Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking

Kirill Aistov; Khaled Abud; Irina Serzhenko; Egor Kovalev; Aleksey Yakushev; Aleksandr Akimenkov; Dmitry Obydenkov; Yury Markin

cs.CVOct 1, 2026

Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking

Authors: Kirill Aistov, Khaled Abud, Irina Serzhenko, Egor Kovalev, Aleksey Yakushev, Aleksandr Akimenkov, Dmitry Obydenkov, Yury Markin, +3 more

Organizations: MSU AI Institute, Moscow, Russia · Trusted AI Research Center RAS, Moscow, Russia

Abstract

Invisible watermarking has become a central tool for tracing AI-generated images, but its robustness against adaptive removal attacks remains an open security question. We introduce Latent Frequency Masking, an attack that erases watermark evidence by replacing selected Fourier coefficients in the latent representation of a watermarked image. The replacement can be sampled from Gaussian noise for efficiency or derived from diffusion regeneration for improved image preservation. We provide a theoretical distortion bound relating the change between the reconstructed adversarial image and the masked latent-frequency perturbation. We evaluate the proposed attack against six diffusion watermarking methods on images generated from DiffusionDB and MS-COCO prompts. Latent Frequency Masking removes or substantially weakens several watermarks while preserving perceptual quality and achieving favorable runtime compared with existing attacks. These results identify latent-frequency manipulation as a practical attack surface and highlight the need to include such attacks in robustness evaluations of generative image watermarking.

Figures & tables

Fig. 1: Overview of the watermark robustness evaluation setup

Fig. 2: The overall scheme of the proposed Latent Frequency Masking removal algorithm

Fig. 3: Removal efficiency (TPR@1%FPR $\downarrow$ of the watermark after attack) vs image quality (PSNR $\uparrow$ ) for different attacks measured on DiffusionDB dataset. Lower-right is better; LFM variants sit on the Pareto front for all methods except Gaussian Shading

	DiffusionDB					MS-COCO
	Robustness	Quality metrics				Robustness	Quality metrics
Attack	TPR@1%FPR $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	CLIP IQA $\uparrow$	TPR@1%FPR $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	CLIP IQA $\uparrow$
No attack	0.97	$\infty$	1.000	0.000	0.866	0.98	$\infty$	1.000	0.000	0.883
Adv. Embedding [ 21 ]	0.71	22.2	0.462	0.402	0.349	0.71	22.3	0.459	0.439	0.301
Diff. Regeneration [ 23 ]	0.51	21.7	0.620	0.205	0.840	0.51	22.4	0.657	0.178	0.833
Diff. Rinsing [ 21 ]	0.42	20.1	0.553	0.258	0.856	0.44	20.8	0.591	0.223	0.838

TABLE I: Attack performance and quality metrics averaged across all tested watermarks on DiffusionDB and MS-COCO datasets

Fig. 4: Removal efficiency (TPR@1%FPR $\downarrow$ of the watermark after attack) vs image quality (LPIPS $\uparrow$ ) for different attacks measured on DiffusionDB dataset. Lower-left is better; LFM variants sit on the Pareto front for all methods except Gaussian Shading

Fig. 5: Average attack performance vs execution time. The size of the dot represents the average PSNR on the DiffusionDB dataset

Fig. 6: Examples of a Tree-Ring-watermarked image subjected to different attacks. The prompt is sampled from the DiffusionDB database.

Attack	TPR@1%FPR	PSNR
VAE	1.0	33.1
VAE + Masking	1.0	23.7
FFT + Masking	0.995	11.4
VAE + FFT + Masking (Gaussian)	0.001	19.4
VAE + FFT + Masking (Diffusion)	0.385	28.7

TABLE II: Ablation results, VAE represents only the Encoder and Decoder steps without any masking, VAE + Masking: masking performed in spatial domain without FFT step, FFT + Masking: frequency masking is performed on images without Encoder and Decoder steps, VAE + FFT + Masking: full algorithm

Explore similar work

Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework
Apr 24, 2026Chunpeng Wang, Binyan Qu, Xiaoyu Wang +4Watermarks Diffusion Models
Qilu University of Technology (Shandong Academy of Sciences) Jinan, Shandong Province, China · Dalian Maritime University Dalian, Liaoning Province, China · Nanjing University of Science and Technology Nanjing, Jiangsu Province, China +1
DeepFreqMark: End-To-End Learnable Frequency-Domain Watermarking with Spherical Attack Simulation for Latent Diffusion Models
Aug 10, 2026Chen-Hsiu Huang, Mario Köppen, Ja-Ling WuWatermarks Latent Diffusion Model
National Taiwan University, Taipei, Taiwan · Kyushu Institute of Technology, Fukuoka, Japan
MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation
Aug 10, 2026Jie Cao, Qi Li, Zelin Zhang +4Watermarks Ai-Generated Image Detection
Queen’s University, Canada · University of Waterloo, Canada

Apr 24, 2026, cs.CVJ/K move · Enter open · S save

Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework

Chunpeng Wang, Binyan Qu, Xiaoyu Wang, Zhiqiu Xia+3

Qilu University of Technology (Shandong Academy of Sciences) Jinan, Shandong Province, China · Dalian Maritime University Dalian, Liaoning Province, China · Nanjing University of Science and Technology Nanjing, Jiangsu Province, China+1

Watermarks Diffusion Models Frequency Domain Visual Fidelity

Open paper AskPDF arXiv

Digital image watermarking has advanced rapidly for copyright protection of generative AI, yet the comparatively limited progress in watermark attack techniques has broken the attack-defense balance and hindered further advances in the field. In this paper, we propose FMDiffWA, a frequency-domain modulated diffusion framework for watermark attacks. Specifically, we introduce a frequency-domain watermark modulation (FWM) module and incorporate it into the sampling stages both the forward and reverse diffusion processes. This mechanism enables selective modulation of watermark-related frequency components, thereby allowing FMDiffWA to effectively neutralize the invisible watermark signals while preserving the perceptual quality of the attacked watermarked images. To achieve a better trade-off between attack efficacy and visual fidelity, we reformulate the training strategy of conventional diffusion models by augmenting the canonical noise estimation objective with an auxiliary refinement constraint. Comprehensive experiments demonstrate that FMDiffWA achieves superior visual fidelity compared to existing watermark attacks, while exhibiting strong generalization across diverse watermarking schemes.

Abstract

Explore similar work

Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework

DeepFreqMark: End-To-End Learnable Frequency-Domain Watermarking with Spherical Attack Simulation for Latent Diffusion Models

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation