LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Authors: Saibo Ye, Huajie Chen, Xin Guo, Le Yang, Chi Liu, Xiangyu Hu, Jingjing Guo, Tianqing Zhu
Organizations: Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu 610054, China · School of Cyber Engineering, Xidian University, Xi’an 710071, China
Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.
Figures & tables
Fig. 1: Overview of LiBRA. A watermarked image is encoded into latent space and iteratively refined using feedback from a frozen watermark detector. LiBRA steers the mean soft bit-matching confidence toward a fixed near-chance target to discourage excessive bit inversion, while fidelity regularization limits visual changes. The refined latent is decoded into the output image. The dashed arrow denotes iterative refinement. Images are illustrative.
Notation
Definition
x0 , x′
Watermarked input and attacked image.
E , D
Public autoencoder encoder and decoder.
Dm
Watermark decoder.
w , N
Watermark key and its bit length.
Lw , δ
Input latent representation and latent perturbation.
Ms
Frequency-guided spatial mask.
TABLE I: Main notation.
Capability
Assumed
Query the detector Dm on chosen images
yes
Back-propagate gradients through Dm
yes
Know or estimate the key w
yes
Know the key length N
yes
Use a public, non-watermarked VAE (E,D)
yes
Access the provider’s watermarked decoder
no
TABLE II: Adversary capabilities assumed in this work.
Fig. 2: Overview of the attack. Stage 1 builds an optional spatial prior Ms from the image’s DWT energy; Stage 2 perturbs the latent code of a public autoencoder inside that prior and decodes the attacked image x′ ; Stage 3 queries the detector and scores the decoded bits with the watermark objective. Dashed arrows denote parameter updates. The symmetric objective guides mean confidence toward a near-chance target and counteracts excessive inversion, while fidelity penalties constrain changes to the latent representation and reconstructed image.
Fig. 3: The heuristic spatial prior: (a) watermarked input; (b) spatial mask; (c) perturbation visualization. The mask describes image content, not watermark localization.
Fig. 4: Bit-accuracy trajectories under the baseline, the adaptive per-bit variant (B+) and the two-sided objective (LiBRA).
Symbol
Meaning
Value
T
optimization iterations
50
—
optimizer / learning rate
Adam / 0.01
τh , τl
mask thresholds (high, low freq.)
0.3 , 0.5
k , p
closing kernel side length, expansion radius
5 , 2
λl
weight of ∥Ms⊙δ∥22
10−2
λx
weight of ∥x′−x0∥22
10−4
TABLE III: Attack hyperparameters.
Scheme ( N , accepted k )
Configuration
DR1↓
Bit ACC
PSNR (dB) ↑
SSIM ↑
LPIPS ↓
DR2↓
Stable Signature N=48 , k=15:33
No attack
1.00
0.996
—
1.000
0.000
1.00
Baseline
0.00
0.018
35.1
0.942
0.074
1.00
B (fixed τ )
0.00
0.091
36.0
0.951
0.066
1.00
B+ (adaptive τ )
0.00
0.228
36.8
0.958
0.060
1.00
LiBRA (two-sided)
0.00
0.458
38.0
0.970
0.046
0.03
YU1 N=100 , k=37:63
No attack
1.00
0.998
—
1.000
0.000
1.00
TABLE IV: Main results across four watermarking systems.
Fig. 5: Distribution of achieved bit accuracy on Stable Signature over 5,000 images, on the 48-bit grid. Panels compare no attack, baseline, B, B+, and LiBRA. Shading denotes exact accepted counts k=15:33 at α=0.01 ; the black curve is the theoretical binomial null. Percentages report the two-sided and naive one-sided detection rates.
Fig. 6: Relationship between final mean confidence and hard bit accuracy under LiBRA on Stable Signature ( N=48 ). The vertical band marks ∣cˉ−0.45∣≤0.02 and the horizontal band marks exact accepted bit counts. Crosses illustrate meeting the soft target while failing the hard test. Each point represents one attacked image, with horizontal and vertical jitter for visibility; categories and statistics use unjittered values.
Scheme
N
Soft target met
Hard-test evasion
Target met, detected
Stable Signature
48
0.95
0.97
0.02
YU1
100
0.97
1.00
0.00
HiDDeN
30
0.93
0.96
0.03
MBRS
64
0.94
0.95
0.03
TABLE V: Soft-target and hard-test agreement.
Family
Method
DR1↓
Bit ACC
SSIM ↑
LPIPS ↓
DR2↓
Post-processing
Center crop ( 10% )
1.00
0.943
0.618
0.312
1.00
JPEG ( q=90 )
1.00
0.991
0.967
0.029
1.00
Gaussian blur ( k=5 )
1.00
0.978
0.884
0.148
1.00
Bilateral filter
1.00
0.969
0.912
0.106
1.00
Quantization ( 8 levels)
1.00
0.927
0.741
0.223
1.00
Removal attacks
WEvade-W-I (flip) [ 9 ]
0.00
0.012
0.944
0.067
1.00
TABLE VI: Comparison with removal attacks and image transformations.
Method
Space / reference
DR2↓
SSIM ↑
LPIPS ↓
Time (s/image)
WEvade-W-II
pixel / random
0.02
0.951
0.061
24.8
WEvade-W-II
latent / random
0.03
0.965
0.050
118.6
LiBRA
latent / random
0.04
0.967
0.048
12.5
LiBRA
latent / key
0.03
0.970
0.046
12.4
TABLE VII: Comparison with WEvade-W-II.
Configuration
Bit ACC
SSIM ↑
LPIPS ↓
DR2↓
Time (s/image)
VAE reconstruction only
0.893
0.976
0.039
1.00
0.2
Full latent, no mask
0.461
0.962
0.053
0.03
12.1
Random mask
0.452
0.964
0.051
0.05
12.4
Edge (Sobel) mask
0.455
0.967
0.049
0.04
12.4
LiBRA (frequency mask)
0.458
0.970
0.046
0.03
12.4
+Lbit
0.447
0.966
0.050
0.04
12.9
TABLE VIII: Ablation study of attack components.
Fig. 7: Sensitivity of LiBRA to the target mean confidence a⋆ across four watermarking systems. The vertical dashed line marks the default setting a⋆=0.45 .
a⋆
Bit ACC
MAE to target
SSIM ↑
LPIPS ↓
DR2↓
0.30
0.309
0.031
0.962
0.053
0.44
0.40
0.407
0.027
0.967
0.049
0.05
0.45
0.458
0.026
0.970
0.046
0.03
0.48
0.484
0.027
0.972
0.044
0.02
0.50
0.503
0.029
0.973
0.043
0.02
TABLE IX: Sensitivity to the target confidence.
Objective
Bit ACC
SSIM ↑
LPIPS ↓
DR2↓
DR after JPEG ↓
Point, a⋆=0.45
0.458
0.970
0.046
0.03
0.05
Band, h=0.10
0.406
0.972
0.044
0.05
0.06
Band, h=0.15
0.359
0.974
0.042
0.12
0.09
Band, h=0.18
0.331
0.975
0.041
0.26
0.15
TABLE X: Comparison of point-target and band-penalty objectives.
DR2↓
α
Acceptance bounds
Width
Baseline
B+
LiBRA
0.1
[0.420,0.580]
0.160
1.00
1.00
0.21
0.05
[0.400,0.600]
0.200
1.00
1.00
0.06
0.01
[0.370,0.630]
0.260
1.00
0.98
0.00
0.001
[0.340,0.660]
0.320
1.00
0.93
0.00
TABLE XI: Effect of the detector significance level.
Key error ϵ
Bit ACC
MAE to target
SSIM ↑
LPIPS ↓
DR2↓
0 (exact key)
0.458
0.026
0.970
0.046
0.03
0.05
0.463
0.028
0.970
0.046
0.03
0.10
0.469
0.032
0.969
0.047
0.04
0.20
0.481
0.041
0.968
0.048
0.05
TABLE XII: Sensitivity to watermark key estimation errors.
Baseline
LiBRA
T
Bit ACC
SSIM ↑
DR2↓
Bit ACC
SSIM ↑
DR2↓
10
0.214
0.968
0.94
0.527
0.975
0.06
25
0.052
0.955
1.00
0.466
0.971
0.03
50
0.018
0.942
1.00
0.458
0.970
0.03
100
0.004
0.921
1.00
0.455
0.970
0.03
TABLE XIII: Effect of the iteration budget.
Resolution
Latent shape (H/f)×(W/f)×C
Bit ACC
DR2↓
Time (s/image)
Peak memory (GB)
256×256
32×32×4
0.461
0.04
3.6
5.1
512×512
64×64×4
0.458
0.03
12.4
13.8
768×768
96×96×4
0.457
0.03
25.9
29.6
TABLE XIV: Effect of image resolution.
Condition
Bit ACC
SSIM ↑
DR1↓
DR2↓
None (as attacked)
0.458
0.970
0.00
0.03
JPEG ( q=90 )
0.466
0.962
0.12
0.03
JPEG ( q=50 )
0.489
0.921
0.36
0.05
Resize ( 0.5× , restored)
0.474
0.931
0.21
0.04
Gaussian noise ( σ=0.02 )
0.471
0.903
0.18
0.04
Center crop ( 10% )
0.483
0.611
0.29
0.05
TABLE XV: Post-processing robustness and dispersion-aware detection.
Setting
DR2↓
Dispersion DR ↓
Combined DR ↓
SSIM ↑
LPIPS ↓
No attack
1.00
0.99
1.00
1.000
0.000
LiBRA
0.03
0.62
0.64
0.970
0.046
LiBRA +Ldisp
0.04
0.06
0.09
0.966
0.050
TABLE XVI: Adaptive attack against the dispersion-aware detector.
Fig. 8: Qualitative comparison on Stable Signature ( N=48 ). Columns: input x0 , baseline, B+, and LiBRA; lower rows are labeled as amplified residuals.
Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored. Existing attacks either succeed only against specific generative models or achieve removal at the cost of severe visual degradation. In this paper, we propose MarkNull, a model-agnostic watermark removal attack via on-manifold latent manipulation. MarkNull is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. To quantify this dependency, we introduce the Noise-Latent Alignment Score (NLAS) and formulate an optimization objective that selectively decorrelates the latent representation from the embedded watermark while preserving semantic fidelity. Extensive evaluations across different categories of watermarking paradigms, including post-hoc, fine-tuning-based, and initial-noise-based schemes, demonstrate that MarkNull reduces average bit accuracy to 53.14%, approaching random-guessing (50%), without perceptible image degradation. To further improve scalability, we propose MarkNull-A, an amortized, optimization-free variant that distills the attack into a single forward pass, achieving 0.50 s/image with modest computational overhead. Notably, our attacks successfully compromise Google's SynthID-Image system while preserving high visual quality and transfer effectively to video watermarking. Finally, we present an attack detection mechanism as a defensive counterpart to MarkNull and MarkNull-A, highlighting the necessity of developing watermark designs resilient to model-agnostic latent-space attacks.
Jie Cao, Qi Li, Zelin Zhang +4
Queen’s University, Canada · University of Waterloo, Canada
With the proliferation of AI-generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug-and-play, training-free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion-denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.
Invisible watermarking has become a central tool for tracing AI-generated images, but its robustness against adaptive removal attacks remains an open security question. We introduce Latent Frequency Masking, an attack that erases watermark evidence by replacing selected Fourier coefficients in the latent representation of a watermarked image. The replacement can be sampled from Gaussian noise for efficiency or derived from diffusion regeneration for improved image preservation. We provide a theoretical distortion bound relating the change between the reconstructed adversarial image and the masked latent-frequency perturbation. We evaluate the proposed attack against six diffusion watermarking methods on images generated from DiffusionDB and MS-COCO prompts. Latent Frequency Masking removes or substantially weakens several watermarks while preserving perceptual quality and achieving favorable runtime compared with existing attacks. These results identify latent-frequency manipulation as a practical attack surface and highlight the need to include such attacks in robustness evaluations of generative image watermarking.
Kirill Aistov, Khaled Abud, Irina Serzhenko +8
MSU AI Institute, Moscow, Russia · Trusted AI Research Center RAS, Moscow, Russia