RemTraceNet: Few-Shot Forensic Detection of Invisible Watermark Attacks

Jidong Yang; Huaike Yu; Qi Li; Yuantian Miao; Wei Zong; Yang-Wai Chow; Willy Susilo; Chunpeng Wang

cs.CVSep 18, 2026

RemTraceNet: Few-Shot Forensic Detection of Invisible Watermark Attacks

Authors: Jidong Yang, Huaike Yu, Qi Li, Yuantian Miao, Wei Zong, Yang-Wai Chow, Willy Susilo, Chunpeng Wang,

Organizations: Key Laboratory of Computing Power Network and Information Security, Ministry of Education; Shandong Computer Science Center; Shandong Provincial Key Laboratory of Industrial Network and Information System Security; Shandong Fundamental Research Center for Computer Science; Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Department of Computer Science, City University of Hong Kong (Dongguan), Dongguan, Guangdong 518057, China · Institute of Cybersecurity and Cryptology (iC2), University of Wollongong, Australia · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China

Abstract

Removing an invisible watermark and concealing the forensic evidence are distinct objectives: successfully disrupting the embedded watermark does not imply that the removal process is forensically undetectable. When verification fails, removal traces can provide complementary evidence for provenance and ownership verification, whereas their absence leaves the cause of the failure ambiguous. Existing methods are typically evaluated by watermark suppression and perceptual quality, while forensic stealth is rarely considered. We therefore study watermark-attack-specific few-shot forensics: for each known pipeline, a specialist can separate its outputs from paired clean and unattacked watermarked controls. Separate Attack-vs-Clean and Attack-vs-Watermarked evaluations prevent watermark-presence shortcuts. Image-aligned and prompt-matched controls are used for post-hoc and generator-integrated schemes, respectively. In this work, we introduce RemTraceNet, which fuses constrained residuals, local relations, FFT/Haar statistics, and block-DCT evidence at native resolution. Across 23 removal pipelines and 10 watermark configurations, we evaluate native 256 x 256 and 512 x 512 inputs. With 100 attacked training images per pipeline, the three-seed TPR@1%FPR, macro-averaged over attacks and watermark configurations, ranges from 82.75% to 88.17% across resolutions and control types. Under the condition of same labels and protocol, RemTraceNet outperforms retrained SRNet, ZhuNet, and SiaStegNet baselines by 10.80--15.68 percentage points. Extensive experimental results show that erasing a watermark and erasing evidence of its removal are distinct challenges, and that removal traces remain learnable under limited supervision.

Figures & tables

Figure 1: RemTraceNet overview. One specialist is selected for a known pipeline, while the image input contains no pipeline or watermark identity. Four global views are fused by learned gates; dense relation and DCT maps form a local Top- $k$ MIL decision. Equal weighting of the global and local logits produces the probability that the image was processed.

Symbol	Meaning	Symbol	Meaning
$q$	Pairing unit	$c$ , $p$	Source identity and prompt
$w$ , $a$	Watermark configuration and specified pipeline	$W_{w}$ , $K_{a}$	Watermark embedding and pipeline operators
$G_{0}$ , $G_{w}$	Clean and watermarked generators	$\xi_{0}$ , $\xi_{w}$	Generation random variables
$x_{c}$ , $x_{q}^{0}$	Source image and paired clean control	$x_{q,w}$ , $x^{+}_{q,w,a}$	Unattacked and processed watermarked images
$y$	Binary label: processed $1$ , control $0$	$f_{a}(x)=s$	Logit of the specialist for pipeline $a$
$\mathcal{T}_{\mathrm{clean}}$ , $\mathcal{T}_{\mathrm{wm}}$	Clean- and watermarked-control evaluation slices	$n$	Number of complete training triplets

Table 1: Symbols used in the problem formulation and method.

Res.	Negative	AUROC (All)	TPR@1%FPR (All)	TPR@1%FPR (Seen)	TPR@1%FPR (Unseen)
256	Clean	$98.21\pm 0.09$	$87.35\pm 0.90$	$91.28\pm 0.98$	$83.43\pm 0.90$
256	Watermarked	$98.01\pm 0.06$	$88.17\pm 0.36$	$92.03\pm 0.88$	$84.31\pm 0.56$
512	Clean	$96.44\pm 0.62$	$82.75\pm 1.19$	$82.97\pm 1.80$	$82.53\pm 0.58$
512	Watermarked	$96.68\pm 0.69$	$82.88\pm 1.74$	$85.62\pm 2.40$	$80.13\pm 1.44$

Table 2: Main test-ROC results with

n=100

training triplets per attack, reported as mean

\pm

standard deviation (%) over three seeds, with “All” averaging five seen and five unseen watermarks.

Figure 2: Qualitative forensic traces across nine attacks, showing the clean, watermarked, and attacked images, the amplified attacked–watermarked residual ( $\times 15$ ), and the native local-decision response for the same input.

Figure 3: Attack-family detection with $n=100$ complete training triplets per attack. Cells report three-seed macro AUROC while keeping native resolution and negative role separate. Panel (a) compares seen and unseen watermarks; panel (b) compares built-in (generator-integrated) and post-hoc configurations. Family and group means macro-average independently computed metrics for each attack and watermark.

Res.	Negative	SRNet	ZhuNet	SiaStegNet	RemTraceNet
256	Clean	61.46	69.04	75.69	86.49
256	Watermarked	63.33	68.34	75.40	87.77
512	Clean	51.61	61.80	70.25	84.12
512	Watermarked	53.35	62.37	69.05	84.73

Table 3: Seed-42 TPR@1%FPR (%) with

n=100

complete training triplets per attack. Each entry macro-averages 23 attack operations and ten watermarks for the specified resolution and negative role. Every model is retrained from scratch on the same attack-specific forensic task. Best values are bold.

Model	Conventional distortions (12)	Learned compression/ VAE reconstruction (5)	Diffusion regeneration (3)	Latent-space inversion (1)	Watermark forgery (1)	Classical denoising (1)
SRNet	52.12	93.61	19.94	27.25	44.77	95.75
ZhuNet	60.84	91.44	46.08	21.12	63.65	93.75
SiaStegNet	57.54	98.44	79.92	69.05	79.60	98.70
RemTraceNet	82.67	94.38	82.77	78.08	88.75	93.85

Table 4: Seed-42 family-level empirical test-ROC TPR@1%FPR (%) with

n=100

complete training triplets per attack. Entries macro-average slices defined by operation, watermark, resolution, and negative role; family operation counts appear in parentheses. Best values are bold.

Figure 4: Effective ablations. Only settings that reduce TPR@1%FPR in all four combinations of resolution and negative role are shown. Core-architecture and loss-suite points are three-seed means; clean-negative and global-DCT points use seed 42. Each point is the ablated setting minus its within-suite reference; negative values indicate degradation.

Watermark Removal Detection

See all 11 papers

The Forensic Cost of Watermark Removal: From Dedicated Attacks to Image Editing
Apr 28, 2026Gautier Evennou, Ewa KijakWatermark Removal Digital Image Forensics
IMATAG · IRISA, Univ. Rennes, INRIA, CNRS
Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy
May 16, 2026Maria Bulychev, Neil G. Marchant, Benjamin I. P. RubinsteinWatermark Removal Digital Image Forensics
University of Melbourne
Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition
Sep 18, 2026Qi Li, Jidong Yang, Feng-Lei Fan +7Watermark Removal Robust Watermarking
Key Laboratory of Computing Power Network and Information Security, Ministry of Education; Shandong Computer Science Center; Shandong Provincial Key Laboratory of Industrial Network and Information System Security; and Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Department of Data Science, City University of Hong Kong, Hong Kong, China · School of Computer and Information Sciences, College of Engineering, Science and Environment, The University of Newcastle, Callaghan, NSW 2308, Australia +2

Apr 28, 2026J/K move · Enter open · S save

The Forensic Cost of Watermark Removal: From Dedicated Attacks to Image Editing

Gautier Evennou, Ewa Kijak

IMATAG · IRISA, Univ. Rennes, INRIA, CNRS

Watermark Removal Digital Image Forensics Robust Watermarking Watermark Removal Detection

Open paper AskPDF arXiv

Current watermark removal methods are evaluated on two axes: attack success rate and perceptual quality. We show this is insufficient. While state-of-the-art attacks successfully degrade the watermark signal without visible distortion, they leave distinct statistical artifacts that betray the removal attempt. We name this overlooked axis Watermark Removal Detection (WRD) and demonstrate that a modern classifier trained on these artifacts achieves state-of-the-art detection rates at

10^{-3}

FPR across every removal method tested. No existing attack accounts for this forensic leakage. We benchmark leading watermarking schemes against standard removal pipelines under the extended evaluation triple of attack success, perceptual quality, and forensic detectability, and find that no current method balances all three. Our results establish forensic stealthiness as a necessary requirement for watermark removal.

Abstract

Watermark Removal Detection

Explore similar work

The Forensic Cost of Watermark Removal: From Dedicated Attacks to Image Editing

Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition