Understanding Semantic Perturbations on In-Processing Generative Image Watermarks

Anirudh Nakra; Min Wu

cs.CVMar 29, 2026

Understanding Semantic Perturbations on In-Processing Generative Image Watermarks

Authors: Anirudh Nakra, Min Wu

Organizations: University of Maryland, College Park, MD, USA

Abstract

The widespread deployment of high-fidelity generative models has intensified the need for reliable mechanisms for provenance and content authentication. In-processing watermarking, embedding a signature into the generative model's synthesis procedure, has been advocated as a solution and is often reported to be robust to standard post-processing (such as geometric transforms and filtering). Yet robustness to semantic manipulations that alter high-level scene content while maintaining reasonable visual quality is not well studied or understood. We introduce a simple, multi-stage framework for systematically stress-testing in-processing generative watermarks under semantic drift. The framework utilizes off-the-shelf models for object detection, mask generation, and semantically guided inpainting or regeneration to produce controlled, meaning-altering edits with minimal perceptual degradation. Based on extensive experiments on representative schemes, we find that robustness varies significantly with the degree of semantic entanglement: methods by which watermarks remain detectable under a broad suite of conventional perturbations can fail under semantic edits, with watermark detectability in many cases dropping to near zero while image quality remains high. Overall, our results reveal a critical gap in current watermarking evaluations and suggest that watermark designs and benchmarking must explicitly account for robustness against semantic manipulation.

Figures & tables

Figure 1: Representative in-processing generative image watermarks such as Stable-Signature [ 7 ] , Tree-Ring [ 35 ] , and Gaussian Shading [ 36 ] aim to embed the watermarking signal during the LDM generation process. We study the resilience of these watermarks against a variety of semantic perturbations, aiming to quantify the level of semantic entanglement achieved by these methods.

Panel of Figure 2 — Figure 2: Overview of evaluation: (a) Examples of different improved image-processing-based perturbations. (b) The modular pipeline used to generate global & local semantic perturbations.

Figure 3: An overview of semantic perturbations across representative in-processing watermarking methods.

Panel of Figure 4 — Figure 4: Experimental results of watermark detectability vs visual fidelity in SSIM under enhanced image-processing-based perturbations, showing general robustness under these manipulations. Detection metrics are bit accuracy for StableSig/Gaussian shading and the normalized negative logarithm of $p$ -value for tree-ring. Color indicates the perturbation strength, and markers indicate the watermarking schemes. Note that we normalize the $p$ -values for understanding the trend of the tree-ring detection metric with perturbation strength. Extended results in tabular form are provided in the supplemental material.

Figure 5: Experimental results of watermark detectability against visual fidelity in SSIM ( $y$ -axis) and semantic drift ( $x$ -axis) under semantic perturbations. Color indicates detectability (TPR@0.1%). Results show watermark detectability can collapse across methods under varying levels of semantic drift, revealing a gap not captured by conventional robustness tests. — Figure 5: Experimental results of watermark detectability against visual fidelity in SSIM ( $y$ -axis) and semantic drift ( $x$ -axis) under semantic perturbations. Color indicates detectability ([email protected]%). Results show watermark detectability can collapse across methods under varying levels of semantic drift, revealing a gap not captured by conventional robustness tests.

Perturbation	Variant	Method	PSNR ( $\uparrow$ )	SSIM ( $\uparrow$ )	Detection metric	[email protected]% ( $\uparrow$ )	VLMA ( $\uparrow$ )	BLIPA ( $\uparrow$ )
Global	Stylization	Stable Signature [ 7 ]	$12.7_{\pm 1.2}$	$0.40_{\pm 0.05}$	$57.8_{\pm 6.0}\%$	$0.44$	$0.63_{\pm 0.22}$	$0.56_{\pm 0.10}$
		Tree Ring [ 35 ]	$12.9_{\pm 1.5}$	$0.41_{\pm 0.05}$	$2.7e\!-\!02$	$0.67$	$0.56_{\pm 0.24}$	$0.53_{\pm 0.11}$
		Gaussian Shading [ 36 ]	$12.3_{\pm 1.5}$	$0.40_{\pm 0.05}$	$98.9_{\pm 0.2}\%$	$0.99$	$0.57_{\pm 0.24}$	$0.55_{\pm 0.11}$
Local	Texture Shift	Stable Signature [ 7 ]	$16.9_{\pm 4.1}$	$0.71_{\pm 0.10}$	$50.2_{\pm 7.9}\%$	$0.10$	$0.77_{\pm 0.19}$	$0.78_{\pm 0.11}$
		Tree Ring [ 35 ]	$16.6_{\pm 4.5}$	$0.77_{\pm 0.11}$	$1.4e\!-\!07$	$0.97$	$0.78_{\pm 0.19}$	$0.76_{\pm 0.13}$
		Gaussian Shading [ 36 ]	$15.8_{\pm 4.5}$	$0.75_{\pm 0.12}$	$99.7_{\pm 0.1}\%$	$1.00$	$0.74_{\pm 0.25}$	$0.75_{\pm 0.11}$

Table 1: Robustness to semantic manipulation across in-processing watermarking methods (averaged over seeds). Detection metric is bit accuracy for stable signature/Gaussian shading, and the average

p

-value for tree ring. Extended results across multiple seeds for each variant are provided in the supplemental material.

Panel of Figure 6 — Figure 6: Experimental results on watermark detectability under local semantic perturbations as a function of masked area. (a) $p$ -value of the detected tree-ring watermark when an increasing fraction of the image is masked. It is positively correlated with the mask size, indicating reduced detectability as a larger fraction of the image is replaced. (b) Bit accuracy of the detected stable signature watermark remains near chance across all mask sizes, indicating failure even for small masks. (c) Bit accuracy of the Gaussian shading watermark remains consistently high, showing minimal sensitivity to mask size.

Attack Category	Same Family			Cross Family
Attack Category	PSNR ( $\uparrow$ )	SSIM ( $\uparrow$ )	Detection Metric	PSNR ( $\uparrow$ )	SSIM ( $\uparrow$ )	Detection Metric
Stable Signature [ 7 ] .	$16.29$	$0.68$	$50.10\%$	$15.43$	$0.64$	$53.49\%$
Tree Ring [ 35 ] .	$15.83$	$0.75$	$3.88e-07$	$15.18$	$0.63$	$9.08e-07$
Gaussian Shading [ 36 ] .	$14.87$	$0.72$	$99.60\%$	$13.85$	$0.63$	$98.43\%$

Table 2: Local semantic perturbations using the same or different diffusion model family. Detection metric is bit accuracy for stable signature/Gaussian shading, and the average

p

-value for tree ring. Cross-family perturbations may degrade detection metrics more than same-family perturbations.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Attack Category	Strength	Stable Signature			Tree Ring			Gaussian Shading
Attack Category	Strength	PSNR ( $\uparrow$ )	SSIM ( $\uparrow$ )	Bit Acc ( $\uparrow$ )	PSNR ( $\uparrow$ )	SSIM ( $\uparrow$ )	$p$ -val ( $\downarrow$ )	PSNR ( $\uparrow$ )	SSIM ( $\uparrow$ )	Bit Acc ( $\uparrow$ )
Seam Carving	2%	$21.24_{\pm 3.17}$	$0.69_{\pm 0.11}$	$0.99_{\pm 0.02}$	$20.65_{\pm 3.97}$	$0.69_{\pm 0.13}$	$1.10e\text{-}21$	$19.46_{\pm 2.77}$	$0.65_{\pm 0.11}$	$0.99_{\pm 0.01}$
	10%	$16.06_{\pm 2.63}$	$0.51_{\pm 0.13}$	$0.99_{\pm 0.02}$	$15.83_{\pm 2.92}$	$0.50_{\pm 0.13}$	$1.80e\text{-}05$	$14.63_{\pm 2.70}$	$0.47_{\pm 0.13}$	$0.83_{\pm 0.11}$
	20%	$14.76_{\pm 2.46}$	$0.46_{\pm 0.13}$	$0.98_{\pm 0.02}$	$14.56_{\pm 2.66}$	$0.45_{\pm 0.13}$	$2.00e\text{-}03$	$13.53_{\pm 2.54}$	$0.42_{\pm 0.13}$	$0.76_{\pm 0.10}$
	40%	$14.02_{\pm 2.34}$	$0.43_{\pm 0.13}$	$0.98_{\pm 0.03}$	$13.81_{\pm 2.60}$	$0.42_{\pm 0.13}$	$5.20e\text{-}03$	$12.94_{\pm 2.51}$	$0.39_{\pm 0.13}$	$0.71_{\pm 0.10}$
	50%	$13.42_{\pm 2.23}$	$0.41_{\pm 0.13}$	$0.96_{\pm 0.04}$	$13.26_{\pm 2.57}$	$0.39_{\pm 0.12}$	$1.80e\text{-}02$	$12.52_{\pm 2.43}$	$0.37_{\pm 0.13}$	$0.68_{\pm 0.10}$

Appendix

Table 3: Robustness to improved baseline image-processing-based perturbations

Panel of Figure 7 — Figure 7: Experimental results of watermark detectability vs visual fidelity in PSNR under enhanced image-processing-based perturbations, showing general robustness under these manipulations. Detection metrics are bit accuracy for Stable Signature/Gaussian shading and the normalized negative logarithm of $p$ -value for Tree-Ring. Color indicates the perturbation strength, and markers indicate the watermarking schemes.

Figure 8: Experimental results of watermark detectability against visual fidelity in PSNR ( $y$ -axis) and semantic drift ( $x$ -axis) under semantic perturbations. Color indicates detectability (TPR@0.1%). Results show watermark detectability can collapse across methods under varying levels of semantic drift, revealing a gap that has not been captured by conventional robustness tests. — Figure 8: Experimental results of watermark detectability against visual fidelity in PSNR ( $y$ -axis) and semantic drift ( $x$ -axis) under semantic perturbations. Color indicates detectability ([email protected]%). Results show watermark detectability can collapse across methods under varying levels of semantic drift, revealing a gap that has not been captured by conventional robustness tests.

Panel of Figure 9 — Figure 9: (a) Image watermarked using StableSignature [ 7 ] , (b) Global semantic perturbation on (a), (c) Local inter-object replacement perturbation on (a).

Panel of Table 5 — Table 5: (a) Cosine similarity between unperturbed watermarked image and perturbed watermarked images using BLIP, (b) Cosine similarity between unperturbed watermarked image and perturbed watermarked images using VLM.

Figure 10: Cosine similarity between unperturbed watermarked image and perturbed watermarked images using BLIP and VLM, including global semantic perturbations with 2 seed variants, intra-object local semantic perturbation with 3 seed variants, inter-object local semantic perturbation, and a distinct scene.

Figure 11: Overview of the scene graph generation (SGG) process.

Figure 13: Triplet similarity between unperturbed watermarked image and perturbed watermarked images using SGGs generated by VLM captions, including intra-object local semantic perturbation with 3 seed variants, inter-object local semantic perturbation, and a distinct scene.

AI-Generated Image Watermarking

See all 24 papers

Sep 30, 2026

Semantic Watermarking for Malicious Image Manipulation Detection

The proliferation of high-fidelity generative editing models has made it possible to inject violent or sexual content into otherwise ordinary images while preserving visual plausibility, with concrete consequences for public discourse and vulnerable populations. We propose a robust semantic watermarking framework that reframes the watermark as a recoverable semantic reference rather than an opaque identifier. Our framework combines a

β

-VAE-based binary watermark (CLIP-VAE) with explicit channel-aware training---random bit-flip noise is injected during training so that the decoder learns graceful degradation under the noisy watermarking channel. As a downstream application, a lightweight module SDA-Net uses the recovered semantic embedding to expose not only whether but in which semantic direction an image has been altered. In a 5-way comparison against representative binary hashing baselines (SimHash, ITQ, HashNet, and their robust-MLP variants), CLIP-VAE achieves the highest reconstruction cosine similarity to the original CLIP embedding under realistic InstructPix2Pix bit-error rates, and uniquely supports direction-of-drift detection---a forensic complement to existing content-moderation pipelines.

Yoonseo Kim, Seungwoo Baek, Junyoung Park

Korea University, Seoul, South Korea.

Image Forgery Detection Robust Watermarking

Ask PDF

Feb 25, 2026

Breaking Semantic-Aware Watermarks via LLM-Guided Coherence-Preserving Semantic Injection

Generative images have proliferated on Web platforms in social media and online copyright distribution scenarios, and semantic watermarking has increasingly been integrated into diffusion models to support reliable provenance tracking and forgery prevention for web content. Traditional noise-layer-based watermarking, however, remains vulnerable to inversion attacks that can recover embedded signals. To mitigate this, recent content-aware semantic watermarking schemes bind watermark signals to high-level image semantics, constraining local edits that would otherwise disrupt global coherence. Yet, large language models (LLMs) possess structured reasoning capabilities that enable targeted exploration of semantic spaces, allowing locally fine-grained but globally coherent semantic alterations that invalidate such bindings. To expose this overlooked vulnerability, we introduce a Coherence-Preserving Semantic Injection (CSI) attack that leverages LLM-guided semantic manipulation under embedding-space similarity constraints. This alignment enforces visual-semantic consistency while selectively perturbing watermark-relevant semantics, ultimately inducing detector misclassification. Extensive empirical results show that CSI consistently outperforms prevailing attack baselines against content-aware semantic watermarking, revealing a fundamental security weakness of current semantic watermark designs when confronted with LLM-driven semantic perturbations.

Zheng Gao, Xiaoyu Li, Zhicheng Bao +2

University of New South Wales Sydney, New South Wales, Australia · Griffith University Brisbane, Queensland, Australia

Watermark Removal Diffusion Model Watermarking Robust Watermarking

Ask PDF

May 19, 2026

Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing

This paper investigates a fundamental yet underexplored question: can watermarked images remain editable without compromising watermark integrity? We propose SafeMark, a framework for watermark-preserving text-guided image manipulation that explicitly integrates watermark integrity into the editing process. Specifically, SafeMark adds a thresholded watermark-decoding loss directly to the diffusion editor's training objective, fine-tuning the editor so that semantically valid edits also preserve the embedded watermark at the final output. This design admits a clean information-theoretic justification: maintaining high bit-accuracy on the edited image lower-bounds the mutual information that the editor channel preserves between watermark and edited output, the quantity that fundamentally controls watermark recoverability. SafeMark is compatible with differentiable diffusion-based editors, and requires no architectural modification. Extensive evaluations across multiple datasets, text-guided editing methods, and post-edit distortion settings demonstrate that SafeMark achieves high watermark bit accuracy across diverse editing settings while maintaining high-quality semantic edits, without sacrificing robustness to common post-edit distortions. These results demonstrate that semantic editability and watermark integrity are fundamentally compatible, enabling trustworthy image provenance in generative editing pipelines.

Xiaodong Wu, Qi Li, Xiangman Li +3

Queen’s University · University of Waterloo

Diffusion Model Watermarking Text-Guided Image Editing Robust Watermarking Diffusion-Based Image Editing Image Editing AI-Generated Image Watermarking

Ask PDF

Abstract

AI-Generated Image Watermarking

Explore similar work

Semantic Watermarking for Malicious Image Manipulation Detection

Breaking Semantic-Aware Watermarks via LLM-Guided Coherence-Preserving Semantic Injection

Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing