Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition

Qi Li; Jidong Yang; Feng-Lei Fan; Yuantian Miao; Xiao Chen; Huaike Yu; Chunpeng Wang; Suo Gao

cs.CVSep 18, 2026

Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition

Authors: Qi Li, Jidong Yang, Feng-Lei Fan, Yuantian Miao, Xiao Chen, Huaike Yu, Chunpeng Wang, Suo Gao,

Organizations: Key Laboratory of Computing Power Network and Information Security, Ministry of Education; Shandong Computer Science Center; Shandong Provincial Key Laboratory of Industrial Network and Information System Security; and Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Department of Data Science, City University of Hong Kong, Hong Kong, China · School of Computer and Information Sciences, College of Engineering, Science and Environment, The University of Newcastle, Callaghan, NSW 2308, Australia · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China ·

Abstract

Invisible image watermarks are commonly evaluated against benign postprocessing operations such as compression, resizing, blur, and color changes. These tests leave out a different threat: a learned remover that preserves semantic image content while discarding residual evidence that carries the payload. We propose Disentangle and Drop (DnD), an attack that is agnostic to the watermark method and treats watermark removal as a representation routing problem. DnD decomposes a watermarked image into a semantic grayscale carrier and an auxiliary residual branch, and then suppresses the residual branch to reduce watermark evidence. The model is trained with latent spectral perturbations and low-strength diffusion exposure so that the drop operation remains stable under adaptive reconstruction. Experiments on seven representative watermark families show that one shared operating setting gives competitive removal with high visual fidelity. Operating scans and ablations separate usable attacks from image-damaging settings: stronger noise or diffusion can raise removal scores by damaging the image, while the practical regime comes from dropping the residual latent. These results argue for evaluating watermark robustness against learned removal at the representation level, not only against conventional image edits.

Figures & tables

Symbol	Meaning	Symbol	Meaning
$x_{w}$	watermarked RGB input image	$H,W$	image height and width
$x_{c}$	clean carrier or paired clean image when available	$m$	watermarking method under evaluation
$\operatorname{Dec}_{m}$	method-specific watermark decoder or detector	$\mathcal{A},\mathcal{A}_{\theta}$	attack mapping and its parameterized form
$d,\tau$	distortion measure and fidelity constraint threshold	$\theta$	parameters of the attack mapping
$E,D$	DnD encoder and decoder	$g,u$	structure latent and auxiliary residual latent
$(g_{w},u_{w})$	latent pair encoded from $x_{w}$	$(g_{c},u_{c})$	latent pair encoded from $x_{c}$ when available

Table 1: Summary of notation. Subscripts

w

and

c

denote watermarked and clean carriers when both are available.

Figure 1: Overview of the DnD inference pipeline. A watermarked image is encoded into a structure latent $g$ and an auxiliary residual latent $u$ . The structure branch is preserved under the latent spectral perturbation $A_{g}(g;K)$ , while the auxiliary residual branch is suppressed before decoding. The dropped output $x_{0}$ can then pass through low-strength diffusion stress $A_{x}(x_{0};S)$ and residual refinement $R$ to produce the final output $x_{R}$ .

Probe	Formal role	Metric	Observed support
B1 information gate	tests Proposition 1	$(\epsilon_{g},\rho-\delta)$	small structure drift and positive gap with clean carrier fidelity preserved
B2 counterfactual swaps	tests Lemma 1	BER or detector response of $cw$ and $w0$	payload evidence follows $u_{w}$ and is suppressed by $u=0$
B3 pixel energy	supports residual channel separability	$E_{g},E_{u},E_{W}-E_{g}-E_{u}$	watermark induced energy is explained mainly by the auxiliary branch
B4 decoder sensitivity	checks branch geometry	unit-response sensitivity to $g$ and $u$	$g$ remains stable while $u$ is discardable
B5 spectral localization	checks the latent stressor	low/mid/high residual bands	watermark residuals concentrate in bands targeted by $A_{g}$
B6 information certificate	links BER to recoverability	$1-h_{2}(\min(p,0.5))$	certificate decreases as BER approaches random guessing

Table 2: Residual channel separability and payload routing analysis. The probes map the formal removability argument to measurable predictions, separating targeted residual suppression from untargeted image degradation.

Figure 2: Trade-off between BER and PSNR across attack families. The plot tests whether watermark disruption can be separated from visible image degradation. Conventional image edits can reach high removal only by moving to regimes with low PSNR, while reconstruction and regeneration baselines show method-dependent tradeoffs. The fixed controlled DnD operating point lies in the high-fidelity region, consistent with learned residual channel suppression being distinct from visible image degradation.

Figure 3: Tables 3 and 4 provide an aggregate comparison of watermark removal performance and image quality across different attack endpoints. The horizontal axis reports the mean PSNR over the six bit-decoder watermark families, the vertical axis reports the corresponding mean BER, and color indicates the Tree-Ring removal accuracy under the fixed low-FPR detector setting. The shaded region denotes the low-fidelity range. The fixed DnD operating point weakens payload recovery for the bit-decoder families while keeping the image content within the fidelity constraint, and it still retains a measurable detector-removal effect on Tree-Ring.

Attack endpoint	DwtDct			DwtDctSvd			RivaGAN			SSL			StegaStamp			Stable Signature			Tree-Ring
	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	Removal Acc. $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$
Gaussian blur	0.3481	29.30	0.8906	0.0000	30.36	0.9050	0.0000	30.77	0.8945	0.0000	28.16	0.8413	0.0000	28.09	0.8482	0.1813	30.53	0.9062	0.0000	29.48	0.9003
Gaussian noise	0.6038	20.59	0.4996	0.3025	20.49	0.4762	0.0516	20.55	0.4794	0.5055	20.53	0.5135	0.0018	20.52	0.5072	0.1842	23.28	0.4925	0.0100	22.45	0.4555
Brightness	0.4591	7.78	0.2871	0.3787	8.00	0.2931	0.1391	8.39	0.2910	0.0023	8.07	0.2538	0.0000	7.87	0.2584	0.3762	7.93	0.2425	0.0700	7.32	0.2448
Contrast	0.4587	14.21	0.6466	0.3787	14.35	0.6687	0.1309	14.39	0.6497	0.0048	14.34	0.5788	0.0000	14.00	0.5811	0.4279	14.69	0.5733	0.0100	13.91	0.5498
Rotation	0.4097	9.69	0.2187	0.4094	9.98	0.2392	0.3081	9.82	0.2329	0.0333	9.98	0.2122	0.4227	9.59	0.2100	0.4281	10.19	0.2255	0.7200	8.98	0.2101

Table 3: Quantitative comparison between conventional watermark removal attacks in image space and the fixed controlled operating point of DnD (

K=0.925,U=0.02,S=0.04

). BER is reported for bit-decoder watermarks, and Removal Acc. is reported for Tree-Ring. Bold values mark the strongest raw entry within this table; BER values above 0.5 should be read under the random-guessing ceiling described in the protocol.

Attack endpoint	DwtDct			DwtDctSvd			RivaGAN			SSL			StegaStamp			Stable Signature			Tree-Ring
	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	Removal Acc. $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$
CtrlRegen	0.4216	21.16	0.6242	0.4713	21.58	0.6455	0.4803	21.66	0.6272	0.5298	20.83	0.5594	0.4505	20.91	0.5949	0.5112	21.57	0.6320	0.2200	21.68	0.6570
WatermarkAttacker Diff 60	0.4153	23.96	0.7154	0.4088	24.59	0.7357	0.4106	24.84	0.7210	0.4885	23.22	0.6439	0.2570	23.37	0.6755	0.5050	24.80	0.7378	0.1500	24.98	0.7702
BMSHJ2018	0.4113	29.30	0.8676	0.4000	29.96	0.8760	0.3934	30.15	0.8615	0.5053	28.31	0.8115	0.3683	28.41	0.8272	0.3360	30.34	0.8679	0.0200	29.91	0.8587
Cheng2020	0.4119	30.59	0.8943	0.3875	31.05	0.8968	0.4025	31.26	0.8851	0.4905	29.94	0.8503	0.3619	30.08	0.8629	0.2533	31.45	0.8861	0.0400	31.36	0.8812
SADRE Diff 60	0.4156	25.99	0.7663	0.4844	26.68	0.7844	0.3559	27.02	0.7647	0.4838	24.98	0.6906	0.2465	25.19	0.7237	0.4771	27.47	0.8087	0.0100	28.44	0.8559

Table 4: Quantitative comparison between reconstruction or regeneration endpoints for watermark removal and the fixed controlled operating point of DnD (

K=0.925,U=0.02,S=0.04

). WatermarkAttacker Diff 60 and SADRE Diff 60 denote 60-step reverse-diffusion reconstruction attacks, while BMSHJ2018 and Cheng2020 denote VAE-based learned-compression reconstruction endpoints [ 41 , 42 ] . BER is reported for bit-decoder watermarks, and Removal Acc. is reported for Tree-Ring. Bold values mark the strongest raw entry within this table; BER values above 0.5 should be read under the random-guessing ceiling described in the protocol.

Figure 4: Qualitative comparison across seven watermark families. For each watermark family, the image row shows the attacked output and the residual row shows the amplified absolute difference to the watermarked reference. The fixed DnD endpoint is highlighted in green. Compared with severe brightness changes or high-noise attacks, DnD preserves image content while altering residual evidence used by watermark decoders.

A. K/U/S scan evidence
Setting	$K/U/S$ or Slice	BER $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	Tree-Ring Removal Acc. $\uparrow$
Coarse scan: maximum removal boundary	$1.5/0.5/0.2$	0.521	17.99	0.464	0.90
Coarse scan: best high-fidelity point, PSNR $\geq 28$	$0.5/0/0$	0.344	30.18	0.932	0.21
Fine scan: best bit removal	$0.85/0/0.04$	0.411	28.43	0.900	0.51
Fine scan: best bit removal, PSNR $\geq 29$	$1.0/0/0.10$	0.408	29.17	0.905	0.46
Finer scan: best bit removal	$0.825/0/0.03$	0.412	28.14	0.899	0.45

Table 5: Aggregated scan and ablation evidence. BER, PSNR, and SSIM average SSL, DwtDct, DwtDctSvd, RivaGAN, Stable Signature, and StegaStamp; Tree-Ring removal accuracy is reported separately.

Figure 5: Effect of reintroducing the auxiliary residual branch under different diffusion regimes. Without diffusion, larger $U$ behaves like residual restoration and improves PSNR while reducing removal. Once diffusion is active, larger $U$ no longer recovers fidelity and mainly weakens the attack, which supports the interpretation that strong diffusion is a poor core mechanism for useful watermark removal.

Figure 6: Ablation tradeoff at $K=0.925,U=0.02,S=0.04$ . The scatter view separates useful removal under a fidelity constraint from low-fidelity variants with high raw removal scores. Removing the frequency-aware latent attack or clean-drop supervision increases removal metrics at substantial fidelity cost, whereas unfreezing the Stage 2 base shifts the model toward reconstruction and disabling the test-time refiner shows the role of post-drop repair.

Watermark Removal

Watermark removal studies how to erase or evade embedded signals in text, images, and audio while preserving useful content.

See all 39 papers

FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack
Jul 30, 2026Chunpeng Wang, Yuxin Li, Xiaoyu Wang +3Watermark Removal
Qilu University of Technology (Shandong Academy of Sciences), Jinan, Shandong Province, China · Dalian Maritime University, Dalian, Liaoning Province, China · Dalian Polytechnic University, Dalian, Liaoning Province, China
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Oct 2, 2026Saibo Ye, Huajie Chen, Xin Guo +5Watermark Removal AI-Generated Image Watermarking
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2
Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal
Sep 22, 2026Jidong Yang, Huaike Yu, Qi Li +4Watermark Removal Disentangled Representation Learning
Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Department of Computer Science, City University of Hong Kong (Dongguan), Dongguan, Guangdong 518057, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China +1

Jul 30, 2026J/K move · Enter open · S save

FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack

Chunpeng Wang, Yuxin Li, Xiaoyu Wang, Jidong Yang+2

Qilu University of Technology (Shandong Academy of Sciences), Jinan, Shandong Province, China · Dalian Maritime University, Dalian, Liaoning Province, China · Dalian Polytechnic University, Dalian, Liaoning Province, China

Watermark Removal

Open paper AskPDF arXiv

Existing invisible watermark removal methods often struggle to accurately capture the watermark-bearing features, leading to an unfavorable trade-off between watermark suppression and perceptual fidelity. In this paper, we propose the Frequency-Decoupled Diffusion Watermark Attack Network (FDDWAN), a coarse-to-fine framework that performs watermark removal through wavelet-domain decomposition and residual diffusion refinement. In the initial stage, the Wavelet-based Frequency-domain Preliminary Attack Module (WFPAM) decomposes the watermarked image into low- and high-frequency subbands and applies frequency-specific attack strategies tailored to their respective contributions to watermark robustness and perceptual quality. In the next stage, the Frequency-domain Residual Diffusion Attack Module (FRDAM) separately models the residual distributions between the preliminarily attacked outputs and the corresponding watermark-free references during training. Rather than reconstructing the entire image, FRDAM selectively refines frequency-domain residuals, directing the diffusion process toward the remaining watermark related discrepancies while minimizing modifications to image content. Extensive experiments on CelebA and ImageNet across four representative watermarking schemes demonstrate that FDDWAN achieves a more favorable trade-off between watermark removal effectiveness and visual fidelity than conventional and learning-based attack methods.

Abstract

Watermark Removal

Explore similar work

FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal