches, which are then decoded by the decoder to derive the purged image.
Figure 3. Masking Strategy . HSN offers three types of masking strategies: Random, Continuous, and Scattered, where β controls the masking ratio.
Figure 4. HIDE&SEEK Plus Training Workflow . In stage HIDE , the masking model takes a target image to predict a rank for all pixels in the image. The rank is then mapped to a soft mask for random perturbation. The soft mask, the perturbed image and the target image are used to compute the HIDE loss. In stage SEEK , A randomly masked image is fed into the pixel generator to predict the next pixel. The SEEK loss is then computed using the predicted pixel and the target pixel.
Figure 5. HIDE&SEEK Plus Evaluation Workflow . The watermarked image is fed into the masking model to produce a pixel rank. Pixels with probabilities less than 0.5 are directly masked for reconstruction. Following the order provided by the pixel rank, the masked pixels are gradually reconstructed, where the most vulnerable pixel is reconstructed at last.
Figure 6. Evaluation of Attacks on Defense Watermarks. Each sub-figure contains the results of a defense watermark against image manipulations. StableSignature and StegaStamp are abbreviated as SbSig and StSt. The fourth bar of TRW represents the inverse distance, whereas the rest of the fourth bars stand for bit accuracy. The height of the bars represents the normalized value under one metric, and the actual values are on top of the bars.
Attacks
HSN
HS+
UnMarker
Diff Atk
VAE Atk
Time(s)
871
1302
2553
1454
839
Money($)
0.99
1.48
2.91
1.66
0.96
Table 2. Average Consumption of the Watermark Removal Attacks on One Hundred Machine-Generated Images
Lfrq
Lsmt
Lpct
PSNR ↑
SSIM ↑
LPIPS ↓
Bit Acc. ↓
Detect ↓
✓
✓
✓
31.49
0.89
0.14
0.63
0.52
×
✓
✓
30.65
0.86
0.18
0.61
0.45
✓
×
✓
30.89
0.87
0.13
0.67
0.66
✓
✓
×
31.15
0.88
0.16
0.63
0.53
Table 3. Impact of the Loss Terms
Order
PSNR ↑
SSIM ↑
LPIPS ↓
Bit Acc. ↓
Detect ↓
Original
31.49
0.89
0.14
0.63
0.52
Inverse
32.18
0.90
0.12
0.65
0.58
Random
31.91
0.89
0.14
0.63
0.54
Table 4. Impact of the Reconstruction Order
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 7. Impact of the Masking Strategy and Ratio. Each sub-figure contains experimental results of a masking strategy with different masking ratio ranging from 0.6 to 0.8 with 0.05 step length. The height of the bars represents the normalized value under one metric, and the actual values are on top of the bars.
Figure 8. Evaluation of Defense Watermarks against Image Manipulations. Each sub-figure contains the results of an image manipulation attacking different defense watermarks. StableSignature and StegaStamp are abbreviated as SbSig and StSt. The blue bar of TRW represents the inverse distance, whereas the rest of the blue bars stand for bit accuracy. The height of the bars represents the normalized value under one metric, and the actual values are on top of the bars.
Figure 9. Visual Effect of Watermarked Images Attacked by Different Methods.
Watermarking combines an imperceptible change to an input image that will trigger a detector, to assert provenance and protect intellectual property. The literature has shown great interest in attacks on watermarking schemes: attackers are clearly motivated to steal copyrighted material or circumvent legislated deepfake protections. In this work, we make a simple-yet-powerful observation: that such attacks on watermarking-like watermarks themselves-seek an imperceptible change to an input image (now already watermarked) that will trigger a detector. This analogy comparing watermark attacks to watermarking itself is highly suggestive: that watermarks could be used to attack watermarks. Our first contribution validates this hypothesis. In rigorous experiments spanning 96 combinations of dataset, victim, and attack watermarks, we show that simply re-watermarking an already watermarked image reliably suppresses the original signal, without requiring gradients, surrogate models, or detection keys. Our second contribution is a simple classifier for detecting the presence and identity of an existing watermark in a given image. Surprisingly, experimental findings demonstrate outstanding overall accuracies 0.878-0.953. This result is of independent interest as a security vulnerability: research shows that method-specific attacks achieve substantially stronger removal than black-box attacks. Taken together, watermark identification combined with re-watermarking successfully reduces bit accuracy by at least 25% and up to 48%. Our work constitutes a cheap, generic, and highly effective attack pipeline, calling into question the reliability of current watermarking schemes to such a simple attack, as well as the value of existing sophisticated attacks.
Maria Bulychev, Neil G. Marchant, Benjamin I. P. Rubinstein
Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.
Saibo Ye, Huajie Chen, Xin Guo +5
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2
Invisible watermarks are used to mark who owns a painting. We show that a simple attack removes the most robust one we test. The attack redraws the watermarked painting with brush strokes, using a pretrained stroke-based renderer. We call this attack BrushOff. It needs no training, no knowledge of the watermark, and no generative model. We test four watermarks on 500 paintings from five styles. VINE, a recent watermark built to survive image editing, survives all 14 conventional distortions we test, with at least 97.8% detection. Repainting lowers its detection to 1.8%, while the output keeps a no-reference quality score close to that of the clean paintings. Diffusion regeneration can also remove VINE, but at the same removal level it moves the image twice as far from the painting in DreamSim distance, and it changes what the painting shows. Because the renderer draws a countable number of strokes, we can control the attack strength step by step. Finally, we test what kind of signal survives. A simple probe that stores bits in the relative brightness of neighboring regions survives repainting, while a probe that uses absolute brightness does not. The same probe fails under diffusion regeneration, while VINE fails under repainting. Robustness to these two attacks is therefore a separate property, and benchmarks should test both.