Removing Watermarks with Partial Regeneration using Semantic Information

Caleb Geniesse; John Kevin Cava; Krti Tallam; Michael W. Mahoney; N. Benjamin Erichson

REVIEW 4 major objections 6 minor 1 cited by

Removing Watermarks with Partial Regeneration using Semantic Information

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Semantic background repainting erases four invisible watermarks.

desk verdict A clever attack pipeline with a load-bearing statistical gap: the TreeRing claim rests on an average p-value, not per-image detection rates. read the letter →

arxiv 2505.08234 v1 pith:MBTI3CMA submitted 2025-05-13 cs.CV cs.AIcs.CR

Krti Tallam , John Kevin Cava , Caleb Geniesse , N. Benjamin Erichson , Michael W. Mahoney This is my paper · ORCID

classification cs.CVcs.AIcs.CR

keywords invisiblewatermarkssemanticwatermarkremovaldiffusioninpaintingvision-languagemodelzero-shotsegmentationTreeRingmaskedSSIMgenerativeAIprovenance

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that invisible and semantic image watermarks, even those designed to survive cropping, resizing, and compression, can be removed by an adaptive adversary that understands what the image means. The proposed attack, SemanticRegen, first asks a vision-language model what the important object and background are, cuts out the foreground with text-guided segmentation, and then regenerates only the background with a diffusion model. The paper reports that this erases all four watermarks it tests: TreeRing is defeated at an average $p = 0.10$, above the $0.05$ threshold, and StegaStamp, StableSig, and DWT/DCT watermarks drop below $0.75$ bit accuracy. A careful reader would care because this shows that a class of watermarking defenses can be bypassed without destroying the content, and it introduces a foreground-focused metric, masked SSIM, for judging such attacks.

What carries the argument

The load-bearing mechanism is partial regeneration: instead of transforming the whole image, SemanticRegen identifies the meaningful foreground with a text-guided segmentation mask and uses a diffusion inpainting model to recreate only the background, conditioned on a caption produced by a vision-language model. This concentrates the removal operation on the region where the paper assumes the watermark signal lives, preserving the objects a human viewer would notice. The paper introduces masked SSIM (mSSIM), the structural similarity computed only inside the foreground mask, as the metric that makes this foreground preservation visible.

What would settle it

Run SemanticRegen on a set of watermarked images whose TreeRing watermark was embedded in the foreground object or spread across the entire image; if the average TreeRing $p$-value drops below $0.05$, or if any of the other three schemes' bit accuracy rises above $0.75$, the paper's claim that SemanticRegen removes these watermarks is falsified.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that semantic background regeneration removes current invisible watermarks while preserving apparent meaning. In experiments over 1,000 prompts, SemanticRegen is the only method tested that defeats TreeRing, with an average $p$-value of $0.10$ (success threshold $p > 0.05$), and it lowers the bit accuracy of StegaStamp, StableSig, and invisible DWT/DCT watermarks below $0.75$. The same attack keeps masked SSIM around $0.94$, meaning the foreground regions that carry the image's meaning are nearly unchanged, and it outperforms prior diffusion-based removers in masked SSIM. The paper presents this as evidence of a gap between current watermarking defenses and semantics-aware adversaries.

Load-bearing premise

The attack's load-bearing premise is that the watermark lives in the background rather than in the foreground object; if a watermark is spread across the whole image or embedded in the salient object, regenerating the background will not remove it.

Editorial extensions

If this is right

TreeRing and similar semantic watermarks cannot be considered robust solely because they survive cropping, resizing, and compression; an adversary with semantic understanding can bypass them without harming perceived content.
A watermark that is removed by background regeneration can be made more durable by coupling the signal to the foreground mask, for instance by embedding across the whole image rather than in low-salience regions.
mSSIM provides a practical quality measure for attacks that intentionally alter non-salient regions, letting researchers compare removal methods on the regions that matter for human meaning.
Because SemanticRegen is label-free, the same attack can be deployed against any future watermarking scheme without retraining or access to the watermark decoder.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper's experiments, the same pipeline could be pointed at any semantically separable image region, so future watermarking schemes that hide signals in a particular texture or style component would face the same attack surface.
A natural experiment the paper does not run is to invert the mask and regenerate only the foreground; the change in detector confidence would reveal where each watermark actually stores its signal.
The results indirectly suggest a cheap diagnostic for watermark robustness: measure how much background-only regeneration shifts the detector's output, which would give a label-free robustness score before committing to a full adversarial benchmark.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The thing to know: SemanticRegen is a genuinely new attack design—VQA captions, zero-shot segmentation, background-only inpainting—and the mSSIM metric is a sensible addition for foreground fidelity. But the paper's headline result, that it defeats TreeRing, does not hold up as reported. The evidence is a single average p-value of 0.10 across 1,000 images. For watermark removal, the p-value is per image; the average being above 0.05 is compatible with most images still being detected. No per-image distribution, no confidence intervals, no false-positive calibration on unwatermarked images. That is not a minor weakness; it is the load-bearing evidence for the paper's unique contribution.

What is actually new: the three-stage pipeline is a plausible combination of known building blocks, and the authors are honest that it works best on images with clear, separable foreground/background—that assumption is stated in Section 3.1. Compared against four watermarking schemes with 1,000 prompts, the bit-accuracy reductions for StegaStamp and StableSig are plausible. The mSSIM idea of measuring quality only over foreground regions is useful; the numbers show a meaningful improvement over baselines (0.94–0.95 vs 0.84–0.86).

The soft spots, in order of severity. First, the TreeRing claim as discussed. The fix is straightforward: report the fraction of images with p > 0.05, or a histogram, plus error bars. Second, the evaluation lacks reproducibility: no code, no data, no random seeds, no details on which prompts were used. That is fixable but currently blocks verification. Third, the references are sloppy—at least one placeholder author names and a citation for MiniChat-MA pointing to a legal-policy paper. That erodes confidence in the related-work discussion. Fourth, mSSIM partially uses the same mask that guides the attack, so it is not fully independent; this is a minor point given the attack itself is the thing being evaluated, but worth stating.

Who this is for: anyone working on watermark robustness or generative-AI provenance. The attack idea deserves serious referee time; the statistical presentation does not. I would recommend conditional acceptance or major revision, not rejection. If the authors supply per-image detection statistics and release code, the TreeRing result has a real chance of surviving.

Referee Report

4 major / 6 minor

Summary. The paper proposes SemanticRegen, a three-stage, label-free watermark removal attack that (i) captions the input image with BLIP2 using structured VQA prompts, (ii) extracts foreground masks with LangSAM, and (iii) inpaints only the background with Stable Diffusion guided by an LLM-generated prompt. The method is evaluated on 1,000 prompts across four watermarking systems (TreeRing, StegaStamp, StableSig, and DWT/DCT). The paper claims that SemanticRegen is the only method to defeat the TreeRing watermark, reporting an average detection p-value of 0.10 against a success threshold of p > 0.05, and that it reduces bit accuracy below 0.75 for the other three schemes while maintaining masked SSIM (mSSIM) around 0.94. A new metric, mSSIM, is introduced to measure foreground-preservation fidelity.

Significance. If the evaluation were statistically sound, the result would be significant: a semantics-aware background-inpainting attack that defeats a state-of-the-art Fourier-domain watermark like TreeRing while preserving foreground quality would expose a real vulnerability in current watermarking defenses and motivate robustness research. The paper's strengths include a clearly described modular pipeline, the use of off-the-shelf zero-shot components (BLIP2, LangSAM, Stable Diffusion) with no dataset-specific training, and qualitative examples that appear to support the approach. The introduction of mSSIM, despite flaws discussed below, is a reasonable attempt to measure region-specific fidelity. However, the statistical basis for the headline TreeRing claim is currently insufficient, and the quality metric is partly self-referential, so the paper's central claims require substantial additional evidence before publication.

major comments (4)

[Section 4.1, Table 1] The headline claim that SemanticRegen defeats the TreeRing watermark is supported only by an average p-value of 0.10 across 1,000 images, with a success threshold of p > 0.05. Because detection p-values are defined per image, an average above the threshold does not imply that the watermark is removed on a typical image; for example, a distribution with 80% of images at p = 0.01 and 20% at p = 0.46 would yield the same mean. Report the full p-value distribution, the fraction of images exceeding the 0.05 threshold, confidence intervals for the mean, and the calibration of the detector on unwatermarked images. Without these, the paper's primary contribution relative to prior attacks is not established.
[Section 4.3, Table 1] The bit-accuracy success criterion is also applied to averaged values. The paper states that <24/32 indicates successful removal, and Table 1 reports average bit accuracies (e.g., 0.70 for StegaStamp). An average below 0.75 does not guarantee that most images are below the threshold, and no per-image distributions or error bars are given. Moreover, several baselines (Distortion 0.68, Rinse4x-Diff60 0.69) also satisfy the average criterion for StegaStamp, so the paper should clarify what specific advantage SemanticRegen offers for these watermarks beyond the TreeRing case.
[Section 3.4, Eq. (1)] The proposed mSSIM metric is computed using the same segmentation mask M that the attack pipeline generates and uses for inpainting. Because SemanticRegen explicitly preserves the foreground region, mSSIM largely measures similarity in pixels that the attack leaves untouched, and it does not penalize background degradation where watermark removal occurs. The paper should validate mSSIM against human perception, report global SSIM/PSNR for all compared methods (Table 3 only covers SemanticRegen), and analyze the sensitivity of mSSIM to the choice of mask.
[Sections 3.1 and 3.2] The paper repeatedly assumes that watermark information resides in the background, yet it does not provide any analysis supporting this for the tested schemes, particularly TreeRing, which embeds a ring in the Fourier domain of the entire image. The stated limiting condition in Section 1 ('clear, separable backgrounds') and the Key Assumptions in Section 3.1 narrow the claim to a subset of images, but no ablation or spatial analysis of the watermark signal is given. Provide evidence of where the watermark energy is localized, or discuss why background-only regeneration is sufficient for global watermarks.

minor comments (6)

[Abstract] The phrase 'embedsemanticsignals' should be 'embed semantic signals' (missing space).
[Section 4.3] The sentence 'In addition, we assess the accuracy of the bit for other watermarking methods, where a value <24/32 indicates successful removal' is duplicated verbatim in the same paragraph; one occurrence should be removed.
[Table 3 caption] The meaning of 'Image (Original)' and 'Image (Masked)' is unclear; clarify whether these are pre- and post-attack images or masked versions, and describe how the values are computed.
[Section 3.4] The notation 'M∈{0,1} {3,256,256}' is malformed; use proper mathematical notation such as M∈{0,1}^{3×256×256} (and likewise for the image tensors).
[References] Reference [10] lists 'Anonymous Authors', reference [20] uses 'John Doe and Jane Smith', and reference [48] does not describe the MiniChat-MA model used in Section 3.3; these citations must be replaced with real and relevant sources.
[Section 4.1] The phrase 'outperforming alternative methods' is imprecise for p-values; since a higher p-value indicates better removal (failing to reject the no-watermark null), the text should say 'surpassing the success threshold' rather than 'outperforming'.

Circularity Check

1 steps flagged · score 2.0 of 10

Attack results are externally measured; only the mSSIM foreground-quality metric is partly self-referential.

self definitional [Section 3.4, Eq. (1); Section 3.2]
"For each prompt, we compute an image segmentation mask, M, which delineates the background from the foreground. ... mSSIM = SSIM(M∗X img,M∗X attacked),(1). ... The segmentation mask obtained from LangSAM is inverted and passed to the inpainting model, ensuring that the salient object remains unchanged, while the background is regenerated to remove any traces of embedded watermarks."

The same LangSAM segmentation mask M is used both to define the attack's protected foreground (the inverted mask is passed to the inpainter so the salient object remains unchanged) and as the evaluation mask in Eq. (1). Therefore mSSIM measures only the pixels the method is designed to leave untouched; a high mSSIM for SemanticRegen is a direct consequence of the method's masking choice rather than an independent quality outcome. The paper's claim of up to 12 percent higher mSSIM is thus partly self-referential, although it does not feed back into the watermark-removal p-value/bit-accuracy results.

full rationale

SemanticRegen's central watermark-removal claims are not circular: TreeRing removal is judged by the external TreeRing detector's p-values, and bit-accuracy for the other schemes is judged by the respective decoders, so the attack outcome is measured outside the attack's own definitions. The only self-referential element is the mSSIM quality metric: the same LangSAM mask that the attack inverts to protect the foreground is reused in Eq. (1) to compute mSSIM on the foreground, so the reported high mSSIM for SemanticRegen is substantially a by-construction consequence of the method's masking, not an independent validation. This does not feed back into the attack-success numbers, so it is minor. The manuscript itself flags the relevant limitation in Section 1 (optimal performance with 'clear, separable backgrounds') and in Sections 3.1-3.2 assumptions, and there is a reference/name mismatch for MiniChat-MA in the reference list ([48] is a legal-AI-review article, not MiniChat-MA), which is a support gap but not a circularity. The average-p-value criterion for TreeRing (Section 4.3) is a statistical-validity concern, not a circularity, and is excluded from this score. No load-bearing self-citations or uniqueness-imported-from-authors arguments appear.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on the assumption that watermarks reside in the background and that off-the-shelf models can reliably separate foreground from background. The only hand-chosen parameters are the mask threshold and inference steps; neither is fitted to the evaluation data. No new physical or conceptual entities are introduced; mSSIM is an evaluation tool rather than an entity.

free parameters (2)

mask size threshold
Section 3.2 describes an iterative threshold-based mask expansion but does not report the threshold value. This hand-chosen parameter controls how much background is regenerated and therefore how much watermark is removed.
diffusion inference steps = 50
Section 3.3 states 'We use Stable Diffusion-v2 with 50 inference steps.' This is a chosen hyperparameter, not fitted to data.

assumptions (3)

domain assumption The target image contains a distinguishable foreground object that is visually separable from the background.
Listed under 'Key Assumptions' in Section 3.1; without this, the segmentation and background-inpainting strategy cannot work.
domain assumption The watermark signal is embedded primarily in the background region, so background-only inpainting removes it.
This is the load-bearing premise of the attack, stated implicitly in Section 3.2 where the background is regenerated to remove watermark traces. It is not tested explicitly.
domain assumption BLIP2 captioning, LangSAM segmentation, and Stable Diffusion inpainting perform correctly on the test images.
Section 3.1 lists accurate captioning, precise segmentation, and semantically coherent inpainting as assumptions of the approach.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Removing Watermarks with Partial Regeneration using Semantic Information." pith.science (2026). https://pith.science/paper/MBTI3CMA

@misc{pith2026250508234,
  author       = {Pith},
  title        = {Pith review of: Removing Watermarks with Partial Regeneration using Semantic Information},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MBTI3CMA}},
  note         = {Machine review of arXiv:2505.08234}
}

read the original abstract

As AI-generated imagery becomes ubiquitous, invisible watermarks have emerged as a primary line of defense for copyright and provenance. The newest watermarking schemes embed semantic signals - content-aware patterns that are designed to survive common image manipulations - yet their true robustness against adaptive adversaries remains under-explored. We expose a previously unreported vulnerability and introduce SemanticRegen, a three-stage, label-free attack that erases state-of-the-art semantic and invisible watermarks while leaving an image's apparent meaning intact. Our pipeline (i) uses a vision-language model to obtain fine-grained captions, (ii) extracts foreground masks with zero-shot segmentation, and (iii) inpaints only the background via an LLM-guided diffusion model, thereby preserving salient objects and style cues. Evaluated on 1,000 prompts across four watermarking systems - TreeRing, StegaStamp, StableSig, and DWT/DCT - SemanticRegen is the only method to defeat the semantic TreeRing watermark (p = 0.10 > 0.05) and reduces bit-accuracy below 0.75 for the remaining schemes, all while maintaining high perceptual quality (masked SSIM = 0.94 +/- 0.01). We further introduce masked SSIM (mSSIM) to quantify fidelity within foreground regions, showing that our attack achieves up to 12 percent higher mSSIM than prior diffusion-based attackers. These results highlight an urgent gap between current watermark defenses and the capabilities of adaptive, semantics-aware adversaries, underscoring the need for watermarking algorithms that are resilient to content-preserving regenerative attacks.

Figures

Figures reproduced from arXiv: 2505.08234 by the authors.

**Figure 2.** Examples before and after watermarking with Tree Ring, and [PITH_FULL_IMAGE:figures/full_fig_p011_2.png] view at source ↗

**Figure 3.** Comparison of images displaying different watermarks before and after under [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Performance versus image quality comparison. Points further to the right indi [PITH_FULL_IMAGE:figures/full_fig_p016_4.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Position: Preventing AI-Generated CSAM Necessitates New Approaches to AI Safety
cs.CY 2026-06 accept novelty 6.5 of 10

Legal and ethical bans on CSAM access and generation break standard AI safety techniques, creating 15 open problems that demand new methods for dataset cleaning, concept fusion prevention, fine-tuning resilience, dete...

Reference graph

Works this paper leans on

50 extracted references · 38 canonical work pages · cited by 1 Pith paper

[1]

Digital image and video watermarking: methodolo- gies, attacks, applications, and future directions.Multimedia Tools and Applications, 83(2):5531–5591, 2024

P Aberna and L Agilandeeswari. Digital image and video watermarking: methodolo- gies, attacks, applications, and future directions.Multimedia Tools and Applications, 83(2):5531–5591, 2024

work page 2024
[2]

Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

Ali Al-Haj. Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

2007
[3]

Flamingo: A visual language model for few-shot learning.arXiv preprint arXiv:2204.14198, 2022

Jean-Baptiste Alayrac, Jeff Donahue, Mario Lucic, Arthur Mensch, Aidan Clark, George van den Driessche, Jordan Hoffmann, Bogdan Damoc, Sebastian Borgeaud, et al. Flamingo: A visual language model for few-shot learning.arXiv preprint arXiv:2204.14198, 2022

arXiv 2022
[4]

Benchmarking the robustness of image watermarks, 2024

Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Cheng- hao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. Benchmarking the robustness of image watermarks, 2024

work page 2024
[5]

Andersen

B. Andersen. Generative ai and copyright.Machine Learning & Law Journal, 8(1):45– 60, 2024

work page 2024
[6]

Bottom-up and top-down attention for image captioning and visual question answering

Peter Anderson, Xiaodong He, Chris Buehler, Damien Teney, Mark Johnson, Stephen Gould, and Lei Zhang. Bottom-up and top-down attention for image captioning and visual question answering. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6077–6086, 2018

work page 2018
[7]

A. Andy. Ai and digital rights.AI Ethics Review, 5(2):123–130, 2023

work page 2023
[8]

Vqa: Visual question answering

Stanislaw Antol, Aishwarya Agrawal, Jiasen Lu, Margaret Mitchell, Dhruv Batra, C Lawrence Zitnick, and Devi Parikh. Vqa: Visual question answering. InProceedings of the IEEE international conference on computer vision (ICCV), pages 2425–2433, 2015

work page 2015

Show all 50 references

[9]

Quantitative approaches in multimodal fundus imaging: state of the art and future perspectives.Progress in Retinal and Eye Research, 92:101111, 2023

Alessandro Arrigo, Emanuela Aragona, Maurizio Battaglia Parodi, and Francesco Bandello. Quantitative approaches in multimodal fundus imaging: state of the art and future perspectives.Progress in Retinal and Eye Research, 92:101111, 2023

2023
[10]

A comprehensive benchmark for visual question answering models.arXiv preprint arXiv:2404.08589, 2024

Anonymous Authors. A comprehensive benchmark for visual question answering models.arXiv preprint arXiv:2404.08589, 2024. 18

2024 arXiv
[11]

Variational image compression with a scale hyperprior, 2018

Johannes Ball´ e, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compression with a scale hyperprior, 2018

2018
[12]

Digital image watermarking tech- niques: a review.Information, 11(2):110, 2020

Mahbuba Begum and Mohammad Shorif Uddin. Digital image watermarking tech- niques: a review.Information, 11(2):110, 2020

2020
[13]

The rise of artificial intelligence in healthcare applications

Adam Bohr and Kaveh Memarzadeh. The rise of artificial intelligence in healthcare applications. InArtificial Intelligence in healthcare, pages 25–60. Elsevier, 2020

2020
[14]

When deep learning meets watermarking: A survey of application, attacks and defenses.Computer Standards & Interfaces, page 103830, 2024

Huajie Chen, Chi Liu, Tianqing Zhu, and Wanlei Zhou. When deep learning meets watermarking: A survey of application, attacks and defenses.Computer Standards & Interfaces, page 103830, 2024

2024
[15]

Rethinking atrous convolution for semantic image segmentation

Liang-Chieh Chen, George Papandreou, Iasonas Kokkinos, Kevin Murphy, and Alan L Yuille. Rethinking atrous convolution for semantic image segmentation. In arXiv preprint arXiv:1706.05587, 2017

2017 arXiv
[16]

Learned image compression with discretized gaussian mixture likelihoods and attention modules, 2020

Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules, 2020

2020
[17]

Digital millennium copyright act.Public Law, 105(304):112, 1998

US Congress. Digital millennium copyright act.Public Law, 105(304):112, 1998

1998
[18]

Cox and K

J. Cox and K. Johnson. Digital watermarking.Journal of Cryptography, 12(3):45– 56, 2007

2007
[19]

Generative models are self- watermarked: Declaring model authentication through re-generation.arXiv preprint arXiv:2402.16889, 2024

Aditya Desu, Xuanli He, Qiongkai Xu, and Wei Lu. Generative models are self- watermarked: Declaring model authentication through re-generation.arXiv preprint arXiv:2402.16889, 2024

2024 arXiv
[20]

Robust watermarking for generative ai models.arXiv preprint arXiv:2304.06790, 2023

John Doe and Jane Smith. Robust watermarking for generative ai models.arXiv preprint arXiv:2304.06790, 2023

2023 arXiv
[21]

Gonzalez, and Trevor Darrell

Lisa Dunlap, Alyssa Umino, Han Zhang, Jiezhi Yang, Joseph E. Gonzalez, and Trevor Darrell. Diversify your vision datasets with automatic diffusion-based augmentation, 2023

2023
[22]

The stable signature: Rooting watermarks in latent diffusion models, 2023

Pierre Fernandez, Guillaume Couairon, Herv´ e J´ egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models, 2023

2023
[23]

An extensive analysis of digital image watermark- ing techniques.International Journal of Intelligent Systems and Applications in En- gineering, 12(1):121–145, 2024

Sachin Gaur and Varun Barthwal. An extensive analysis of digital image watermark- ing techniques.International Journal of Intelligent Systems and Applications in En- gineering, 12(1):121–145, 2024

2024
[24]

An extensive research on robust digital image watermark- ing techniques: A review.International Journal of Signal and Imaging Systems En- gineering, 8(1-2):89–104, 2015

D Kannan and M Gobi. An extensive research on robust digital image watermark- ing techniques: A review.International Journal of Signal and Imaging Systems En- gineering, 8(1-2):89–104, 2015

2015
[25]

Imagic: Text-based real image editing with diffusion models, 2023

Bahjat Kawar, Shiran Zada, Oran Lang, Omer Tov, Huiwen Chang, Tali Dekel, Inbar Mosseri, and Michal Irani. Imagic: Text-based real image editing with diffusion models, 2023. 19

2023
[26]

Berg, Wan-Yen Lo, Piotr Doll´ ar, and Ross Girshick

Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C. Berg, Wan-Yen Lo, Piotr Doll´ ar, and Ross Girshick. Segment anything.arXiv:2304.02643, 2023

2023 arXiv
[27]

A compreshensive re- view on digital image watermarking techniques

Lalan Kumar, Kamred Udham Singh, and Indrajeet Kumar. A compreshensive re- view on digital image watermarking techniques. In2023 International Conference on Computational Intelligence and Sustainable Engineering Solutions (CISES), pages 737–743. IEEE, 2023

2023
[28]

Artificial intelligence: revolutionizing cyber security in the digital era.Journal of Computers, Mechanical and Management, 2(3):31–42, 2023

Sarvesh Kumar, Upasana Gupta, Arvind Kumar Singh, and Avadh Kishore Singh. Artificial intelligence: revolutionizing cyber security in the digital era.Journal of Computers, Mechanical and Management, 2(3):31–42, 2023

2023
[29]

Adversarial robustness of watermarks in multimodal ai systems.arXiv preprint arXiv:2411.18479, 2024

Alice Lee and Rahul Kumar. Adversarial robustness of watermarks in multimodal ai systems.arXiv preprint arXiv:2411.18479, 2024

2024 arXiv
[30]

Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models, 2023

Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models, 2023

2023
[31]

Adversarial attack for robust watermark protection against inpainting-based and blind watermark removers

Mingzhi Lyu, Yi Huang, and Adams Wai-Kin Kong. Adversarial attack for robust watermark protection against inpainting-based and blind watermark removers. In Proceedings of the 31st ACM International Conference on Multimedia, pages 8396– 8405, 2023

2023
[32]

lang-segment-anything, 2023

Luca Medeiros. lang-segment-anything, 2023

2023
[33]

Methods for countering attacks on image water- marking schemes: Overview.Journal of Visual Communication and Image Repre- sentation, page 104073, 2024

Anna Melman and Oleg Evsutin. Methods for countering attacks on image water- marking schemes: Overview.Journal of Visual Communication and Image Repre- sentation, page 104073, 2024

2024
[34]

Proactive deepfake detection using gan- based visible watermarking.ACM Transactions on Multimedia Computing, Commu- nications and Applications, 2023

Aakash Varma Nadimpalli and Ajita Rattani. Proactive deepfake detection using gan- based visible watermarking.ACM Transactions on Multimedia Computing, Commu- nications and Applications, 2023

2023
[35]

Diffusion models for adversarial purification, 2022

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification, 2022

2022
[36]

Inves- tigating deep watermark security: An adversarial transferability perspective, 2024

Biqing Qi, Junqi Gao, Yiang Luo, Jianxing Liu, Ligang Wu, and Bowen Zhou. Inves- tigating deep watermark security: An adversarial transferability perspective, 2024

2024
[37]

A novel model watermarking for protecting generative adversarial net- work.Computers & Security, 127:103102, 2023

Tong Qiao, Yuyan Ma, Ning Zheng, Hanzhou Wu, Yanli Chen, Ming Xu, and Xi- angyang Luo. A novel model watermarking for protecting generative adversarial net- work.Computers & Security, 127:103102, 2023

2023
[38]

High-resolution image synthesis with latent diffusion models

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨ orn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684–10695, 6 2022

2022
[39]

Robustness of ai-image detectors: Funda- mental limits and practical attacks, 2024

Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Funda- mental limits and practical attacks, 2024. 20

2024
[40]

A review of image watermarking for identity protection and verification.Multimedia Tools and Applications, pages 1–63, 2023

Sunpreet Sharma, Ju Jia Zou, Gu Fang, Pancham Shukla, and Weidong Cai. A review of image watermarking for identity protection and verification.Multimedia Tools and Applications, pages 1–63, 2023

2023
[41]

Artificial intelligence, machine learning and deep learning in advanced robotics, a review.Cognitive Robotics, 2023

Mohsen Soori, Behrooz Arezoo, and Roza Dastres. Artificial intelligence, machine learning and deep learning in advanced robotics, a review.Cognitive Robotics, 2023

2023
[42]

Stegastamp: Invisible hyperlinks in physical photographs

Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InIEEE Conference on Computer Vision and Pattern Recog- nition (CVPR), 2020

2020
[43]

Robust image watermarking theories and techniques: A review.Journal of applied research and technology, 12(1):122–138, 2014

Hai Tao, Li Chongmin, Jasni Mohamad Zain, and Ahmed N Abdalla. Robust image watermarking theories and techniques: A review.Journal of applied research and technology, 12(1):122–138, 2014

2014
[44]

Llama 2: Open foundation and fine-tuned chat models, 2023

Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucu- rull, David Esiobu, Jude Fernandes, Jeremy...

2023
[45]

Tree-ring wa- termarks: Fingerprints for diffusion images that are invisible and robust, 2023

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring wa- termarks: Fingerprints for diffusion images that are invisible and robust, 2023

2023
[46]

Robust invisible video watermarking with attention, 2019

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention, 2019

2019
[47]

Robust image watermarking using stable diffusion.arXiv preprint arXiv:2401.04247, 2024

Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Robust image watermarking using stable diffusion.arXiv preprint arXiv:2401.04247, 2024

2024 arXiv
[48]

Z. Zhang. Legal challenges in ai-generated content.AI & Law Review, 12(4):123–130, 2023

2023
[49]

Invisible image water- marks are provably removable using generative ai, 2023

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christo- pher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image water- marks are provably removable using generative ai, 2023

2023
[50]

A brief, in-depth survey of deep learning-based image watermarking.Applied Sciences, 13(21):11852, 2023

Xin Zhong, Arjon Das, Fahad Alrasheedi, and Abdullah Tanvir. A brief, in-depth survey of deep learning-based image watermarking.Applied Sciences, 13(21):11852, 2023. 21

2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Digital image and video watermarking: methodolo- gies, attacks, applications, and future directions.Multimedia Tools and Applications, 83(2):5531–5591, 2024

P Aberna and L Agilandeeswari. Digital image and video watermarking: methodolo- gies, attacks, applications, and future directions.Multimedia Tools and Applications, 83(2):5531–5591, 2024

work page 2024

[2] [2]

Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

Ali Al-Haj. Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

2007

[3] [3]

Flamingo: A visual language model for few-shot learning.arXiv preprint arXiv:2204.14198, 2022

Jean-Baptiste Alayrac, Jeff Donahue, Mario Lucic, Arthur Mensch, Aidan Clark, George van den Driessche, Jordan Hoffmann, Bogdan Damoc, Sebastian Borgeaud, et al. Flamingo: A visual language model for few-shot learning.arXiv preprint arXiv:2204.14198, 2022

arXiv 2022

[4] [4]

Benchmarking the robustness of image watermarks, 2024

Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Cheng- hao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. Benchmarking the robustness of image watermarks, 2024

work page 2024

[5] [5]

Andersen

B. Andersen. Generative ai and copyright.Machine Learning & Law Journal, 8(1):45– 60, 2024

work page 2024

[6] [6]

Bottom-up and top-down attention for image captioning and visual question answering

Peter Anderson, Xiaodong He, Chris Buehler, Damien Teney, Mark Johnson, Stephen Gould, and Lei Zhang. Bottom-up and top-down attention for image captioning and visual question answering. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6077–6086, 2018

work page 2018

[7] [7]

A. Andy. Ai and digital rights.AI Ethics Review, 5(2):123–130, 2023

work page 2023

[8] [8]

Vqa: Visual question answering

Stanislaw Antol, Aishwarya Agrawal, Jiasen Lu, Margaret Mitchell, Dhruv Batra, C Lawrence Zitnick, and Devi Parikh. Vqa: Visual question answering. InProceedings of the IEEE international conference on computer vision (ICCV), pages 2425–2433, 2015

work page 2015