Research map / Adversarial robustness and security / Attacks on text and graphs
On the Robustness of Watermarking for Autoregressive Image Generation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies removal and forgery attacks on in-generation watermarks for autoregressive image generators (IndexMark, WMAR, ClusterMark, BitMark), proposing VQ-Regen, LatentOpt, BitOpt and frequency-injection attacks.
Problem
In-generation watermarks for autoregressive image generators are assumed robust, but their vulnerability to removal and forgery attacks, which matters for synthetic-data filtering and provenance, is unexplored.
Approach
Exploits the token/bit structure of AR image generators: VQ-Regen substitutes k-th nearest codebook tokens, LatentOpt optimizes pixel perturbations through a proxy VQ-VAE encoder to move latents, BitOpt flips bits at green-set-relevant positions, and frequency injection plants periodic spectral peaks that trigger BitMark's detector.
Key results
- Token-based watermarks (IndexMark, WMAR, ClusterMark) are removable in black-box settings, e.g. LatentOpt-Removal black-box reduces ClusterMark TPR to 0.78 at ~32 dB PSNR, while forgery in black-box settings stays below 10% TPR.
- BitMark is robust to removal (black-box LatentOpt-R TPR 0.97), but the white-box+ BitOpt-R removes the watermark (TPR 0.00) at 46.17 dB PSNR.
- Frequency injection forgery achieves median p-values of 7.5e-31 at 29.75 dB PSNR on BitMark without access to any model.
Surprising findings
- Closer alignment of the proxy VQ-VAE to the target (white-box) makes VQ-Regen less effective against ClusterMark, since substituted tokens still fall into correct clusters.
- Model-free frequency injection forges BitMark watermarks with strong detection (p around 1e-31), and this cannot be prevented by adjusting the detection threshold.
Limitations
- Forgery of token-based watermarks mostly fails outside white-box settings.
- Some attacks (e.g., UnMarker) could not run at larger resolutions due to memory; C-Reweight not evaluated since code unavailable.
- Geometric robustness evaluated without the synchronization layer.
Experimental setup
Datasets: MS-COCO ImageNet
Benchmarks: MS-COCO cover images
Metrics: TPR@FPR=1% median p-value PSNR LPIPS z-score
Baselines: Regen. Rinse CtrlRegen+ BitFlipper UnMarker geometric transformations perturbations
Builds on: KGW watermarking BitMark WMAR ClusterMark IndexMark
Closest papers by meaning
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.90)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.90)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.89)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.89)
- BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.88)
- Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.