Research map / Image generation / Autoregressive and latent generation
Image Watermarks are Removable using Controllable Regeneration from Clean Noise
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CtrlRegen, a controllable diffusion regeneration attack that starts from clean Gaussian noise (or a partially noised latent in CtrlRegen+) and uses a semantic adapter (DINOv2 features) plus a Canny-edge spatial ControlNet to remove watermarks while preserving image quality.
Problem
Regeneration attacks remove low-perturbation image watermarks but fail on high-perturbation watermarks (StegaStamp, TreeRing); adding more noise to remove them degrades image quality and consistency.
Approach
Regenerate the watermarked image from clean Gaussian noise under two trained controls: a semantic control adapter (IP-Adapter-style, DINOv2 image embeddings via decoupled cross-attention) and a spatial ControlNet conditioned on Canny edges, so semantics and layout are preserved without carrying watermark signal; CtrlRegen+ adds a tunable number of noising steps for a quality/removal trade-off.
Key results
- On StegaStamp, CtrlRegen reduces TPR@1%FPR from 1.00 to 0.01, versus 0.94 for Rinse.
- On TreeRing, CtrlRegen reduces TPR@1%FPR from 0.99 to 0.12, versus 0.61 for Rinse.
- CtrlRegen achieves the best CLIP-FID and Q-Align/LIQE scores across the watermarks reported, e.g. TreeRing CLIP-FID 1.63 vs 2.84 for Regen, but lower PSNR (about 19 vs 25).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| adding spatial control network (edge-detected Canny condition) to semantic control (ablation) | CtrlRegen · DwtDctSvd/RivaGAN/SSL/StableSignature/StegaStamp/TreeRing | CLIP-FID (lower better): e.g. StegaStamp 9.97 -> 5.27; TreeRing 3.93 -> 1.63 | Helped |
| adding spatial control network to semantic control (ablation) | CtrlRegen · all six watermarks | PSNR and Q-Align/LIQE: e.g. DwtDctSvd Q-Align 2.84 -> 3.63; PSNR 15.41 -> 19.13 | Helped |
| regenerate from clean Gaussian noise (CtrlRegen) instead of 70-step Regen | StegaStamp · StegaStamp | T@1%F after attack (lower better): 0.99 -> 0.01 | Helped |
| regenerate from clean Gaussian noise (CtrlRegen) instead of 70-step Regen | TreeRing · TreeRing | T@1%F after attack (lower better): 0.87 -> 0.12 | Helped |
| regenerate from clean Gaussian noise (CtrlRegen) instead of Regen | low perturbation watermarks (DwtDctSvd, RivaGAN, SSL, StableSignature) · DwtDctSvd/RivaGAN/SSL/StableSignature | T@1%F after attack (lower better): DwtDctSvd 0.39 -> 0.00; RivaGAN 0.07 -> 0.00; SSL 0.39 -> 0.06; StableSignature 0.02 -> 0.02 | No clear effect |
| Rinse (Regen applied twice) instead of single Regen | high perturbation watermarks · StegaStamp/TreeRing | T@1%F after attack (lower better): StegaStamp 0.99 -> 0.94; TreeRing 0.87 -> 0.61 | Mixed |
| CtrlRegen+ noising steps increased (up to 500) on Regen vs CtrlRegen+ on high perturbation watermarks | Regen (uncontrolled) with high noising steps · StegaStamp/TreeRing | image quality and consistency | Hurt |
| adding semantic/spatial controls (CtrlRegen+) to noising-based regeneration | CtrlRegen+ on high perturbation watermarks · StegaStamp/TreeRing | image quality/similarity at matched removal | Helped |
| controlled regeneration with semantic and spatial control (CtrlRegen) vs uncontrolled Regen on PSNR | CtrlRegen · all six watermarks | PSNR (higher better): StegaStamp 22.34 -> 19.10; TreeRing 25.59 -> 19.32 | Hurt |
Surprising findings
- CtrlRegen has lower PSNR than Regen and Rinse, which the authors argue reflects benign changes rather than degradation, contrary to the usual expectation that higher PSNR means better quality.
Limitations
- Consistency is constrained by the SD v1.5 backbone, per the authors.
- PSNR is lower than baselines, so pixel-level fidelity is reduced.
- Evaluated only on seven watermark methods with specific bit lengths.
Experimental setup
Datasets: LAION-2B COYO-700M MSCOCO MIRFLICKR DiffusionDB
Benchmarks: MIRFLICKR DiffusionDB
Metrics: TPR@1%FPR bit accuracy CLIP-FID PSNR Q-Align LIQE
Baselines: Regen Rinse
Builds on: Regen Rinse ControlNet IP-Adapter Stable Diffusion
Closest papers by meaning
- Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models (CVPR 2024 · similarity 0.90)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.89)
- GaussMarker: Robust Dual-Domain Watermark for Diffusion Models (ICML 2025 · similarity 0.89)
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.88)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.88)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.