{"paper":{"title":"Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy","license":"http://creativecommons.org/licenses/by/4.0/","headline":"Re-watermarking an already watermarked image reliably suppresses the original signal.","cross_cats":["cs.CV"],"primary_cat":"cs.CR","authors_text":"Benjamin I. P. Rubinstein, Maria Bulychev, Neil G. Marchant","submitted_at":"2026-05-16T03:57:37Z","abstract_excerpt":"Watermarking combines an imperceptible change to an input image that will trigger a detector, to assert provenance and protect intellectual property. The literature has shown great interest in attacks on watermarking schemes: attackers are clearly motivated to steal copyrighted material or circumvent legislated deepfake protections. In this work, we make a simple-yet-powerful observation: that such attacks on watermarking-like watermarks themselves-seek an imperceptible change to an input image (now already watermarked) that will trigger a detector. This analogy comparing watermark attacks to "},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"simply re-watermarking an already watermarked image reliably suppresses the original signal, without requiring gradients, surrogate models, or detection keys","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The core analogy holds that any imperceptible change intended to trigger a detector (including a new watermark) will interfere with an existing watermark's detection, independent of the specific schemes used.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"Re-watermarking reliably removes existing watermarks across 96 dataset-victim-attack combinations and pairs with a classifier achieving 0.878-0.953 accuracy, cutting bit accuracy by 25-48%.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"Re-watermarking an already watermarked image reliably suppresses the original signal.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"0fd627de0ad6fc6305b216506ec9190fe9c3f4d1404800e2e31bc34ee3bd60a5"},"source":{"id":"2605.16796","kind":"arxiv","version":1},"verdict":{"id":"a60b814e-72e4-40d0-bd2d-8b90bd355547","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-19T21:17:01.144463Z","strongest_claim":"simply re-watermarking an already watermarked image reliably suppresses the original signal, without requiring gradients, surrogate models, or detection keys","one_line_summary":"Re-watermarking reliably removes existing watermarks across 96 dataset-victim-attack combinations and pairs with a classifier achieving 0.878-0.953 accuracy, cutting bit accuracy by 25-48%.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The core analogy holds that any imperceptible change intended to trigger a detector (including a new watermark) will interfere with an existing watermark's detection, independent of the specific schemes used.","pith_extraction_headline":"Re-watermarking an already watermarked image reliably suppresses the original signal."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.16796/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"doi_title_agreement","ran_at":"2026-05-19T21:31:19.309845Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"doi_compliance","ran_at":"2026-05-19T21:31:00.400796Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"claim_evidence","ran_at":"2026-05-19T19:01:56.290911Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"ai_meta_artifact","ran_at":"2026-05-19T18:33:26.427065Z","status":"skipped","version":"1.0.0","findings_count":0}],"snapshot_sha256":"7cdb3d8a5e3b6d77019fb8087bdea43242fcb1996077f700749581d77f515119"},"references":{"count":55,"sample":[{"doi":"","year":2024,"title":"B. An, M. Ding, T. Rabbani, A. Agrawal, Y . Xu, C. Deng, S. Zhu, A. Mohamed, Y . Wen, T. Goldstein, and F. Huang. W A VES: Benchmarking the robustness of image watermarks. InForty-first International ","work_id":"e9e8125a-322d-4087-89f3-77606733c9a5","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2018,"title":"J. Ballé, D. Minnen, S. Singh, S. J. Hwang, and N. Johnston. Variational image compression with a scale hyperprior. InInternational Conference on Learning Representations, 2018","work_id":"89675e3d-e4a4-4364-b33a-64aa796801b0","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"Flux.2: Next generation image generation","work_id":"cc531e14-6531-4795-9adf-233a243770e2","ref_index":3,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2025,"title":"T. Bui, S. Agarwal, and J. Collomosse. TrustMark: Robust watermarking and watermark removal for arbitrary resolution images. InProceedings of the IEEE/CVF International Conference on Computer Vision (","work_id":"dcb563d2-6d1b-4bee-8496-2a94bb3151bb","ref_index":4,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2023,"title":"T. Bui, S. Agarwal, N. Yu, and J. Collomosse. RoSteALS: Robust steganography using autoencoder latent space. In2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pa","work_id":"f1e171d1-6f22-411a-b183-607793eb93ed","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":55,"snapshot_sha256":"1c3fda3fd983c7bb06bed46aaa2e6164cc3b0723c807286a0524be1967c00b36","internal_anchors":0},"formal_canon":{"evidence_count":2,"snapshot_sha256":"79c742162cdb7608d48d31c287c7241a79641d89970ac9ad1a767dee740947d6"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}