Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal

Jidong Yang; Huaike Yu; Qi Li; Chunpeng Wang; Yuantian Miao; Suo Gao; Xiao Chen

cs.CVSep 22, 2026

Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal

Authors: Jidong Yang, Huaike Yu, Qi Li, Chunpeng Wang, Yuantian Miao, Suo Gao, Xiao Chen

Organizations: Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, and Shandong Provincial Key Laboratory of Industrial Network and Information System Security, Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Department of Computer Science, City University of Hong Kong (Dongguan), Dongguan, Guangdong 518057, China · School of Information Science and Engineering, Dalian Polytechnic University, Dalian 116034, China · School of Computer and Information Sciences, College of Engineering, Science and Environment, The University of Newcastle, Callaghan, NSW 2308, Australia

Abstract

Fixed image distortions do not cover an attacker that learns from paired clean and watermarked images. We study this paired-training threat with single-image inference: deployment uses neither the clean reference nor the watermark key, payload, or decoder. An encoder maps each image to a structural latent $g$ and an auxiliary residual latent $u$ . Push supervision reconstructs the watermarked image from $D(g_w,u_w)$ . Pull supervision trains the zero-auxiliary output $D(A_g(g_w;k),0)$ toward the paired clean image. At $k=1.10,u=0$ , the four-method sweep gives an average BER of $0.3958$ , PSNR of $31.07$ dB, and SSIM of $0.9554$ . Restoring $u$ from $0$ to $0.15$ moves average BER from $0.3893$ to $0.3357$ , while PSNR falls from $30.99$ to $28.23$ dB. The intervention supports decoder dependence on the auxiliary input in the evaluated setting. The accompanying theory is a conditional, post-hoc account of this behavior rather than an experimentally verified information-relocation result.

Figures & tables

Resource	Training and offline selection	Deployment on one image
Image input	Paired $(x_{c},x_{w})$ examples	One watermarked image $x_{w}$
Watermark families	Four represented families	The trained mapping can be applied to any input; results distinguish seen from excluded families
Clean reference	Used as the supervised target	Unavailable
Key, payload, or seed	Not required by the attack training loss	Unavailable
Decoder or detector	Used after training to report metrics and select $(k,u)$	Not queried or supplied to $A_{\theta}$
Objective	Learn the paired clean target while retaining reconstruction fidelity	Produce one attacked image under the fixed selected setting

Table 1: Attacker capability by phase. Evaluator access is separated from the deployment inputs.

Figure 1: Paired push–pull training and single-image inference. Push reconstructs the watermarked input from $(g_{w},u_{w})$ . Pull supervises the attacked zero-auxiliary output toward the paired clean target. Deployment follows $x_{w}\rightarrow E\rightarrow(g_{w},u_{w})\rightarrow(A_{g}(g_{w};k),0)\rightarrow x_{\mathrm{atk}}$ and does not use the clean reference or watermark verifier.

Figure 2: Pair-level supervision. The shared encoder maps aligned clean and watermarked images to two decoder inputs. The full watermarked path is pushed toward $x_{w}$ ; the attacked zero-auxiliary path is pulled toward $x_{c}$ .

Group	Representative terms	Function
Full-path push	$\\|D(g_{w},u_{w})-x_{w}\\|_{1}$	Preserve the watermarked input when both decoder inputs are present.
Structural pull	$\\|A_{g}(g_{w};k)-g_{c}\\|_{1}$	Align the attacked structural input with the paired clean representation.
Zero-auxiliary pull	$\\|D(A_{g}(g_{w};k),0)-x_{c}\\|_{1}$	Train the exact form of the deployed decoder input toward the paired clean target.
Reconstruction constraints	Clean reconstruction and $\\|u_{c}\\|_{1}$	Retain visible content and discourage unnecessary clean residual storage.
Fidelity constraints	Perceptual, high-frequency, and edge losses	Penalize content, texture, and boundary changes in the attacked output.
Spectral constraints	Quantization and multiband magnitude losses	Regularize the attacked structural latent and its frequency profile.

Table 2: Functional groups in the training objective. The first three rows implement the paired push–pull structure; the remaining rows constrain fidelity and optimization.

Figure 3: Structural-latent frequency intervention. The rFFT coefficients are divided into radial bands, modified by the $k$ -controlled operator, and returned to the decoder through an inverse rFFT.

$k$	$u$	BER $\rightarrow 0.5$	PSNR $\uparrow$	SSIM $\uparrow$
1.10	0.00	0.3958	31.07	0.9554
1.00	0.00	0.3938	31.07	0.9553
0.90	0.00	0.3867	31.11	0.9586
0.90	0.03	0.3720	31.30	0.9591

Table 3: Shared fine-sweep settings over DwtDct, DwtDctSvd, RivaGAN, and SSL Watermarking. Bold BER is closest to

0.5

; bold PSNR/SSIM is larger.

$u$	BER $\rightarrow 0.5$	PSNR $\uparrow$	SSIM $\uparrow$
0.00	0.3893	30.99	0.9568
0.03	0.3695	31.05	0.9571
0.06	0.3521	30.83	0.9571
0.15	0.3357	28.23	0.9548
0.20	0.3426	26.09	0.9509

Table 4: Fine-sweep averages by auxiliary scale. Bold BER is closest to

0.5

; bold PSNR/SSIM is larger.

Method	Family	BER/Acc Rem.	PSNR	SSIM
DwtDct	Unseen	0.4106	31.69	0.9656
DwtDctSvd	Seen	0.4856	31.54	0.9659
RivaGAN	Seen	0.3697	31.65	0.9597
SSL Watermarking	Unseen	0.3207	29.43	0.9303
StegaStamp	Seen	0.4251	31.37	0.9470
Stable Signature	Unseen	0.2275	28.35	0.8934

Table 5: Selected-point results on all methods. Tree-Ring reports Acc Removal; other rows report BER, with values closer to

0.5

preferred.

Attack	Mean RR $\uparrow$	Mean PSNR $\uparrow$	Mean SSIM $\uparrow$	Tree-Ring Acc Removal $\uparrow$	Tree-Ring PSNR $\uparrow$	Tree-Ring SSIM $\uparrow$
JPEG	0.1774	35.87	0.9669	0.0000	43.18	0.9923
Gaussian noise	0.4769	20.99	0.4947	0.0100	22.45	0.4555
CtrlRegen	0.9276	21.28	0.6139	0.2200	21.68	0.6570
WatermarkAttacker	0.8251	24.13	0.7049	0.1500	24.98	0.7702
SADRE-Cheng	0.7692	30.73	0.8792	0.0400	31.36	0.8812
Ours ( $k=1.10,u=0$ )	0.7464	30.67	0.9436	0.3200	26.81	0.8799

Table 6: Compact baseline comparison. Bit metrics average DwtDct, DwtDctSvd, RivaGAN, SSL Watermarking, StegaStamp, and Stable Signature. Tree-Ring detector results are not included in those averages.

Figure 4: Representative outputs, absolute residuals $|x_{\mathrm{atk}}-x_{w}|\times 8$ , and signed residuals $(x_{\mathrm{atk}}-x_{w})\times 8$ . Red and blue denote positive and negative signed changes. The full grid is in Appendix E .

Attack	Acc Removal $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$
No ring notch	0.3200	26.81	0.8799
$r=0.40$	0.3400	26.60	0.8723
$r=0.45$	0.3600	26.31	0.8727
$r=0.50$	0.3900	25.47	0.8724
$r=0.55$	0.3500	25.40	0.8739
$r=0.60$	0.3200	26.24	0.8770

Table 7: Tree-Ring ring-notch radius scan at

k=1.10,u=0

Variant	$\Delta$ BER	$\Delta$ PSNR
w/o spectral alignment	$-0.044$	$+1.19$
w/o scheduled drop0 term	$+0.038$	$-3.37$
w/o perceptual constraint	$+0.010$	$-0.31$
w/o high-frequency residual	$-0.001$	$-0.01$
Fourier groups 4	$+0.004$	$-0.06$
Fourier groups 16	$+0.001$	$-0.06$

Table 8: Mean ablation changes over six bit-decoder methods. Tree-Ring is excluded. Positive

\Delta

BER moves toward

0.5

because all values remain below

0.5

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Setting	$k$	$u$	Avg. BER $\rightarrow 0.5$	PSNR $\uparrow$	SSIM $\uparrow$	Method BERs
$K0U0$	0.00	0.00	0.4042	22.51	0.9144	0.339/0.444/0.489/0.344
$K1U0$	1.00	0.00	0.3913	31.07	0.9553	0.316/0.414/0.470/0.365
$K0U1$	0.00	1.00	0.0697	37.80	0.9883	0.012/0.240/0.026/0.001
$K1U1$	1.00	1.00	0.1137	27.95	0.8583	0.125/0.225/0.105/0.000

Appendix

Table 9: Coarse-grid corners. Method BERs follow SSL Watermarking/DwtDct/DwtDctSvd/RivaGAN. Bold BER is closest to

0.5

; bold PSNR/SSIM is larger.

Setting	$k$	$u$	Avg. BER $\rightarrow 0.5$	PSNR $\uparrow$	SSIM $\uparrow$	Method BERs
Attack optimum	1.10	0.00	0.3958	31.07	0.9554	0.324/0.418/0.479/0.362
Nearby point	1.00	0.00	0.3938	31.07	0.9553	0.324/0.411/0.473/0.368
Balanced point	0.90	0.00	0.3867	31.11	0.9586	0.319/0.418/0.463/0.348
Nonzero- $u$ point	0.90	0.03	0.3720	31.30	0.9591	0.311/0.414/0.486/0.277
Higher- $u$ point	0.90	0.05	0.3550	31.29	0.9593	0.312/0.413/0.475/0.219

Appendix

Table 10: Full set of selected fine-sweep points. Method BERs follow SSL Watermarking/DwtDct/DwtDctSvd/RivaGAN.

$u$	BER $\rightarrow 0.5$	$\Delta$ BER	PSNR $\uparrow$	$\Delta$ PSNR	SSIM $\uparrow$
0.00	0.3893	0.0000	30.99	0.00	0.9568
0.03	0.3695	$-0.0198$	31.05	$+0.06$	0.9571
0.05	0.3570	$-0.0323$	30.94	$-0.05$	0.9571
0.06	0.3521	$-0.0372$	30.83	$-0.16$	0.9571
0.10	0.3399	$-0.0494$	30.01	$-0.98$	0.9566
0.15	0.3357	$-0.0536$	28.23	$-2.76$	0.9548

Appendix

Table 11: Fine-sweep averages grouped by auxiliary scale. Deltas are relative to

u=0

Setting	DwtDct			DwtDctSvd			RivaGAN			SSL Watermarking
	BER $\rightarrow 0.5$	PSNR	SSIM	BER $\rightarrow 0.5$	PSNR	SSIM	BER $\rightarrow 0.5$	PSNR	SSIM	BER $\rightarrow 0.5$	PSNR	SSIM
$k=1.10,u=0$	0.4181	31.68	0.9656	0.4794	31.54	0.9659	0.3619	31.65	0.9597	0.3237	29.42	0.9302
$k=0.90,u=0.03$	0.4141	31.85	0.9683	0.4859	31.61	0.9685	0.2772	31.83	0.9627	0.3110	29.92	0.9368

Appendix

Table 12: Per-method fine-sweep metrics. Bold BER is closest to

0.5

; bold PSNR/SSIM is larger.

Method	Selection	$k$	$u$	BER $\rightarrow 0.5$	PSNR $\uparrow$	SSIM $\uparrow$
DwtDct	Strongest attack	0.8500	0.2500	0.5003	25.47	0.9613
DwtDct	Best recovery	0.0000	1.0000	0.2403	37.27	0.9900
DwtDct	RR $\geq 0.50$ best PSNR	0.9250	0.0375	0.4153	31.88	0.9679
DwtDctSvd	Strongest attack	0.5000	0.2500	0.5000	27.02	0.9661
DwtDctSvd	Best recovery	0.0000	1.0000	0.0262	37.59	0.9896
DwtDctSvd	RR $\geq 0.50$ best PSNR	0.9400	0.0163	0.4675	31.67	0.9677

Appendix

Table 13: Per-method points recomputed from the scan result files. Strongest attack maximizes RR with PSNR

\geq 25

dB; constrained rows maximize PSNR subject to an RR floor.

Panel of Figure 5 — Figure 5: Full PSNR (left) and BER (right) views across attack strength $k$ and auxiliary scale $u$ . BER should be read by proximity to $0.5$ .

Attack	DwtDct			DwtDctSvd			RivaGAN			SSL Watermarking			StegaStamp			Stable Signature			Tree-Ring
	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	Acc Rem.	PSNR	SSIM
Gaussian blur	0.3481	29.30	0.8906	0.0000	30.36	0.9050	0.0000	30.77	0.8945	0.0000	28.16	0.8413	0.0000	28.09	0.8482	0.1813	30.53	0.9062	0.0000	29.48	0.9003
Gaussian noise	0.6038	20.59	0.4996	0.3025	20.49	0.4762	0.0516	20.55	0.4794	0.5055	20.53	0.5135	0.0018	20.52	0.5072	0.1842	23.28	0.4925	0.0100	22.45	0.4555
JPEG	0.4038	33.67	0.9673	0.0156	34.28	0.9680	0.0025	34.42	0.9653	0.0255	34.43	0.9515	0.0001	34.63	0.9544	0.0848	43.80	0.9950	0.0000	43.18	0.9923
Brightness	0.4591	7.78	0.2871	0.3787	8.00	0.2931	0.1391	8.39	0.2910	0.0023	8.07	0.2538	0.0000	7.87	0.2584	0.3762	7.93	0.2425	0.0700	7.32	0.2448
Contrast	0.4587	14.21	0.6466	0.3787	14.35	0.6687	0.1309	14.39	0.6497	0.0048	14.34	0.5788	0.0000	14.00	0.5811	0.4279	14.69	0.5733	0.0100	13.91	0.5498

Appendix

Table 14: Conventional image-space attacks and our selected point. Bold BER is closest to

0.5

; bold detector removal and fidelity metrics are larger.

Attack	DwtDct			DwtDctSvd			RivaGAN			SSL Watermarking			StegaStamp			Stable Signature			Tree-Ring
	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	Acc Rem.	PSNR	SSIM
BM3D	0.4097	35.45	0.9422	0.3591	36.27	0.9412	0.0191	36.22	0.9391	0.2903	32.37	0.8715	0.0015	32.56	0.8837	0.2035	33.15	0.9019	0.0000	33.22	0.8973
CtrlRegen	0.4216	21.16	0.6242	0.4713	21.58	0.6455	0.4803	21.66	0.6272	0.5298	20.83	0.5594	0.4505	20.91	0.5949	0.5112	21.57	0.6320	0.2200	21.68	0.6570
WatermarkAttacker	0.4153	23.96	0.7154	0.4088	24.59	0.7357	0.4106	24.84	0.7210	0.4885	23.22	0.6439	0.2570	23.37	0.6755	0.5050	24.80	0.7378	0.1500	24.98	0.7702
SADRE-BMSHJ	0.4113	29.30	0.8676	0.4000	29.96	0.8760	0.3934	30.15	0.8615	0.5053	28.31	0.8115	0.3683	28.41	0.8272	0.3360	30.34	0.8679	0.0200	29.91	0.8587
SADRE-Cheng	0.4119	30.59	0.8943	0.3875	31.05	0.8968	0.4025	31.26	0.8851	0.4905	29.94	0.8503	0.3619	30.08	0.8629	0.2533	31.45	0.8861	0.0400	31.36	0.8812

Appendix

Table 15: Denoising, reconstruction, and regeneration attacks compared with our selected point. Bold BER is closest to

0.5

; bold detector removal and fidelity metrics are larger.

Variant	DwtDct			DwtDctSvd			RivaGAN			SSL Watermarking
	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM	BER	PSNR	SSIM
Full	0.4106	31.69	0.9656	0.4856	31.54	0.9659	0.3697	31.65	0.9597	0.3208	29.43	0.9303
w/o spectral alignment	0.4131	32.89	0.9772	0.4550	33.01	0.9776	0.2828	32.89	0.9713	0.2717	30.30	0.9517
w/o scheduled drop0	0.4225	27.95	0.9440	0.4928	27.33	0.9425	0.4934	27.52	0.9322	0.3610	26.76	0.8976
w/o perceptual constraint	0.4144	31.35	0.9630	0.4684	31.18	0.9640	0.3159	31.11	0.9558	0.2995	30.00	0.9323
w/o high-frequency residual	0.4147	31.69	0.9656	0.4891	31.58	0.9657	0.3669	31.54	0.9581	0.3090	29.57	0.9303

Appendix

Table 16: Ablations on DwtDct, DwtDctSvd, RivaGAN, and SSL Watermarking at

k=1.10,u=0

. Bold BER is closest to

0.5

; bold PSNR/SSIM is larger.

Variant	StegaStamp			Stable Signature			Tree-Ring
	BER	PSNR	SSIM	BER	PSNR	SSIM	Acc Rem.	PSNR	SSIM
Full	0.4251	31.37	0.9470	0.2275	28.35	0.8934	0.3200	26.81	0.8799
w/o spectral alignment	0.3573	33.28	0.9681	0.1975	28.78	0.9001	0.2700	27.54	0.8903
w/o scheduled drop0	0.4640	27.67	0.9175	0.2321	26.57	0.8825	0.1700	24.66	0.8410
w/o perceptual constraint	0.4164	31.04	0.9415	0.3863	27.48	0.8360	0.3700	25.08	0.8579
w/o high-frequency residual	0.4377	31.26	0.9453	0.2135	28.29	0.8922	0.3400	26.36	0.8756

Appendix

Table 17: Ablations on StegaStamp, Stable Signature, and Tree-Ring. Tree-Ring reports Acc Removal, not BER.

Figure 6: Full double residual comparison across all evaluated watermarking systems. Each watermarking block shows attack outputs, absolute residuals $|x_{\mathrm{atk}}-x_{w}|\times 8$ , and signed residuals $(x_{\mathrm{atk}}-x_{w})\times 8$ for the same attack methods as Tables 14 and 15 .

Stage	Operation	Output size	Notes
Input fusion	Concatenate RGB and $H(\mathrm{rgb2gray}(x))$	$4\times H\times W$	High frequency extractor uses kernel 5 and $\sigma=1.0$ .
Head	Conv $4\!\rightarrow\!64$ , ResBlock $(64)\times 2$	$64\times H\times W$	First shared feature map.
Down 1	DownConv $64\!\rightarrow\!128$	$128\times H/2\times W/2$	The $64$ channel head output is stored as a skip.
Down 2	DownConv $128\!\rightarrow\!256$	$256\times H/4\times W/4$	The $128$ channel feature is stored as a skip.
Bridge	ResBlock $(256)\times 4$	$256\times H/4\times W/4$	Bottleneck refinement.
Up 1	UpConv $256\!\rightarrow\!128$ + skip	$128\times H/2\times W/2$	Additive skip from Down 2 input.

Appendix

Table 18: Encoder block table. A residual block is Conv

(3,1,1)

–ReLU–Conv

(3,1,1)

plus an identity skip. A down block is Conv

(3,2,1)

–Conv

(3,1,1)

–ReLU. An up block is bilinear upsample by 2, Conv

(3,1,1)

–Conv

(3,1,1)

–ReLU, followed by skip addition.

Stage	Operation	Output size	Notes
Input fusion	Concatenate $g$ , $u$ , and $H(g)$	$18\times H\times W$	$C=16$ , so $1+C+1=18$ .
Projection	Conv $18\!\rightarrow\!64$	$64\times H\times W$	$3\times 3$ , stride 1, padding 1.
Residual trunk	ResBlock $(64)\times 8$	$64\times H\times W$	Full resolution residual refinement.
Expansion	Conv $64\!\rightarrow\!256$ , GELU	$256\times H\times W$	$3\times 3$ , stride 1, padding 1.
RGB head	Conv $256\!\rightarrow\!3$ , $\tanh$	$3\times H\times W$	$1\times 1$ projection to RGB in $[-1,1]$ .

Appendix

Table 19: Decoder block table. The decoder is full resolution throughout; it does not downsample.

Weight	Value	Active stage	Loss term / note
$\lambda_{\mathrm{inv}}$	2.0	1–3	MSE between $x_{c}$ and $D(g_{c},u_{c})$ .
$\lambda_{\mathrm{grayc}}$	1.0	1–3	Grayscale conformity for $g_{c}$ .
$\lambda_{\mathrm{rec1}}$	1.0	1–3	Multiplies $\\|D(g_{w},u_{w})-x_{w}\\|_{1}$ after the schedule scale $s_{\mathrm{rec1}}(e)$ .
$\lambda_{\mathrm{g-atk}}$	3.0	2–3	$\\|A_{g}(g_{w};k)-g_{c}\\|_{1}$ ; zero in Stage 1.
$\lambda_{\mathrm{gray\_hatw}}$	1.0	1–3	Grayscale conformity for the attacked structural latent. In Stage 1, $A_{g}$ is identity.
$\lambda_{\mathrm{drop0}}$	target 10.0	2–3	Same Stage 3 residual as $\mathcal{L}_{\mathrm{recov}}$ ; warms from 2.0 to 10.0 in Stage 2 and is 10.0 in Stage 3.

Appendix

Table 20: Complete loss weights used in the reported training schedule. Stage 1, Stage 2, and Stage 3 correspond to epochs 0–14, 15–79, and 80–139.

Stage	Epochs	Schedule
Stage 1	0–14	$A_{g}$ is identity, attack strength $k=0$ , zero auxiliary attack losses are inactive, and $s_{\mathrm{rec1}}=1$ .
Stage 2.1	15–35	Stage 2 starts. Attack strength follows a cosine ramp from 0.25 toward 0.75, $\lambda_{\mathrm{drop0}}$ warms from 2.0 toward 10.0, and $s_{\mathrm{rec1}}$ begins cosine decay.
Stage 2.2	36–57	Middle third of Stage 2; same schedules continue. The pooled VGG Stage 2 scale is $\min(1,3p_{\mathrm{s2}})$ and is saturated after the first third of Stage 2.
Stage 2.3	58–79	Final third of Stage 2. Attack strength reaches 0.75 and $s_{\mathrm{rec1}}$ reaches its floor 0.2.
Stage 3	80–139	Full objective is active. Attack strength ramps continuously from 0.75 to 1.0 during the first 8 Stage 3 epochs and stays at 1.0 afterwards. Perceptual Stage 3 weights warm up over the first 5 Stage 3 epochs.

Appendix

Table 21: Stage transition and scheduled quantities.

Watermark Removal

Watermark removal studies how to erase or evade embedded signals in text, images, and audio while preserving useful content.

See all 39 papers

Sep 18, 2026

Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition

Invisible image watermarks are commonly evaluated against benign postprocessing operations such as compression, resizing, blur, and color changes. These tests leave out a different threat: a learned remover that preserves semantic image content while discarding residual evidence that carries the payload. We propose Disentangle and Drop (DnD), an attack that is agnostic to the watermark method and treats watermark removal as a representation routing problem. DnD decomposes a watermarked image into a semantic grayscale carrier and an auxiliary residual branch, and then suppresses the residual branch to reduce watermark evidence. The model is trained with latent spectral perturbations and low-strength diffusion exposure so that the drop operation remains stable under adaptive reconstruction. Experiments on seven representative watermark families show that one shared operating setting gives competitive removal with high visual fidelity. Operating scans and ablations separate usable attacks from image-damaging settings: stronger noise or diffusion can raise removal scores by damaging the image, while the practical regime comes from dropping the residual latent. These results argue for evaluating watermark robustness against learned removal at the representation level, not only against conventional image edits.

Qi Li, Jidong Yang, Feng-Lei Fan +7

Key Laboratory of Computing Power Network and Information Security, Ministry of Education; Shandong Computer Science Center; Shandong Provincial Key Laboratory of Industrial Network and Information System Security; and Shandong Fundamental Research Center for Computer Science, Qilu University of Technology (Shandong Academy of Sciences), Jinan 250353, China · Department of Data Science, City University of Hong Kong, Hong Kong, China · School of Computer and Information Sciences, College of Engineering, Science and Environment, The University of Newcastle, Callaghan, NSW 2308, Australia +2

Watermark Removal Robust Watermarking

Ask PDF

Oct 2, 2026

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.

Saibo Ye, Huajie Chen, Xin Guo +5

Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2

Watermark Removal AI-Generated Image Watermarking Latent Space Optimization

Ask PDF

Feb 23, 2026

Decoupling Defense Strategies for Robust Image Watermarking

Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.

Jiahui Chen, Zehang Deng, Zeyu Zhang +3

Tsinghua University · Swinburne University of Technology · The Australian National University +2

Robust Watermarking Adversarial Robustness Adversarial Training

Ask PDF

Abstract

Watermark Removal

Explore similar work

Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Decoupling Defense Strategies for Robust Image Watermarking