Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removal

Inzamamul Alam; MD Tanvir Islam; Simon S. Woo

REVIEW 3 major objections 4 minor 23 references

Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removal

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read SADRE claims that saliency-masked latent noise plus reverse diffusion removes invisible watermarks to near-chance bit recovery while keeping PSNR above 33 dB.

desk verdict A plausible diffusion-based watermark removal attack with a consistent table, but the saliency mask M and watermark strength τ are never defined, and the theory is asserted rather than shown. read the letter →

arxiv 2504.12809 v1 pith:5XCVZGJJ submitted 2025-04-17 cs.CV cs.MM

Inzamamul Alam , Md Tanvir Islam , Simon S. Woo This is my paper · ORCID

classification cs.CVcs.MM

keywords invisiblewatermarkremovaldiffusionreconstructionsaliencymaskadaptivenoiseinjectionlatentspaceperturbationgenerativeattackimagefidelitybitrecoveryaccuracy

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that invisible image watermarks can be removed by a diffusion-based attack that knows nothing about the embedding scheme except roughly where the watermark sits and how strong it is. It proposes SADRE, which maps the watermarked image to a latent space, injects noise only into regions selected by a saliency mask, sizes the noise to the estimated watermark strength, and reconstructs the image by reverse diffusion. Reported results put bit-recovery accuracy between 0.40 and 0.48 across six watermarking schemes, while PSNR stays above 33 dB and SSIM above 0.84. The reason to care is that it changes the threat model for image provenance: a posted image could be stripped of its invisible copyright marker without the attacker ever seeing the original.

What carries the argument

The load-bearing object is the masked latent perturbation: a saliency mask $M$ identifies watermark-affected regions of the latent representation $z$, and noise $\eta$ is added only through the element-wise product $M\odot\eta$, with the noise level $\sigma(x_w)$ chosen from an estimate of watermark strength $\tau(x_w)$. A reverse diffusion process $A(\tilde z)$ then restores a high-fidelity image from the perturbed latent. The paper ties this to a localized Hölder continuity condition on the embedding map $\phi$, so that distortions stay inside the masked regions and the reconstruction error stays bounded with high probability.

What would settle it

Run SADRE against a watermarking scheme that spreads its bits across the full latent space, for example over all frequency bands or random coordinates, so no saliency mask can localize them. If bit recovery accuracy stays near 1.0, the paper's assumption that watermark-affected regions are maskable is refuted.

Watch

Extended reading notes

Core claim

On its own terms, SADRE claims to be a general watermark-removal attack: it beats JPEG compression, VAE-based reconstruction, and a prior regeneration attack on every watermarking scheme tested. The mechanism is targeted perturbation of a latent representation. The embedding function is assumed to satisfy a localized Hölder condition, so the difference between watermarked and clean latents is concentrated where a saliency mask points. Noise is added only in those masked regions, with the noise level chosen to balance detectability and distortion, and a reverse diffusion process reconstructs the image. The paper derives a reconstruction-stability bound, $P[\|A(\tilde z)-x\|\le \epsilon]\ge 1-\delta$, and reports bit-recovery accuracies of 0.40 for StegaStamp, 0.42 for DwtDctSvd, 0.45 for DwtDct and RivaGAN, 0.47 for Tree-Ring, and 0.48 for EditGuard, with PSNR above 33 dB for every scheme.

Load-bearing premise

The whole attack depends on the saliency mask actually marking the regions where the watermark lives and on the adversary being able to estimate the watermark's strength; if either fails, the targeted noise has no principled target.

Editorial extensions

If this is right

A web adversary who can estimate watermark strength can strip invisible watermarks from posted images without access to the clean original.
Watermarking schemes whose only defense is embedding invisibility are not enough: the attack is reported to work across six different embedding designs.
After one SADRE pass, bit recovery accuracy drops to 0.40-0.48 for the tested schemes, so provenance tracing through these watermarks becomes unreliable.
Because PSNR stays above 33 dB and SSIM above 0.84, the attacked images remain visually usable, which is what makes the attack practical for real web content.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper never validates that the saliency mask actually isolates watermark-affected latents; a natural test is to scramble the mask and check whether the bit-recovery improvement disappears. If random masks work as well, the saliency mechanism is not the cause.
A watermarking scheme that spreads its message uniformly across the latent space, rather than concentrating it in maskable regions, would be the natural countermeasure to try next; this is not tested in the paper.
The stability theorem depends on a Hölder constant and a critical noise threshold; one practical extension is to measure reconstruction error as the injected noise passes that threshold, to see whether the bound is tight.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: SADRE is a diffusion-based watermark removal attack that reports lower bit-recovery accuracy (BRA) and Wasserstein distance than JPEG, VAE, and a regeneration attack across six watermarking schemes, with PSNR above 33 dB. The table is internally consistent and the method is plausible. But the two components that make it 'saliency-aware' — the mask M and the watermark strength estimate τ(x_w) — are never operationalized, and the theoretical claims are asserted without proof.

What's actually new: the combination of saliency-guided noise injection in latent space with a 50-step diffusion reconstruction is a reasonable incremental extension of regeneration attacks. Evaluating on six schemes including Tree-Ring, StegaStamp, and EditGuard is useful, and the reported numbers (BRA 0.40–0.48, W_p 0.080–0.195) are competitive. The threat model is honest: the adversary has no clean image and does not know the embedding mechanism.

The soft spots are serious but not disqualifying. Eq. 2 has no operational target because M is never defined or validated against any watermarking scheme. Section 4.1 only gives the noise range (0.05–0.15) and λ_w = 0.1. If M is just a generic saliency map or a full-image mask, the claimed advantage over plain diffusion plus tuned noise evaporates. Second, Theorem 1, Theorem 2, and Eqs. 6–7 are stated without derivation; the Hölder continuity citation (Mitrea–Taylor) is about metric tensors, not image watermarking, so the theory is decorative as it stands. Third, one cell looks off: RivaGAN under JPEG has SSIM 0.1459 at 32.48 dB, suspiciously low; that needs a check. Fourth, no error bars, no statistical tests, no code commit hash.

The central empirical claim — SADRE beats the three baselines on these six schemes — is supported by the table as reported, so I don't see a load-bearing flaw that falsifies the experiment. But the gap between narrative and support is real. A serious referee should engage, not desk-reject, and should push for a concrete definition of M, a derivation or removal of the theory, and a runnable code snapshot.

Who gets value: researchers working on watermark robustness or adversarial regeneration attacks. This is a short companion-paper contribution, not a breakthrough, but it is a useful data point if the missing details are filled in. My recommendation: send to peer review with expectation of heavy revision; the method and theory need work, but the empirical direction is worth refereeing.

Referee Report

3 major / 4 minor

Summary. The paper proposes Saliency-Aware Diffusion Reconstruction (SADRE), a pipeline that removes invisible watermarks by mapping a watermarked image into a latent space, injecting noise only into regions selected by a saliency mask, and then reconstructing the image with a reverse diffusion process. The authors claim that SADRE is theoretically grounded via Hölder-continuity assumptions and stability bounds (Theorems 1 and 2), and that it outperforms JPEG compression, VAE reconstruction, and a regeneration attack on six watermarking schemes, reducing bit recovery accuracy to 0.40–0.48 while keeping PSNR above 33 dB.

Significance. If the empirical claims hold, SADRE would be a practically relevant attack for web-content watermark removal, and the paper's breadth across six watermarking schemes is a strength. The authors provide a code link and report a table in which SADRE consistently achieves the lowest BRA and W_p among the four compared attacks, which is a useful baseline for future work. However, the significance is currently limited by two gaps: the saliency mask M and watermark-strength estimate τ(x_w) are never operationally defined, and the theoretical results are asserted without proofs. Because these components are the only factors distinguishing SADRE from a generic diffusion-regeneration attack, the central contribution is not yet reproducible or fully supported.

major comments (3)

[Section 3.1, Eqs. (2)-(3)] The saliency mask M and the watermark-strength estimate τ(x_w) are introduced as givens, but the manuscript never states how M is computed (e.g., gradient-based saliency, attention map, or a full-image mask) nor how τ(x_w) is estimated for any of the six watermarking schemes. Since Eq. (2) is the only mechanism distinguishing SADRE from a plain diffusion-regeneration attack, this omission makes the method non-reproducible and prevents attribution of the reported gains in Section 4.2 to saliency guidance. The implementation details in Section 4.1 report only the noise range and λ_w, which does not resolve the gap.
[Sections 3.2-3.3, Theorems 1-2 and Eqs. (4), (6), (7), (9)] The abstract's claim that the framework is 'theoretically grounded with stability guarantees' rests entirely on assertions. Theorem 1, the Type I/II error relation in Eq. (6), the error bound in Eq. (7), and Theorem 2 are stated without proofs or derivations, and no domain of validity is given for parameters such as σ_c, δ, Δ, and Φ. In particular, Φ in Eq. (6) is not defined, and Eq. (7) is subsequently used as the basis for the reconstruction error bound. The authors should either supply complete derivations or explicitly soften the theoretical-guarantees claim.
[Section 4.1-4.2] The diffusion component is described only as a '50-step diffusion model with a linear noise schedule'; the architecture, pretraining data, and latent-space specification are not given. Without this information, it is unclear whether SADRE's advantage over the Regeneration Attack of [22] in Table 2 comes from the saliency-guided noise injection or simply from using a different, possibly stronger diffusion backbone. A controlled comparison using the same diffusion backbone with and without the saliency mask is needed to support the central empirical claim in Section 4.2.

minor comments (4)

[Table 2] The SSIM value of 0.1459 for RivaGAN under JPEG compression appears implausible relative to the neighboring entries and may be a typographical error; also, the identical SSIM values 0.9182 for DwtDct and DwtDctSvd under JPEG deserve a check.
[Eq. (6)] The function Φ in Eq. (6) is never defined; if it denotes the standard normal CDF, this should be stated explicitly, along with the assumptions that justify its use.
[Eqs. (8)-(9)] The composite metric D in Eq. (8) and the DSSIM term in Eq. (9) rely on a formal definition of DSSIM, but the manuscript only describes it as 'the inverse of SSIM'; the exact formula should be provided.
[Section 2.1] The threat model assumes the adversary can estimate τ(x_w), but this assumption is never validated for any of the six watermarking schemes; a brief discussion or empirical check would strengthen the threat-model section.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: reported results are benchmarked against external attacks; theoretical bounds are asserted rather than derived and do not construct the empirical numbers.

full rationale

The paper's central empirical claim is a comparative evaluation against external baselines (JPEG compression, VAE, and the Regeneration Attack) on six watermarking schemes, reporting measured PSNR, SSIM, W_p, and BRA values. None of these reported quantities is defined as the output of the model's own equations: SADRE's BRA and W_p values are experimental measurements, not algebraic consequences of Eq. (8) or Eq. (9). The theoretical statements (Theorem 1, Eq. (7), Theorem 2) are asserted without proof, and while Theorem 1 restates the stability condition from the problem statement and Theorem 2 uses the composite metric D defined in Eq. (8), these are unsupported claims rather than derivations that feed back into the empirical pipeline. The paper contains self-citations ([2], [3], [6]) but they are contextual references to the authors' other work and are not load-bearing for the watermark-removal derivation or the benchmark results. There is no fitted parameter that is then renamed as a prediction, no uniqueness theorem imported from the authors' prior work, and no known result merely renamed. The main weaknesses are the undefined saliency mask M and watermark-strength estimate τ(x_w), which are reproducibility and validity concerns, not circularity, because the paper does not define the measured metrics in terms of M or τ. Overall, the derivation chain does not reduce to its own inputs by construction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claims rest on several structural assumptions: Hölder continuity of the embedding, saliency as a proxy for watermark location, estimability of watermark strength, and an unproved reconstruction-stability theorem. Free parameters are the hand-set noise range, λ_w, α/β, and the diffusion schedule.

free parameters (4)

Adaptive noise level σ(x_w) = 0.05 to 0.15
Eq 3 defines σ as an argmin over detectability plus distortion, but the implementation sets it in a fixed 0.05-0.15 range without estimating watermark strength per image.
Weight λ_w = 0.1
Balances detectability and distortion in Eq 3; hand-set and not ablated.
Perceptual weights α and β in D and Theorem 2 = α=0.85, β=0.75
Chosen for the composite fidelity metric and used in the Theorem 2 inequality; no data-driven justification or normalization is given.
Diffusion steps and noise schedule = 50 steps, linear schedule
Experimental choice for the reverse diffusion; not derived from watermark strength.

assumptions (4)

ad hoc to paper The embedding function φ satisfies localized Hölder continuity (Eq 1).
Eq 1 asserts ∥φ(x_w)-φ(x)∥_M ≤ C ∥x_w-x∥^α_h for watermark-affected regions. This is assumed so that later error bounds in Eq 7 can be stated.
ad hoc to paper The saliency mask M identifies watermark-affected latent regions.
Eq 2 restricts noise to M. Invisible watermarks are not necessarily located in visually salient regions, and the paper provides no evidence that saliency aligns with watermark influence.
domain assumption The adversary can estimate the watermark strength τ(x_w).
Section 2.1 lists this as an adversary capability, and Eq 3 uses it to set σ, but no estimation method is given.
ad hoc to paper The reverse diffusion process reconstructs the clean image with bounded error (Theorem 1).
Theorem 1 states P[∥A(z̃)-x∥ ≤ ε] ≥ 1-δ with no proof; the bound is effectively assumed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removal." pith.science (2026). https://pith.science/paper/5XCVZGJJ

@misc{pith2026250412809,
  author       = {Pith},
  title        = {Pith review of: Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removal},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5XCVZGJJ}},
  note         = {Machine review of arXiv:2504.12809}
}

read the original abstract

As digital content becomes increasingly ubiquitous, the need for robust watermark removal techniques has grown due to the inadequacy of existing embedding techniques, which lack robustness. This paper introduces a novel Saliency-Aware Diffusion Reconstruction (SADRE) framework for watermark elimination on the web, combining adaptive noise injection, region-specific perturbations, and advanced diffusion-based reconstruction. SADRE disrupts embedded watermarks by injecting targeted noise into latent representations guided by saliency masks although preserving essential image features. A reverse diffusion process ensures high-fidelity image restoration, leveraging adaptive noise levels determined by watermark strength. Our framework is theoretically grounded with stability guarantees and achieves robust watermark removal across diverse scenarios. Empirical evaluations on state-of-the-art (SOTA) watermarking techniques demonstrate SADRE's superiority in balancing watermark disruption and image quality. SADRE sets a new benchmark for watermark elimination, offering a flexible and reliable solution for real-world web content. Code is available on~\href{https://github.com/inzamamulDU/SADRE}{\textbf{https://github.com/inzamamulDU/SADRE}}.

Figures

Figures reproduced from arXiv: 2504.12809 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 16 canonical work pages

[22]

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. 2023. In- visible image watermarks are provably removable using generative ai. arXiv preprint arXiv:2306.01953 (2023)

arXiv 2023
[1]

Ali Al-Haj. 2007. Combined DWT-DCT digital image watermarking. Journal of computer science 3, 9 (2007), 740–746

2007
[2]

Inzamamul Alam, Muhammad Shahid Muneer, and Simon S Woo. 2024. UGAD: Universal Generative AI Detector utilizing Frequency Fingerprints. In Proceed- ings of the 33rd ACM International Conference on Information and Knowledge Management. 4332–4340

work page 2024
[3]

Inzamamul Alam, Md Samiullah, SM Asaduzzaman, Upama Kabir, AM Aahad, and Simon S Woo. 2025. MIRACLE: Malware image recognition and classification by layered extraction. Data Mining and Knowledge Discovery 39, 1 (2025), 10

work page 2025
[4]

Mucong Ding, Tahseen Rabbani, Bang An, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. [n. d.]. WAVES: Benchmarking the Robustness of Image Watermarks. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models

work page 2024
[5]

Khalid M Hosny, Amal Magdi, Osama ElKomy, and Hanaa M Hamza. 2024. Digital image watermarking using deep learning: A survey. Computer Science Review 53 (2024), 100662

2024
[6]

Md Tanvir Islam, Inzamamul Alam, Simon S Woo, Saeed Anwar, IK Lee, and Khan Muhammad. 2024. LoLI-Street: Benchmarking Low-Light Image Enhancement and Beyond. In Proceedings of the Asian Conference on Computer Vision . 1250– 1267

work page 2024
[7]

Md Tanvir Islam, Nasir Rahim, Saeed Anwar, Muhammad Saqib, Sambit Bakshi, and Khan Muhammad. 2024. Hazespace2m: A dataset for haze aware single image dehazing. In Proceedings of the 32nd ACM International Conference on Multimedia . 9155–9164

work page 2024

Show all 23 references

[8]

Yicheng Leng, Chaowei Fang, Gen Li, Yixiang Fang, and Guanbin Li. 2024. Remov- ing Interference and Recovering Content Imaginatively for Visible Watermark Removal. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 38. 2983–2990

2024
[9]

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In2014 European Conference on Computer Vision (ECCV), Zurich, Switzerland, September 6-12, 2014, Proceed...

2014
[10]

Yang Liu, Zhen Zhu, and Xiang Bai. 2021. Wdnet: Watermark-decomposition network for visible watermark removal. In Proceedings of the IEEE/CVF winter conference on applications of computer vision . 3685–3693

2021
[11]

Marius Mitrea and Michael Taylor. 2000. Potential theory on Lipschitz domains in Riemannian manifolds: Holder continuous metric tensors. Communications in Partial Differential Equations 25, 7-8 (2000), 1487–1536

2000
[12]

KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. 2008. Dwt-dct-svd based watermarking. In 2008 3rd international conference on communication systems software and middleware and workshops (COMSW ARE’08). IEEE, 271–274

2008
[13]

Li Niu, Xing Zhao, Bo Zhang, and Liqing Zhang. 2023. Fine-grained Visible Watermark Removal. In Proceedings of the IEEE/CVF International Conference on Computer Vision. 12770–12779

2023
[14]

Jaesik Park, Yu-Wing Tai, and In So Kweon. 2012. Identigram/watermark removal using cross-channel correlation. In 2012 IEEE Conference on Computer Vision and Pattern Recognition. IEEE, 446–453

2012
[15]

Kavitha Soppari and N Subhash Chandra. 2023. Automated digital image wa- termarking based on multi-objective hybrid meta-heuristic-based clustering approach. International Journal of Intelligent Robotics and Applications 7, 1 (2023), 164–189

2023
[16]

Ruizhou Sun, Yukun Su, and Qingyao Wu. 2023. DENet: disentangled embedding network for visible watermark removal. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 2411–2419

2023
[17]

Matthew Tancik, Ben Mildenhall, and Ren Ng. 2020. Stegastamp: Invisible hy- perlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 2117–2126

2020
[18]

Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoine Manzagol
[19]

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree- Rings Watermarks: Invisible Fingerprints for Diffusion Images. In Advances in Neural Information Processing Systems , A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (Eds.), Vol. 36...

2023
[20]

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramacha- neni. 2019. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285 (2019)

2019 arXiv
[21]

Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. 2024. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 11964–11974

2024
[2008]

In Proceedings of the 25th international conference on Machine learning

Extracting and composing robust features with denoising autoencoders. In Proceedings of the 25th international conference on Machine learning . 1096–1103

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [22]

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. 2023. In- visible image watermarks are provably removable using generative ai. arXiv preprint arXiv:2306.01953 (2023)

arXiv 2023

[2] [1]

Ali Al-Haj. 2007. Combined DWT-DCT digital image watermarking. Journal of computer science 3, 9 (2007), 740–746

2007

[3] [2]

Inzamamul Alam, Muhammad Shahid Muneer, and Simon S Woo. 2024. UGAD: Universal Generative AI Detector utilizing Frequency Fingerprints. In Proceed- ings of the 33rd ACM International Conference on Information and Knowledge Management. 4332–4340

work page 2024

[4] [3]

Inzamamul Alam, Md Samiullah, SM Asaduzzaman, Upama Kabir, AM Aahad, and Simon S Woo. 2025. MIRACLE: Malware image recognition and classification by layered extraction. Data Mining and Knowledge Discovery 39, 1 (2025), 10

work page 2025

[5] [4]

Mucong Ding, Tahseen Rabbani, Bang An, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. [n. d.]. WAVES: Benchmarking the Robustness of Image Watermarks. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models

work page 2024

[6] [5]

Khalid M Hosny, Amal Magdi, Osama ElKomy, and Hanaa M Hamza. 2024. Digital image watermarking using deep learning: A survey. Computer Science Review 53 (2024), 100662

2024

[7] [6]

Md Tanvir Islam, Inzamamul Alam, Simon S Woo, Saeed Anwar, IK Lee, and Khan Muhammad. 2024. LoLI-Street: Benchmarking Low-Light Image Enhancement and Beyond. In Proceedings of the Asian Conference on Computer Vision . 1250– 1267

work page 2024

[8] [7]

Md Tanvir Islam, Nasir Rahim, Saeed Anwar, Muhammad Saqib, Sambit Bakshi, and Khan Muhammad. 2024. Hazespace2m: A dataset for haze aware single image dehazing. In Proceedings of the 32nd ACM International Conference on Multimedia . 9155–9164

work page 2024