Research map / Image generation / Autoregressive and latent generation
Invisible Image Watermarks Are Provably Removable Using Generative AI
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes regeneration attacks that add Gaussian noise to an image's embedding and reconstruct it with a denoiser, VAE, or diffusion model, provably removing pixel-level invisible watermarks.
Problem
Invisible image watermarks used for copyright protection and AI-generated image provenance can be removed by evasion attacks; the question is whether such watermarks are fundamentally non-robust.
Approach
Destructive noise injection in an embedding space followed by constructive regeneration (denoiser, VAE, or latent diffusion) removes watermarks; a Gaussian-DP style analysis gives a certified tradeoff guarantee that no detector can distinguish the output from unwatermarked images, plus utility bounds on image closeness.
Key results
- Regeneration attacks (VAE and diffusion) achieve over 99% removal rates on DwtDctSvd, RivaGAN, and SSL watermarks.
- On RivaGAN, the regeneration attacks remove 98% of watermarks while keeping PSNR above 30.
- StegaStamp is most resistant; only diffusion attack with substantial noise removes it effectively.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply regeneration attacks (VAE-Bmshj2018, VAE-Cheng2020, or Diffusion) | Invisible pixel-level watermarks · DwtDctSvd, RivaGAN, and SSL watermark | watermark removal rate: over 99% | Helped |
| use diffusion regeneration with substantial noise | StegaStamp · StegaStamp | watermark removal rate | Helped |
| increase the diffusion noise level (ablation) | Diffusion regeneration attack · StegaStamp | watermark removal rate | Helped |
| increase the diffusion noise level (ablation) | Diffusion regeneration attack · StegaStamp | image quality | Hurt |
| use VAE regeneration instead of diffusion regeneration | Regeneration attack · Watermarked images | PSNR and SSIM | Helped |
| use VAE regeneration instead of diffusion regeneration | Regeneration attack · Watermarked images | visual sharpness | Hurt |
| use a semantic watermark such as Tree-Ring instead of a pixel-level invisible watermark | Watermarking · Attacks in this paper | watermark resilience | Helped |
| use Diffusion regeneration on RivaGAN | Regeneration attack · RivaGAN | watermark removal rate: 98% | Helped |
Surprising findings
- StegaStamp resists most attacks, with only high-noise diffusion regeneration effectively removing it.
- PSNR and SSIM are insensitive to the blurring introduced by VAE regeneration, so VAE outputs score well despite visible blur.
Limitations
- Theoretical guarantee applies only to l2-bounded pixel-level watermarks; neural embeddings have no uniform Lipschitz bound and VAE lacks direct guarantee.
- StegaStamp remains hard to remove except at high noise levels, trading off image quality.
- Semantic watermarks such as Tree-Ring are proposed as an alternative but only partially evaluated and are more visible.
Experimental setup
Datasets: MS-COCO Stable Diffusion Prompts (SDP)
Benchmarks: MS-COCO SDP
Metrics: TPR@FPR=0.01 PSNR SSIM FID
Baselines: Brightness change Contrast change JPEG compression Gaussian noise Gaussian blur
Builds on: Gaussian differential privacy PNDM CompressAI VAEs
Closest papers by meaning
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.90)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.90)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.90)
- Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.89)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.89)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.