Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulation

Bin Gong; Kui Ren; Peng Cheng; Qinglong Wang; Xinyu Zhang; YiTao Zhang; Zhongjie Ba

REVIEW 6 major objections 4 minor 36 references

Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulation

T0 review · 6 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Robust watermarks leak: a single image enables removal and forgery

desk verdict A genuinely novel single-image no-box attack with strong empirical results on robust watermarks, but the leakage story is over-sold and the channel-selection mechanism needs a control. read the letter →

arxiv 2502.06418 v1 pith:JTTOKFTB submitted 2025-02-10 cs.CV cs.CR

Zhongjie Ba , Yitao Zhang , Peng Cheng , Bin Gong , Xinyu Zhang , Qinglong Wang , Kui Ren This is my paper · ORCID

classification cs.CVcs.CR

keywords robustwatermarkingwatermarkleakagedetectionevasionforgeryno-boxattackchannel-awarefeatureextractionrobustness-stealthinessparadoxDAPAO

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Robust watermarks are supposed to survive real-world distortions, but this paper argues that the redundancy needed for that robustness is exactly what gives attackers a handle: robust schemes embed detectable patterns so redundantly that the patterns leak into ordinary image features. The authors propose DAPAO, an attack that extracts this leaked watermark information from a single watermarked image using channel-aware feature analysis, with no queries to the encoder or decoder. From that one image, DAPAO can both scrub the watermark from the carrier and transplant it onto a clean image, achieving detection evasion and forgery. Across seven watermarking schemes the authors report an average 60% gain in evasion success and 51% gain in forgery accuracy over state-of-the-art attacks while keeping visual quality high. If the claim holds, current robust post-processing watermarks are manipulable by any attacker with one uploaded image.

What carries the argument

The load-bearing mechanism is channel-aware leakage localization. The watermarked image is passed through DenseNet, a pre-trained convolutional feature extractor; the channel maps are clustered, and the two smallest clusters define a binary mask $W$ that picks out feature channels where watermark patterns concentrate. All attack stages are optimizations on masked features: Eq. 1 minimizes $L(W\cdot F(I_{wm}), W\cdot F(I_{wm}+\delta))$ under an $\ell^\infty$ budget for evasion, Eq. 2 does the same to extract the transferable watermark, and Eq. 3 aligns the non-watermark channels of the forged image with a clean target $I'$ so the transplanted watermark looks semantically natural. The supporting theory views an image's feature space as a direct sum $P_r \oplus P_c$ of watermark-ready and content channels; the encoder implicitly projects embeddings into $P_r$, and robustness beyond the threshold $C(I)$ forces spillover into $P_c$, which is what the mask detects.

What would settle it

Compare the attack's success when the mask $W$ is chosen by the two-smallest-clusters rule against the same optimization with $W$ set to random channel subsets of equal size. If random masks match the clustered mask's success rate, the leakage-localization mechanism is not doing the work. Separately, train a robust watermark whose encoder deliberately spreads the signal evenly over all channels: the claimed localized leakage should disappear and DAPAO's success should drop.

Watch

Extended reading notes

Core claim

At its core, the paper claims a robustness–stealthiness trade-off: to stay decodable under JPEG, noise, and screen-shooting distortions, learning-based watermarkers spread or amplify the watermark signal, and the decoder amplifies its attention to that signal. The authors formalize this as pressure on an embedding capacity $C(I)$, the largest watermark-to-image energy ratio that keeps visual quality above a threshold. Once robustness demands exceed $C(I)$, the encoder must carry watermark information in feature channels it would normally leave to image content, creating artifacts and cross-image pattern leakage that a pre-trained network can see. DAPAO exploits this by clustering the channel maps of one watermarked image, selecting the two smallest clusters as the leak-containing mask $W$, and then running Projected Gradient Descent to maximize feature distance on those masked channels. The resulting perturbation both removes the watermark on its own image (evasion) and, combined with a second-stage semantic alignment for strongly content-bound watermarks, transfers the watermark to a clean image (forgery).

Load-bearing premise

The attack's key assumption is that watermark leakage is concentrated in a small, identifiable set of DenseNet feature channels, namely the two smallest clusters of one image's channel maps, and that this set is consistent enough to optimize against.

Editorial extensions

If this is right

An attacker with no access to the encoder, decoder, or original image can defeat all seven tested post-processing watermarking schemes, including learned ones that survive JPEG, noise, and screen-shooting distortions.
Watermark removal and watermark forgery become two uses of a single extracted perturbation, so a leaked watermark can be scrubbed from one image and re-embedded on another at essentially the same cost.
Watermarking schemes that bind the watermark tightly to image semantics, such as in-processing methods like Tree-Ring, are expected to resist this attack, but those schemes cannot watermark existing real-world images.
Selecting only the two smallest feature clusters, rather than optimizing over all channels, is what preserves image quality; using all channels raises success but collapses SSIM and PSNR.
Because the attack requires only one image, dynamic or time-varying watermarks that change per image may still be exposed if their leakage is channel-concentrated.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial: If the capacity-based proof is correct, the leakage is a quantitative consequence of pushing robustness past the embeddable threshold, so any future robust watermark will leak at some distortion level; the paper's mask-finding procedure is one practical detector of that leak.
Editorial: The same channel-clustering signal could be used defensively: measuring how concentrated the leak is across DenseNet channels might serve as a cheap audit that a watermark has crossed its safe embedding capacity.
Editorial: Stage II suggests a more general transplant attack: if leaked watermark features can be aligned onto arbitrary content, an attacker could forge watermarks across many images from one source image, not just one target.
Editorial: A natural extension is to test DAPAO with other feature extractors or with multiple leaked images; success there would show the phenomenon is not a quirk of DenseNet channel statistics.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Worth a serious look. The attack is real: a single watermarked image, no queries to encoder or decoder, no paired data, and it gets detection-evasion SR above 0.9 on most of seven robust post-processing schemes, with PSNR in the mid-30s. That is a genuine step beyond WmAttacker, WmRobust, and the degradation baselines. The evaluation is honest in the sense that the targets are independently trained decoders, so there is no fitting to the target.

What's new is the combination: pre-trained DenseNet features, per-image clustering to pick a handful of channels, and PGD in that masked feature space to do both removal and forgery. The two-stage forgery for semantic watermarks is also a reasonable new idea.

The theory in Sec 4.2 is not load-bearing and should not be stated as a proof. The channel-capacity argument is applied to a learned system without justification, and the appendix algebra has an epsilon^2 vs epsilon mismatch. This can be cut or downgraded to a heuristic.

The more serious gap is that the channel-selection rule is never validated as watermark-specific. We don't get the cluster count k, the clustering algorithm, an ablation over k, or a random-channel control. The ablation shows the mask buys about 8 dB over using all channels, but we don't know a random mask of the same size wouldn't buy the same. That matters because the 'robust watermarks leak' narrative depends on the selected channels actually carrying watermark information. This doesn't kill the attack — the empirical result stands on its own — but it does mean the mechanism is asserted, not shown.

Also, the 60%/51% headline improvements aren't clearly derived from the tables, and the evaluation uses 100 images with no error bars. Fixable.

Bottom line: this deserves a proper review. The threat model is realistic, the attack is novel, and the results are strong enough to matter. The revision needs to fix or remove the theory, add a random-channel control and cluster-count ablation, and reconcile the headline numbers with the tables. I'd engage with it.

Referee Report

6 major / 4 minor

Summary. The paper proposes DAPAO, an attack framework against post-processing robust image watermarking schemes. The attack operates in a no-box setting: given a single watermarked image, it uses a pre-trained DenseNet as a feature extractor, clusters the resulting channel maps to identify a small set of feature channels believed to contain watermark leakage, and then optimizes a perturbation on those channels. The same extracted signal is used both to evade watermark detection (by perturbing the watermarked image) and to forge a watermark (by transferring the learned perturbation to a clean image). The authors report high success rates on seven watermarking schemes, including learning-based and classical ones, and claim 60% improvement in evasion success rate and 51% improvement in forgery accuracy over state-of-the-art methods. A theoretical argument in Sec. 4.2 is offered to explain why robust watermarks necessarily leak information.

Significance. If the central claim is correct, the paper identifies a practically relevant vulnerability: robust post-processing watermarks can be removed or forged from a single image without querying the encoder or decoder. The manuscript has real strengths: it evaluates against seven independent watermarking schemes, including robust learning-based methods; the attack success is measured against independently trained decoders, so the main result is not an artifact of fitting to the target model; and the ablation study begins to isolate the role of feature extraction. However, the significance is currently limited by an internally inconsistent theoretical section, an unvalidated and under-specified channel-selection mechanism, and quantitative claims that do not match the reported tables. The core empirical phenomenon may well be real, but the manuscript as written does not yet establish that the proposed channel-selection step is responsible for the attack's success, rather than generic feature-space perturbation.

major comments (6)

[Sec. 4.2 / Appendix C] The proof of Proposition 4.3 is internally inconsistent. In Definition 4.1, E(I, wm) is defined using phi(I, wm), while phi(I, wm) is defined by minimizing an objective that itself calls E(p, wm); this circularity makes the formal model incoherent. In the main text the capacity condition is written as ϵ||W|| ≤ sqrt((2^{2H(wm)} − 1)δη²), but the correct implication from R ≥ H(wm) is ϵ||W|| ≥ sqrt((2^{2H(wm)} − 1)δη²). The proof in Appendix C derives the inequality in the opposite direction from the main text. Because Proposition 4.3 is the stated theoretical basis for the robustness–stealthiness paradox, this section must be corrected, or the proposition should be explicitly labeled as a heuristic rather than a proof.
[Sec. 4.3 / Algorithm 1] The channel-selection mechanism is load-bearing but under-specified and unvalidated. The text says the method selects 'the two clusters with the smallest number of samples,' whereas Algorithm 1 says 'find the k clusters,' and neither k, the clustering algorithm, the DenseNet layer used, nor the number of selected channels is reported anywhere in the paper. More importantly, there is no ablation comparing W to a random subset of channels of equal size, no variation of k or of the clustering algorithm, and no analysis of whether the selected channel positions are stable across different images watermarked by the same scheme. Because W is computed per image from the attacked image itself, it may be dominated by content-dependent outlier channels rather than watermark leakage. Without such controls, the claim that watermark information 'leaks' specifically into a small identifiable channel subset is not established; the visual-fidelity improvement in Table 4 could equally come from perturbing a small number of arbitrary channels.
[Sec. 5.2 / Tables 1–3] The headline performance gains do not match the reported tables. In Table 1, the average absolute improvement over the best baseline success rate per scheme is about 0.49 on COCO, not 0.60, and for DwtDct and DwtDctSvd the gain over the JPEG baseline is only 0.03 and 0.08, respectively. In Table 3, the average absolute gain over WmRobust is about 0.14, not 0.51; the 51% figure only appears plausible when averaging over CopyAttack and Steganalysis, which have very low success rates. If '60%' and '51%' are meant as relative improvements, the denominator must be stated explicitly. The manuscript should report exact definitions of the improvement and align the abstract, Sec. 5.2, and the tables.
[Sec. 5.1 / Sec. 5.2] The evaluation uses only 100 images per dataset with no error bars, confidence intervals, or repeated runs. With n=100, the standard error of a success rate near 0.5 is 0.05, so several claimed advantages are within statistical noise: for example, in Table 1 the DwtDct row shows Ours 0.96 versus JPEG 0.93, a difference of 0.03, and in Table 3 the RivaGan row shows Ours 0.18 versus WmRobust 0.08. To support the quantitative claims, the authors should report the number of independent runs, standard deviations or exact binomial confidence intervals, and significance tests where relevant.
[Sec. 5.3 / Table 4] The ablation study does not control for the perturbation budget. Neither the value of ϵ nor the number of PGD steps is reported in Sec. 5.1 or in the algorithm descriptions. In Table 4, the w/o W, w/o F row reaches SR 1.0 on PIMoG and 0.62 on DwtDct at PSNR ≈ 27.5, while the full method reaches high SR at PSNR ≈ 34–36; these results are not directly comparable because the methods operate at different distortion levels. The authors should compare methods at matched perturbation budgets or matched PSNR values and explicitly state the values of ϵ and m used in all experiments.
[Sec. 4.4 / Algorithm 2] The mathematical objective of Stage I in the forgery attack is unclear. Equation (2) is exactly the evasion objective of Eq. (1), namely minimizing −L(W·F(Iwm), W·F(Iwm+δ)), but the forgery stage is supposed to extract watermark information, not merely distort it. Algorithm 2 shows a different update rule with a leading minus sign on the gradient, and the final output is I' − δ. The authors should clarify the sign convention in the optimizer update, define what objective is actually being optimized in Stage I, and explain why a perturbed watermarked image yields a watermark pattern that can be transferred to a clean image.

minor comments (4)

[Tables 1–3] The table entries are typeset without column separators (e.g., '0.32 0.628 25.0260 0.715 27.586'), making the tables very difficult to read. Please reformat the tables with proper vertical alignment.
[Sec. 5.1 / Algorithm 1] Several key hyperparameters are not reported: the perturbation budget ϵ, the number of PGD steps m, the DenseNet layer from which features are extracted, the clustering algorithm, and the value of k. These are necessary for reproduction.
[Sec. 4.1 / Figure 4] The feasibility study claims that leakage patterns are 'similar across different images' and that 'not all features contain such leakage,' but no quantitative metric is given. Please provide a numerical measure of channel-wise leakage and of cross-image similarity.
[Sec. 7.1] The statement that DAPAO exhibits 'limited performance' on Tree-Ring is not supported by any experiment. Either report the quantitative result or clearly label this as a conjecture.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the attack's success is measured against independently trained watermark decoders, and no load-bearing claim reduces by construction to its own inputs.

full rationale

The paper's central claim—that robust watermarks leak and that this leakage enables single-image no-box evasion and forgery—is tested against seven publicly available watermark decoders (DwtDctSvd, DwtDct, RivaGAN, StegaStamp, HiDDeN, PIMoG, CIN) using bit accuracy and success rate. These are external targets that the attack never queries or optimizes against, so the empirical result is not fitted to the benchmark. The channel mask W is indeed derived from the attacked image itself by clustering DenseNet feature channels and taking the two smallest clusters, but W is an input to the attack's feature-space objective, not a parameter fitted to the decoder. The optimization in Eq. (1)–(3) maximizes or minimizes distances between masked features; the reported outcome (decoder bit accuracy) is independent of that objective, so the derivation does not reduce to its own definition. The theoretical discussion in Sec. 4.2 is heuristic and informal; the notational circularity between E and phi in Definition 4.1 is not load-bearing because Proposition 4.3 and its proof rely on C(I) and a channel-capacity inequality rather than on that recursive mapping. There are no load-bearing self-citations: references to prior watermarking work are external, and no 'uniqueness theorem' or prior result by the same authors is invoked to force the chosen method. The paper itself notes an explicit limitation in Sec. 7.1 (limited performance on in-processing watermarks such as Tree-Ring), and its own Table 4 ablation shows that the all-channel variant 'w/o W' already reaches high success rates at lower PSNR, indicating that the mask mainly improves visual fidelity rather than guaranteeing attack success. These are correctness and generalizability concerns, not circularity. Because the central evaluation is self-contained against external decoders, the appropriate circularity finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central attack depends on unstated clustering hyperparameters and perturbation budgets, and the theoretical explanation rests on two unsupported domain assumptions and a misapplied information-theoretic formula. No new physical entities are introduced.

free parameters (4)

cluster count k
The attack clusters DenseNet feature channels and picks the two smallest clusters, but neither the clustering algorithm nor k is reported.
number of selected channels = not reported
The mask W is built from the two smallest clusters; the size of W is unspecified and likely depends on the image.
perturbation budget epsilon = not reported
The PGD budget ||δ||∞ < ε is central to both attacks but its value is not given in the main text or appendix.
PGD steps and loss weights = not reported
Step count m and the relative weighting of SSIM and L1 losses are not specified, preventing exact reproduction.

assumptions (4)

domain assumption The decoder must implicitly disentangle image content from watermark, and the encoder's feature space splits into Pr and Pc subspaces.
Introduced in Sec 4.2 without evidence; the equation defining φ(I,wm) is not well-typed (min over p in Pr of a function of E(p,wm)).
ad hoc to paper Robustness training increases watermark redundancy, expanding embedding regions into Pc and causing leakage.
The paper asserts this in Sec 4.1-4.2 and supports it with the feasibility study, but does not directly measure redundancy or embedding regions.
ad hoc to paper Watermark-related leakage is concentrated in a small number of feature channels identifiable by clustering.
Assumed in Sec 4.3; the feasibility study shows some channels differ, but the clustering-based localization is not independently validated.
standard math The channel capacity formula R = 1/2 log(1 + epsilon^2||W||^2/delta^2) applies to the watermark decoding problem.
Invoked in Sec 4.2, but the subsequent inequality is reversed, so the application is not correct as written.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulation." pith.science (2026). https://pith.science/paper/JTTOKFTB

@misc{pith2026250206418,
  author       = {Pith},
  title        = {Pith review of: Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JTTOKFTB}},
  note         = {Machine review of arXiv:2502.06418}
}

read the original abstract

Watermarking plays a key role in the provenance and detection of AI-generated content. While existing methods prioritize robustness against real-world distortions (e.g., JPEG compression and noise addition), we reveal a fundamental tradeoff: such robust watermarks inherently improve the redundancy of detectable patterns encoded into images, creating exploitable information leakage. To leverage this, we propose an attack framework that extracts leakage of watermark patterns through multi-channel feature learning using a pre-trained vision model. Unlike prior works requiring massive data or detector access, our method achieves both forgery and detection evasion with a single watermarked image. Extensive experiments demonstrate that our method achieves a 60\% success rate gain in detection evasion and 51\% improvement in forgery accuracy compared to state-of-the-art methods while maintaining visual fidelity. Our work exposes the robustness-stealthiness paradox: current "robust" watermarks sacrifice security for distortion resistance, providing insights for future watermark design.

Figures

Figures reproduced from arXiv: 2502.06418 by the authors.

**Figure 1.** Demonstration of our attacks. An attacker can perform watermark removal and forgery attacks with only one watermarked image without knowledge about the underlying watermarking systems. The attacker is free of copyright violation accusations as the extracted watermark is incorrect; the attacker can spread fake news by forging the watermark of an authoritative media. the technology safer (Diane Bartz, 2024). Watermar… view at source ↗

**Figure 2.** Illustration of learning-based watermarking methods. 2.1. Image Watermarking Image watermarking includes injection, extraction, and verification. During watermark injection, an encoder E(·, ·) receives the identification information wm (“0011011" in [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 4.** Demonstration of our feasibility study. 3.3. Attacker’s Capability The attacker can download watermarked images uploaded by the victim, perform watermark removal or watermark spoofing on a clean image. Notably, we assume three realistic limitations: 1) The attacker neither have knowledge about the target watermarking system (i.e., encoder and decoder), nor can he query the system; 2) The attacker cannot obtain the … view at source ↗

Figures from the paper (20 more)

**Figure 6.** Figure 6: Examples of watermark removal via our evasion attack on PIMoG [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: Examples of watermark spoofing via our forgery attack on PIMoG. P(X ≥ k|H0) = Pn i=k n k 0.5 n. 5.2. Results and Analysis In this section, we present the detailed results of our attacks and provide an analysis of the relevant findings. More detailed experimental res…

**Figure 8.** Figure 8: The detailed success rate of PIMoG evasion attacks and the corresponding PSNR visual metric on DIV2K dataset [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]

**Figure 10.** Figure 10: The detailed success rate of CIN evasion attacks and the corresponding PSNR visual metric on DIV2K dataset [PITH_FULL_IMAGE:figures/full_fig_p011_10.png]

**Figure 13.** Figure 13: The detailed success rate of PIMoG evasion attacks and the corresponding SSIM visual metric [PITH_FULL_IMAGE:figures/full_fig_p012_13.png]

**Figure 15.** Figure 15: The detailed success rate of CIN evasion attacks and the corresponding SSIM visual metric. A.2. Spoof Attack against Related Works We provide detailed spoof attack results as shown in [PITH_FULL_IMAGE:figures/full_fig_p012_15.png]

**Figure 16.** Figure 16: The detailed success rate of StegaStamp evasion attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p013_16.png]

**Figure 18.** Figure 18: The detailed success rate of RivaGan evasion attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p013_18.png]

**Figure 20.** Figure 20: The detailed success rate of HiDDeN evasion attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p014_20.png]

**Figure 22.** Figure 22: The detailed success rate of PIMoG evasion attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p014_22.png]

**Figure 25.** Figure 25: The detailed success rate of CIN evasion attacks and the corresponding SSIM visual metric [PITH_FULL_IMAGE:figures/full_fig_p015_25.png]

**Figure 26.** Figure 26: The detailed success rate of PIMoG forgery attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p015_26.png]

**Figure 28.** Figure 28: The detailed success rate of CIN forgery attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p016_28.png]

**Figure 30.** Figure 30: Examples of the evasion attack against HiDDeN. T V represents the lower bound of the visual quality. Proposition C.2. When the robustness requirement exceeds C(I), a decline in visual quality is inevitable. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_30.png]

**Figure 31.** Figure 31: Examples of the spoof attack against HiDDeN. Proof. Let the distortion layer T introduce noise η ∼ T , with the requirement that ||wm − D(Iwm + η)|| ≤ B B is bit error rate.Then computing channel capacity: R = 1 2 log(1 + ϵ 2 ||W||2 δ 2 η ) To correctly transmit K bit…

**Figure 32.** Figure 32: The detailed success rate of PIMoG forgery attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p018_32.png]

**Figure 35.** Figure 35: The detailed success rate of CIN forgery attacks and the corresponding SSIM visual metric. and the visual quality constraint be ϵ||W||2 ≤ C(I)||I||2 When q (22H(wm) − 1)δη2 > C(I)||I||2, the system cannot simultaneously satisfy both, and it is necessary to increase C(…

**Figure 37.** Figure 37: The detailed success rate of StegaStamp forgery attacks and the corresponding SSIM visual metric [PITH_FULL_IMAGE:figures/full_fig_p019_37.png]

**Figure 38.** Figure 38: The detailed success rate of RivaGan forgery attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p019_38.png]

**Figure 40.** Figure 40: The detailed success rate of HiDDeN forgery attacks and the corresponding PSNR visual metric [PITH_FULL_IMAGE:figures/full_fig_p020_40.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 18 canonical work pages

[1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...
[2]

URL https://www.midjourney.com/home

Midjourney, 2024. URL https://www.midjourney.com/home

work page 2024
[3]

URL https://openai.com/sora

Sora, 2024. URL https://openai.com/sora

work page 2024
[4]

and Timofte, R

Agustsson, E. and Timofte, R. Ntire 2017 challenge on single image super-resolution: Dataset and study. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, July 2017

2017
[5]

Combined dwt-dct digital image watermarking

Al-Haj, A. Combined dwt-dct digital image watermarking. Journal of computer science, 3 0 (9): 0 740--746, 2007

work page 2007
[6]

Benchmarking the robustness of image watermarks

An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y., Deng, C., Zhu, S., Mohamed, A., Wen, Y., Goldstein, T., et al. Benchmarking the robustness of image watermarks. arXiv preprint arXiv:2401.08573, 2024

arXiv 2024
[7]

Lsb based digital image watermarking for gray scale image

Chopra, D., Gupta, P., Sanjay, G., and Gupta, A. Lsb based digital image watermarking for gray scale image. IOSR Journal of Computer Engineering, 6 0 (1): 0 36--41, 2012

work page 2012
[8]

Diane Bartz, K. H. Openai, google, others pledge to watermark ai content for safety, white house says, 2024. URL https://www.reuters.com/technology/openai-google-others-pledge-watermark-ai-content-safety-white-house-2023-07-21/

work page 2024

Show all 36 references

[9]

PIMoG : An Effective Screen-shooting Noise-Layer Simulation for Deep-Learning-Based Watermarking Network

Fang, H., Jia, Z., Ma, Z., Chang, E.-C., and Zhang, W. PIMoG : An Effective Screen-shooting Noise-Layer Simulation for Deep-Learning-Based Watermarking Network . In Proceedings of the 30th ACM International Conference on Multimedia , pp.\ 2267--2275, Lisboa Portugal, October 2022. ACM

2022
[10]

Denoising diffusion probabilistic models

Ho, J., Jain, A., and Abbeel, P. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 0 6840--6851, 2020

2020
[11]

A transfer attack to image watermarks

Hu, Y., Jiang, Z., Guo, M., and Gong, N. A transfer attack to image watermarks. arXiv preprint arXiv:2403.15365, 2024

2024 arXiv
[12]

Huang, G., Liu, Z., van der Maaten, L., and Weinberger, K. Q. Densely connected convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017

2017
[13]

Jiang, Z., Zhang, J., and Gong, N. Z. Evading watermark based detection of ai-generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 1168--1181, 2023

2023
[14]

Jiang, Z., Guo, M., Hu, Y., and Gong, N. Z. Watermark-based detection and attribution of ai-generated content. arXiv preprint arXiv:2404.04254, 2024

2024
[15]

and Hengartner, U

Kassis, A. and Hengartner, U. Unmarker: A universal attack on defensive watermarking. CoRR, abs/2405.08363, 2024. URL https://doi.org/10.48550/arXiv.2405.08363

2024 doi arXiv
[16]

Kayleen Devlin, J. C. Fake trump arrest photos: How to spot an ai-generated image, 2024. URL https://www.bbc.com/news/world-us-canada-65069316

2024
[17]

V., and Herrigel, A

Kutter, M., Voloshynovskiy, S. V., and Herrigel, A. Watermark copy attack. In Security and Watermarking of Multimedia Contents II, volume 3971, pp.\ 371--380. SPIE, 2000

2000
[18]

Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Doll \'a r, P., and Zitnick, C. L. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp....

2014
[19]

A novel two-stage separable deep learning framework for practical blind watermarking

Liu, Y., Guo, M., Zhang, J., Zhu, Y., and Xie, X. A novel two-stage separable deep learning framework for practical blind watermarking. In Proceedings of the 27th ACM International Conference on Multimedia, MM '19, pp.\ 1509–1517, New York, NY, USA, 2019. Association for Compu...

2019
[20]

Decoupled weight decay regularization

Loshchilov, I. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017

2017 arXiv
[21]

Leveraging optimization for adaptive attacks on image watermarks

Lukas, N., Diaa, A., Fenaux, L., and Kerschbaum, F. Leveraging optimization for adaptive attacks on image watermarks. In The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=O9PArxKLe1

2024
[22]

Towards Blind Watermarking : Combining Invertible and Non-invertible Mechanisms

Ma, R., Guo, M., Hou, Y., Yang, F., Li, Y., Jia, H., and Xie, X. Towards Blind Watermarking : Combining Invertible and Non-invertible Mechanisms . In Proceedings of the 30th ACM International Conference on Multimedia , pp.\ 1532--1542, Lisboa Portugal, October 2022. ACM. doi:1...

2022
[23]

Towards deep learning models resistant to adversarial attacks

M a dry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. stat, 1050 0 (9), 2017

2017
[24]

A., Ajay, M

Navas, K. A., Ajay, M. C., Lekshmi, M., Archana, T. S., and Sasikumar, M. DWT-DCT-SVD based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops ( COMSWARE '08) , pp.\ 271--274. IEEE, January 2008

2008
[25]

Dalle3, 2024

OpenAI. Dalle3, 2024. URL https://openai.com/index/dall-e-3/

2024
[26]

S., Rezaei, K., Kumar, A., Chegini, A., Wang, W., and Feizi, S

Saberi, M., Sadasivan, V. S., Rezaei, K., Kumar, A., Chegini, A., Wang, W., and Feizi, S. Robustness of ai-image detectors: Fundamental limits and practical attacks. arXiv preprint arXiv:2310.00076, 2023

2023 arXiv
[27]

Stegastamp: Invisible hyperlinks in physical photographs

Tancik, M., Mildenhall, B., and Ng, R. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 2117--2126, 2020

2020
[28]

and buley

Wang, Q. and buley. Invisible watermark. https://github.com/ ShieldMnt/invisible- watermark., 2020. Online; accessed 27-Jan-2025

2020
[29]

C., Sheikh, H

Wang, Z., Bovik, A. C., Sheikh, H. R., and Simoncelli, E. P. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13 0 (4): 0 600--612, 2004

2004
[30]

Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

Wen, Y., Kirchenbauer, J., Geiping, J., and Goldstein, T. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023

2023 arXiv
[31]

Yang, P., Ci, H., Song, Y., and Shou, M. Z. Steganalysis on digital watermarking: Is your defense truly impervious?, 2024. URL https://arxiv.org/abs/2406.09026

2024 arXiv
[32]

Artificial Fingerprinting for Generative Models : Rooting Deepfake Attribution in Training Data

Yu, N., Skripniuk, V., Abdelnabi, S., and Fritz, M. Artificial Fingerprinting for Generative Models : Rooting Deepfake Attribution in Training Data . In 2021 IEEE / CVF International Conference on Computer Vision ( ICCV ) , pp.\ 14428--14437, Montreal, QC, Canada, October 2021...

2021
[33]

S., and Fritz, M

Yu, N., Skripniuk, V., Chen, D., Davis, L. S., and Fritz, M. Responsible disclosure of generative models using scalable fingerprinting. In International Conference on Learning Representations, 2021 b

2021
[34]

A., Xu, L., Cuesta-Infante, A., and Veeramachaneni, K

Zhang, K. A., Xu, L., Cuesta-Infante, A., and Veeramachaneni, K. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285, 2019

1909 arXiv
[35]

Invisible image watermarks are provably removable using generative ai

Zhao, X., Zhang, K., Su, Z., Vasan, S., Grishchenko, I., Kruegel, C., Vigna, G., Wang, Y.-X., and Li, L. Invisible image watermarks are provably removable using generative ai. arXiv preprint arXiv:2306.01953, 2023

2023 arXiv
[36]

Hidden: Hiding data with deep networks

Zhu, J., Kaplan, R., Johnson, J., and Fei-Fei, L. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp.\ 657--672, 2018

2018

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

[2] [2]

URL https://www.midjourney.com/home

Midjourney, 2024. URL https://www.midjourney.com/home

work page 2024

[3] [3]

URL https://openai.com/sora

Sora, 2024. URL https://openai.com/sora

work page 2024

[4] [4]

and Timofte, R

Agustsson, E. and Timofte, R. Ntire 2017 challenge on single image super-resolution: Dataset and study. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, July 2017

2017

[5] [5]

Combined dwt-dct digital image watermarking

Al-Haj, A. Combined dwt-dct digital image watermarking. Journal of computer science, 3 0 (9): 0 740--746, 2007

work page 2007

[6] [6]

Benchmarking the robustness of image watermarks

An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y., Deng, C., Zhu, S., Mohamed, A., Wen, Y., Goldstein, T., et al. Benchmarking the robustness of image watermarks. arXiv preprint arXiv:2401.08573, 2024

arXiv 2024

[7] [7]

Lsb based digital image watermarking for gray scale image

Chopra, D., Gupta, P., Sanjay, G., and Gupta, A. Lsb based digital image watermarking for gray scale image. IOSR Journal of Computer Engineering, 6 0 (1): 0 36--41, 2012

work page 2012

[8] [8]

Diane Bartz, K. H. Openai, google, others pledge to watermark ai content for safety, white house says, 2024. URL https://www.reuters.com/technology/openai-google-others-pledge-watermark-ai-content-safety-white-house-2023-07-21/

work page 2024