Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

T0 review · 4 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper shows that adaptive attacks can strip invisible watermarks from images while keeping them visually near-identical, defeating both a known-algorithm and an unknown-algorithm detector at the 0.1% false-positive threshold.

desk verdict First place on both tracks is real and externally measured, but the headline claim of 'watermark removal' is overstated because the core VAE attack flips the message rather than destroying it. read the letter →

arxiv 2508.21072 v1 pith:HZOZHYRL submitted 2025-08-28 cs.CV

Fahad Shamshad , Tameem Bakr , Yahia Shaaban , Noor Hussein , Karthik Nandakumar , Nils Lukas This is my paper
classification cs.CV
keywords imagewatermarkremovaladversarialattackStegaStampTreeRingvariationalautoencoderdiffusionpurificationNeurIPS2024challengerobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper demonstrates that invisible image watermarks can be removed with near-perfect success while preserving visual quality, under two realistic threat models: a beige-box setting where the watermarking algorithm is known but its parameters are not, and a black-box setting where the algorithm is unknown. For known StegaStamp-style watermarks, the key idea is to fine-tune a variational autoencoder on pairs of the same image watermarked with a message and its inverse, training the VAE to cancel the message-dependent signal. For unknown watermarks, the paper clusters images by spatial or spectral artifact signatures and applies a tailored combination of diffusion-based purification, VAE cancellation, and a small spatial translation. On the NeurIPS 2024 challenge, the attack lowered the detection scores to 0.037 and 0.043 at a 0.1% false-positive rate, equivalent to roughly 95.7% watermark removal, while keeping quality metrics competitive. The paper argues these results show current watermarking schemes are not robust against adaptive, computationally feasible adversaries.

What carries the argument

The paired-message VAE fine-tuning is the central object: a variational autoencoder (an encoder/decoder pair) trained with an MSE loss to map a StegaStamp-watermarked image carrying message m to the same image watermarked with the inverted message 1−m. The inversion forces the latent bottleneck to drop the message-dependent signal, so on unseen images the fine-tuned VAE outputs a watermark-free reconstruction. Around this core, the paper adds test-time optimization (refining the VAE on the specific input using MSE + LPIPS + SSIM losses) and a CIELAB color/contrast transfer to restore fidelity, plus a spatial translation for Fourier-phase watermarks and a cluster-conditioned diffusion purific

What would settle it

Generate a new test set with a StegaStamp variant whose encoder uses a message-dependent key, so that the same image watermarked with m and with 1−m differ not only in the additive watermark component but also in the transformation itself; run the paired-VAE attack and measure the detection score at the 0.1% false-positive threshold. If the detection score stays near 1.0 while image-quality metrics remain unchanged, the central separability assumption is false.

Watch

Extended reading notes

Core claim

On the NeurIPS 2024 challenge's two tracks, the paper's attack lowers detection scores to 0.037 (beige-box) and 0.043 (black-box) at a 0.1% false-positive rate, meaning more than 95% of watermarked images pass as clean. The key technical move is a paired-message VAE: the adversary fine-tunes a pretrained variational autoencoder on pairs of the same image watermarked with a random 100-bit message and its complement, training it to reconstruct the complement image from the original. Because the only difference between the pair is the message, the VAE learns to discard the message-dependent watermark component and re-synthesize the content. After a test-time optimization step that aligns the re

Load-bearing premise

The beige-box attack relies on the assumption that the challenge's StegaStamp variant is close enough to the public StegaStamp model used to generate paired training data, and that fine-tuning on (message, inverse-message) pairs cancels the watermark on unseen images; if the actual encoder is substantially different or the message signal is not separable this way, the VAE cancellation would not transfer.

Editorial extensions

If this is right

  • At the challenge's 0.1% false-positive threshold, both detectors flag fewer than 5% of attacked images, so an attacker can strip the watermark from roughly 19 of every 20 images.
  • The StegaStamp VAE attack transfers from a paired training set built with a public StegaStamp encoder to the challenge's modified StegaStamp variant without retraining on challenge images.
  • TreeRing-style Fourier-phase watermarks are broken by a trivial 7-pixel spatial translation, with boundary columns restored to hide the shift; no model or training is needed.
  • The black-box attack is effective only because images are clustered by artifact signatures; a single global diffusion setting would not erase all four watermark families.
  • The success of these attacks implies watermark robustness claims should be tested under adaptive, cluster-aware adversaries rather than fixed corruption sets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The inverse-message cancellation trick should generalize to any learned watermark whose encoder is roughly symmetric under logical message inversion; testing it against other message-embedding schemes would be a direct extension.
  • Attack traces such as the 7-pixel translation or diffusion-induced smoothing could themselves be fingerprinted; a defender might build a detector that recognizes these removal artifacts and flags images as 'cleaned'.
  • The CIELAB color/contrast restoration is a model-agnostic quality booster that could be bolted onto other watermark-removal pipelines, potentially raising their quality scores without sacrificing removal rate.
  • Because the clustering step was based on 300 images and manual inspection, a larger challenge with more diverse watermarks could shift the artifact types; an automated artifact classifier would be needed to scale this approach.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents the authors' first-place solution to the NeurIPS 2024 Erasing the Invisible challenge. For the beige-box track, the method fine-tunes an SDXL VAE on pairs of images watermarked with complementary StegaStamp messages, then applies test-time optimization and CIELAB color/contrast transfer, and removes TreeRing watermarks with a 7-pixel spatial translation. For the black-box track, the 300 test images are manually clustered into four artifact classes, and cluster-specific diffusion-based purification with ChatGPT captions and tuned noise strengths is applied. The reported official leaderboard detection scores are 0.037 (beige-box) and 0.043 (black-box), and the paper claims near-perfect watermark removal (95.7%).

Significance. The official first-place result is externally measured on the competition leaderboard, giving the central empirical claim credibility. The paper also contains useful ablations, a clear description of the attack components, and an honest account of unsuccessful approaches. However, the paper's own text and equations reveal two load-bearing problems. First, the VAE in Eq. (1) is trained to map a StegaStamp image with message m to the same image with message 1-m, so it is a message-flip evasion attack, not demonstrated watermark destruction; no experiment checks whether the output still contains a valid StegaStamp message. Second, the method was selected and tuned using repeated leaderboard queries on the same 300 test images, and the manual clustering is test-specific, so the reported 95.7% is a test-set-tuned score without holdout validation. These issues limit the paper's scientific generality and need to be addressed before the claimed 'watermark removal' is accepted.

major comments (4)
  1. [3.1.1, Eq. (1), Algorithm 1] The training target in Eq. (1) is x_i = StegaStamp(x, 1-m), not a clean image. Thus the VAE learns a message-complementing map, not a watermark-removal map. The abstract's 'near-perfect watermark removal' and the text's 'effectively strip away the watermark' are inconsistent with this objective. The leaderboard detection score only checks distance from the original message m; it does not test whether the output still contains a valid StegaStamp message. No experiment decodes the attacked images. Please reframe the contribution as a message-evasion attack or add a decoding experiment showing that no valid message remains.
  2. [3.2/3.3, Algorithm 3, Table 5, Figure 9] The paper states that leaderboard queries were allowed up to five times per day, and Figure 9 says the diffusion model choice was made 'from leaderboard submissions'; Section 3.3 says hyperparameters (especially s) were tuned to balance removal and fidelity. The 300 test images were manually clustered and the cluster assignments are listed by index in Table 5, so the method is not an algorithm that can be applied to new images without manual inspection. No holdout validation, cross-validation, or error bars are reported. The reported 95.7% is therefore a test-set-tuned score, not evidence of generalizable watermark removal. Please add a validation split or explicitly label the result as a leaderboard score.
  3. [3.1.1, Eq. (2), Algorithm 2, Table 3] Test-time optimization minimizes MSE, LPIPS, and SSIM against the original watermarked image x_w. This should encourage the output to retain the watermark, and Table 3 indeed shows the detection score worsens from 0.023 to 0.033 when this step is added. The text's claim that 'this step effectively removes the watermark signal' is not supported. Please revise the description or provide evidence that the step removes rather than re-introduces the watermark.
  4. [3.1.1 'Paired Dataset Generation'] The beige-box attack is built on pairs generated with the public WAVES StegaStamp model, while the challenge uses a modified StegaStamp whose parameters are unknown. The paper does not directly verify that the public model's artifacts transfer to the challenge variant. Since the beige-box adversary knows the algorithm but not its hyperparameters, this assumption is load-bearing for the VAE attack and for the two black-box clusters that reuse the VAE pipeline. Please provide a transfer analysis, e.g., decoding rates on challenge images with the public model before and after the attack.
minor comments (6)
  1. [Algorithm 3] The cluster numbering in Algorithm 3 is inconsistent with Section 3.3 and Figure 5: Algorithm 3 maps Cluster 1 to boundary artifacts and Cluster 2 to circular Fourier patterns, whereas Section 3.3 lists Cluster 1 as no artifacts, Cluster 2 as boundary, Cluster 3 as circular, and Cluster 4 as square. This makes the pipeline ambiguous.
  2. [Figure 2 and Section 3.1.1] The Figure 2 caption says the VAE minimizes MSE loss 'effectively suppressing watermark artifacts', but Eq. (1) minimizes reconstruction to the inverse-message image. Rephrase to avoid implying clean-image reconstruction.
  3. [References] References [28] and [29] are the same paper; merge them.
  4. [Reproducibility] No code or trained models are linked. Since the contribution is an attack pipeline with many engineering components, releasing code/models would materially improve reproducibility.
  5. [Table 6] Ours has lower PSNR than 'w/o Pixel Restoration' (14.353 vs. 14.878), while the text says restoration improves fidelity. Clarify that PSNR is lower because of the global shift and that the improvement claim refers to perceptual and distribution metrics.
  6. [Various] Typos: 'Invisible W atermark' in the title, 'invese' in Figure 2, and 'oundary' in the Figure 4 caption.

Circularity Check

1 steps flagged · score 6.0 of 10

Beige-box StegaStamp 'removal' is trained to output the inverse-message watermarked image, so beating the detection metric is by construction; actual watermark destruction is never verified.

  1. self definitional [Section 3.1.1 (Adaptive VAE Finetuning), Eq. (1) and Algorithm 1; cf. detection-score definition in Section 3 (Challenge Overview)]
    "Given a watermarked image x_w and its inverse message counterpart x_i, the VAE - consisting of encoder E_theta and decoder D_phi - was optimized to reconstruct x_i from x_w, using the following MSE loss: L(θ,ϕ) = ∥D_ϕ(E_θ(x_w))−x_i∥². ... This adaptive fine-tuning stage enabled the model to effectively strip away the watermark while preserving image structure. ... An attacked image is flagged as watermarked if its decoded message falls below this threshold."

    The training target x_i is not a clean image: it is StegaStamp(x, 1−m), i.e., the same watermarking scheme carrying the bitwise complement of the original message. If Eq. (1) is minimized, D(E(x_w)) ≈ StegaStamp(x, 1−m), so the output still lies on the StegaStamp-watermarked manifold and decodes to 1−m rather than to no message. The challenge's detection score, however, only checks whether the decoded message is close to the known original m; decoding to 1−m maximizes the distance d(m,1−m) and therefore counts as 'removed.' Thus the claimed near-perfect removal is achieved by constructing the inverse-message image, exactly the quantity used as the training label. The paper reports no decoding experiment on attacked images to show the StegaStamp signal is absent, so the 'removal' result is

full rationale

The paper's core beige-box StegaStamp attack (which is reused for black-box clusters 2 and 3) trains a VAE to map a StegaStamp image carrying message m to a StegaStamp image carrying message 1−m. The competition's detection metric is defined by the decoded-message distance d(m,m′); an image is 'removed' if m′ is far from m. Hence the low detection score of the VAE output is guaranteed along the message axis by the choice of training labels, not by demonstrated removal of the watermark signal. This is a self-definitional reduction: the thing called 'removal' is exactly the inverse-message reconstruction target. The paper's own quality numbers (PSNR 28.06, SSIM 0.82) are consistent with remaining on the StegaStamp manifold rather than projecting to clean images. The TreeRing translation attack and black-box diffusion purification are empirical and not circular; they are validated by the external leaderboard. Overall, the external ranking is not fabricated, but the central 'near-perfect watermark removal' claim for the VAE-based component reduces by construction to message-flip evasion, so partial circularity (score 6) is warranted.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

This attack paper rests on engineering assumptions rather than mathematical axioms. The main contribution is a tuned configuration, and the most load-bearing assumptions are domain transfer assumptions about the watermarking variants and the stability of diffusion purification. There are no invented entities. The free parameters are the cluster-specific diffusion strengths and the TreeRing shift, both fitted on the competition leaderboard.

free parameters (3)
  • Diffusion strength s per black-box cluster = s=0.16 (No Artifacts), s=0.04 (Square Fourier), VAE for Boundary/Circular
    Tuned on the leaderboard; higher s removes more watermark but degrades quality (Section 3.3, Figure 9).
  • TreeRing translation shift Δx = 7 pixels
    Empirically determined as the optimal trade-off between watermark removal and boundary artifacts (Section 3.1.2, Figure 4).
  • SSIM loss weight in test-time optimization = 0.5
    Hand-chosen coefficient in Equation 2 balancing MSE, LPIPS, and SSIM terms during VAE refiner optimization.
assumptions (5)
  • ad hoc to paper Fine-tuning a VAE on image pairs watermarked with message m and inverse 1-m suppresses the watermark signal while preserving content.
    Core assumption of the beige-box StegaStamp attack and the boundary/circular black-box clusters; no formal property of StegaStamp is established to guarantee cancellation (Section 3.1.1).
  • domain assumption The competition's modified StegaStamp and TreeRing variants are close enough to the public WAVES StegaStamp model and the described TreeRing method that pretrained models and priors transfer.
    The paper uses the WAVES StegaStamp model to generate training pairs and assumes it matches the challenge's variant (Section 3.1.1).
  • standard math Spatial translation with a 7-pixel shift disrupts TreeRing's Fourier phase watermark (Fourier shift theorem).
    The paper invokes the spatial-frequency duality to justify the translation attack (Section 3.1.2).
  • ad hoc to paper Manual visual clustering of the 300 test images into four artifact classes is exhaustive and each class is homogeneous in watermark behavior.
    The clustering in Section 3.2 and Table 5 is performed by inspection on the test set; there is no demonstrated algorithmic criterion or transfer to unseen images.
  • domain assumption Pretrained diffusion models conditioned on ChatGPT captions project watermarked images onto the clean image manifold while preserving semantics.
    Used for all black-box diffusion-based removal; relies on prior work on diffusion purification [37, 44] but is assumed to work here with the chosen strength s.

how reviews work

0 comments
Cite this review

Pith. "Pith review of First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge." pith.science (2026). https://pith.science/paper/HZOZHYRL

@misc{pith2026250821072,
  author       = {Pith},
  title        = {Pith review of: First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HZOZHYRL}},
  note         = {Machine review of arXiv:2508.21072}
}
read the original abstract

Content watermarking is an important tool for the authentication and copyright protection of digital media. However, it is unclear whether existing watermarks are robust against adversarial attacks. We present the winning solution to the NeurIPS 2024 Erasing the Invisible challenge, which stress-tests watermark robustness under varying degrees of adversary knowledge. The challenge consisted of two tracks: a black-box and beige-box track, depending on whether the adversary knows which watermarking method was used by the provider. For the beige-box track, we leverage an adaptive VAE-based evasion attack, with a test-time optimization and color-contrast restoration in CIELAB space to preserve the image's quality. For the black-box track, we first cluster images based on their artifacts in the spatial or frequency-domain. Then, we apply image-to-image diffusion models with controlled noise injection and semantic priors from ChatGPT-generated captions to each cluster with optimized parameter settings. Empirical evaluations demonstrate that our method successfully achieves near-perfect watermark removal (95.7%) with negligible impact on the residual image's quality. We hope that our attacks inspire the development of more robust image watermarking methods.

Figures

Figures reproduced from arXiv: 2508.21072 by the authors.

Figure 1
Figure 1. Top row: Original watermarked images. Bottom row: Images after our attack, with minimal perceptual difference from the originals, showcasing the effectiveness of our method in preserving visual fidelity. Best viewed zoomed in. To gauge the robustness of invisible watermarking methods against realistic threats, the NeurIPS 2024 Erasing the Invisible: A Stress-Test Challenge for Image Watermarks [10] introduced a rigo… view at source ↗
Figure 2
Figure 2. Overview of our dataset generation and VAE-based watermark removal pipeline for StegaStamp watermarks. We generate 1,000 images from Stable Diffusion 2-1 using publicly available prompts, embedding each with a random binary message and its inverse via a StegaStamp encoder to create paired watermarked images. A fine-tuned Variational Autoencoder (VAE) minimizes Mean Squared Error (MSE) loss between pairs, effectively… view at source ↗
Figure 3
Figure 3. Top row: Original watermarked images. Bottom row: Images after our attack, with minimal perceptual difference from the originals, showcasing the effectiveness of our method in preserving visual fidelity. Best viewed zoomed in [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (19 more)
Figure 4
Figure 4. Figure 4: Effect of spatial translation on TreeRing watermarks. Left: Di￾rect 7-pixel shift removes watermark but introduces boundary artifacts (highlighted in red). Right: Restor￾ing the leftmost 7 columns from the original image removes oundary arti￾facts while preserving qual…
Figure 5
Figure 5. Figure 5: Spatial–frequency arti￾fact clustering of 300 black-box watermarked images. Each image was manually examined for visible spa￾tial and frequency-domain patterns. This yielded four clusters: Cluster￾1 no noticeable artifacts, Cluster￾2 boundary artifacts in the spatial d…
Figure 6
Figure 6. Figure 6: Overview of our image-to-image diffusion pipeline for black-box watermark removal. Starting from the watermarked input, we perform a forward diffusion step, injecting Gaussian noise according to a strength parameter s (tuned per cluster), to obtain a noisy latent. A pr…
Figure 7
Figure 7. Figure 7: Images distribution for Black-box track clusters. 3.3 Cluster-Specific Solutions Our empirical clustering analysis revealed distinct artifact patterns, enabling the design of adaptive, cluster-tailored watermark removal strategies rather than relying on a single, globa…
Figure 8
Figure 8. Figure 8: Performance of our pipeline across beige-box and black-box tracks. StegaStamp achieves the most balanced quality–removal trade-off, aided by CIELAB-based post-processing, while TreeRing and the black-box cluster with Fourier square patterns show reduced score for align…
Figure 9
Figure 9. Figure 9: Effect of strength s and steps T on watermark removal. PSNR drops sharply at s ≈ 0.10, motivating cluster-specific settings. From leaderboard results, we observe that stable-diffusion-xl-refiner-1.0 consistently outperforms other diffusion models in terms of watermark …
Figure 10
Figure 10. Figure 10: Qualitative results of the ControlNet-based edge guidance watermark removal [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Qualitative examples of failed watermark [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Qualitative results for watermark removal on StegaStamp images in the Beige-box track. Each triplet shows (left) the original watermarked input, (middle) the output after applying our removal method, and (right) the residual difference between them. Our approach prese…
Figure 13
Figure 13. Figure 13: Qualitative results for watermark removal on TreeRings images in the Beige-box track. Each triplet shows (left) the original watermarked input, (middle) the output after applying our removal method, and (right) the residual difference between them. Our approach preser…
Figure 14
Figure 14. Figure 14: Qualitative results on the Black-box track for images without noticeable artifacts. Each triplet shows (left) the original watermarked input, (middle) the output after applying our removal method, and (right) the residual difference between them. Our approach preserve…
Figure 15
Figure 15. Figure 15: Qualitative results on the Black-box track for images with boundary artifacts. Each triplet shows (left) the original watermarked input, (middle) the output after applying our removal method, and (right) the residual difference between them. Our approach preserves sem…
Figure 16
Figure 16. Figure 16: Qualitative results on the Black-box track for images containing circular Fourier-domain artifacts. Each triplet shows (left) the original watermarked input, (middle) the output after applying our removal method, and (right) the residual difference between them. Our a…
Figure 17
Figure 17. Figure 17: Qualitative results on the Black-box track for images containing square Fourier-domain artifacts. Each triplet shows (left) the original watermarked input, (middle) the output after applying our removal method, and (right) the residual difference between them. Our app…
Figure 18
Figure 18. Figure 18: Effect of varying the diffusion strength parameter on Black-box watermark removal. Lower values (0.04–0.12) maintain high perceptual quality with partial removal, whereas higher values yield stronger removal at the cost of visible distortions. This illustrates the qua…
Figure 19
Figure 19. Figure 19: Captions automatically generated by ChatGPT for a set of original watermarked images. These textual descriptions capture semantic and stylistic details of the inputs and are subsequently used to guide image-to-image diffusion for watermark removal. 28 [PITH_FULL_IMAG…
Figure 20
Figure 20. Figure 20: Captions automatically generated by ChatGPT for a set of original watermarked images. These textual descriptions capture semantic and stylistic details of the inputs and are subsequently used to guide image-to-image diffusion for watermark removal. 29 [PITH_FULL_IMAG…
Figure 21
Figure 21. Figure 21: Effect of spatial translation on TreeRing watermarks. [PITH_FULL_IMAGE:figures/full_fig_p030_21.png]
Figure 22
Figure 22. Figure 22: Captions generated by ChatGPT for watermarked images, used in conjunction with a ControlNet-based image-to-image diffusion model. Unlike earlier setups, the prompts explicitly capture both semantic content and color attributes, providing richer conditioning for waterm…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    Re-watermarking reliably removes existing watermarks across 96 dataset-victim-attack combinations and pairs with a classifier achieving 0.878-0.953 accuracy, cutting bit accuracy by 25-48%.

Reference graph

Works this paper leans on

66 extracted references · 44 canonical work pages · cited by 1 Pith paper

  1. [1]

    Digital image and video watermarking: methodologies, attacks, applications, and future directions

    P Aberna and Loganathan Agilandeeswari. Digital image and video watermarking: methodologies, attacks, applications, and future directions. Multimedia Tools and Applications, 83(2):5531–5591, 2024

    work page 2024

  2. [2]

    Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  3. [3]

    Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

    Ali Al-Haj. Combined dwt-dct digital image watermarking.Journal of computer science, 3(9):740–746, 2007

    work page 2007

  4. [4]

    Waves: Benchmarking the robustness of image watermarks

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Benchmarking the robustness of image watermarks. InForty-first International Confer- ence on Machine Learning, 2024

    work page 2024

  5. [5]

    Mitigating watermark stealing attacks in generative models via multi-key watermarking.arXiv preprint arXiv:2507.07871, 2025

    Toluwani Aremu, Noor Hussein, Munachiso Nwadike, Samuele Poppi, Jie Zhang, Karthik Nandakumar, Neil Gong, and Nils Lukas. Mitigating watermark stealing attacks in generative models via multi-key watermarking.arXiv preprint arXiv:2507.07871, 2025

    arXiv 2025

  6. [6]

    Blind image deconvolution using deep generative priors.IEEE Transactions on Computational Imaging, 6:1493–1506, 2020

    Muhammad Asim, Fahad Shamshad, and Ali Ahmed. Blind image deconvolution using deep generative priors.IEEE Transactions on Computational Imaging, 6:1493–1506, 2020

    work page 2020

  7. [7]

    Image watermarking using dct domain constraints

    Adrian G Bors and Ioannis Pitas. Image watermarking using dct domain constraints. In Proceedings of 3rd IEEE International Conference on Image Processing, volume 3, pp. 231–234. IEEE, 1996

    work page 1996

  8. [8]

    Image watermarking of generative diffusion models.arXiv preprint arXiv:2502.10465, 2025

    Yunzhuo Chen, Jordan Vice, Naveed Akhtar, Nur Al Hasan Haldar, and Ajmal Mian. Image watermarking of generative diffusion models.arXiv preprint arXiv:2502.10465, 2025

    arXiv 2025

Show all 66 references
  1. [9]

    Optimizing adaptive attacks against content watermarks for language models.arXiv preprint arXiv:2410.02440, 2024

    Abdulrahman Diaa, Toluwani Aremu, and Nils Lukas. Optimizing adaptive attacks against content watermarks for language models.arXiv preprint arXiv:2410.02440, 2024

    2024 arXiv

  2. [10]

    Erasing the invisible: A stress-test challenge for image watermarks

    Mucong Ding, Tahseen Rabbani, Bang An, Souradip Chakraborty, Chenghao Deng, Mehrdad Saberi, Yuxin Wen, Xuandong Zhao, Mo Zhou, Anirudh Satheesh, et al. Erasing the invisible: A stress-test challenge for image watermarks. InNeurIPS 2024 Competition Track, 2024

    2024

  3. [11]

    Visual watermarking in the era of diffusion models: Advances and challenges.arXiv preprint arXiv:2505.08197, 2025

    Junxian Duan, Jiyang Guan, Wenkui Yang, and Ran He. Visual watermarking in the era of diffusion models: Advances and challenges.arXiv preprint arXiv:2505.08197, 2025

    2025 arXiv

  4. [12]

    On the difficulty of constructing a robust and publicly-detectable watermark.arXiv preprint arXiv:2502.04901, 2025

    Jaiden Fairoze, Guillermo Ortiz-JimÊnez, Mel Vecerik, Somesh Jha, and Sven Gowal. On the difficulty of constructing a robust and publicly-detectable watermark.arXiv preprint arXiv:2502.04901, 2025

    2025 arXiv

  5. [13]

    Creating, using, misusing, and detecting deep fakes.Journal of Online Trust and Safety, 1(4), 2022

    Hany Farid. Creating, using, misusing, and detecting deep fakes.Journal of Online Trust and Safety, 1(4), 2022

    2022

  6. [14]

    The good, the bad and the ugly: Watermarks, transferable attacks and adversarial defenses

    Grzegorz Głuch, Berkant Turan, Sai Ganesh Nagarajan, and Sebastian Pokutta. The good, the bad and the ugly: Watermarks, transferable attacks and adversarial defenses. arXiv preprint arXiv:2410.08864, 2024

    2024

  7. [15]

    Generative adversarial networks

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM, 63(11):139–144, 2020. 14

    2020

  8. [16]

    Stable diffusion prompts dataset.https://huggingface.co/datasets/ Gustavosta/Stable-Diffusion-Prompts, 2024

    Gustavosta. Stable diffusion prompts dataset.https://huggingface.co/datasets/ Gustavosta/Stable-Diffusion-Prompts, 2024. Accessed: February 2025

    2024

  9. [17]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  10. [18]

    Security benefits and side effects of labeling ai-generated images.arXiv preprint arXiv:2505.22845, 2025

    Sandra Höltervennhoff, Jonas Ricker, Maike M Raphael, Charlotte Schwedes, Rebecca Weil, Asja Fischer, Thorsten Holz, Lea Schönherr, and Sascha Fahl. Security benefits and side effects of labeling ai-generated images.arXiv preprint arXiv:2505.22845, 2025

    2025

  11. [19]

    Digital image watermarking using deep learning: A survey.Computer Science Review, 53:100662, 2024

    Khalid M Hosny, Amal Magdi, Osama ElKomy, and Hanaa M Hamza. Digital image watermarking using deep learning: A survey.Computer Science Review, 53:100662, 2024

    2024

  12. [20]

    Robin: Robust and invisible watermarks for diffusion models with adversarial optimization.Advances in Neural Information Processing Systems, 37:3937–3963, 2024

    Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization.Advances in Neural Information Processing Systems, 37:3937–3963, 2024

    2024

  13. [21]

    Invisible watermarks: Attacks and robustness.arXiv preprint arXiv:2412.12511, 2024

    Dongjun Hwang, Sungwon Woo, Tom Gao, Raymond Luo, and Sunghwan Baek. Invisible watermarks: Attacks and robustness.arXiv preprint arXiv:2412.12511, 2024

    2024 arXiv

  14. [22]

    Forging and removing latent- noise diffusion watermarks using a single image

    Anubhav Jain, Yuya Kobayashi, Naoki Murata, Yuhta Takida, Takashi Shibuya, Yuki Mitsufuji, Niv Cohen, Nasir Memon, and Julian Togelius. Forging and removing latent- noise diffusion watermarks using a single image. arXiv preprint arXiv:2504.20111, 2025

    2025 arXiv

  15. [23]

    A dwt-dft composite watermarking scheme robust to both affine transform and jpeg compression.IEEE transactions on circuits and systems for video technology, 13(8):776–786, 2003

    Xiangui Kang, Jiwu Huang, Yun Q Shi, and Yan Lin. A dwt-dft composite watermarking scheme robust to both affine transform and jpeg compression.IEEE transactions on circuits and systems for video technology, 13(8):776–786, 2003

    2003

  16. [24]

    Auto-encoding variational bayes, 2013

    Diederik P Kingma, Max Welling, et al. Auto-encoding variational bayes, 2013

    2013

  17. [25]

    The role of imagenet classes in fr\’echet inception distance

    Tuomas Kynkäänniemi, Tero Karras, Miika Aittala, Timo Aila, and Jaakko Lehti- nen. The role of imagenet classes in fr\’echet inception distance. arXiv preprint arXiv:2203.06026, 2022

    2022 arXiv

  18. [26]

    A baseline method for removing invisible image watermarks using deep image prior.arXiv preprint arXiv:2502.13998, 2025

    Hengyue Liang, Taihui Li, and Ju Sun. A baseline method for removing invisible image watermarks using deep image prior.arXiv preprint arXiv:2502.13998, 2025

    2025 arXiv

  19. [27]

    A survey of text watermarking in the era of large language models

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1–36, 2024

    2024

  20. [29]

    Image watermarks are removable using controllable regeneration from clean noise

    Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. arXiv preprint arXiv:2410.05470, 2024

    2024 arXiv

  21. [30]

    Analyzing Threats of Large-Scale Machine Learning Systems

    Nils Lukas. Analyzing Threats of Large-Scale Machine Learning Systems. PhD thesis, University of Waterloo, 2024

    2024

  22. [31]

    In32nd USENIX Security Symposium (USENIX Security 23), pp

    Nils Lukas and Florian Kerschbaum.{PTW}: Pivotal tuning watermarking for{Pre- Trained} image generators. In32nd USENIX Security Symposium (USENIX Security 23), pp. 2241–2258, 2023

    2023

  23. [32]

    Leveraging optimization for adaptive attacks on image watermarks

    Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. InThe Twelfth International Conference on Learning Representations, 2024. URLhttps://openreview.net/forum? id=O9PArxKLe1. 15

    2024

  24. [33]

    Are semantic watermarks for diffusion models resilient to layout control? InThe 1st Workshop on GenAI Watermarking

    Denis Lukovnikov, Andreas Müller, Jonas Thietke, Erwin Quiring, and Asja Fischer. Are semantic watermarks for diffusion models resilient to layout control? InThe 1st Workshop on GenAI Watermarking

  25. [34]

    Safety at scale: A comprehensive survey of large model safety.arXiv preprint arXiv:2502.05206, 2025

    Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, et al. Safety at scale: A comprehensive survey of large model safety.arXiv preprint arXiv:2502.05206, 2025

    2025 arXiv

  26. [35]

    Sdedit: Guided image synthesis and editing with stochastic differential equations

    Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint arXiv:2108.01073, 2021

    2021 arXiv

  27. [36]

    Black-box forgery attacks on semantic watermarks for diffusion models

    Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pp. 20937–20946, 2025

    2025

  28. [37]

    Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460, 2022

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anand- kumar. Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460, 2022

    2022 arXiv

  29. [38]

    A survey of digital image watermarking techniques

    Vidyasagar M Potdar, Song Han, and Elizabeth Chang. A survey of digital image watermarking techniques. InINDIN’05. 2005 3rd IEEE International Conference on Industrial Informatics, 2005., pp. 709–716. IEEE, 2005

    2005

  30. [39]

    Single-shot retinal image enhancement using deep image priors

    Adnan Qayyum, Waqas Sultani, Fahad Shamshad, Junaid Qadir, and Rashid Tufail. Single-shot retinal image enhancement using deep image priors. In International Conference on Medical Image Computing and Computer-Assisted Intervention, pp. 636–646. Springer, 2020

    2020

  31. [40]

    Untrained neural network priors for inverse imaging problems: A survey

    Adnan Qayyum, Inaam Ilahi, Fahad Shamshad, Farid Boussaid, Mohammed Bennamoun, and Junaid Qadir. Untrained neural network priors for inverse imaging problems: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(5):6511– 6536, 2022

    2022

  32. [41]

    An overview on digital content watermarking

    Wang Qi, Bei Yue, Chen Wangdu, Pan Xinghao, Cheng Zhipeng, Wang Shaokang, Wang Yizhao, and Wang Chenwei. An overview on digital content watermarking. In Signal and Information Processing, Networking and Computers: Proceedings of the 8th International Conference on Signal and I...

    2022

  33. [42]

    Sok: On the role and future of aigc watermarking in the era of gen-ai

    Kui Ren, Ziqi Yang, Li Lu, Jian Liu, Yiming Li, Jie Wan, Xiaodi Zhao, Xianheng Feng, and Shuo Shao. Sok: On the role and future of aigc watermarking in the era of gen-ai. arXiv preprint arXiv:2411.11478, 2024

    2024 arXiv

  34. [43]

    Iconmark: Robust inter- pretable concept-based watermark for ai images

    Vinu Sankar Sadasivan, Mehrdad Saberi, and Soheil Feizi. Iconmark: Robust inter- pretable concept-based watermark for ai images. arXiv preprint arXiv:2507.13407, 2025

    2025 arXiv

  35. [44]

    Defense-gan: Protect- ing classifiers against adversarial attacks using generative models

    Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protect- ing classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605, 2018

    2018 arXiv

  36. [45]

    U can’t gen this? a survey of intellectual property protection methods for data in generative ai.arXiv preprint arXiv:2406.15386, 2024

    Tanja Šarčević, Alicja Karlowicz, Rudolf Mayer, Ricardo Baeza-Yates, and Andreas Rauber. U can’t gen this? a survey of intellectual property protection methods for data in generative ai.arXiv preprint arXiv:2406.15386, 2024

    2024 arXiv

  37. [46]

    Compressed sensing-based robust phase retrieval via deep generative priors.IEEE Sensors Journal, 21(2):2286–2298, 2020

    Fahad Shamshad and Ali Ahmed. Compressed sensing-based robust phase retrieval via deep generative priors.IEEE Sensors Journal, 21(2):2286–2298, 2020

    2020

  38. [47]

    Deep ptych: Subsampled fourier ptychography using generative priors

    Fahad Shamshad, Farwa Abbas, and Ali Ahmed. Deep ptych: Subsampled fourier ptychography using generative priors. In ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 7720–7724. IEEE, 2019. 16

    2019

  39. [48]

    Adaptive ptych: Leveraging image adaptive generative priors for subsampled fourier ptychogra- phy

    FahadShamshad, AsifHanif, FarwaAbbas, MuhammadAwais, andAliAhmed. Adaptive ptych: Leveraging image adaptive generative priors for subsampled fourier ptychogra- phy. InProceedings of the IEEE/CVF International Conference on Computer Vision Workshops, pp. 0–0, 2019

    2019

  40. [49]

    Subsampled fourier ptychography via pretrained invertible and untrained network priors

    Fahad Shamshad, Asif Hanif, and Ali Ahmed. Subsampled fourier ptychography via pretrained invertible and untrained network priors. InNeurIPS 2019 Workshop on Solving Inverse Problems with Deep Networks, 2019

    2019

  41. [50]

    Clip2protect: Protect- ing facial privacy using text-guided makeup via adversarial latent search

    Fahad Shamshad, Muzammal Naseer, and Karthik Nandakumar. Clip2protect: Protect- ing facial privacy using text-guided makeup via adversarial latent search. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20595– 20605, 2023

    2023

  42. [51]

    Evading forensic classifiers with attribute-conditioned adversarial faces

    Fahad Shamshad, Koushik Srivatsan, and Karthik Nandakumar. Evading forensic classifiers with attribute-conditioned adversarial faces. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16469–16478, 2023

    2023

  43. [52]

    Rethinking oversaturation in classifier-free guidance via low frequency.arXiv preprint arXiv:2506.21452, 2025

    Kaiyu Song and Hanjiang Lai. Rethinking oversaturation in classifier-free guidance via low frequency.arXiv preprint arXiv:2506.21452, 2025

    2025 arXiv

  44. [53]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2117–2126, 2020

    2020

  45. [54]

    Elevating defenses: Bridging adversarial training and watermarking for model resilience.arXiv preprint arXiv:2312.14260, 2023

    Janvi Thakkar, Giulio Zizzo, and Sergio Maffeis. Elevating defenses: Bridging adversarial training and watermarking for model resilience.arXiv preprint arXiv:2312.14260, 2023

    2023 arXiv

  46. [55]

    Deep image prior

    Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Deep image prior. InProceed- ings of the IEEE conference on computer vision and pattern recognition, pp. 9446–9454, 2018

    2018

  47. [56]

    Security and privacy on generative data in aigc: A survey.ACM Computing Surveys, 57(4):1–34, 2024

    Tao Wang, Yushu Zhang, Shuren Qi, Ruoyu Zhao, Zhihua Xia, and Jian Weng. Security and privacy on generative data in aigc: A survey.ACM Computing Surveys, 57(4):1–34, 2024

    2024

  48. [57]

    Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004

    2004

  49. [58]

    Tree-rings wa- termarks: Invisible fingerprints for diffusion images.Advances in Neural Information Processing Systems, 36, 2024

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings wa- termarks: Invisible fingerprints for diffusion images.Advances in Neural Information Processing Systems, 36, 2024

    2024

  50. [59]

    Copyrightmeter: Revisiting copyright protection in text-to-image models.arXiv preprint arXiv:2411.13144, 2024

    Naen Xu, Changjiang Li, Tianyu Du, Minxi Li, Wenjie Luo, Jiacheng Liang, Yuyuan Li, Xuhong Zhang, Meng Han, Jianwei Yin, et al. Copyrightmeter: Revisiting copyright protection in text-to-image models.arXiv preprint arXiv:2411.13144, 2024

    2024 arXiv

  51. [60]

    Can simple averaging defeat modern watermarks? Advances in Neural Information Processing Systems, 37:56644–56673, 2024

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks? Advances in Neural Information Processing Systems, 37:56644–56673, 2024

    2024

  52. [61]

    Gaussian shading: Provable performance-lossless image watermarking for diffusion models

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12162–12171, 2024

    2024

  53. [62]

    Protecting intellectual property of deep neural networks with watermark- ing

    Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural networks with watermark- ing. In Proceedings of the 2018 on Asia conference on computer and communications security, pp. 159–172, 2018. 17

    2018

  54. [63]

    Adding conditional control to text-to- image diffusion models

    Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to- image diffusion models. InProceedings of the IEEE/CVF international conference on computer vision, pp. 3836–3847, 2023

    2023

  55. [64]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition, pp. 586–595, 2018

    2018

  56. [65]

    Sok: Watermarking for ai-generated content.arXiv preprint arXiv:2411.18479, 2024

    Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramer, et al. Sok: Watermarking for ai-generated content.arXiv preprint arXiv:2411.18479, 2024

    2024 arXiv

  57. [66]

    Invisible image watermarks are provably removable using generative ai.Advances in neural information processing systems, 37:8643–8672, 2024

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai.Advances in neural information processing systems, 37:8643–8672, 2024

    2024

  58. [67]

    tree-ring

    Zhizhen Zhao, Jong Chul Ye, and Yoram Bresler. Generative models for inverse imaging problems: From mathematical foundations to physics-driven applications.IEEE Signal Processing Magazine, 40(1):148–163, 2023. 18 Appendix This appendix provides background information and exten...

    2023

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.