Pith. sign in

REVIEW 4 major objections 4 minor 42 references

SPFM-Net removes invisible watermarks by reconstructing images from 90% masked patches, achieving zero-shot attack on unseen deep watermarks while maintaining near-perfect visual fidelity.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

SPFM-Net attacks invisible watermarks by reconstructing heavily masked images with a pretrained semantic model; it reports good removal on Stable Signature/HiDDeN but poor removal on Yu.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection The masking math doesn't close: Eq. 1 assumes all 196 patches while the text says 90% are discarded, and the SSIM 0.99 claim hangs on that gap. the 4 major comments →

arxiv 2607.27811 v1 pith:ZHYBEOCZ submitted 2026-07-30 cs.CV

SPFM-Net: Semantic-Prior-Guided Frequency-Constrained Mamba for Invisible Watermark Attack

Chunpeng Wang , Yanan Shi , Zhiqiu Xia , Jidong Yang , Suo Gao , Qi Li This is my paper
classification cs.CV
keywords invisible watermark attackwatermark removalmasked autoencoderMambafrequency domainsemantic priorzero-shot generalizationimage restoration
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a single network, trained only on simple watermarks (LSB, DCT, QPHFMs), can disrupt state-of-the-art deep watermarking schemes like Stable Signature and HiDDeN without any retraining on them, while keeping attacked images nearly indistinguishable from originals (SSIM around 0.99). The authors reformulate invisible watermark removal as a semantic-guided image restoration problem: they mask 90% of the image patches, use a pretrained Masked Autoencoder (with only the last three blocks fine-tuned) to reconstruct the image from natural-image priors, and then pass features through multi-scale frequency and Mamba-based global state-space modules to suppress residual watermark traces. The motivation is that globally distributed watermark signals are hard to capture with local operations; by destroying spatial coherence through masking and exploiting semantic priors, the network can separate watermark from content. If true, this would provide a universal watermark attack that is both highly effective and visually lossless, undermining the robustness guarantees of current invisible watermarking methods.

Core claim

The central claim is that SPFM-Net achieves a state-of-the-art trade-off between watermark attack effectiveness and perceptual fidelity by treating watermark removal not as a pixel-level perturbation suppression task but as semantic-guided image restoration. The discovery is that high-ratio random masking (90%) of the input patches, combined with a partially fine-tuned pretrained Masked Autoencoder, forces the network to rely on global semantic priors rather than local pixel statistics; this, together with the Multi-scale Residual Frequency Feature Interaction (MRFFI) module and the Mamba-based Global State-space Feature Modeling (GSFM) module, allows the network to suppress globally distrib

What carries the argument

The key machinery is a pipeline of four cooperating components: (1) a front-end that patchifies the image and randomly masks out 90% of the patches, destroying the spatial coherence of watermark signals; (2) a pretrained Masked Autoencoder (MAE) used as the semantic backbone, with only the final three Transformer blocks and normalization layer unfrozen, which reconstructs a semantically consistent representation from the sparse visible patches; (3) the Multi-scale Residual Frequency Feature Interaction (MRFFI) module, which uses three parallel 3x3 convolution branches with strides 1, 2, and 4 to capture watermark residuals at multiple receptive fields and applies channel attention to suppres

Load-bearing premise

The load-bearing assumption is that a 90%-masked input still permits near-perfect image reconstruction (SSIM ~0.99) at inference, yet the paper's architecture equations describe processing all 196 patches; if the masking is not applied at test time or if reconstruction from 10% pixels cannot reach such fidelity, the reported attack effectiveness and fidelity numbers are unsupported.

What would settle it

Obtain the trained model (or retrain as described) and run it on a watermarked image with two settings: (a) 90% random masking applied at inference, (b) no masking at inference (all 196 patches passed to the encoder). Compute BER and SSIM for each. If setting (a) yields SSIM above 0.98 and BER comparable to the paper, the claim is plausible; if setting (b) is required to reach those numbers, the paper's front-end description is misleading. Additionally, checking the actual token count fed into the MAE encoder in the public code would resolve the ambiguity.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the zero-shot claim holds, watermarking schemes that rely on learned embedding (e.g., HiDDeN, Stable Signature) can be neutralized by a generic attack network that has never seen them, lowering the barrier for mass watermark removal.
  • The reported simultaneous improvement in both BER and PSNR over prior attacks implies that the traditional inverse relationship between attack strength and fidelity is not fundamental; semantic-prior-guided reconstruction can break it.
  • Since the network is trained on only three simple watermark variants, its success suggests that the watermark signal is treated as a high-frequency anomaly irrespective of embedding domain; this may extend to other unseen watermark types.
  • The failure case on the Yu watermark (BER 0.12) shows the approach is not universal; it sacrifices attack strength on spatial-domain watermarks that couple with high-frequency details, defining a trade-off boundary rather than a strictly dominant solution.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper never states whether the 90% random masking is applied at inference time; if it is, reconstructing a 224x224 image from 10% visible patches is an extreme super-resolution task, and the reported SSIM of 0.99 is close to the physical limit. A reader could verify this by inspecting a public implementation or the network's forward pass.
  • The training set consists entirely of face images, and the evaluations on SS and HiDDeN also use face or SDXL content; a natural testable extension is to probe generalization to non-face content (e.g., text, objects, medical scans), where the semantic prior may be weaker.
  • The frequency loss penalizes only the amplitude spectrum, not phase; since phase carries most structural information, adding a phase or complex-spectrum loss could improve fidelity further on edge-rich images, a modification the paper does not explore.
  • The paper's framing of watermark attack as semantic restoration suggests a wider principle: any global, imperceptible perturbation uncorrelated with natural image statistics can be removed by a strong generative prior. This predicts that watermarks embedded in semantic latents (e.g., through adversarial perturbations or latent modification) may be more resistant, which is consistent with the poor
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes SPFM-Net, a network for removing invisible image watermarks by reformulating the task as semantic-guided image restoration. The method patches the watermarked image, applies high-ratio random masking (ρ=0.9), feeds the retained tokens through a mostly frozen pretrained MAE encoder (last three transformer blocks unfrozen), then applies a Multi-scale Residual Frequency Feature Interaction module and a Mamba-based Global State-space Feature Modeling module before a transposed-convolution decoder. Training uses a joint loss combining pixel L1, FFT amplitude, and Sobel edge constraints. The authors train on images watermarked with LSB, DCT, and QPHFMs, then evaluate zero-shot on three deep-learning watermarks (Yu, Stable Signature, HiDDeN), reporting BERs of 0.12, 0.48, and 0.55 and SSIM of 0.99 on all targets. Comparisons are made with classical distortions and with DiffusionAttack, VAEAttack, and UnMarker. Ablation studies add MRFFI, GSFM, and the joint loss incrementally.

Significance. If the results held, the paper would demonstrate a meaningful advance: a single network that disrupts unseen deep watermarks while maintaining high perceptual fidelity, with an evaluation design that is genuinely zero-shot since the deep watermarking methods are absent from training. The idea of using MAE-style semantic priors for watermark removal is interesting, and the multi-domain loss and Pareto-style trade-off analysis are appropriate. However, the central forward-pass description is internally inconsistent, the reported fidelity figures are not credible without clarification, and the universal/favorable framing is contradicted by the authors' own Yu result. The significance of the work is contingent on resolving these load-bearing issues.

major comments (4)
  1. [Image Patching and Random Masking / Eq. (1), Partially Unfrozen Masked Encoder] The text states ρ=0.9, so only N(1−ρ)=19.6≈20 visible patches are retained, yet Eq. (1) writes Tglobal=E(Xw)∈R^{196×C} and the decoder requires a 14×14=196-token feature map. No mask-token reinsertion or equivalent mechanism is described to map 20 visible tokens to 196 output tokens. This is not a presentation detail: the claimed "sparse-input semantic reconstruction" depends on which forward pass is actually executed. If all 196 tokens are processed at test time, masking is inert and the architecture reduces to a partially fine-tuned ViT decoder; if only ~20 patches are processed, the reported SSIM≥0.99 on arbitrary images such as SDXL/SDP prompts is implausible. The authors must specify the exact inference-time masking protocol, add the missing token-construction step, and report results under that protocol, ideally with code.
  2. [Ablation Study (Tables 3 and 4)] The mask ratio ρ is a core contribution and the main source of the forward-pass inconsistency, but it is never ablated. The ablation varies MRFFI, GSFM, and the joint loss only. A proper evaluation should include at least ρ∈{0, 0.25, 0.5, 0.75, 0.9} with BER and fidelity metrics on both training-domain and zero-shot watermarks. Without this, the contribution of random masking to attack effectiveness is unsubstantiated, and the reported fidelity numbers cannot be attributed to the sparse-input mechanism.
  3. [Limitation paragraph and Table 1] For the Yu watermark, SPFM-Net attains BER 0.12, far from the random-guess 0.5 and below the 0.37 achieved by UnMarker. The authors acknowledge this in the Limitation paragraph, but the Abstract and Contributions still claim a "favorable trade-off" and a "universal invisible watermark attack." A method that leaves one of three representative deep watermarks largely extractable, and matches rather than exceeds UnMarker on SS attack effectiveness (0.48 vs. 0.48), does not support the current framing. This discrepancy should be re-scoped or subjected to a dedicated analysis rather than relegated to a single limitation sentence.
  4. [Experimental Settings / Attack Effectiveness Evaluation] All tables report point estimates with no error bars, confidence intervals, or significance tests, and each evaluation set contains only 100 images per watermarking scheme. Cross-mechanism generalization claims of this strength require an assessment of run-to-run and sample-to-sample variability; for example, the BER differences of 0.01–0.03 between ablation variants in Tables 3 and 4 are within probable noise. Report means and standard deviations over multiple seeds and random test splits, or otherwise provide statistical justification for the reported numbers.
minor comments (4)
  1. [Implementation Details] Typo: "only bocks 21, 22, and 23" should be "blocks 21, 22, and 23." Also, the description of the training data as "internally loaded clean face images" is vague; specify the dataset name, size, and watermarking parameters.
  2. [Tables 1 and 2] The watermarking scheme is referred to as "Hidden" in Table 1 and "HiDDeN" elsewhere; unify the notation. Additionally, the paper uses "Yu" as a target, but the corresponding watermarking method is not fully described in the Experimental Settings; provide a citation and a brief explanation of its embedding mechanism.
  3. [Figures 5–7] The visual comparisons in Figure 5 and the Pareto plots in Figure 6 are difficult to read in the grayscale/print version. Consider adding enlarged crops or separate high-resolution panels. Figure 7 lacks axis labels and a legend, making the trade-off claim hard to verify.
  4. [Method, Decoder and Optimization] The decoder is described as containing four transposed convolution layers, but the use of skip connections from "shallow MAE encoder layers" is not architecturally specified. Clarify which encoder features are used and at what resolution they are concatenated.

Circularity Check

0 steps flagged

No significant circularity: the zero-shot claim is evaluated on watermarks excluded from training, and self-citations are contextual rather than load-bearing.

full rationale

The derivation chain is not circular. SPFM-Net's central empirical claim—zero-shot removal on unseen deep watermarks—is tested on SS, HiDDeN, and Yu after training only on LSB/DCT/QPHFMs watermarks, which the paper states explicitly: 'the evaluated deep learning-based schemes are absent from the training phase.' The reconstruction targets are clean ground-truth images via L_pixel, L_fft, and L_edge, and BER/PSNR are computed against external watermark decoders and paired watermarked images; no equation reduces a fitted parameter to the reported BER. The authors' own self-citations (HIWANet, WARDM) appear only as related-work context and are not used to justify the method's validity. The cited He et al. 2025 paper of the same name supports a multi-receptive-field design choice, but the attack result does not rest on that citation. The acknowledged Yu limitation (BER 0.12) is an honest negative result, the opposite of a self-confirming loop. An internal inconsistency exists between the 90% random masking description and Eq. (1)'s N=196 token sequence, and the reported SSIM 0.99 from a 10% visible input is unexplained; however, that is a correctness/reproducibility defect, not a circularity where the output is equivalent to the input by construction.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

Main free parameters are hand-tuned and the central transferability assumption is unproven. No code or data are provided to validate the empirical claims.

free parameters (4)
  • mask ratio rho = 0.9
    Central design choice; discards 90% of tokens. Its effect on fidelity vs. attack is not validated and conflicts with Eq. 1.
  • loss weights lambda1, lambda2 = 0.5, 0.3
    Described as 'based on empirical optimization'; hand-tuned to balance pixel, FFT, and edge losses.
  • number of unfrozen MAE blocks = 3 (blocks 21-23)
    Chosen to adapt to watermark noise while preserving semantic prior; no ablation justifying exactly three.
  • patch size P = 16
    Fixed to 16; affects sequence length and mask granularity, no ablation.
axioms (4)
  • domain assumption Invisible watermarks can be suppressed by reconstructing the image from heavily masked inputs according to natural-image priors.
    Central premise of the method; not proven and contradicted by Yu result and fidelity concerns.
  • domain assumption A pretrained MAE trained on natural images provides semantic priors that are sufficiently watermark-agnostic to transfer across LSB/DCT/QPHFMs to deep generative watermarks.
    Underlies the zero-shot claim; evaluation is limited to 100 images per target.
  • domain assumption The official watermark decoders/extractors for Yu, SS, and HiDDeN are used correctly and BER is a valid measure of attack success.
    Needed for BER numbers; code not provided.
  • domain assumption Randomly sampling 100 images per target gives stable estimates of BER and perceptual metrics.
    No confidence intervals or repeated sampling reported.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of SPFM-Net: Semantic-Prior-Guided Frequency-Constrained Mamba for Invisible Watermark Attack." pith.science (2026). https://pith.science/paper/ZHYBEOCZ

@misc{pith2026260727811,
  author       = {Pith},
  title        = {Pith review of: SPFM-Net: Semantic-Prior-Guided Frequency-Constrained Mamba for Invisible Watermark Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZHYBEOCZ}},
  note         = {Machine review of arXiv:2607.27811}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Existing watermark attacks typically rely on predefined signal-processing operations or locally constrained restoration networks, making it difficult to capture the long-range dependencies of globally distributed watermark signals and resulting in an unfavorable trade-off between removal effectiveness and visual fidelity. In this paper, we propose SPFM-Net, a semantic-prior-guided and frequency-constrained Mamba framework for invisible watermark attack. SPFM-Net first employs high-ratio masking to disrupt the spatial coherence of invisible watermark signals, and then utilizes a partially fine-tuned pretrained Masked Autoencoder to reconstruct semantically consistent image from sparse observations while suppressing watermark-related information. A Multi-scale Residual Frequency Feature Interaction module subsequently aggregates watermark-related residual features across multiple receptive fields, while adaptively suppressing responses from watermark-irrelevant regions. To further capture the long-range dependencies of globally distributed watermark signals, a lightweight Mamba-based Global State-space Feature Modeling (GSFM) unit is introduced to separate watermark-related features from natural image content and suppress the remaining watermark traces. In addition, SPFM-Net is optimized using a multi-level objective that jointly imposes spatial-, frequency-, and edge-domain constraints, enabling effective watermark suppression while preserving perceptual quality. Extensive experiments on representative spatial-domain, transform-domain, orthogonal moment-based, and deep learning-based watermarking schemes demonstrate that SPFM-Net achieves a favorable trade-off between watermark attack effectiveness and perceptual fidelity.

Figures

Figures reproduced from arXiv: 2607.27811 by Chunpeng Wang, Jidong Yang, Qi Li, Suo Gao, Yanan Shi, Zhiqiu Xia.

Figure 1
Figure 1. Figure 1: Overview of the proposed SPFM-Net. decoder T reconstructs the watermark-free image Xˆ under spatial-frequency joint constraints with skip connections. Image Patching and Random Masking Modern deep learning watermarks implicitly embed copy￾right information into spatial or high-dimensional features, deeply entangling with natural textures and complicating segmentation. Processing these images as continuous … view at source ↗
Figure 3
Figure 3. Figure 3: MRFFI Module Architecture. watermark perturbations distribute unevenly, uniform fea￾ture processing risks damaging clean backgrounds. Thus, M introduces a channel attention mechanism to generate an adaptive weight map A: A = σ(Conv1×1(fm)) (5) Fout = A ⊙ fm ∈ R 1024×14×14 (6) where σ(·) is the Sigmoid function and ⊙ denotes the Hadamard product. This dynamic weighting significantly en￾hances watermark-rela… view at source ↗
Figure 4
Figure 4. Figure 4: Mamba-based GSFM Module Architecture. feature: fdec ∈ R 1024×14×14 . T contains four consecutive transposed convolution layers, each using a 2 × 2 kernel and a stride of 2. Feature channels are hierarchically reduced from 1024 to 512, 256, 128, and finally 3, while spatial resolution exponentially enlarges from 14 to 28, 56, 112, and 224 to progressively refine image details. Since feature reduction inevit… view at source ↗
Figure 5
Figure 5. Figure 5: SOTA removal attack outputs across different wa [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Performance trade-off between attack effectiveness [PITH_FULL_IMAGE:figures/full_fig_p007_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Trade-off between image quality and attack effec [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

42 extracted references · 3 linked inside Pith

  1. [1]

    Proceedings of the European Conference on Computer Vision (ECCV) , pages=

    Hidden: Hiding data with deep networks , author=. Proceedings of the European Conference on Computer Vision (ECCV) , pages=

  2. [2]

    ACM , pages=

    MBRS: Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression , author=. ACM , pages=

  3. [3]

    International Conference on Learning Representations (ICLR) , year=

    Responsible disclosure of generative models using scalable fingerprinting , author=. International Conference on Learning Representations (ICLR) , year=

  4. [4]

    Proceedings of the 32nd ACM International Conference on Multimedia , pages=

    Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation , author=. Proceedings of the 32nd ACM International Conference on Multimedia , pages=

  5. [5]

    Signal Processing , volume=

    Highly applicable and imperceptible watermark attack network , author=. Signal Processing , volume=. 2025 , publisher=

    2025

  6. [6]

    Proceedings of the 32nd British Machine Vision Conference (BMVC) , pages=

    WAN: Watermarking Attack Network , author=. Proceedings of the 32nd British Machine Vision Conference (BMVC) , pages=. 2021 , organization=

    2021

  7. [7]

    Diffusion Denoising Watermark Removal Models to Attack Invisible Image Watermarks , author=

  8. [8]

    1107.0740 , archivePrefix=

    An intuitive proof of the data processing inequality , author=. 1107.0740 , archivePrefix=

    Pith/arXiv arXiv

  9. [9]

    2003 , publisher=

    Information theory, inference and learning algorithms , author=. 2003 , publisher=

    2003

  10. [10]

    2018 , publisher=

    Digital Image Processing , author=. 2018 , publisher=

    2018

  11. [11]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    SPFM-Net: Lightweight multi-receptive visual mamba network , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  12. [12]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Masked autoencoders are scalable vision learners , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  13. [13]

    Signal Processing , volume=

    Color medical image lossless watermarking using chaotic system and accurate quaternion polar harmonic transforms , author=. Signal Processing , volume=. 2019 , publisher=

    2019

  14. [14]

    Journal of King Saud University - Computer and Information Sciences , volume=

    An imperceptible spatial domain color image watermarking scheme , author=. Journal of King Saud University - Computer and Information Sciences , volume=. 2019 , publisher=

    2019

  15. [15]

    International Journal of Advanced Computer Information , volume=

    Tamper localization and content restoration in fragile image watermarking: A review , author=. International Journal of Advanced Computer Information , volume=

  16. [16]

    International Journal of Advanced Computer Information , volume=

    Robust image watermarking based on hybrid IWT-DCT-SVD , author=. International Journal of Advanced Computer Information , volume=

  17. [17]

    International Journal of Advanced Computer Information , volume=

    Robust digital image watermarking using DWT, Hessenberg, and SVD for copyright protection , author=. International Journal of Advanced Computer Information , volume=

  18. [18]

    IEEE Transactions on Multimedia , volume=

    Exploring accurate invariants on polar harmonic Fourier moments in polar coordinates for robust image watermarking , author=. IEEE Transactions on Multimedia , volume=. 2024 , publisher=

    2024

  19. [19]

    Journal of the Franklin Institute , volume=

    Fast image reconstruction method using radial harmonic Fourier moments and its application in digital watermarking , author=. Journal of the Franklin Institute , volume=. 2025 , publisher=

    2025

  20. [20]

    Information Sciences , volume=

    A two-stage robust reversible watermarking using polar harmonic transform for high robustness and capacity , author=. Information Sciences , volume=. 2024 , publisher=

    2024

  21. [21]

    2024 , eprint=

    Stable signature is unstable: removing image watermark from diffusion models , author=. 2024 , eprint=

    2024

  22. [22]

    Advances in Neural Information Processing Systems (NeurIPS) , volume=

    Tree-rings watermarks: Invisible fingerprints for diffusion images , author=. Advances in Neural Information Processing Systems (NeurIPS) , volume=

  23. [23]

    Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages=

    The stable signature: Rooting watermarks in latent diffusion models , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pages=

  24. [24]

    Advances in Neural Information Processing Systems (NeurIPS) , volume=

    Invisible image watermarks are provably removable using generative AI , author=. Advances in Neural Information Processing Systems (NeurIPS) , volume=

  25. [25]

    Waves: Benchmarking the robustness of image watermarks , author=

  26. [26]

    Proceedings of the IEEE Symposium on Security and Privacy (SP) , pages=

    Unmarker: a universal attack on defensive image watermarking , author=. Proceedings of the IEEE Symposium on Security and Privacy (SP) , pages=. 2025 , organization=

    2025

  27. [27]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

    The unreasonable effectiveness of deep features as a perceptual metric , author=. Proceedings of the IEEE conference on computer vision and pattern recognition , pages=

  28. [28]

    IEEE Transactions on Dependable and Secure Computing , year=

    Can watermarks be removed like noise? A watermarking attack network using residual diffusion model , author=. IEEE Transactions on Dependable and Secure Computing , year=

  29. [29]

    International Conference on Information Security , pages=

    Detect and remove watermark in deep neural networks via generative adversarial networks , author=. International Conference on Information Security , pages=. 2021 , organization=

    2021

  30. [30]

    IEEE Transactions on Circuits and Systems for Video Technology , volume=

    Concealed attack for robust watermarking based on generative model and perceptual loss , author=. IEEE Transactions on Circuits and Systems for Video Technology , volume=. 2021 , publisher=

    2021

  31. [31]

    2025 , eprint=

    When there is no decoder: Removing watermarks from stable diffusion models in a no-box setting , author=. 2025 , eprint=

    2025

  32. [32]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=

    Toward generalized image quality assessment: Relaxing the perfect reference quality assumption , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages=

  33. [33]

    Journal of Information Security and Applications , volume=

    A large-capacity and robust screen-shooting resilient image watermarking based on attention-enhanced invertible neural network , author=. Journal of Information Security and Applications , volume=. 2026 , publisher=

    2026

  34. [34]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Sleepermark: Towards robust watermark against fine-tuning text-to-image diffusion models , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  35. [35]

    arXiv preprint arXiv:2305.12502 , year=

    Watermarking diffusion model , author=. arXiv preprint arXiv:2305.12502 , year=

    Pith/arXiv arXiv

  36. [36]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  37. [37]

    arXiv preprint arXiv:2311.18297 , year=

    TrustMark: Universal Watermarking for Arbitrary Resolution Images , author=. arXiv preprint arXiv:2311.18297 , year=

    Pith/arXiv arXiv

  38. [38]

    Proceedings of the ACM International Conference on Multimedia , pages=

    Practical Deep Dispersed Watermarking with Synchronization and Fusion , author=. Proceedings of the ACM International Conference on Multimedia , pages=

  39. [39]

    Proceedings of the ACM International Conference on Multimedia , pages=

    Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms , author=. Proceedings of the ACM International Conference on Multimedia , pages=

  40. [40]

    Neural Networks , volume=

    A self-supervised network for image denoising and watermark removal , author=. Neural Networks , volume=. 2024 , publisher=

    2024

  41. [41]

    Proceedings of the AAAI Conference on Artificial Intelligence , pages=

    DENet: Disentangled embedding network for visible watermark removal , author=. Proceedings of the AAAI Conference on Artificial Intelligence , pages=

  42. [42]

    International Conference on Intelligent Information and Computing Systems (ICIICS) , pages=

    DiffWA: Diffusion models for watermark attack , author=. International Conference on Intelligent Information and Computing Systems (ICIICS) , pages=

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.