MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoising

• URL: http://arxiv.org/abs/2602.15364v1
• Date: Tue, 17 Feb 2026 05:19:00 GMT
• Title: MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoising
• Authors: Jie Cao, Zelin Zhang, Qi Li, Jianbing Ni,
• Abstract summary: MarkSweep is a novel watermark removal attack that erases embedded watermarks from AI-generated images without degrading visual quality.<n>It amplifies watermark noise in high-frequency regions via edge-aware Gaussian perturbations and injects it into clean images.<n>It integrates two modules, the learnable frequency decomposition module and the frequency-aware fusion module, to suppress amplified noise and eliminate watermark traces.
• Score: 15.570983503312227
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: AI watermarking embeds invisible signals within images to provide provenance information and identify content as AI-generated. In this paper, we introduce MarkSweep, a novel watermark removal attack that effectively erases the embedded watermarks from AI-generated images without degrading visual quality. MarkSweep first amplifies watermark noise in high-frequency regions via edge-aware Gaussian perturbations and injects it into clean images for training a denoising network. This network then integrates two modules, the learnable frequency decomposition module and the frequency-aware fusion module, to suppress amplified noise and eliminate watermark traces. Theoretical analysis and extensive experiments demonstrate that invisible watermarks are highly vulnerable to MarkSweep, which effectively removes embedded watermarks, reducing the bit accuracy of HiDDeN and Stable Signature watermarking schemes to below 67%, while preserving perceptual quality of AI-generated images.

Related papers

• Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks [4.138397555991069]
  Powerful diffusion-based image generation and editing models can inadvertently remove or distort embedded watermarks.<n>We present a theoretical and empirical analysis demonstrating that diffusion-based image editing can effectively break state-of-the-art robust watermarks.<n>We propose a diffusion-driven attack that uses generative image regeneration to erase watermarks from a given image.
  arXiv  Detail & Related papers  (2025-11-05T16:20:29Z)
• TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity [76.98973481600002]
  This paper proposes a Tamper-Aware Generative image WaterMarking method named TAG-WM.<n>The proposed method comprises four key modules: a dual-mark joint sampling (DMJS) algorithm for embedding copyright and localization watermarks into the latent space while preserving generative quality.<n>The experimental results demonstrate that TAG-WM achieves state-of-the-art performance in both tampering robustness and localization capability even under distortion.
  arXiv  Detail & Related papers  (2025-06-30T03:14:07Z)
• Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removal [18.47018538990973]
  This paper introduces a novel Saliency-Aware Diffusion Reconstruction framework for watermark elimination on the web.<n>SADRE disrupts embedded watermarks by injecting targeted noise into latent representations guided by saliency masks.<n>A reverse diffusion process ensures high-fidelity image restoration, leveraging adaptive noise levels determined by watermark strength.
  arXiv  Detail & Related papers  (2025-04-17T10:15:10Z)
• SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution [27.345134138673945]
  We propose SuperMark, a robust, training-free watermarking framework.<n>SuperMark embeds the watermark into initial Gaussian noise using existing techniques.<n>It then applies pre-trained Super-Resolution models to denoise the watermarked noise, producing the final watermarked image.<n>For extraction, the process is reversed: the watermarked image is inverted back to the initial watermarked noise via DDIM Inversion, from which the embedded watermark is extracted.<n>Experiments demonstrate that SuperMark achieves fidelity comparable to existing methods while significantly improving robustness.
  arXiv  Detail & Related papers  (2024-12-13T11:20:59Z)
• Hidden in the Noise: Two-Stage Robust Watermarking for Images [25.731533630250798]
  We present a distortion-free watermarking method for images based on a diffusion model's initial noise.<n> detecting the watermark requires comparing the initial noise reconstructed for an image to all previously used initial noises.<n>We propose a two-stage watermarking framework for efficient detection.
  arXiv  Detail & Related papers  (2024-12-05T22:50:42Z)
• Image Watermarks are Removable Using Controllable Regeneration from Clean Noise [26.09012436917272]
  A critical attribute of watermark techniques is their robustness against various manipulations.<n>We introduce a watermark removal approach capable of effectively nullifying state-of-the-art watermarking techniques.<n>Our methods offer superior visual consistency/quality and enhanced watermark removal performance compared to existing regeneration approaches.
  arXiv  Detail & Related papers  (2024-10-07T20:04:29Z)
• Certifiably Robust Image Watermark [57.546016845801134]
  Generative AI raises many societal concerns such as boosting disinformation and propaganda campaigns. Watermarking AI-generated content is a key technology to address these concerns. We propose the first image watermarks with certified robustness guarantees against removal and forgery attacks.
  arXiv  Detail & Related papers  (2024-07-04T17:56:04Z)
• MarkPlugger: Generalizable Watermark Framework for Latent Diffusion Models without Retraining [48.41130825143742]
  In the fast-evolving era of AI-generated content (AIGC), the rapid iteration and modification of latent diffusion models (LDMs) makes retraining with watermark models costly.<n>We propose MarkPlugger, a generalizable plug-and-play watermark framework without LDM retraining.<n>Our experimental findings reveal that our method effectively harmonizes image quality and watermark recovery rate.
  arXiv  Detail & Related papers  (2024-04-08T15:29:46Z)
• Perceptive self-supervised learning network for noisy image watermark removal [59.440951785128995]
  We propose a perceptive self-supervised learning network for noisy image watermark removal (PSLNet) Our proposed method is very effective in comparison with popular convolutional neural networks (CNNs) for noisy image watermark removal.
  arXiv  Detail & Related papers  (2024-03-04T16:59:43Z)
• Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks [47.04650443491879]
  We analyze the robustness of various AI-image detectors including watermarking and deepfake detectors. We show that watermarking methods are vulnerable to spoofing attacks where the attacker aims to have real images identified as watermarked ones.
  arXiv  Detail & Related papers  (2023-09-29T18:30:29Z)
• Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust [55.91987293510401]
  Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. We introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed.
  arXiv  Detail & Related papers  (2023-05-31T17:00:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.