Removing Watermarks with Partial Regeneration using Semantic Information

• URL: http://arxiv.org/abs/2505.08234v1
• Date: Tue, 13 May 2025 05:25:06 GMT
• Title: Removing Watermarks with Partial Regeneration using Semantic Information
• Abstract summary: We introduce SemanticRegen, a three-stage, label-free attack that erases state-of-the-art semantic and invisible watermarks.<n> evaluated on 1,000 prompts across four watermarking systems.<n>Results highlight an urgent gap between current watermark defenses and the capabilities of adaptive, semantics-aware adversaries.
• Score: 43.49935979539602
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As AI-generated imagery becomes ubiquitous, invisible watermarks have emerged as a primary line of defense for copyright and provenance. The newest watermarking schemes embed semantic signals - content-aware patterns that are designed to survive common image manipulations - yet their true robustness against adaptive adversaries remains under-explored. We expose a previously unreported vulnerability and introduce SemanticRegen, a three-stage, label-free attack that erases state-of-the-art semantic and invisible watermarks while leaving an image's apparent meaning intact. Our pipeline (i) uses a vision-language model to obtain fine-grained captions, (ii) extracts foreground masks with zero-shot segmentation, and (iii) inpaints only the background via an LLM-guided diffusion model, thereby preserving salient objects and style cues. Evaluated on 1,000 prompts across four watermarking systems - TreeRing, StegaStamp, StableSig, and DWT/DCT - SemanticRegen is the only method to defeat the semantic TreeRing watermark (p = 0.10 > 0.05) and reduces bit-accuracy below 0.75 for the remaining schemes, all while maintaining high perceptual quality (masked SSIM = 0.94 +/- 0.01). We further introduce masked SSIM (mSSIM) to quantify fidelity within foreground regions, showing that our attack achieves up to 12 percent higher mSSIM than prior diffusion-based attackers. These results highlight an urgent gap between current watermark defenses and the capabilities of adaptive, semantics-aware adversaries, underscoring the need for watermarking algorithms that are resilient to content-preserving regenerative attacks.

Related papers

• MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation [17.91170892407516]
  We propose MarkNull, a model-agnostic watermark removal attack via on-manifold latent manipulation.<n>MarkNull is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise.<n>Our attacks successfully compromise Google's SynthID-Image system while preserving high visual quality and transfer effectively to video watermarking.
  arXiv  Detail & Related papers  (2026-08-10T19:33:15Z)
• WMVLM: Evaluating Diffusion Model Image Watermarking via Vision-Language Models [79.32764976020435]
  Digital watermarking is essential for securing generated images from diffusion models.<n>Previous watermark evaluation methods lack a unified framework for both residual and semantic watermarks.<n>We proposeLM, the first unified and interpretable evaluation framework for diffusion model image watermarking via vision-language models.
  arXiv  Detail & Related papers  (2026-01-29T12:14:32Z)
• SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks [74.76909939060833]
  Black-box forgery attacks pose outsized risk to provenance and trust.<n>We propose SemBind, a framework for latent-based watermarks that resists black-box forgery.<n>We show that SemBind-enabled anti-forgery variants markedly reduce false acceptance under black-box forgery.
  arXiv  Detail & Related papers  (2026-01-28T07:02:40Z)
• RAVEN: Erasing Invisible Watermarks via Novel View Synthesis [35.417500510522835]
  In this work, we expose a fundamental vulnerability in invisible watermarks by reformulating watermark removal as a view synthesis problem.<n>Our key insight is that generating a perceptually consistent alternative view of the same semantic content, naturally removes the embedded watermark while preserving visual fidelity.<n>We introduce a zero-shot diffusion-based framework that applies controlled geometric transformations in latent space, augmented with view-guided correspondence attention to maintain structural consistency during reconstruction.
  arXiv  Detail & Related papers  (2026-01-13T18:59:58Z)
• From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protection [24.55335024940469]
  Embeddings-as-a-Service (E) has emerged as a successful commercial paradigm on the web platform.<n>Prior studies have revealed that E is vulnerable to imitation attacks.<n>We propose SemMark, a novel semantic-based watermarking paradigm for E copyright protection.
  arXiv  Detail & Related papers  (2025-12-18T11:50:38Z)
• IConMark: Robust Interpretable Concept-Based Watermark For AI Images [50.045011844765185]
  We propose IConMark, a novel in-generation robust semantic watermarking method.<n>IConMark embeds interpretable concepts into AI-generated images, making it resilient to adversarial manipulation.<n>We demonstrate its superiority in terms of detection accuracy and maintaining image quality.
  arXiv  Detail & Related papers  (2025-07-17T05:38:30Z)
• PT-Mark: Invisible Watermarking for Text-to-image Diffusion Models via Semantic-aware Pivotal Tuning [19.170393134039568]
  We present Semantic-aware Pivotal Tuning Watermarks (PT-Mark)<n>PT-Mark preserves both the semantics of diffusion images and the traceability of the watermark.<n>It achieves a 10% improvement in the performance of semantic preservation compared to state-of-the-art watermarking methods.
  arXiv  Detail & Related papers  (2025-04-15T04:25:57Z)
• Defending LLM Watermarking Against Spoofing Attacks with Contrastive Representation Learning [34.76886510334969]
  A piggyback attack can maliciously alter the meaning of watermarked text-transforming it into hate speech-while preserving the original watermark.<n>We propose a semantic-aware watermarking algorithm that embeds watermarks into a given target text while preserving its original meaning.
  arXiv  Detail & Related papers  (2025-04-09T04:38:17Z)
• Bridging Knowledge Gap Between Image Inpainting and Large-Area Visible Watermark Removal [57.84348166457113]
  We introduce a novel feature adapting framework that leverages the representation capacity of a pre-trained image inpainting model.<n>Our approach bridges the knowledge gap between image inpainting and watermark removal by fusing information of the residual background content beneath watermarks into the inpainting backbone model.<n>For relieving the dependence on high-quality watermark masks, we introduce a new training paradigm by utilizing coarse watermark masks to guide the inference process.
  arXiv  Detail & Related papers  (2025-04-07T02:37:14Z)
• SEAL: Semantic Aware Image Watermarking [26.606008778795193]
  We propose a novel watermarking method that embeds semantic information about the generated image directly into the watermark.<n>The key pattern can be inferred from the semantic embedding of the image using locality-sensitive hashing.<n>Our results suggest that content-aware watermarks can mitigate risks arising from image-generative models.
  arXiv  Detail & Related papers  (2025-03-15T15:29:05Z)
• MarkPlugger: Generalizable Watermark Framework for Latent Diffusion Models without Retraining [48.41130825143742]
  In the fast-evolving era of AI-generated content (AIGC), the rapid iteration and modification of latent diffusion models (LDMs) makes retraining with watermark models costly.<n>We propose MarkPlugger, a generalizable plug-and-play watermark framework without LDM retraining.<n>Our experimental findings reveal that our method effectively harmonizes image quality and watermark recovery rate.
  arXiv  Detail & Related papers  (2024-04-08T15:29:46Z)
• Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks [47.04650443491879]
  We analyze the robustness of various AI-image detectors including watermarking and deepfake detectors. We show that watermarking methods are vulnerable to spoofing attacks where the attacker aims to have real images identified as watermarked ones.
  arXiv  Detail & Related papers  (2023-09-29T18:30:29Z)
• DiffWA: Diffusion Models for Watermark Attack [8.102989872457156]
  We propose DiffWA, a conditional diffusion model with distance guidance for watermark attack. The core of our method is training an image-to-image conditional diffusion model on unwatermarked images. The results show that the model can remove the watermark with good effect and make the bit error rate of watermark extraction higher than 0.4.
  arXiv  Detail & Related papers  (2023-06-22T10:45:49Z)
• Invisible Image Watermarks Are Provably Removable Using Generative AI [47.25747266531665]
  Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. We propose a family of regeneration attacks to remove these invisible watermarks. The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image.
  arXiv  Detail & Related papers  (2023-06-02T23:29:28Z)
• Exploring Structure Consistency for Deep Model Watermarking [122.38456787761497]
  The intellectual property (IP) of Deep neural networks (DNNs) can be easily stolen'' by surrogate model attack. We propose a new watermarking methodology, namely structure consistency'', based on which a new deep structure-aligned model watermarking algorithm is designed.
  arXiv  Detail & Related papers  (2021-08-05T04:27:15Z)
• Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models [72.9364216776529]
  We propose a novel watermark removal attack from a different perspective. We design a simple yet powerful transformation algorithm by combining imperceptible pattern embedding and spatial-level transformations. Our attack can bypass state-of-the-art watermarking solutions with very high success rates.
  arXiv  Detail & Related papers  (2020-09-18T09:14:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.