Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

• URL: http://arxiv.org/abs/2605.16796v1
• Date: Sat, 16 May 2026 03:57:37 GMT
• Title: Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy
• Abstract summary: Attacks on watermarking-like watermarks themselves seek an imperceptible change to an input image (now watermarked) that will trigger a detector.<n>We show that simply re-watermarking an already watermarked image reliably suppresses the original signal.<n>Our work constitutes a cheap, generic, and highly effective attack pipeline, calling into question the reliability of current watermarking schemes.
• Score: 15.634495620977297
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Watermarking combines an imperceptible change to an input image that will trigger a detector, to assert provenance and protect intellectual property. The literature has shown great interest in attacks on watermarking schemes: attackers are clearly motivated to steal copyrighted material or circumvent legislated deepfake protections. In this work, we make a simple-yet-powerful observation: that such attacks on watermarking-like watermarks themselves-seek an imperceptible change to an input image (now already watermarked) that will trigger a detector. This analogy comparing watermark attacks to watermarking itself is highly suggestive: that watermarks could be used to attack watermarks. Our first contribution validates this hypothesis. In rigorous experiments spanning 96 combinations of dataset, victim, and attack watermarks, we show that simply re-watermarking an already watermarked image reliably suppresses the original signal, without requiring gradients, surrogate models, or detection keys. Our second contribution is a simple classifier for detecting the presence and identity of an existing watermark in a given image. Surprisingly, experimental findings demonstrate outstanding overall accuracies 0.878-0.953. This result is of independent interest as a security vulnerability: research shows that method-specific attacks achieve substantially stronger removal than black-box attacks. Taken together, watermark identification combined with re-watermarking successfully reduces bit accuracy by at least 25% and up to 48%. Our work constitutes a cheap, generic, and highly effective attack pipeline, calling into question the reliability of current watermarking schemes to such a simple attack, as well as the value of existing sophisticated attacks.

Related papers

• Towards Robust Content Watermarking Against Removal and Forgery Attacks [38.76860389018762]
  We build a novel watermarking paradigm called Instance-Specific watermarking with Two-Sided detection.<n>We introduce a strategy that dynamically controls the injection time and watermarking patterns based on the semantics of users' prompts.<n>Experiments have demonstrated the superiority of our watermarking against removal and forgery attacks.
  arXiv  Detail & Related papers  (2026-04-08T04:28:56Z)
• Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models [42.902365202924535]
  We investigate watermark forging in the context of widely used post-hoc image watermarking.<n>We introduce a preference model to assess whether an image is watermarked.<n>We demonstrate the model's capability to remove and forge watermarks by optimizing the input image through backpropagation.
  arXiv  Detail & Related papers  (2025-10-23T12:06:35Z)
• Robust and Minimally Invasive Watermarking for EaaS [50.08021440235581]
  Embeds as a Service (Eding) is emerging as a crucial role in AI applications.<n>Eding is vulnerable to model extraction attacks, highlighting the need for copyright protection.<n>We propose a novel embedding-specific watermarking (ESpeW) mechanism to offer robust copyright protection for Eding.
  arXiv  Detail & Related papers  (2024-10-23T04:34:49Z)
• An Undetectable Watermark for Generative Image Models [65.31658824274894]
  We present the first undetectable watermarking scheme for generative image models.<n>In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric.<n>Our scheme works by selecting the initial latents of a diffusion model using a pseudorandom error-correcting code.
  arXiv  Detail & Related papers  (2024-10-09T18:33:06Z)
• Certifiably Robust Image Watermark [57.546016845801134]
  Generative AI raises many societal concerns such as boosting disinformation and propaganda campaigns. Watermarking AI-generated content is a key technology to address these concerns. We propose the first image watermarks with certified robustness guarantees against removal and forgery attacks.
  arXiv  Detail & Related papers  (2024-07-04T17:56:04Z)
• UnMarker: A Universal Attack on Defensive Image Watermarking [4.013156524547072]
  We present UnMarker -- the first practical universal attack on defensive watermarking. UnMarker requires no detector feedback, no unrealistic knowledge of the watermarking scheme or similar models, and no advanced denoising pipelines. Evaluations against SOTA schemes prove UnMarker's effectiveness.
  arXiv  Detail & Related papers  (2024-05-14T07:05:18Z)
• A Transfer Attack to Image Watermarks [34.913290430783185]
  We propose a new transfer evasion attack to image watermark in the no-box setting.<n>Our major contribution is to show that, both theoretically and empirically, watermark-based AI-generated image detector based on existing watermarking methods is not robust to evasion attacks.
  arXiv  Detail & Related papers  (2024-03-22T17:33:11Z)
• Invisible Image Watermarks Are Provably Removable Using Generative AI [47.25747266531665]
  Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. We propose a family of regeneration attacks to remove these invisible watermarks. The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image.
  arXiv  Detail & Related papers  (2023-06-02T23:29:28Z)
• Certified Neural Network Watermarks with Randomized Smoothing [64.86178395240469]
  We propose a certifiable watermarking method for deep learning models. We show that our watermark is guaranteed to be unremovable unless the model parameters are changed by more than a certain l2 threshold. Our watermark is also empirically more robust compared to previous watermarking methods.
  arXiv  Detail & Related papers  (2022-07-16T16:06:59Z)
• Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models [72.9364216776529]
  We propose a novel watermark removal attack from a different perspective. We design a simple yet powerful transformation algorithm by combining imperceptible pattern embedding and spatial-level transformations. Our attack can bypass state-of-the-art watermarking solutions with very high success rates.
  arXiv  Detail & Related papers  (2020-09-18T09:14:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.