Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction

Huajie Chen; Tianqing Zhu; Hailin Yang; Yuchen Zhong; Yang Zhang; Hui Sun; Heng Xu; Zuobin Ying

cs.CRMar 1, 2026

Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction

Authors: Huajie Chen, Tianqing Zhu, Hailin Yang, Yuchen Zhong, Yang Zhang, Hui Sun, Heng Xu, Zuobin Ying,

Organizations: City University of Macau · CISPA Helmholtz Center for Information Security · Guangzhou University

Abstract

Watermarking has emerged as a key defense against the misuse of machine-generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost-effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.

Figures & tables

Figure 1. Overview of HIDE&SEEK . Compared to existing attacks that introduce global modification to the watermarked image so as to remove the embedded watermark, HIDE&SEEK locates the vulnerable pixels and modifies them to purge the watermark while preserving high visual quality.

Symbols	Definitions
$X,\tilde{X}$	The original/reconstructed image
$L_{\text{pix}}$	The pixel loss
$L_{\text{frq}}$	The frequency loss
$L_{\text{pct}}$	The perceptual loss
$L_{\text{smt}}$	The semantic loss
$C,c$	The number/index of channels

Table 1. Notations

Figure 2. HIDE&SEEK Naive Workflow . The adversary first masks the watermarked image with a mask using a strategy and a ratio. Those visible patches are then encoded by the encoder and concatenated with the masked patches, which are then decoded by the decoder to derive the purged image.

Figure 3. Masking Strategy . HSN offers three types of masking strategies: Random, Continuous, and Scattered, where $\beta$ controls the masking ratio.

Figure 4. HIDE&SEEK Plus Training Workflow . In stage HIDE , the masking model takes a target image to predict a rank for all pixels in the image. The rank is then mapped to a soft mask for random perturbation. The soft mask, the perturbed image and the target image are used to compute the HIDE loss. In stage SEEK , A randomly masked image is fed into the pixel generator to predict the next pixel. The SEEK loss is then computed using the predicted pixel and the target pixel.

Figure 5. HIDE&SEEK Plus Evaluation Workflow . The watermarked image is fed into the masking model to produce a pixel rank. Pixels with probabilities less than $0.5$ are directly masked for reconstruction. Following the order provided by the pixel rank, the masked pixels are gradually reconstructed, where the most vulnerable pixel is reconstructed at last.

Figure 6. Evaluation of Attacks on Defense Watermarks. Each sub-figure contains the results of a defense watermark against image manipulations. StableSignature and StegaStamp are abbreviated as SbSig and StSt. The fourth bar of TRW represents the inverse distance, whereas the rest of the fourth bars stand for bit accuracy. The height of the bars represents the normalized value under one metric, and the actual values are on top of the bars.

Attacks	HSN	HS+	UnMarker	Diff Atk	VAE Atk
Time(s)	871	1302	2553	1454	839
Money($)	0.99	1.48	2.91	1.66	0.96

Table 2. Average Consumption of the Watermark Removal Attacks on One Hundred Machine-Generated Images

$L_{\text{frq}}$	$L_{\text{smt}}$	$L_{\text{pct}}$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	Bit Acc. $\downarrow$	Detect $\downarrow$
$\checkmark$	$\checkmark$	$\checkmark$	31.49	0.89	0.14	0.63	0.52
$\times$	$\checkmark$	$\checkmark$	30.65	0.86	0.18	0.61	0.45
$\checkmark$	$\times$	$\checkmark$	30.89	0.87	0.13	0.67	0.66
$\checkmark$	$\checkmark$	$\times$	31.15	0.88	0.16	0.63	0.53

Table 3. Impact of the Loss Terms

Order	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	Bit Acc. $\downarrow$	Detect $\downarrow$
Original	31.49	0.89	0.14	0.63	0.52
Inverse	32.18	0.90	0.12	0.65	0.58
Random	31.91	0.89	0.14	0.63	0.54

Table 4. Impact of the Reconstruction Order

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7. Impact of the Masking Strategy and Ratio. Each sub-figure contains experimental results of a masking strategy with different masking ratio ranging from $0.6$ to $0.8$ with $0.05$ step length. The height of the bars represents the normalized value under one metric, and the actual values are on top of the bars.

Figure 8. Evaluation of Defense Watermarks against Image Manipulations. Each sub-figure contains the results of an image manipulation attacking different defense watermarks. StableSignature and StegaStamp are abbreviated as SbSig and StSt. The blue bar of TRW represents the inverse distance, whereas the rest of the blue bars stand for bit accuracy. The height of the bars represents the normalized value under one metric, and the actual values are on top of the bars.

Figure 9. Visual Effect of Watermarked Images Attacked by Different Methods.

Watermark Removal

Watermark removal studies how to erase or evade embedded signals in text, images, and audio while preserving useful content.

See all 39 papers

Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy
May 16, 2026Maria Bulychev, Neil G. Marchant, Benjamin I. P. RubinsteinWatermark Removal Digital Image Forensics
University of Melbourne
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Oct 2, 2026Saibo Ye, Huajie Chen, Xin Guo +5Watermark Removal AI-Generated Image Watermarking
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2
BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Painting
Oct 19, 2026Hao Chen, Junnan XuWatermark Removal Robust Watermarking

May 16, 2026J/K move · Enter open · S save

Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

Maria Bulychev, Neil G. Marchant, Benjamin I. P. Rubinstein

University of Melbourne

Watermark Removal Digital Image Forensics Robust Watermarking Watermark Removal Detection

Open paper AskPDF arXiv

Watermarking combines an imperceptible change to an input image that will trigger a detector, to assert provenance and protect intellectual property. The literature has shown great interest in attacks on watermarking schemes: attackers are clearly motivated to steal copyrighted material or circumvent legislated deepfake protections. In this work, we make a simple-yet-powerful observation: that such attacks on watermarking-like watermarks themselves-seek an imperceptible change to an input image (now already watermarked) that will trigger a detector. This analogy comparing watermark attacks to watermarking itself is highly suggestive: that watermarks could be used to attack watermarks. Our first contribution validates this hypothesis. In rigorous experiments spanning 96 combinations of dataset, victim, and attack watermarks, we show that simply re-watermarking an already watermarked image reliably suppresses the original signal, without requiring gradients, surrogate models, or detection keys. Our second contribution is a simple classifier for detecting the presence and identity of an existing watermark in a given image. Surprisingly, experimental findings demonstrate outstanding overall accuracies 0.878-0.953. This result is of independent interest as a security vulnerability: research shows that method-specific attacks achieve substantially stronger removal than black-box attacks. Taken together, watermark identification combined with re-watermarking successfully reduces bit accuracy by at least 25% and up to 48%. Our work constitutes a cheap, generic, and highly effective attack pipeline, calling into question the reliability of current watermarking schemes to such a simple attack, as well as the value of existing sophisticated attacks.

Abstract

Watermark Removal

Explore similar work

Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Painting