1 Introduction↩︎

Generative models like DALL-E [1], Imagen [2], and Stable Diffusion [3] can produce images that are often visually indistinguishable from those created by human photographers and artists, potentially leading to misunderstandings and false beliefs due to their visual similarity. To address this, government leaders [4]–[6] advocate for the responsible use of AI, emphasizing the importance of identifying AI-generated content. In response, leading AI companies such as Google [7], Microsoft [8], and OpenAI [9] have pledged to incorporate watermarks into their AI-generated images. Invisible watermarks [10]–[12] are preferred as they preserve image quality and are less likely to be removed by laypersons. However, abusers are aware of these watermarks and may attempt to remove them, making it crucial for invisible watermarks to be robust against evasion attacks.

Existing attacks can be categorized into two types. The first is destructive, where the watermark is removed by corrupting the image. Typical destructive attacks include modifying the brightness, JPEG compression, and adding Gaussian noise. These approaches are effective at removing watermarks, but they result in significant quality loss. The second type of attack is constructive, where the watermark is treated as some noise on the original image and removed by purifying the image. Constructive attacks include image-denoising techniques like Gaussian blur [13], BM3D [14], and learning-based approaches [15]. However, they cannot remove resilient watermarks easily. To counter these attacks, learning-based watermarking methods [16]–[18] were proposed to explicitly train against the known attacks to be robust. But how about other attacks? What is the end of this cat-and-mouse game? In this paper, we ask a more fundamental question:

To be more precise, is there a fundamental trade-off between the invisibility of a watermark and its resilience to any attack that preserves the image quality to a certain-level?

To address this question, we propose a regeneration attack that leverages the strengths of both destructive and constructive approaches. The pipeline of the attack is given in Figure 1. Our attack first corrupts the image by adding Gaussian noise to its latent representation. Then, we reconstruct the image from the noisy embedding using a generative model. The proposed regeneration attack is flexible in that it can be instantiated with various regeneration algorithms, including traditional denoisers and deep generative models such as diffusion models [19]. Ironically, the recent advances in generative models that created the desperate need for invisible watermarks are also making watermark removal easier when integrated into the proposed regeneration attack.

Surprisingly, we prove that the proposed attack guarantees the removal of certain invisible watermarks such that no detection algorithm could work. In other words, our attack is provably effective in removing any watermarks that perturb the image within a limited range of \(\ell_2\)-distance, regardless of whether they have been proposed or have not yet been invented. We also show that our attack maintains image quality comparable to the unwatermarked original.

To validate our theory, we conduct extensive experiments on four widely used invisible watermarks [16], [18], [20], [21]. Our proposed attack method significantly outperforms five baseline methods in terms of both image quality and watermark removal. For the resilient watermark scheme RivaGAN, our regeneration attacks successfully remove 98% of the invisible watermarks while maintaining a PSNR above 30 compared to the original images. With the empirical results and the theoretical guarantee, we claim that pixel-level invisible image watermarks are vulnerable to our regeneration attacks.

Given the vulnerability of invisible watermarks, we explore another option: semantic watermarks. Semantic watermarks do not limit the perturbation to be within an \(\ell_2\)-distance. As long as the watermarked image looks similar and contains similar content, it is considered suitable for use. One instance of such semantic watermarks is Tree-Ring [22], which has shown resilience against our attacks. While not a perfect solution, as the watermark becomes somewhat “visible”, semantic watermarking offers a potential path forward for protecting the proper use of AI-generated images when invisible watermarks are provably ineffective.

Our contributions can be summarized as follows:

• We propose a family of regeneration attacks for image watermark removal that can be instantiated with many existing denoising algorithms and generative models.

• We prove that the proposed attack is guaranteed to remove certain pixel-based invisible watermarks and that the regenerated images are close to the original unwatermarked image.

• We evaluate the proposed attack on various invisible watermarks to demonstrate their vulnerability and its effectiveness compared with strong baselines.

• We explore other possibilities to embed watermarks in a visible yet semantically similar way. Empirical results indicate that this approach works better under our attack and is worth investigating as an alternative.

2 Related Work and Background↩︎

2.1 Related Work↩︎

Image watermarking and steganography. Steganography and invisible watermarking are key techniques in information hiding, serving diverse purposes such as copyright protection, privacy-preserved communication, and content provenance. Early works in this area employ hand-crafted methods, such as Least Significant Bit (LSB) embedding [10], which subtly hides data in the lowest order bits of each pixel in an image. Over time, numerous techniques have been developed to imperceptibly embed secrets in the spatial [11] and frequency [23], [24] domains of an image. Additionally, the emergence of deep learning has contributed significantly to this field. Deep learning methods offer improved robustness against noise while maintaining the quality of the generated image. SteganoGAN [17] uses generative adversarial networks (GAN) for steganography and perceptual image optimization. RivaGAN [16], further improves GAN-based watermarking by leveraging attention mechanisms. SSL watermarking [18], trained with self-supervision, enhances watermark features through data augmentation. Stable Signature [25] fine-tunes the decoder of Latent Diffusion Models to add the watermark. Tree-Ring [22] proposes a semantic watermark, which watermarks generative diffusion models using minimal shifts of their output distribution. This work focuses on the removal of invisible watermarks, as opposed to visible watermarks, for several reasons. Visible watermarks are straightforward for potential adversaries to visually identify and locate within an image. Additionally, removal techniques for visible watermarks are already extensively studied in prior work such as [26]–[28]. In contrast, invisible watermarks do not have explicit visual cues that reveal their presence or location. Developing removal techniques for imperceptible embedded watermarks presents unique challenges.

Deep generative models. The high-dimensional nature of images poses unique challenges to generative modeling. In response to these challenges, several types of deep generative models have been developed, including Variational Auto-Encoders (VAEs) [29], [30], Generative Adversarial Networks (GANs) [31], flow-based generative models [32], and diffusion models [3], [19]. These models leverage deep latent representations to generate high-quality synthetic images and approximate the true data distribution. One particularly interesting use of generative models is for data purification, i.e., removing the adversarial noise from a data sample. The purification is similar to watermark removal except that purification is a defense strategy while watermark removal is an attack. The diffusion-based approach in [33] is similar to an instance of our regeneration attack, but the usage is different in our paper and our theoretical guarantee of watermark removal is stronger. In this paper, we aim to demonstrate the capability of these deep generative models in removing invisible watermarks from images by utilizing the latent representations obtained through the encoding and decoding processes.

2.2 Problem Setup↩︎

This section defines invisible watermarks and the properties of an algorithm for their detection. It then discusses the threat model for the removal of invisible watermarks.

A watermarking scheme is typically designed such that \(P_1\) is different from \(P_0\) so the corresponding (carefully designed) detection algorithm can distinguish them almost perfectly, that is, to ensure \(\epsilon_1\) and \(\epsilon_2\) are nearly \(0\). An attack on a watermarking scheme aims at post-processing a possibly watermarked image which changes both \(P_0\) and \(P_1\) with the hope of increasing Type I and Type II error at the same time, hence evading the detection.

We consider the following threat model for removing invisible watermarks from images:

Adversary’s capabilities. We assume that an adversary only has access to the watermarked images. The watermarking scheme \({\mathsf{Watermark}}\), the auxiliary information \({\mathsf{aux}}\), and the detection algorithm \({\mathsf{Detect}}\) are unknown to the adversary. The adversary can make modifications to these already watermarked images it has access to using arbitrary side information and computational resources, but it cannot rely on any specific property of the watermarking process and it cannot query \({\mathsf{Detect}}\).

Adversary’s objective. The primary objective of an adversary is to render the watermark detection algorithm ineffective. Specifically, the adversary aims to produce an image \(\tilde{x}\) from the watermarked image \(x_w\) which causes the \({\mathsf{Detect}}\) algorithm to always have a high Type I error (false positive rate) or a high Type II error (false negative rate). Simultaneously, the output image \(\tilde{x}\) should maintain comparable quality to the original, non-watermarked image. The adversary’s objective will be formally defined later.

2.3 Invisible Watermark Detection↩︎

Watermarking methods implant \(k\)-bit secret information into images. The detection algorithm \({\mathsf{Detect}}\) uses an extractor for this hidden data, applying a statistical test to ascertain if the extracted message matches the secret. This test evaluates the number of matching bits \(M(m, m')\) between the extracted \(m'\) and original \(m \in \{0,1\}^k\) messages. A watermark is detected if \(M(m, m') \geq \tau\) for a predefined threshold \(\tau\) [34], [35]. Formally, we distinguish whether an image \(x\) was watermarked (\(H_1\)) or not (\(H_0\)). Assuming under null hypothesis \(H_0\) that the extracted bits behave like independent Bernoulli variables with a 0.5 probability, \(M(m,m')\) follows a binomial distribution \(B(k, 0.5)\). The false positive rate (\(\epsilon_1\)) corresponds to the probability that \(M(m,m')\) exceeds \(\tau\). This has a closed form using the regularized incomplete beta function \(I_x(a;b)\): \[\epsilon_1(\tau) =\mathbb{P}\left(M\left(m, m^{\prime}\right)>\tau \mid H_0\right)=\frac{1}{2^k} \sum_{i=\tau+1}^k {k \choose i} \nonumber =I_{1 / 2}(\tau+1, k-\tau) .\]

Decision threshold. We consider a watermark to be detected, if we can reject the null hypothesis \(H_0\) with a \(p\)-value less than \(0.01\). In practice, for a \(k=32\)-bit watermark, we require at least \(23\) bits to be extracted correctly in order to confirm the presence of a watermark. This provides a reasonable balance between detecting real watermarks and avoiding false positives.

3 The Proposed Regeneration Attack↩︎

Our attack method first destructs a watermarked image by adding noise to its representation, and then reconstructs it from the noised representation.

Specifically, given an embedding function \(\phi: \mathbb{R}^n\rightarrow \mathbb{R}^d\), a regeneration function \(\mathcal{A}: \mathbb{R}^d \rightarrow \mathbb{R}^n\), and a noise level \(\sigma\), the attack algorithm takes a watermarked image \(x_w\in \mathbb{R}^n\) and returns \[\label{eq:algo} \hat{x} = \underbrace{\mathcal{A}\Big( \overbrace{\phi(x_w) + \mathcal{N}(0,\sigma^2 I_d)}^{\text{destructive}}\Big)}_{\text{constructive}}.\tag{1}\] The first step of the algorithm is destructive. It maps the watermarked image \(x_w\) to an embedding \(\phi(x_w)\) (which is a possibly different representation of the image), and adds i.i.d. Gaussian noise. The explicit noise shows the destructive nature of the first step. The second step of the algorithm is constructive. The corrupted image representation \(\phi(x_w)+\mathcal{N}(0,\sigma^2 I_d)\) is passed through a regeneration function \(\mathcal{A}\) to reconstruct the original clean image.

There are various different choices for \(\phi\) and \(\mathcal{A}\) that can instantiate our attack. \(\phi\) can be as simple as identity map, or as complicated as deep generative models including variational autoencoders [36]. \(\mathcal{A}\) can be traditional denoising algorithms from image processing and recent AI models such as diffusion [19]. The choice of \(\phi\) and \(\mathcal{A}\) may change the empirical results, but it does not affect the theoretical guarantee. In the following sections, we introduce three combinations of \(\phi\) and \(\mathcal{A}\) to instantiate the attack. Among the three, the diffusion instantiation is the most complicated and we describe it with pseudocode in Algorithm 2.

3.1 Attack Instance 1: Identity Embedding with Denoising Reconstruction↩︎

Set \(\phi\) to be identity map, then \(\mathcal{A}\) can be any image denoising algorithm, e.g., BM3D [14], TV-denoising [37], bilateral filtering [38], DnCNNs [15], or a learned natural image manifold [14], [15], [39], [40]. A particular example of interest is a “denoising autoencoder” [41], which takes \(\phi\) to be identity, adds noise to the image deliberately, and then denoises by attempting to reconstruct the image. Observe that for “denoising autoencoder” we do not need to add additional noise.

3.2 Attack Instance 2: VAE Embedding and Reconstruction↩︎

The regeneration attack in Equation 1 can be instantiated with a variational autoencoder (VAE). A VAE [36] consists of an encoder \(q_\phi(z|x)\) that maps a sample \(x\) to the latent space \(z\) and a decoder \(p_\theta(x|z)\) that maps a latent \(z\) back to the data space \(x\). Both the encoder and decoder are parameterized with neural networks. VAEs are trained with a reconstruction loss that measures the distance from the reconstructed sample to the original sample and a prior matching loss that restricts the latent to follow a pre-defined prior distribution.

Instead of mapping \(x\) directly to \(z\), the encoder maps it to the mean \(\mu(x)\) and variance \(\sigma(x)\) of a Gaussian distribution and samples from it. Therefore, VAE already adds noise during the encoding stage (though its variance depends on the sample \(x\), which is not exactly the same as defined in Equation 1 ), so there is no need to add extra noise. Note that this is similar to the situation of denoising autoencoders described in Section 3.1, as the denoising autoencoder is a trivial case of VAE where \(\mu(x)\) is identity.

3.3 Attack Instance 3: Diffusion Embedding and Reconstruction↩︎

The regeneration attack can also be instantiated with diffusion models. Diffusion models [19] define a generative process that learns to sample from an unknown true distribution \(p(z_0)\). This process is learned by estimating original samples from randomly noised ones. In other words, diffusion models are trained to denoise, which makes them candidates for the regeneration function \(\mathcal{A}\) in the proposed attack. The embedding function \(\phi\) can either be identity [19] or a latent embedding [3], depending on the space where diffusion is trained.

For diffusion models, the process of adding noise to a clean sample is known as the forward process. Likewise, the process of denoising a noisy sample is known as the backward process. The forward process is defined by the following stochastic differential equation (SDE): \(d z=f(z, t) d t+g(t) d w\refstepcounter{equation}~~(\theequation)\label{eq:fwd},\) where \(t \in[0,1], z \in \mathbb{R}^d\), \(w(t) \in \mathbb{R}^d\) is a standard Wiener process, and \(f,g\) are real-valued functions. The backward process can then be described with its reverse SDE: \(d \hat{z}=\left[f(\hat{z}, t)-g(t)^2 \nabla_{\hat{z}} \log p_t(\hat{z})\right] d t+g(t) d \bar{w}\refstepcounter{equation}~~(\theequation)\label{eq:bwd},\) where \(\hat{w}\) is a reverse Wiener process. Diffusion models parameterize \(\nabla_{\hat{z}} \log p_t(\hat{z})\) with a neural network \(s(z,t)\). By substituting \(s(z,t)\) into Equation [eq:bwd], the backward SDE becomes known and solvable using numerical solvers [42], [43], \(\hat{z}_0=\mathsf{solve}(z_t, t, s, f, g)\).

Among many ways to define \(f\) and \(g\) in Equation [eq:fwd], variance preserving SDE (VP-SDE) is commonly used [3], [19]. Under this setting, the conditional distribution of the noised sample is the following Gaussian [44]: \(p(z_t|z_0)=\mathcal{N}(\sqrt{\alpha(t)}z_0, 1-\alpha(t))\refstepcounter{equation}~~(\theequation)\label{eq:cond},\) where \(\alpha(t)\) a pre-defined noise schedule. The variance of the original distribution \(p(z_0)\) is preserved at any step.

As defined in Algorithm 2, our algorithm removes the watermark from the watermarked image \(x_w\) using diffusion models. \(x_w\) is first mapped to the latent representation \(z_0\), which is then noised to the time step \(t^*\). A latent diffusion model is then used to reconstruct the latent \(\hat{z}_0\), which is mapped back to an image \(\hat{x}\).

Similar to denoising autoencoders, in either diffusion or VAEs, the noise-injection is integral to the algorithms themselves, and no additional noise-injection is needed.

4 Theoretical Analysis↩︎

We show in this section that the broad family of regeneration attacks as defined in Equation 1 enjoy provable guarantees on their ability to remove invisible watermarks while retaining the high quality of the original image. Our proofs are deferred to Appendix 10. More discussion on the implications and interpretation of our theoretical analysis can be found in Appendix 9.

4.1 Certified Watermark Removal↩︎

How do we quantify the ability of an attack algorithm to remove watermarks? We argue that if after the attack, no algorithm is able to distinguish whether the result is coming from a watermarked image or the corresponding original image without the watermark, then we consider the watermark certifiably removed. More formally:

Let us also define a parameter to quantify the effect of the embedding function \(\phi\).

The parameter \(L_{x,w}\) measures how much the embedding compresses the watermark added on a particular clean image \(x\). If \(\phi\) is identity, then \(L_{x,w} \equiv 1\). If \(\phi\) is a projection matrix to a linear subspace then \(0\leq L_{x,w} \leq 1\) depending on the magnitude of the component of \(x_w - x\) in this subspace. For a neural image embedding \(\phi\), the exact value of \(L_{x,w}\) is unknown but given each \(x_w\) and \(x\) it can be computed and estimated efficiently. We defer more discussion to the Appendix 7.

Figure 3 illustrates what the tradeoff function looks like. The result says that after the regeneration attack, it is impossible for any detection algorithm to correctly detect the watermark with high confidence. In addition, it shows that such detection is as hard as telling the origin of a single sample \(Y\) from either of the two Gaussian distributions \(\mathcal{N}(0,1)\) and \(\mathcal{N}(L_{x,w}\Delta/\sigma,1)\). Specifically, when there is a uniform upper bound \(L \geq L_{x,w}\), we can calibrate \(\sigma\) such that the attack is provably effective for a prescribed \(\Phi(\Phi^{-1}(1-\cdot) - L\Delta/\sigma)\)-CWF guarantee for all input images and all \(\Delta\)-invisible watermarks (see specific constructions in Appendix 7).

The proof, deferred to Appendix 10, leverages an interesting connection to a modern treatment of differential privacy [45] known as the Gaussian differential privacy [46]. The work of [46] itself is a refinement and generalization of the pioneering work of [47] and [48] which established a tradeoff-function view.

4.2 Utility Guarantees↩︎

In this section, we prove that the regenerated image \(\hat{x}\) is close to the original (unwatermarked) image \(x_0\). This is challenging because the denoising algorithm only gets access to the noisy version of the watermarked image. Interestingly, we can obtain a general extension lemma showing that for any black-box generative model that can successfully denoise a noisy yet unwatermarked image with high probability, the same result also applies to the watermarked counterpart, except that the failure probability is slightly larger.

The theorem says that if a generative model is able to denoise a noisy version of the original image, then the corresponding watermark-removal attack using this generative model provably produces an image with similar quality.

The above result is powerful in that it makes no assumption about what perturbation the watermarking schemes could inject and which image generation algorithm we use. We give a few examples below.

For denoising algorithms with theoretical guarantees, e.g., TV-denoising [49], our results imply provable guarantees on the utility for the watermark removal attack of the form, “w.h.p., \(\frac{1}{n}\|\hat{x} - x_0\|^2 = \tilde{O}\left( \frac{\sigma \mathrm{TV}_{2d}(x_0)}{n}\right)\)”, i.e., vanishing mean square error (MSE) as \(n\) gets bigger.

For modern deep learning-based image denoising and generation algorithms where worst-case guarantees are usually intractable, Theorem 2 is still applicable for each image separately. That is to say, as long as their empirical denoising quality is good on an unwatermarked image, the quality should also be good on its watermarked counterpart.

5 Evaluation↩︎

5.0.0.1 Datasets.

We evaluate our attack on two types of images: real photos and AI-generated images. For real photos, we use 500 randomly selected images from the MS-COCO dataset [50]. For AI-generated images, we employ the Stable Diffusion-v2.1 model² from Stable Diffusion [3], a state-of-the-art generative model capable of producing high-fidelity images. Using prompts from the Stable Diffusion Prompt (SDP) dataset³, we generate 500 images encompassing both photorealistic and artistic styles. This diverse selection allows for a comprehensive evaluation of our attack on invisible watermarks. All experiments are conducted on Nvidia A6000 GPUs.

5.0.0.2 Watermark settings.

We evaluate four publicly available pixel-level watermarking methods: DwtDctSvd [20], RivaGAN [16], StegaStamp [21], and SSL watermark [18]. These methods represent a variety of approaches, ranging from traditional signal processing to recent deep learning techniques, as introduced in Section [sec:background]. To account for watermarks of different lengths, we use \(k=32\) bits for DwtDctSvd, RivaGAN, and SSL watermark, and \(k=96\) bits for StegaStamp. For watermark detection, we set the decision threshold to reject the null hypothesis with \(p < 0.01\), requiring the detection of 23 out of 32 bits or 59 out of 96 bits, respectively, for the corresponding methods, as described in Section 2.3. For watermark extraction, we use the publicly available code for each method with default inference and fine-tuning parameters specified in their papers.

5.0.0.3 Attack baselines.

To thoroughly evaluate the robustness of our proposed watermarking method, we test it against a diverse set of baseline attacks representing common image perturbations. We select both geometric/quality distortions and noise manipulations that could potentially interfere with embedded watermarks. Specifically, the baseline attack set includes: brightness adjustments with enhancement factors of [2, 4, 6, 8, 12], contrast adjustments with enhancement factors of [2, 3, 4, 5, 6, 7], JPEG compression at quality levels [10, 20, 30, 40, 50, 60], Gaussian noise addition with a mean of 0 and standard deviations of [5, 10, 15, 20, 25, 30], and Gaussian blur with radii of [2, 4, 6, 8, 10, 12]. Further details are provided in Appendix 8.

5.0.0.4 Proposed attacks.

For regeneration attacks using variational autoencoders, we evaluate two pre-trained image compression models from the CompressAI library [51]: Bmshj2018 [52] and Cheng2020 [53]. Compression factors are set to [1, 2, 3, 4, 5, 6], where lower factors correspond to more heavily degraded images. For diffusion model attacks, we use the Stable Diffusion-v2.1 model. The number of noise steps is set to [10, 30, 50, 100, 150, 200] (with \(\sigma =\)[0.10, 0.17, 0.23, 0.34, 0.46, 0.57]), and we employ pseudo numerical methods for diffusion models (PNDMs) [42] to generate samples. By adjusting the compression factors and noise steps, we achieve varying levels of perturbation for regeneration attacks.

5.0.0.5 Evaluation metrics.

We evaluate the quality of attacked and watermarked images compared to the original cover image using two common metrics: Peak Signal-to-Noise Ratio (PSNR) defined as \(\operatorname{PSNR}\left(x, x^{\prime}\right)= -10 \cdot \log_{10}\left(\text{MSE}\left(x, x^{\prime}\right)\right)\), for images \(x, x^{\prime} \in [0,1]^{c \times h \times w}\), and Structural Similarity Index (SSIM) [54] which measures perceptual similarity. To evaluate the diversity and quality of watermarked images, we use Fréchet Inception Distance (FID) [55] between the distributions of watermarked and unwatermarked images. To evaluate the robustness of the watermark, we compute the True Positive Rate (TPR) at a fixed False Positive Rate (FPR), specifically TPR@FPR=0.01. The detection threshold corresponding to FPR=0.01 is set according to each watermark’s default configuration: correctly decoding 23/32, 59/96, and 32/48 bits for the respective watermarking methods, as described in the watermark settings.

5.1 Results and Analysis↩︎

This section presents detailed results and analysis of the regeneration attack experiments on different watermarking methods. Some attacking examples are shown in Figure 4.

5.1.0.1 Watermarking performance without attacks.

Table 6 summarizes the watermarked image quality and detection rates for images watermarked by the four methods without any attacks. Each method—DwtDctSvd, RivaGAN, SSL, and StegaStamp—successfully embeds and retrieves messages from the images. These methods are post-processing techniques, adding watermarks to existing images. Among them, SSL achieves the highest PSNR and SSIM values, indicating superior perceptual quality and minimal visual distortion compared to the original images. DwtDctSvd achieves the lowest FID scores, suggesting the watermarked images maintain fidelity similar to clean images. In contrast, StegaStamp exhibits a noticeable drop in quality, with the lowest PSNR and highest FID scores. As illustrated in Figure 7, StegaStamp introduced noticeable blurring artifacts.

5.1.0.2 Watermark removal effectiveness and image quality reservation.

Figure 5 and 8 present the quality-detectability tradeoff results from applying various regeneration attacks to remove watermarks. The VAE and diffusion model-based attacks (VAE-Bmshj2018, VAE-Cheng2020, Diffusion) consistently achieve over 99% removal rates for the DctDwtSvd, RivaGAN, and SSL watermarking methods, demonstrating their high effectiveness. In contrast, StegaStamp exhibits the highest robustness, with effective removal only achieved by the diffusion model with substantial noise. This resilience is partially attributed to StegaStamp’s lower visual quality and higher perturbation levels (as indicated in Table 6, Figure 7 and Figure [fig:l295dis95new]). Yet, increasing the noise level in diffusion models reduces StegaStamp’s resistance. As demonstrated in Figure 5 and 8, higher noise levels improve the removal rate on StegaStamp, aligning with the theory that larger perturbations necessitate more noise for effective removal. This also aligns with the trade-off of lower image quality at higher noise levels. Overall, the consistently high removal rates across various watermarking schemes demonstrate the effectiveness of regeneration attacks for watermark removal. In terms of image quality preservation, the regeneration attacks generally maintain high quality, as indicated by PSNR and SSIM metrics. VAE models yield higher PSNR and SSIM scores, suggesting superior perceptual quality from a GAN-based perspective. However, qualitative inspection of example images in Figure 4 reveals the VAE outputs exhibit some blurring compared to the diffusion outputs. Since PSNR and SSIM are known to be insensitive to blurring artifacts [54], [56], we conclude that the choice of using regeneration with diffusion models should be guided by the specific requirements of each application.

5.1.0.3 Potential defense.

Although we show that the proposed attack is guaranteed to remove any pixel-based invisible watermarks, it is not impossible to detect AI-generated images. Semantic watermarks offer a viable detection method, with further details and results discussed in Appendix 11.

6 Conclusion↩︎

We proposed a regeneration attack on invisible watermarks that combines destructive and constructive attacks. Our theoretical analysis proved that the proposed regeneration attack is able to remove certain invisible watermarks from images and make the watermark undetectable by any detection algorithm. We showed with extensive experiments that the proposed attack performed well empirically. The proofs and experiments revealed the vulnerability of invisible watermarks. Given this vulnerability, we explored an alternative defense that uses visible but semantically similar watermarks. Our findings on the vulnerability of invisible watermarks underscore the need for shifting the research/industry emphasis from invisible watermarks to their alternatives.

7 Additional Discussion in FAQ style↩︎

How do we control a certain degree of Certified Watermark Freeness apriori? We note that our guarantee in Theorem 1 depends on the specific watermark injected on specific image instance through the unknown local Lipschitz parameter \(L_{x,w}\). Specifying a fixed CWF level requires us to have a uniform upper bound of \(L_{x,w}\) independent to \(x\) and \(w\). To give two concrete examples, when the embedding \(\phi\) is chosen trivial to be the identity map, then we can take \(L_{x,w}\leq 1\). When \(\phi\) is a lower pass filtering, e.g., Fourier transform than removing all high-frequency components except the top \(k\) dimension, then we can bound \(L_{x,w}\leq \sqrt{k}/n\) where \(n\) is the number of pixels. More generally, any linear transformation with bounded operator norm works.

Is there a uniform bound for neural embedding \(\phi\) such as those from VAE and diffusion models? We believe there is, but these bounds might be too conservative to use in practice. In particular, they might be \(\gg 1\) due to the widely observed adversarial examples [57], [58]. If the injected watermarks are carefully designed such that the injected perturbation is aligned with an adversarial perturbation, then the resulting watermarked images will be more resilient to our attacks that leverage the neural embeddings. They will not be more resilient to our attacks that do not use neural embeddings though. In practice, we found that in all existing watermarks, neural embeddings result in substantially smaller distortions to the original images while suppressing \(L_{x,w}\) substantially (Figure [fig:l295dis95new]).

Other ways of achieving CWF without adding Gaussian noise. Research from the golden age of digital watermarking [12], [59]–[61] has proposed methods such as quantization for removing watermarks that provide similar tradeoffs in practice to the watermarks that we experimented with in this paper. However, these methods, in general, do not come with provable CWF guarantees. It is critical that the watermark removal attack is randomized to enjoy similar properties to what we have in Theorem 1. That said, the classical removal attacks can be used in constructing better embedding function \(\phi\) which may help reducing the local Lipschitz parameter and, thus, improving the tradeoff between certified removal and utility of the regenerated image. Besides Gaussian noise, we can also add Laplace noise and other well-known perturbation mechanisms from the differential privacy and cryptography research community. Thoroughly investigating the impact of the choice of noise (and randomized quantization approaches) is an interesting direction of future research.

8 Additional Method Details↩︎

8.1 Invisible Watermarking Methods↩︎

In this section, we review several well-established invisible watermarking schemes that are evaluated in our experiments (Section 5). These approaches cover a range of methods, including traditional signal processing techniques and more recent deep learning methods. They include the default watermarking schemes employed by the widely used Stable Diffusion models [3]. We show some invisible watermarking examples in Figure 7.

DwtDctSvd watermarking. The DwtDctSvd watermarking method [20] combines Discrete Wavelet Transform (DWT), Discrete Cosine Transform (DCT), and Singular Value Decomposition (SVD) to embed watermarks in color images. First, the RGB color space of the cover image is converted to YUV. DWT is then applied to the Y channel, and DCT divides it into blocks. SVD is performed on each block. Finally, the watermark is embedded into the blocks. DwtDctSvd is the default watermark used by Stable Diffusion.

RivaGAN watermarking. RivaGAN [16] presents a robust image watermarking method using GANs. It employs two adversarial networks to assess watermarked image quality and remove watermarks. An encoder embeds the watermark, while a decoder extracts it. By combining these, RivaGAN offers superior performance and robustness. RivaGAN is another watermark used by Stable Diffusion.

StegaStamp watermarking. StegaStamp [21] is a robust CNN-based watermarking method. It uses differentiable image perturbations during training to improve noise resistance. Additionally, it incorporates a spatial transformer network to resist minor perspective and geometric changes like cropping. This adversarial training and spatial transformer enable StegaStamp to withstand various attacks.

SSL watermarking. SSL watermarking [18] utilizes pre-trained neural networks’ latent spaces to encode watermarks. Networks pretrained with self-supervised learning (SSL) extract effective features for watermarking. The method embeds watermarks through backpropagation and data augmentation, then detects and decodes them from the watermarked image or its features.

8.2 Existing Attacking Methods↩︎

In this section, we review common attacking methods that aim to degrade or remove invisible watermarks in images. These methods are widely used to measure the robustness of watermarking algorithms against removal or tampering [16], [18], [21], [22], [25]. The attacking methods can be categorized into destructive attacks, where the watermark is considered part of the image and actively removed by corrupting the image, and constructive attacks, where image processing techniques like denoising are used to obscure the watermark.

Destructive attacks intentionally corrupt the image to degrade or remove the embedded watermark. Common destructive attack techniques include:

Brightness/Contrast adjustment. This attack adjusts the brightness and contrast parameters of the image globally. Adjusting the brightness/contrast makes the watermark harder to detect.

JPEG compression. JPEG is a common lossy image compression technique. It has a quality factor parameter that controls the amount of compression. A lower quality factor leads to more loss of fine details and a higher chance of degrading the watermark.

Gaussian noise. This attack adds random Gaussian noise to each pixel of the watermarked image. The variance of the Gaussian noise distribution controls the strength of the noise. A higher variance leads to more degradation of the watermark signal.

Constructive attacks aim to remove the watermark by improving image quality and restoring the original unwatermarked image. Examples include:

Gaussian blur. Blurring the image by convolving it with a Gaussian kernel smoothens the watermark signal and makes it less detectable. The kernel size and standard deviation parameter control the level of blurring.

Other recent attacking methods [62]–[65] aim to remove invisible image watermarks using generative models. Concurrent to our work, [62] use propose DiffWA, a conditional diffusion model with distance guidance for watermark removal. However, DiffWA only works for low-resolution images and lacks theoretical guarantees. [63] train a substitute classifier and conduct projected gradient descent (PGD) attacks on it to deceive black-box watermark detectors. However, their approach requires multiple queries to the target generator. [64] propose an adaptive attack that locally replicates secret watermarking keys by creating differentiable surrogate keys used to optimize the attack parameters. However, they assume the attacker knows the watermarking method, which is a stronger assumption than ours. Our method removes invisible watermarks from high-resolution images, provides theoretical justifications, and does not assume knowledge of the watermarking algorithm.

9 Remarks on Our Theoretical Guarantee↩︎

In this section, we discuss more about the theoretical guarantees in Section 4. For the readers’ convenience, we first restate the definitions and theorems and then discuss their implications and interpretation. The proofs can be found in Appendix 10.

9.1 Certified Watermark Removal↩︎

How do we quantify the ability of an attack algorithm to remove watermarks? We argue that if after the attack, no algorithm is able to distinguish whether the result is coming from a watermarked image or the corresponding original image without the watermark, then we consider the watermark certifiably removed. More formally:

Let us also define a parameter to quantify the effect of the embedding function \(\phi\).

The parameter \(L_{x,w}\) measures how much the embedding compresses the watermark added on a particular clean image \(x\). If \(\phi\) is identity, then \(L_{x,w} \equiv 1\). If \(\phi\) is a projection matrix to a linear subspace then \(0\leq L_{x,w} \leq 1\) depending on the magnitude of the component of \(x_w - x\) in this subspace. For a neural image embedding \(\phi\), the exact value of \(L_{x,w}\) is unknown but given each \(x_w\) and \(x\) it can be computed efficiently.

Figure 3 illustrates what the tradeoff function looks like. The result says that after the regeneration attack, it is impossible for any detection algorithm to correctly detect the watermark with high confidence. In addition, it shows that such detection is as hard as telling the origin of a single sample \(Y\) from either of the two Gaussian distributions \(\mathcal{N}(0,1)\) and \(\mathcal{N}(L_{x,w}\Delta/\sigma,1)\).

The proof in Section 10 leverages an interesting connection to a modern treatment of differential privacy [45] known as the Gaussian differential privacy [46]. The work of [46] itself is a refinement and generalization of the pioneering work of [47] and [48] which established a tradeoff-function view.

Discussion. Let us instantiate the algorithm with a latent diffusion model by choosing \(\sigma = \sqrt{(1-\alpha(t^*))/\alpha(t^*)}\) (see Algorithm 2) and discuss the parameter choices.

Finally, we note that while Theorem 1 and 2 are specific to \(\ell_2\)-distance, the general idea applies to other distance functions (e.g., \(\ell_1\) distance). \(\ell_2\)-distance is natural for the Gaussian noise natively introduced by diffusion and VAE-based regeneration attacks.

9.2 Utility Guarantees↩︎

In this section, we prove that the regenerated image \(\hat{x}\) is close to the original (unwatermarked) image \(x_0\). This is challenging because the denoising algorithm only gets access to the noisy version of the watermarked image.

Interestingly, we can obtain a general extension lemma showing that for any black-box generative model that can successfully denoise a noisy yet unwatermarked image with high probability, the same result also applies to the watermarked counterpart, except that the failure probability is slightly larger.

The theorem says that if a generative model is able to denoise a noisy version of the original image, then the corresponding watermark-removal attack using this generative model provably produces an image with similar quality.

The above result is powerful in that it makes no assumption about what perturbation the watermarking schemes could inject and which image generation algorithm we use. We give a few examples below.

For denoising algorithms with theoretical guarantees, e.g., TV-denoising [49], our results imply provable guarantees on the utility for the watermark removal attack of the form, “w.h.p., \(\frac{1}{n}\|\hat{x} - x_0\|^2 = \tilde{O}\left( \frac{\sigma \mathrm{TV}_{2d}(x_0)}{n}\right)\)”, i.e., vanishing mean square error (MSE) as \(n\) gets bigger.

For modern deep learning-based image denoising and generation algorithms where worst-case guarantees are usually intractable, Theorem 2 is still applicable for each image separately. That is to say, as long as their empirical denoising quality is good on an unwatermarked image, the quality should also be good on its watermarked counterpart.

10 Proofs of Technical Results↩︎

11 Defense with Semantic Watermarks↩︎

In this section, we discuss possible defenses that are resilient to the proposed attack, and although Theorem 1 has guaranteed that no detection algorithm will be able to detect the watermark after our attack, the guarantee is based on the invisibility with respect to \(\ell_2\) distance. Therefore, by relaxing that invisibility constraint and thus making the watermark more visible, we may be able to prevent the watermark from being removed. One less-harmful way to loosen the invisibility constraint is with semantic watermarks. As shown in Figure 11, pixel-based watermarks such as DwtDctSvd keep the image almost intact, while semantic watermarks change the image significantly but retain its content.

11.1 Tree-Ring Watermarks↩︎

Tree-Ring Watermarking [22] is a new technique that robustly fingerprints diffusion model outputs in a way that is semantically hidden in the image space. An image with a Tree-Ring watermark does not look the same as the image, but it is semantically similar (in Figure 11, both the original and the semantically watermarked image contain an astronaut riding a horse in Zion National Park). Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. [22] demonstrated that Tree-Ring Watermarking can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID.

11.2 Defense Experiments↩︎

To evaluate Tree-Ring as an alternative watermark, we use the same datasets from the previous experiments in Section 5 - MS-COCO and SDP. However, since Tree-Ring adds watermarks during the generation process of diffusion, it cannot directly operate on AI-generated images. Instead, it needs textual inputs that describe the content of the images. We use captions from MS-COCO and the user prompts of SDP datasets as the input prompts. The selected set of attacks (including our proposed attack) is applied to the Tree-Ring watermarked images.

As shown in Table 1, Tree-Ring watermarks show exceptional robustness against all the attacks tested. However, such robustness does not come for free. We depict the \(\ell_2\)-distances between original images and watermarked ones in Figure 12. Images with Tree-Ring watermarks are significantly more different from the original images in both the pixel space and the latent space. These results indicate that Tree-Ring, as an instance of semantic watermarks, shows the potential to be an alternative solution to the image watermarking problem. However, as our theory predicts, the robustness comes at the price of more visible differences.

References↩︎