On the Robustness of Watermarking for Autoregressive Image Generation

Andreas Müller; Denis Lukovnikov; Shingo Kodama; Minh Pham; Anubhav Jain; Jonathan Petit; Niv Cohen; Asja Fischer

cs.CVApr 13, 2026

On the Robustness of Watermarking for Autoregressive Image Generation

Authors: Andreas Müller, Denis Lukovnikov, Shingo Kodama, Minh Pham, Anubhav Jain, Jonathan Petit, Niv Cohen, Asja Fischer

Organizations: Ruhr University Bochum · Middlebury College · New York University · Independent Researcher · Qualcomm

Abstract

The proliferation of autoregressive (AR) image generators demands reliable detection and attribution of their outputs to mitigate misinformation, and to filter synthetic images from training data to prevent model collapse. To address this need, watermarking techniques, specifically designed for AR models, embed a subtle signal at generation time, enabling downstream verification through a corresponding watermark detector. In this work, we study these schemes and demonstrate their vulnerability to both watermark removal and forgery attacks. We assess existing attacks and further introduce three new attacks: (i) a vector-quantized regeneration removal attack, (ii) adversarial optimization-based attack, and (iii) a frequency injection attack. Our evaluation reveals that removal and forgery attacks can be effective with access to a single watermarked reference image and without access to original model parameters or watermarking secrets. Our findings indicate that existing watermarking schemes for AR image generation do not reliably support synthetic content detection for dataset filtering. Moreover, they enable Watermark Mimicry, whereby authentic images can be manipulated to imitate a generator's watermark and trigger false detection to prevent their inclusion in future model training.

Figures & tables

Figure 1: Watermark Mimicry subverts synthetic content filtering . An image generated with the radioactive BitMark watermark (left) carries an embedded signal that allows service providers to identify synthetic content and exclude it from future training to prevent model collapse. However, other parties can transfer this watermark onto unrelated images, causing the detector to mistake authentic images (here, Ranitomeya imitator - the mimic poison frog ) as AI-generated (right). This adversarial strategy inverts the protective intent of radioactive watermarking: rather than preventing real data from being mislabeled, one may exploit the detector’s own decision boundary to shield genuine content from being harvested for training. Photo by andes2amazonexpeditions is licensed under CC BY-NC 4.0 . Sourced from iNaturalist .

Panel of Figure 2 — Figure 2: Token-based semantic watermarking. During generation (left), green tokens (e.g., $T_{1}$ ) are boosted. During verification (right), a statistical test is performed based on the fraction of present green tokens to determine the presence of a watermark.

Figure 4: BitMark Forgery via Frequency Injection. (Left) Averaging 5000 BitMark-watermarked images reveals a structured spatial artifact detectable by the watermarking scheme ( $p=3\times 10^{-33}$ ), and its Fourier transform on the right. (Center) A real cover image and its Fourier transform are not detected as watermarked ( $p=0.02$ , $\text{PSNR}=\infty$ ). (Right) Injecting the frequency patterns marked by red circles into the cover image achieves high visual fidelity ( $\text{PSNR}=35.9$ dB) while successfully triggering BitMark’s detector ( $p=1\times 10^{-19}$ ).

		IndexMark				WMAR				ClusterMark
		TPR	P-value	PSNR	LPIPS	TPR	P-value	PSNR	LPIPS	TPR	P-value	PSNR	LPIPS
WM		1.00	$4.3\text{\times}{10}^{-78}$	-	-	1.00	$4.9\text{\times}{10}^{-45}$	-	-	1.00	$4.6\text{\times}{10}^{-80}$	-	-
Removal
Geom.		0.58	$5.1\text{\times}{10}^{-3}$	18.38	0.12	0.55	$7.3\text{\times}{10}^{-3}$	18.80	0.12	0.78	$9.9\text{\times}{10}^{-6}$	18.51	0.12
Perturb.		0.53	$4.3\text{\times}{10}^{-3}$	17.12	0.44	0.43	$3.0\text{\times}{10}^{-2}$	17.14	0.43	0.80	$2.3\text{\times}{10}^{-23}$	17.15	0.45
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	0.52	$1.0\text{\times}{10}^{-2}$	22.91	0.13	0.36	$5.3\text{\times}{10}^{-2}$	24.09	0.11	0.85	$1.6\text{\times}{10}^{-5}$	22.95	0.13

Table 1: Results for token-based methods , aggregated over multiple target models deployed with each watermarking scheme.

{\color[rgb]{0,0,0}\blacksquare}

is black-box,

{\color[rgb]{0.5,0.5,0.5}\blacksquare}

is grey-box,

\square

is white-box. P-values are reported as median, and all others as mean. For removal, attackers target lower TPR (higher p-values); for forgery, higher TPR (lower p-values).

Panel of Figure 5 — Figure 5: LatentOpt-Removal (top) and LatentOpt-Forgery (bottom) results for different budgets $c\in\{\frac{2}{255},\frac{4}{255},\frac{8}{255},\frac{16}{255},\frac{32}{255}\}$ . The top row also shows different perturbation baselines in varying strengths.

Table 2: Results for removal attack (left), as well as watermarked, radioactive data baseline, and forgery (right) attacks for BitMark .

{\color[rgb]{0,0,0}\blacksquare}

is black-box,

{\color[rgb]{0.5,0.5,0.5}\blacksquare}

is grey-box,

\square

is white-box.

\square

+

indicates having access to the green set

G

. LatentOpt and VQ-Regen (

{\color[rgb]{0,0,0}\blacksquare}

{\color[rgb]{0.5,0.5,0.5}\blacksquare}

) were performed with several attacker models, or specifically with LlamaGen (indicated by ♣ ). P-values are reported as median, and all others as mean. For removal, attackers target lower TPR (higher p-values); for forgery, higher TPR (lower p-values).

Figure 6: Qualitative Eaxmples for BitMark deployed with Infinity-2B for removal attacks (left) and forgery attacks (right). LatentOpt-R and LatentOpt-F attacks are capped by a budget of $\|\Delta x\|^{\infty}=\frac{8}{255}$ . Black-box settings and the VQ-Regen attack use LlamaGen’s VQ-VAE and Infinity-2B’s VQ-VAE as proxy models, respectively.

Figure 7: Box plot showing the distributions of z-scores for different attacks on BitMark (forgery is orange, removal is blue) as well as original watermarked and radioactive images (grey).

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

	LlamaGen	Anole	Taming	RAR	$\infty$ -2B
$\|\mathcal{V}\|$	16384	65536	16384	1024	$2^{16}$	$2^{24}$	$2^{32}$	$2^{64}$
$d$	8	256	256	256	16	24	32	64

Appendix

Table 3: Overview of the visual tokenizer in each model.

|\mathcal{V}|

and

d

refer to the covabulary size and the embedding dimension, respectively.

	IndexMark [ 37 ]		WMAR [ 16 ]			ClusterMark [ 26 ]			BitMark [ 18 ]
	LlamaGen [ 33 ]					LlamaGen [ 33 ]			$\infty$ -2B [ 13 ]
	GPT-B	GPT-L	Anole [ 5 ]	Taming [ 7 ]	RAR-XL [ 44 ]	GPT-B	GPT-L	RAR-XL [ 44 ]	( $V_{d}=2^{32}$ )
	$256\times 256$	$384\times 384$	$512\times 512$	$256\times 256$	$256\times 256$	$256\times 256$	$384\times 384$	$256\times 256$	$1024\times 1024$
Regen. [ 47 ] (60 steps)
SD-v2.1 VAE	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$	${\color[rgb]{0,0,0}\blacksquare}$
Rinse ( $3\times$ Regen. w. 60 steps)

Appendix

Table 4: Detailed breakdown of settings used in each attack, excluding perturbations and geometric transformations. For each watermarking scheme and deployed verifier model, the attacker model is shown on the left side. Using an unrelated model on the attacker side (or no model, as in the Frequency Injection Forgery attack) is considered a black-box setting and is indicated by

{\color[rgb]{0,0,0}\blacksquare}

. Using a model of similar architecture is considered a grey-box setting and is indicated by

{\color[rgb]{0.5,0.5,0.5}\blacksquare}

. For token-based watermarking schemes (IndexMark, WMAR, ClusterMark), this corresponds to using the default version of the deployed verifier model’s encoder, without acces the finetuned weights. White-box settings require full access to the exact weights of the verifier’s encoder and is indicated by

\square

. In the case of BitMark, having additional knowledge of the green set

G

is indicated by

\square

+

. For the LatentOpt-Forgery attack on the Anole and Taming models deployed with WMAR, a higher learning rate (LR=0.01) was chosen. This was done in order to saturate the attack success for experiments with higher perturbation budgets such as

c=\frac{32}{255}

(see Sec. 4.2 ), since the default LR=0.001 would not show forgery success within 300 steps. This was done to show that forgery is possible for all verifier models, albeit at the cost of extreme quality degradtion.

Panel of Figure 8 — Figure 8: Visual examples of perturbations and geometric transformations.

Figure 9: Visual examples of the VQ-Regen attack. The original watermarked image is generated using BitMark deployed with $\infty$ -2B.

Panel of Figure 14 — Algorithm 3 Vector-Quantized Regeneration Attack (VQ-Regen)

Panel of Figure 10 — Figure 10: BitMark Forgery via Frequency Injection Settings. We take an authentic cover image, and then compute its FFT. We inject spectral components with magnitude $\alpha$ and a channel-wise random phase along the diagonals and spaced 32 pixels apart in both axes, directly overwriting the original coefficients. Finally, we apply inverse FFT to reconstruct the attacked image. Settings A and B are limited to the first four frequency bins along the diagonals (lower frequencies). Setting C modifies all frequency bins along the diagonals. Setting A uses a low magnitude of $ln(\alpha)=7.75$ , while settings B and C use a higher magnitude $ln(\alpha)=8.0$ .

Panel of Figure 16 — Algorithm 4 Frequency Injection in the FFT Domain

Figure 12: Visual examples of VQ-Regen and diffusion regeneration-based attacks.

Figure 13: Visual examples of the LatentOpt-Removal attack ( $c=\frac{8}{255}$ at step 300).

Figure 14: Visual examples of the Frequency Injection Forgery and LatentOpt-Forgery ( $c=\frac{8}{255}$ at step 300) attacks on BitMark.

Panel of Figure 15 — Figure 15: LatentOpt attacks for perturbation budgets $c\in\{\frac{2}{255},\frac{4}{255},\frac{8}{255},\frac{16}{255},\frac{32}{255}\}$ .

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$8.6\text{\times}{10}^{-78}$	-	-
Removal
Geometric Transf.		$0.57$	$4.3\text{\times}{10}^{-03}$	${18.358}_{\pm 3.186}$	${0.107}_{\pm 0.043}$
Perturbations		$0.50$	$1.4\text{\times}{10}^{-02}$	${16.882}_{\pm 7.753}$	${0.430}_{\pm 0.371}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.35$	$5.9\text{\times}{10}^{-02}$	${21.828}_{\pm 2.984}$	${0.138}_{\pm 0.047}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.02$	$4.3\text{\times}{10}^{-01}$	${18.890}_{\pm 2.252}$	${0.336}_{\pm 0.078}$

Appendix

Table 5: Full experimental results ( IndexMark deployed w. LlamaGen GPT-B)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$4.0\text{\times}{10}^{-174}$	-	-
Removal
Geometric Transf.		$0.59$	$5.5\text{\times}{10}^{-03}$	${18.408}_{\pm 3.574}$	${0.133}_{\pm 0.056}$
Perturbations		$0.55$	$1.2\text{\times}{10}^{-03}$	${17.366}_{\pm 8.446}$	${0.459}_{\pm 0.399}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.68$	$1.2\text{\times}{10}^{-03}$	${23.994}_{\pm 3.639}$	${0.114}_{\pm 0.043}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.04$	$3.4\text{\times}{10}^{-01}$	${21.395}_{\pm 2.857}$	${0.245}_{\pm 0.070}$

Appendix

Table 6: Full experimental results ( IndexMark deployed w. LlamaGen GPT-L)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$0.99$	$9.1\text{\times}{10}^{-50}$	-	-
Removal
Geometric Transf.		$0.30$	$5.1\text{\times}{10}^{-02}$	${17.426}_{\pm 2.889}$	${0.146}_{\pm 0.067}$
Perturbations		$0.41$	$5.2\text{\times}{10}^{-02}$	${17.053}_{\pm 8.170}$	${0.426}_{\pm 0.391}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.66$	$1.9\text{\times}{10}^{-03}$	${26.904}_{\pm 3.022}$	${0.058}_{\pm 0.026}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.04$	$2.5\text{\times}{10}^{-01}$	${24.144}_{\pm 2.503}$	${0.141}_{\pm 0.056}$

Appendix

Table 7: Full experimental results ( WMAR deployed w. Anole)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$7.4\text{\times}{10}^{-58}$	-	-
Removal
Geometric Transf.		$0.47$	$1.9\text{\times}{10}^{-02}$	${20.123}_{\pm 4.256}$	${0.100}_{\pm 0.045}$
Perturbations		$0.39$	$4.7\text{\times}{10}^{-02}$	${17.229}_{\pm 8.143}$	${0.415}_{\pm 0.346}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.06$	$2.4\text{\times}{10}^{-01}$	${22.850}_{\pm 3.959}$	${0.139}_{\pm 0.068}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.00$	$4.7\text{\times}{10}^{-01}$	${19.914}_{\pm 2.895}$	${0.361}_{\pm 0.109}$

Appendix

Table 8: Full experimental results ( WMAR deployed w. Taming)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$3.8\text{\times}{10}^{-36}$	-	-
Removal
Geometric Transf.		$0.86$	$2.0\text{\times}{10}^{-07}$	${18.850}_{\pm 3.139}$	${0.106}_{\pm 0.040}$
Perturbations		$0.50$	$1.3\text{\times}{10}^{-02}$	${17.148}_{\pm 8.353}$	${0.442}_{\pm 0.379}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.36$	$4.7\text{\times}{10}^{-02}$	${22.507}_{\pm 2.985}$	${0.147}_{\pm 0.044}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.01$	$3.6\text{\times}{10}^{-01}$	${19.281}_{\pm 2.193}$	${0.364}_{\pm 0.070}$

Appendix

Table 9: Full experimental results ( WMAR deployed w. RAR-XL)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$8.6\text{\times}{10}^{-78}$	-	-
Removal
Geometric Transf.		$0.57$	$4.3\text{\times}{10}^{-03}$	${18.358}_{\pm 3.186}$	${0.107}_{\pm 0.043}$
Perturbations		$0.50$	$1.4\text{\times}{10}^{-02}$	${16.882}_{\pm 7.753}$	${0.430}_{\pm 0.371}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.35$	$5.9\text{\times}{10}^{-02}$	${21.828}_{\pm 2.984}$	${0.138}_{\pm 0.047}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.02$	$4.3\text{\times}{10}^{-01}$	${18.890}_{\pm 2.252}$	${0.336}_{\pm 0.078}$

Appendix

Table 10: Full experimental results ( ClusterMark deployed w. LlamaGen GPT-B)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$4.9\text{\times}{10}^{-147}$	-	-
Removal
Geometric Transf.		$0.77$	$9.5\text{\times}{10}^{-05}$	${18.667}_{\pm 3.051}$	${0.131}_{\pm 0.052}$
Perturbations		$0.85$	$8.7\text{\times}{10}^{-47}$	${17.159}_{\pm 8.272}$	${0.470}_{\pm 0.405}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.96$	$1.0\text{\times}{10}^{-11}$	${24.489}_{\pm 3.191}$	${0.109}_{\pm 0.037}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.55$	$6.5\text{\times}{10}^{-03}$	${21.691}_{\pm 2.516}$	${0.234}_{\pm 0.058}$

Appendix

Table 11: Full experimental results ( ClusterMark deployed w. LlamaGen GPT-L)

		TPR	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked		$1.00$	$2.5\text{\times}{10}^{-80}$	-	-
Removal
Geometric Transf.		$0.96$	$6.1\text{\times}{10}^{-14}$	${18.331}_{\pm 3.016}$	${0.110}_{\pm 0.041}$
Perturbations		$0.72$	$3.0\text{\times}{10}^{-15}$	${17.328}_{\pm 8.395}$	${0.436}_{\pm 0.375}$
Regen.	${\color[rgb]{0,0,0}\blacksquare}$	$0.76$	$3.5\text{\times}{10}^{-04}$	${21.928}_{\pm 2.771}$	${0.153}_{\pm 0.050}$
Rinse	${\color[rgb]{0,0,0}\blacksquare}$	$0.14$	$2.0\text{\times}{10}^{-01}$	${18.892}_{\pm 2.065}$	${0.375}_{\pm 0.083}$

Appendix

Table 12: Full experimental results ( ClusterMark w. LlamaGen RAR-XL)

	TPR	Z-Score	P-Value	PSNR $\uparrow$	LPIPS $\downarrow$
Watermarked	$1.00$	${80.474}_{\pm 14.011}$	$0.0\text{\times}{10}^{00}$	-	-
Radio. $\infty$ -2B, 10%	$0.74$	${3.480}_{\pm 1.789}$	$2.4\text{\times}{10}^{-04}$	-	-
Radio. $\infty$ -2B, 50%	$1.00$	${15.611}_{\pm 2.027}$	$2.3\text{\times}{10}^{-55}$	-	-
Radio. $\infty$ -2B, 100%	$1.00$	${31.043}_{\pm 2.775}$	$8.4\text{\times}{10}^{-212}$	-	-
Radio. SD2.1, 50%	$0.81$	${3.975}_{\pm 1.801}$	$2.9\text{\times}{10}^{-05}$	-	-
Radio. SD2.1, 100%	$0.98$	${7.312}_{\pm 2.074}$	$6.5\text{\times}{10}^{-14}$	-	-

Appendix

Table 13: Full experimental results ( BitMark deployed w.

\infty

-2B (

V_{d}=2^{32}

)

Explore similar work

UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators
Apr 12, 2026Yigit Yilmaz, Elena Petrova, Mehmet Kaya +2Robust Watermarking Autoregressive Image Generation
Bandırma Onyedi Eylül University
MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation
Aug 10, 2026Jie Cao, Qi Li, Zelin Zhang +4Watermark Removal Robust Watermarking
Queen’s University, Canada · University of Waterloo, Canada
Data Provenance for Image Auto-Regressive Generation
Jun 22, 2026Bihe Zhao, Louis Kerner, Michel Meintz +3Visual Autoregressive Models Autoregressive Image Generation
CISPA Helmholtz Center for Information Security

Apr 12, 2026J/K move · Enter open · S save

UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators

Yigit Yilmaz, Elena Petrova, Mehmet Kaya, Lucia Rossi+1

Bandırma Onyedi Eylül University

Robust Watermarking Autoregressive Image Generation

Open paper AskPDF arXiv

Invisible watermarking for autoregressive (AR) image generation has recently gained attention as a means of protecting image ownership and tracing AI-generated content. However, existing approaches suffer from three key limitations: (1) they embed only zero-bit watermarks for binary verification, lacking the ability to convey multi-bit messages; (2) they rely on static codebook partitioning strategies that are vulnerable to security attacks once the partition is exposed; and (3) they are designed for specific AR architectures, failing to generalize across diverse AR paradigms. We propose \method{}, a training-free, unified watermarking framework for autoregressive image generators that addresses all three limitations. \method{} introduces three core components: Adaptive Semantic Grouping (ASG), which dynamically partitions codebook entries based on semantic similarity and a secret key, ensuring both image quality preservation and security; Block-wise Multi-bit Encoding (BME), which divides the token sequence into blocks and encodes different bits across blocks with error-correcting codes for reliable message transmission; and a Unified Token-Replacement Interface (UTRI) that abstracts the watermark embedding process to support both next-token prediction (e.g., LlamaGen) and next-scale prediction (e.g., VAR) paradigms. We provide theoretical analysis on detection error rates and embedding capacity. Extensive experiments on three AR models demonstrate that \method{} achieves state-of-the-art performance in image quality (FID), watermark detection accuracy, and multi-bit message extraction, while maintaining robustness against cropping, JPEG compression, Gaussian noise, blur, color jitter, and random erasing attacks.

Abstract

Explore similar work

UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation

Data Provenance for Image Auto-Regressive Generation