LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Saibo Ye; Huajie Chen; Xin Guo; Le Yang; Chi Liu; Xiangyu Hu; Jingjing Guo; Tianqing Zhu

cs.CROct 2, 2026

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Authors: Saibo Ye, Huajie Chen, Xin Guo, Le Yang, Chi Liu, Xiangyu Hu, Jingjing Guo, Tianqing Zhu

Organizations: Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu 610054, China · School of Cyber Engineering, Xidian University, Xi’an 710071, China

Abstract

Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.

Figures & tables

Fig. 1: Overview of LiBRA. A watermarked image is encoded into latent space and iteratively refined using feedback from a frozen watermark detector. LiBRA steers the mean soft bit-matching confidence toward a fixed near-chance target to discourage excessive bit inversion, while fidelity regularization limits visual changes. The refined latent is decoded into the output image. The dashed arrow denotes iterative refinement. Images are illustrative.

Notation	Definition
$x_{0}$ , $x^{\prime}$	Watermarked input and attacked image.
$E$ , $D$	Public autoencoder encoder and decoder.
$D_{m}$	Watermark decoder.
$w$ , $N$	Watermark key and its bit length.
$L_{w}$ , $\delta$	Input latent representation and latent perturbation.
$M^{\mathrm{s}}$	Frequency-guided spatial mask.

TABLE I: Main notation.

Capability	Assumed
Query the detector $D_{m}$ on chosen images	yes
Back-propagate gradients through $D_{m}$	yes
Know or estimate the key $w$	yes
Know the key length $N$	yes
Use a public, non-watermarked VAE $(E,D)$	yes
Access the provider’s watermarked decoder	no

TABLE II: Adversary capabilities assumed in this work.

Fig. 2: Overview of the attack. Stage 1 builds an optional spatial prior $M^{\mathrm{s}}$ from the image’s DWT energy; Stage 2 perturbs the latent code of a public autoencoder inside that prior and decodes the attacked image $x^{\prime}$ ; Stage 3 queries the detector and scores the decoded bits with the watermark objective. Dashed arrows denote parameter updates. The symmetric objective guides mean confidence toward a near-chance target and counteracts excessive inversion, while fidelity penalties constrain changes to the latent representation and reconstructed image.

Fig. 3: The heuristic spatial prior: (a) watermarked input; (b) spatial mask; (c) perturbation visualization. The mask describes image content, not watermark localization.

Fig. 4: Bit-accuracy trajectories under the baseline, the adaptive per-bit variant (B+) and the two-sided objective (LiBRA).

Symbol	Meaning	Value
$T$	optimization iterations	$50$
—	optimizer / learning rate	Adam / $0.01$
$\tau_{h}$ , $\tau_{l}$	mask thresholds (high, low freq.)	$0.3$ , $0.5$
$k$ , $p$	closing kernel side length, expansion radius	$5$ , $2$
$\lambda_{l}$	weight of $\lVert M^{\mathrm{s}}\odot\delta\rVert_{2}^{2}$	$10^{-2}$
$\lambda_{x}$	weight of $\lVert x^{\prime}-x_{0}\rVert_{2}^{2}$	$10^{-4}$

TABLE III: Attack hyperparameters.

Scheme ( $N$ , accepted $k$ )	Configuration	$\mathrm{DR}_{1}\downarrow$	Bit ACC	PSNR (dB) $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	$\mathrm{DR}_{2}\downarrow$
Stable Signature $N=48$ , $k=15{:}33$	No attack	1.00	0.996	—	1.000	0.000	1.00
	Baseline	0.00	0.018	35.1	0.942	0.074	1.00
	B (fixed $\tau$ )	0.00	0.091	36.0	0.951	0.066	1.00
	B+ (adaptive $\tau$ )	0.00	0.228	36.8	0.958	0.060	1.00
	LiBRA (two-sided)	0.00	0.458	38.0	0.970	0.046	0.03
YU1 $N=100$ , $k=37{:}63$	No attack	1.00	0.998	—	1.000	0.000	1.00

TABLE IV: Main results across four watermarking systems.

Fig. 5: Distribution of achieved bit accuracy on Stable Signature over 5,000 images, on the 48-bit grid. Panels compare no attack, baseline, B, B+, and LiBRA. Shading denotes exact accepted counts

k=15{:}33

\alpha=0.01

; the black curve is the theoretical binomial null. Percentages report the two-sided and naive one-sided detection rates.

Fig. 6: Relationship between final mean confidence and hard bit accuracy under LiBRA on Stable Signature ( $N=48$ ). The vertical band marks $|\bar{c}-0.45|\leq 0.02$ and the horizontal band marks exact accepted bit counts. Crosses illustrate meeting the soft target while failing the hard test. Each point represents one attacked image, with horizontal and vertical jitter for visibility; categories and statistics use unjittered values.

Scheme	$N$	Soft target met	Hard-test evasion	Target met, detected
Stable Signature	48	0.95	0.97	0.02
YU1	100	0.97	1.00	0.00
HiDDeN	30	0.93	0.96	0.03
MBRS	64	0.94	0.95	0.03

TABLE V: Soft-target and hard-test agreement.

Family	Method	$\mathrm{DR}_{1}\downarrow$	Bit ACC	SSIM $\uparrow$	LPIPS $\downarrow$	$\mathrm{DR}_{2}\downarrow$
Post-processing	Center crop ( $10\%$ )	1.00	0.943	0.618	0.312	1.00
	JPEG ( $q=90$ )	1.00	0.991	0.967	0.029	1.00
	Gaussian blur ( $k=5$ )	1.00	0.978	0.884	0.148	1.00
	Bilateral filter	1.00	0.969	0.912	0.106	1.00
	Quantization ( $8$ levels)	1.00	0.927	0.741	0.223	1.00
Removal attacks	WEvade-W-I (flip) [ 9 ]	0.00	0.012	0.944	0.067	1.00

TABLE VI: Comparison with removal attacks and image transformations.

Method	Space / reference	$\mathrm{DR}_{2}\downarrow$	SSIM $\uparrow$	LPIPS $\downarrow$	Time (s/image)
WEvade-W-II	pixel / random	0.02	0.951	0.061	24.8
WEvade-W-II	latent / random	0.03	0.965	0.050	118.6
LiBRA	latent / random	0.04	0.967	0.048	12.5
LiBRA	latent / key	0.03	0.970	0.046	12.4

TABLE VII: Comparison with WEvade-W-II.

Configuration	Bit ACC	SSIM $\uparrow$	LPIPS $\downarrow$	$\mathrm{DR}_{2}\downarrow$	Time (s/image)
VAE reconstruction only	0.893	0.976	0.039	1.00	0.2
Full latent, no mask	0.461	0.962	0.053	0.03	12.1
Random mask	0.452	0.964	0.051	0.05	12.4
Edge (Sobel) mask	0.455	0.967	0.049	0.04	12.4
LiBRA (frequency mask)	0.458	0.970	0.046	0.03	12.4
$+\,L_{\mathrm{bit}}$	0.447	0.966	0.050	0.04	12.9

TABLE VIII: Ablation study of attack components.

Fig. 7: Sensitivity of LiBRA to the target mean confidence

a^{\star}

across four watermarking systems. The vertical dashed line marks the default setting

a^{\star}=0.45

$a^{\star}$	Bit ACC	MAE to target	SSIM $\uparrow$	LPIPS $\downarrow$	$\mathrm{DR}_{2}\downarrow$
0.30	0.309	0.031	0.962	0.053	0.44
0.40	0.407	0.027	0.967	0.049	0.05
0.45	0.458	0.026	0.970	0.046	0.03
0.48	0.484	0.027	0.972	0.044	0.02
0.50	0.503	0.029	0.973	0.043	0.02

TABLE IX: Sensitivity to the target confidence.

Objective	Bit ACC	SSIM $\uparrow$	LPIPS $\downarrow$	$\mathrm{DR}_{2}\downarrow$	DR after JPEG $\downarrow$
Point, $a^{\star}=0.45$	0.458	0.970	0.046	0.03	0.05
Band, $h=0.10$	0.406	0.972	0.044	0.05	0.06
Band, $h=0.15$	0.359	0.974	0.042	0.12	0.09
Band, $h=0.18$	0.331	0.975	0.041	0.26	0.15

TABLE X: Comparison of point-target and band-penalty objectives.

			$\mathrm{DR}_{2}\downarrow$
$\alpha$	Acceptance bounds	Width	Baseline	B+	LiBRA
$0.1$	$[0.420,0.580]$	0.160	1.00	1.00	0.21
$0.05$	$[0.400,0.600]$	0.200	1.00	1.00	0.06
$0.01$	$[0.370,0.630]$	0.260	1.00	0.98	0.00
$0.001$	$[0.340,0.660]$	0.320	1.00	0.93	0.00

TABLE XI: Effect of the detector significance level.

Key error $\epsilon$	Bit ACC	MAE to target	SSIM $\uparrow$	LPIPS $\downarrow$	$\mathrm{DR}_{2}\downarrow$
$0$ (exact key)	0.458	0.026	0.970	0.046	0.03
$0.05$	0.463	0.028	0.970	0.046	0.03
$0.10$	0.469	0.032	0.969	0.047	0.04
$0.20$	0.481	0.041	0.968	0.048	0.05

TABLE XII: Sensitivity to watermark key estimation errors.

	Baseline			LiBRA
$T$	Bit ACC	SSIM $\uparrow$	$\mathrm{DR}_{2}\downarrow$	Bit ACC	SSIM $\uparrow$	$\mathrm{DR}_{2}\downarrow$
$10$	0.214	0.968	0.94	0.527	0.975	0.06
$25$	0.052	0.955	1.00	0.466	0.971	0.03
$50$	0.018	0.942	1.00	0.458	0.970	0.03
$100$	0.004	0.921	1.00	0.455	0.970	0.03

TABLE XIII: Effect of the iteration budget.

Resolution	Latent shape $(H/f)\times(W/f)\times C$	Bit ACC	$\mathrm{DR}_{2}\downarrow$	Time (s/image)	Peak memory (GB)
$256\times 256$	$32\times 32\times 4$	0.461	0.04	3.6	5.1
$512\times 512$	$64\times 64\times 4$	0.458	0.03	12.4	13.8
$768\times 768$	$96\times 96\times 4$	0.457	0.03	25.9	29.6

TABLE XIV: Effect of image resolution.

Condition	Bit ACC	SSIM $\uparrow$	$\mathrm{DR}_{1}\downarrow$	$\mathrm{DR}_{2}\downarrow$
None (as attacked)	0.458	0.970	0.00	0.03
JPEG ( $q=90$ )	0.466	0.962	0.12	0.03
JPEG ( $q=50$ )	0.489	0.921	0.36	0.05
Resize ( $0.5\times$ , restored)	0.474	0.931	0.21	0.04
Gaussian noise ( $\sigma=0.02$ )	0.471	0.903	0.18	0.04
Center crop ( $10\%$ )	0.483	0.611	0.29	0.05

TABLE XV: Post-processing robustness and dispersion-aware detection.

Setting	$\mathrm{DR}_{2}\downarrow$	Dispersion DR $\downarrow$	Combined DR $\downarrow$	SSIM $\uparrow$	LPIPS $\downarrow$
No attack	1.00	0.99	1.00	1.000	0.000
LiBRA	0.03	0.62	0.64	0.970	0.046
LiBRA $+L_{\mathrm{disp}}$	0.04	0.06	0.09	0.966	0.050

TABLE XVI: Adaptive attack against the dispersion-aware detector.

Fig. 8: Qualitative comparison on Stable Signature ( $N=48$ ). Columns: input $x_{0}$ , baseline, B+, and LiBRA; lower rows are labeled as amplified residuals.

Explore similar work

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation
Aug 10, 2026Jie Cao, Qi Li, Zelin Zhang +4Watermark Removal Robust Watermarking
Queen’s University, Canada · University of Waterloo, Canada
PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection
May 10, 2026Minh Quoc Duong, Chun Tong Lei, Chun Pong LauDiffusion Model Inversion Diffusion Model Watermarking
City University of Hong Kong
Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking
Oct 1, 2026Kirill Aistov, Khaled Abud, Irina Serzhenko +8Diffusion Model Watermarking Watermark Removal
MSU AI Institute, Moscow, Russia · Trusted AI Research Center RAS, Moscow, Russia

Aug 10, 2026J/K move · Enter open · S save

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation

Jie Cao, Qi Li, Zelin Zhang, Xiaodong Wu+3

Queen’s University, Canada · University of Waterloo, Canada

Watermark Removal Robust Watermarking Latent Space Optimization

Open paper AskPDF arXiv

Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored. Existing attacks either succeed only against specific generative models or achieve removal at the cost of severe visual degradation. In this paper, we propose MarkNull, a model-agnostic watermark removal attack via on-manifold latent manipulation. MarkNull is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. To quantify this dependency, we introduce the Noise-Latent Alignment Score (NLAS) and formulate an optimization objective that selectively decorrelates the latent representation from the embedded watermark while preserving semantic fidelity. Extensive evaluations across different categories of watermarking paradigms, including post-hoc, fine-tuning-based, and initial-noise-based schemes, demonstrate that MarkNull reduces average bit accuracy to 53.14%, approaching random-guessing (50%), without perceptible image degradation. To further improve scalability, we propose MarkNull-A, an amortized, optimization-free variant that distills the attack into a single forward pass, achieving 0.50 s/image with modest computational overhead. Notably, our attacks successfully compromise Google's SynthID-Image system while preserving high visual quality and transfer effectively to video watermarking. Finally, we present an attack detection mechanism as a defensive counterpart to MarkNull and MarkNull-A, highlighting the necessity of developing watermark designs resilient to model-agnostic latent-space attacks.

Abstract

Explore similar work

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking