Research map / Image generation / Autoregressive and latent generation
Can Simple Averaging Defeat Modern Watermarks?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that simply averaging collections of watermarked images extracts content-agnostic watermark patterns, which can be subtracted to remove or forge watermarks (notably Tree-Ring) under greybox and blackbox settings, and proposes security guidelines against steganalysis.
Problem
Content-agnostic image and audio watermarks embed fixed patterns regardless of content, making them vulnerable to steganalysis-style removal and forgery; prior removal attacks were costly distortions or regeneration/adversarial methods.
Approach
Averaging many watermarked images (and clean images, paired or unpaired) cancels image content and reveals the additive watermark pattern; subtracting this pattern removes or forges the watermark with minimal perceptual distortion, and the attack works blackbox without the algorithm.
Key results
- Steganalysis-based removal drops Tree-Ring detection AUC to 0.2407 (blackbox/greybox results reported across n), and RoSteALS bit accuracy to 0.2444, while content-adaptive methods such as SSL and Stable Signature keep high accuracy (>0.95 bit accuracy at convergence).
- Forged Tree-Ring watermarks on clean images achieve 0.00 detection accuracy at 1% FPR for forgery at n>=5 averaged images in the reported table, i.e., forgery fully deceives the detector.
- With three mixed Tree-Ring keys, detection AUC rises from below 0.2 to above 0.7 at n=5000, indicating multi-key assignment partially mitigates the attack.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| subtract the averaged extracted pattern from Tree-Ring watermarked images | Tree-Ring · Watermark removal (blackbox, n=5000) | AUC: 1.000 -> 0.241 | Helped |
| subtract the averaged extracted pattern from RAWatermark images | RAWatermark · Watermark removal (blackbox, n=5000) | AUC: 0.714 -> 0.574 | Helped |
| subtract the averaged extracted pattern from RoSteALS images | RoSteALS · Watermark removal (blackbox, n=5000) | bit accuracy: 0.994 -> 0.244 | Helped |
| subtract the averaged extracted pattern from Stable Signature images | Stable Signature · Watermark removal (blackbox, n=5000) | bit accuracy: 0.998 -> 0.998 | No clear effect |
| subtract the averaged extracted pattern from WmAdapter images | WmAdapter · Watermark removal (blackbox, n=5000) | bit accuracy: 0.902 -> 0.903 | No clear effect |
| subtract the averaged extracted pattern from AudioSeal audio | AudioSeal · Audio watermark removal (greybox and blackbox) | detection accuracy: 1.0 -> around 0.75 | Helped |
| subtract the averaged pattern from WavMark audio | WavMark · Audio watermark removal (large n) | bit accuracy: below 0.8 -> 1.0 | Hurt |
| use fewer images to estimate the extracted pattern (ablation) | Simple averaging watermark-removal attack · Watermark removal across image methods | watermark detection performance | Helped |
| mix three different watermark patterns in the adversary's collection (ablation) | Tree-Ring removal attack · Watermark removal (n=5000; greybox and blackbox) | AUC: below 0.2 -> above 0.7 | Hurt |
| mix more than 4 watermark patterns in the adversary's collection (ablation) | DwtDctSvd removal attack · Watermark removal (blackbox) | detection accuracy: below 0.1 | Mixed |
Surprising findings
- Subtracting the averaged pattern from WavMark-watermarked audio raises its bit accuracy from below 0.8 to 1.0 at large n, rather than removing the watermark.
- Under the blackbox setting, mixing more than 4 DwtDctSvd watermarks drives detection accuracy below 0.1, so multi-key assignment is not a reliable defense.
Limitations
- Attack is only effective against content-agnostic watermarks, not content-adaptive ones.
- Only simple additive averaging on RGB images and 16 kHz mono audio was tested; more complex steganalysis was not explored.
- Ablations use only 100 test images per configuration to limit compute.
Experimental setup
Datasets: COCO2017 Stable Diffusion Prompts DiffusionDB ImageNet Common Voice zh-CN
Benchmarks: COCO2017 Stable Diffusion Prompts DiffusionDB ImageNet Common Voice zh-CN
Metrics: AUC bit accuracy detection accuracy at 1% FPR PSNR SSIM LPIPS SIFID SI-SNR
Baselines: Tree-Ring RingID RAWatermark DwtDctSvd RoSteALS Gaussian Shading Stable Signature WmAdapter RivaGAN SSL HiDDeN DwtDct
Builds on: Tree-Ring RingID
Closest papers by meaning
- Leveraging Optimization for Adaptive Attacks on Image Watermarks (ICLR 2024 · similarity 0.87)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.87)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.86)
- No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices (NeurIPS 2024 · similarity 0.86)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.86)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.