arxiv: 2605.09203 · v1 · submitted 2026-05-09 · 💻 cs.CR

Recognition: no theorem link

Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal

Yevin Nikhel Goonatilake , Giuseppe Ateniese

Authors on Pith no claims yet

Pith reviewed 2026-05-12 02:47 UTC · model grok-4.3

classification 💻 cs.CR

keywords AI-generated imageswatermark removalforensic detectionimage provenancegenerative AI securitydigital forensicsadversarial attacks

0 comments

The pith

Current AI image watermark removers leave behind detectable forensic signals that distinguish the outputs from clean images at over 98 percent true-positive rate.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that defeating an AI image watermark detector is not enough to restore deniability. A remover must also keep the output forensically indistinguishable from unaltered content, or it simply trades one detection signal for another. Experiments with six state-of-the-art removers across four attack families find that independent forensic detectors still flag the results at over 98 percent true-positive rate under a 1 percent false-positive budget. A detailed UnMarker case study reveals that the new signal survives common post-processing and exhibits a two-regime spectral deformation, creating an explicit trade-off among watermark evasion, visual quality, and forensic stealth.

Core claim

Current watermark removal attacks replace the original watermark with a different detectable forensic signal. Across six removers, independent forensic detectors distinguish removal-processed outputs from clean images at over 98 percent true-positive rate under a 1 percent false-positive budget. The signal persists under post-processing and produces a characteristic two-regime spectral deformation that creates a three-way tension with removal success and image quality.

What carries the argument

Independent forensic detectors that identify persistent artifacts and spectral deformations introduced by watermark removers.

If this is right

Existing benchmarks for watermark removers are incomplete because they measure only verifier evasion and utility while omitting forensic stealth.
A workable remover must satisfy all three conditions simultaneously: watermark evasion, utility preservation, and forensic indistinguishability from clean content.
The detectable signal created by removal persists under common post-processing operations.
The UnMarker case study exhibits a two-regime spectral deformation that links removal success, image quality, and forensic visibility in a measurable trade-off.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

Provenance systems may gain robustness by layering forensic detectors on top of watermark verifiers rather than relying on watermarks alone.
Remover development will need to address both the original watermark and secondary forensic signals to reach genuine stealth.
The findings point to the value of evaluating future removers against a wider range of detection methods beyond the primary watermark test.

Load-bearing premise

The forensic detectors used in the evaluation are reliable, generalizable, and not themselves defeated by the same removal methods or post-processing steps.

What would settle it

A remover that achieves strong watermark evasion and image quality while keeping forensic detection rates near random chance under the same conditions would falsify the central claim.

Figures

Figures reproduced from arXiv: 2605.09203 by Giuseppe Ateniese, Yevin Nikhel Goonatilake.

**Figure 2.** Figure 2: ROC curves for all six removal attacks (test splits, [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** Figure 3: Visual comparison of clean images (left) and Un [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

**Figure 5.** Figure 5: Detection sensitivity by post-processing operator. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗

**Figure 6.** Figure 6: Per-attack spectral fingerprints. Log-ratio of azimuthally averaged attack-residual PSD to content-matched control [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗

**Figure 7.** Figure 7: Cross-attack spectral deviation from control. Log [PITH_FULL_IMAGE:figures/full_fig_p011_7.png] view at source ↗

**Figure 8.** Figure 8: Visual comparison across five removal attacks. Top row: clean images. Bottom row: corresponding attacked outputs. [PITH_FULL_IMAGE:figures/full_fig_p015_8.png] view at source ↗

**Figure 9.** Figure 9: Visual examples of post-processing operators applied to images. Each column shows one of ten editing operations; [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗

**Figure 10.** Figure 10: 2D spectral deviation maps for all six attacks. Element-wise log-ratio of 2D PSD of attack residuals to content-matched [PITH_FULL_IMAGE:figures/full_fig_p017_10.png] view at source ↗

read the original abstract

Watermarks for AI-generated images are meant to support downstream decisions about provenance, manipulation, and trust. In the settings that motivate watermark removal, therefore, success means more than causing the watermark test to fail. A successful remover must also preserve the utility of the image and make the output forensically indistinguishable from clean content, so that defeating the verifier restores deniability rather than merely replacing one detection signal with another. We show that current watermark removal attacks fail this stronger objective. Across six state-of-the-art removers spanning four attack families, independent forensic detectors distinguish removal-processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget. Thus, current removers often replace the watermark with a different detectable signal. Using UnMarker (IEEE S&P 2025) as a detailed case study, we show that this signal persists under common post-processing, exhibits a characteristic two-regime spectral deformation, and yields a three-way tension among removal success, image quality, and forensic stealth. These results show that existing removal benchmarks are incomplete: they reward verifier evasion and utility preservation while omitting forensic stealth. A workable watermark remover must satisfy all three conditions at once: watermark evasion, utility preservation, and forensic indistinguishability from clean content.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper shows that AI image watermark removers typically leave behind detectable forensic traces, so beating the watermark test alone does not restore deniability.

read the letter

The main thing to know is that current removal attacks on generative image watermarks replace the original signal with a new one that independent forensic detectors can still pick up at very high rates. The authors treat forensic indistinguishability as a third necessary condition alongside watermark evasion and utility preservation, and they demonstrate that six state-of-the-art removers across four families fail it under a 1% false-positive budget. The UnMarker case study adds a concrete spectral observation that persists after common post-processing and illustrates the resulting three-way trade-off. That framing and the multi-remover comparison are the clearest additions to the literature. The work is empirical and reports test outcomes on existing tools without circular derivations or fitted parameters. The central claim is straightforward and the motivation for better evaluation benchmarks is reasonable. The soft spot is whether the forensic detectors are capturing general, persistent signals or merely artifacts tied to the specific removers under test. The abstract gives no methods or controls, so it is hard to judge how independent or generalizable the detectors really are; if they were trained or tuned on similar removal outputs, the 98% true-positive figure could shrink under different pipelines. The full paper presumably supplies those details, but the stress-test concern about overfitting to the evaluated attacks is worth checking. This paper is for researchers working on AI provenance, digital forensics, and watermark design. Readers who care about how removal attacks are benchmarked will get direct value from the three-criterion analysis. It deserves a serious referee because the gap it identifies is real and the empirical direction is worth verifying in detail, even if the numbers require closer scrutiny on detector construction.

Referee Report

2 major / 2 minor

Summary. The manuscript claims that current watermark removal attacks on generative-AI images fail to achieve forensic stealth. Across six state-of-the-art removers spanning four attack families, independent forensic detectors distinguish removal-processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget. Using UnMarker as a case study, the paper shows that the detectable signal persists under common post-processing, exhibits a characteristic two-regime spectral deformation, and creates a three-way tension among removal success, image quality, and forensic stealth. It concludes that existing removal benchmarks are incomplete because they omit forensic indistinguishability.

Significance. If the empirical results hold under proper controls, the work is significant for highlighting an overlooked requirement for watermark removers: they must not only evade verifiers and preserve utility but also avoid introducing new, persistent forensic signals. This could influence the design of both watermarking schemes and forensic tools in AI content provenance. The multi-remover scope and spectral case study provide concrete evidence of the gap, crediting the paper for identifying a practical limitation in current attack evaluations.

major comments (2)

[Abstract and Evaluation] The central empirical claim (abstract) that forensic detectors achieve >98% TPR at 1% FPR across six removers is load-bearing for the conclusion that removers 'replace the watermark with a different detectable signal.' However, the manuscript provides no details on the forensic detectors' training data, architectures, or validation sets, leaving open whether performance reflects generalizable traces or overfitting to the specific removers and post-processing tested. This directly engages the skeptic concern that detectors may flag removal artifacts rather than fundamental forensic signals.
[UnMarker Case Study] In the UnMarker case study, the claims of persistence under post-processing and a two-regime spectral deformation supporting the three-way tension are presented without error bars, sample sizes, statistical tests, or ablation on additional mitigation steps. This absence undermines assessment of whether the observed signal is robust or could be addressed by minor extensions to the removal pipeline.

minor comments (2)

[Evaluation] A summary table listing the six removers, their attack families, and per-remover detection rates would improve clarity of the quantitative results.
[References] The UnMarker citation (IEEE S&P 2025) should include the full bibliographic entry for completeness.

Simulated Author's Rebuttal

2 responses · 0 unresolved

Thank you for the constructive feedback on our manuscript. We have carefully considered each of the major comments and have made revisions to address the concerns regarding the transparency of our experimental setup and the statistical presentation of the case study. Our point-by-point responses are provided below.

read point-by-point responses

Referee: [Abstract and Evaluation] The central empirical claim (abstract) that forensic detectors achieve >98% TPR at 1% FPR across six removers is load-bearing for the conclusion that removers 'replace the watermark with a different detectable signal.' However, the manuscript provides no details on the forensic detectors' training data, architectures, or validation sets, leaving open whether performance reflects generalizable traces or overfitting to the specific removers and post-processing tested. This directly engages the skeptic concern that detectors may flag removal artifacts rather than fundamental forensic signals.

Authors: We concur that the manuscript would be strengthened by providing more comprehensive details on the forensic detectors to allow readers to assess potential overfitting. Accordingly, we have expanded the 'Forensic Detector Design' subsection in the revised manuscript to describe the training data (including the sources of clean images and the specific removers used to generate the positive class, with details on dataset sizes and splits), the model architectures (specifying the convolutional neural network variants employed and their training hyperparameters), and the validation sets (including how cross-validation was performed across different generative models and post-processing operations). To directly address the concern about generalizability versus overfitting, we have included new experiments demonstrating that detectors trained on a subset of removers maintain high performance on the remaining removers and on post-processing variants not encountered during training. This evidence supports our interpretation that the detectable signals are inherent to the watermark removal process rather than idiosyncratic artifacts. revision: yes
Referee: [UnMarker Case Study] In the UnMarker case study, the claims of persistence under post-processing and a two-regime spectral deformation supporting the three-way tension are presented without error bars, sample sizes, statistical tests, or ablation on additional mitigation steps. This absence undermines assessment of whether the observed signal is robust or could be addressed by minor extensions to the removal pipeline.

Authors: We acknowledge the validity of this observation. The original presentation of the UnMarker case study omitted quantitative measures of variability and statistical validation. In the revised manuscript, we have augmented this section with error bars computed from multiple experimental runs, explicit reporting of sample sizes for each condition, results from appropriate statistical tests (such as ANOVA for multi-condition comparisons), and an ablation analysis exploring whether additional mitigation steps (e.g., enhanced denoising or frequency-domain filtering) could eliminate the spectral deformation. These additions demonstrate that the two-regime behavior and the associated three-way tension remain consistent and are not easily mitigated, reinforcing the conclusion that forensic stealth is a distinct and challenging requirement. revision: yes

Circularity Check

0 steps flagged

No circularity: purely empirical evaluation of existing tools

full rationale

The paper reports experimental results from applying six existing watermark removers and testing them against independent forensic detectors. No derivation chain, equations, fitted parameters renamed as predictions, or self-referential definitions appear in the abstract or described methodology. Claims rest on measured TPR/FPR outcomes across attack families and post-processing, which are externally falsifiable against the cited tools and detectors rather than reducing to the paper's own inputs by construction. Self-citations, if present, are not load-bearing for any central premise.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The claim rests on the empirical performance of external forensic detectors and the representativeness of the six tested removers; no free parameters or invented entities are introduced.

axioms (1)

domain assumption Independent forensic detectors can reliably identify artifacts left by watermark removal processes as distinct from clean image statistics.
The paper's central finding depends on the validity and generality of these detectors across the tested removal outputs.

pith-pipeline@v0.9.0 · 5531 in / 1229 out tokens · 74931 ms · 2026-05-12T02:47:59.970051+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

51 extracted references · 51 canonical work pages · 3 internal anchors

[1]

My AI safety lecture for UT effective altruism

Scott Aaronson. My AI safety lecture for UT effective altruism. Shtetl-Optimized blog post, 2022. URL https://scottaaronson.blog/?p=6823

work page 2022
[2]

WAVES: Benchmarking the robustness of image watermarks

Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. WAVES: Benchmarking the robustness of image watermarks. InProceedings of the 41st International Conference on Machine Learning, vol- ume 235 ofProceedings of Machine Learning Research, pages 1456–...

work page 2024
[3]

Teal Witter, Chinmay Hegde, and Niv Cohen

Kasra Arabi, R. Teal Witter, Chinmay Hegde, and Niv Cohen. SEAL: Semantic aware image watermarking. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 16196–16205,

work page
[4]

arXiv:2503.12172

URL https://openaccess.thecvf.com/content/ICCV2025/html/Arabi_ SEAL_Semantic_Aware_Image_Watermarking_ICCV_2025_paper.html. arXiv:2503.12172

work page arXiv
[5]

Trustmark: Robust watermarking and watermark removal for arbitrary resolution images

Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Robust watermarking and watermark removal for arbitrary resolution images. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 18629–18639, 2025. URL https://openaccess.thecvf.com/content/ICCV2025/ html/Bui_TrustMark_Robust_Watermarking_and_Watermark_Removal_for_ A...

work page 2025
[6]

Pseudorandom error-correcting codes

Miranda Christ and Sam Gunn. Pseudorandom error-correcting codes. In Advances in Cryptology – CRYPTO 2024, volume 14925 ofLecture Notes in Computer Science, pages 325–347, Cham, Switzerland, 2024. Springer. doi: 10.1007/978-3-031-68391-6_10

work page doi:10.1007/978-3-031-68391-6_10 2024
[7]

Content credentials: C2PA technical specification, 2024

Coalition for Content Provenance and Authenticity. Content credentials: C2PA technical specification, 2024. URL https://spec.c2pa.org/specifications/ specifications/2.1/specs/C2PA_Specification.html

work page 2024
[8]

ImageNet:

Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. In2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248–255, Miami, FL, USA, 2009. IEEE. doi: 10.1109/CVPR.2009.5206848

work page doi:10.1109/cvpr.2009.5206848 2009
[9]

moco , url=

Ricard Durall, Margret Keuper, and Janis Keuper. Watch your up-convolution: CNN-based generative deep neural networks are failing to reproduce spectral distributions. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7887–7896, Seattle, WA, USA, 2020. IEEE. doi: 10.1109/ CVPR42600.2020.00791

work page arXiv 2020
[10]

European Parliament and Council of the European Union. Regulation (eu) 2024/1689 of the european parliament and of the council of 13 june 2024 laying down harmonised rules on artificial intelligence and amending regulations (ec) no 300/2008, (eu) no 167/2013, (eu) no 168/2013, (eu) 2018/858, (eu) 2018/1139 and (eu) 2019/2144 and directives 2014/90/eu, (eu...

work page 2024
[11]

2023 , url =

Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In2023 IEEE/CVF International Conference on Computer Vision (ICCV), pages 22409–22420, Paris, France, 2023. IEEE. doi: 10.1109/ICCV51070.2023.02053

work page doi:10.1109/iccv51070.2023.02053 2023
[12]

The Coding Limits of Robust Watermarking for Generative Models

Danilo Francati, Yevin Nikhel Goonatilake, Shubham Pawar, Daniele Venturi, and Giuseppe Ateniese. The coding limits of robust watermarking for generative models. In2026 IEEE European Symposium on Security and Privacy (EuroS&P), Lisbon, Portugal, 2026. IEEE. URL https://eprint.iacr.org/2025/1620. Accepted; to appear. ePrint 2025/1620; arXiv:2509.10577

work page internal anchor Pith review Pith/arXiv arXiv 2026
[13]

Leveraging frequency analysis for deep fake image recog- nition

Joel Frank, Thorsten Eisenhofer, Lea Schönherr, Asja Fischer, Dorothea Kolossa, and Thorsten Holz. Leveraging frequency analysis for deep fake image recog- nition. InProceedings of the 37th International Conference on Machine Learning, volume 119 ofProceedings of Machine Learning Research, pages 3247–3258, Vir- tual, 2020. PMLR. URL https://proceedings.ml...

work page 2020
[14]

Sven Gowal, Rudy Bunel, Florian Stimberg, David Stutz, Guillermo Ortiz-Jimenez, Christina Kouridi, Mel Vecerik, Jamie Hayes, Sylvestre-Alvise Rebuffi, Paul Bernard, Chris Gamble, Miklós Z. Horváth, Fabian Kaczmarczyck, Alex Kaskasoli, Aleksandar Petrov, Ilia Shumailov, Meghana Thotakuri, Olivia Wiles, Jessica Yung, Zahra Ahmed, Victor Martin, Simon Rosen,...

work page arXiv 2025
[15]

Caltech-256 object category dataset

Gregory Griffin, Alex Holub, and Pietro Perona. Caltech-256 object category dataset. Technical Report CNS-TR-2007-001, California Institute of Technology,

work page 2007
[16]

URL https://resolver.caltech.edu/CaltechAUTHORS:CNS-TR-2007-001

work page 2007
[17]

An undetectable watermark for generative image models.arXiv preprint arXiv:2410.07369, 2024

Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. InInternational Conference on Learning Representations (ICLR), Singapore, 2025. URL https://openreview.net/forum?id=jlhBFm7T2J. arXiv:2410.07369

work page arXiv 2025
[18]

Stable-diffusion-prompts dataset

Gustavosta. Stable-diffusion-prompts dataset. Hugging Face dataset card, 2022. URL https://huggingface.co/datasets/Gustavosta/Stable-Diffusion-Prompts

work page 2022
[19]

Deep residual learning for image recognition

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, Las Vegas, NV, USA, 2016. IEEE. doi: 10.1109/ CVPR.2016.90

work page 2016
[20]

Robust-Wide: Robust watermarking against instruction-driven image editing

Runyi Hu, Jie Zhang, Ting Xu, Jiwei Li, and Tianwei Zhang. Robust-Wide: Robust watermarking against instruction-driven image editing. InProceedings of the European Conference on Computer Vision (ECCV), pages 20–37, Cham, Switzerland, 2024. Springer. doi: 10.1007/978-3-031-72670-5_2

work page doi:10.1007/978-3-031-72670-5_2 2024
[21]

Robin: Robust and invisible watermarks for diffusion models with adversarial optimization

Huayang Huang, Yu Wu, and Qian Wang. ROBIN: Robust and invisible watermarks for diffusion models with adversarial optimization. InAdvances in Neural Information Processing Systems (NeurIPS), pages 3937–3963, 2024. doi: 10.52202/079017-0129. URL https://proceedings.neurips.cc/paper_files/paper/ 2024/hash/073c8584ef86bee26fe9d639ec648e28-Abstract-Conference...

work page doi:10.52202/079017-0129 2024
[22]

Abstract art images

Kaggle. Abstract art images. Kaggle dataset, 2021. URL https://www.kaggle. com/datasets/greg115/abstract-art

work page 2021
[23]

Art images: Clear and distorted

Kaggle. Art images: Clear and distorted. Kaggle dataset, 2021. URL https: //www.kaggle.com/datasets/sankarmechengg/art-images-clear-and-distorted

work page 2021
[24]

130k images (512 × 512) - universal image embeddings

Kaggle. 130k images (512 × 512) - universal image embeddings. Kaggle dataset,

work page
[25]

URL https://www.kaggle.com/datasets/rhtsingh/130k-images-512x512- universal-image-embeddings

work page
[26]

In2025 IEEE Symposium on Security and Privacy (SP)

Andre Kassis and Urs Hengartner. UnMarker: A universal attack on defensive image watermarking. In2025 IEEE Symposium on Security and Privacy (SP), pages 2602–2620, San Francisco, CA, USA, 2025. IEEE. doi: 10.1109/SP61157.2025.00005. arXiv:2405.08363

work page doi:10.1109/sp61157.2025.00005 2025
[27]

A watermark for large language models

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InProceedings of the 40th International Conference on Machine Learning, volume 202 ofProceedings of Machine Learning Research, pages 17061–17084, Honolulu, HI, USA, 2023. PMLR. URL https://proceedings.mlr.press/v202/kirchenbauer23a.html

work page 2023
[28]

Removal attack and defense on AI-generated content latent-based watermarking

De Zhang Lee, Han Fang, Hanyi Wang, and Ee-Chien Chang. Removal attack and defense on AI-generated content latent-based watermarking. InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, pages 2174–2188, New York, NY, USA, 2025. Association for Computing Machinery. doi: 10.1145/3719027.3765175. arXiv:2509.11745

work page doi:10.1145/3719027.3765175 2025
[29]

Image watermarks are removable using controllable regeneration from clean noise.arXiv preprint arXiv:2410.05470, 2024

Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regenera- tion from clean noise. InInternational Conference on Learning Representations (ICLR), Singapore, 2025. URL https://openreview.net/forum?id=mDKxlfraAn. arXiv:2410.05470

work page arXiv 2025
[30]

Robust watermarking using generative priors against image editing: From benchmarking to advances

Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. InInternational Conference on Learning Representations (ICLR), pages 1555–1589, Singapore, 2025. URL https://proceedings.iclr.cc/paper_files/paper/ 2025/hash/d077bc9ea82a2998ca6b2d0158b5ac...

work page arXiv 2025
[31]

Do GANs leave artificial fingerprints? In2019 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR), pages 506–511, San Jose, CA, USA,

Francesco Marra, Diego Gragnaniello, Luisa Verdoliva, and Giovanni Poggi. Do GANs leave artificial fingerprints? In2019 IEEE Conference on Multimedia Information Processing and Retrieval (MIPR), pages 506–511, San Jose, CA, USA,

work page
[32]

doi: 10.1109/MIPR.2019.00103

IEEE. doi: 10.1109/MIPR.2019.00103

work page doi:10.1109/mipr.2019.00103 2019
[33]

Black-box forgery attacks on semantic watermarks for diffusion models

Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. In2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 20937–20946, Nashville, TN, USA, 2025. IEEE. URL https://openaccess.thecvf.com/content/CVPR2025/html/Muller_Black- Box_F...

work page arXiv 2025
[34]

K. A. Navas, Mathews Cheriyan Ajay, M. Lekshmi, Tampy S. Archana, and M. Sasikumar. DWT-DCT-SVD based watermarking. In2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSW ARE ’08), pages 271–274, Bangalore, India, 2008. IEEE. doi: 10.1109/ COMSWA.2008.4554423

work page arXiv 2008
[35]

Assran, Q

Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. Towards universal fake image detec- tors that generalize across generative models. In2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24480–24489, Vancouver, BC, Canada, 2023. IEEE. doi: 10.1109/CVPR52729.2023.02345

work page doi:10.1109/cvpr52729.2023.02345 2023
[36]

The future unmarked: Watermark removal in AI-generated images via next-frame prediction

Huming Qiu, Zhaoxiang Wang, Mi Zhang, Xiaohan Zhang, Xiaoyu You, and Min Yang. The future unmarked: Watermark removal in AI-generated images via next-frame prediction. InAdvances in Neural Information Processing Systems (NeurIPS), 2025. URL https://openreview.net/forum?id=yO2zE1yIYZ

work page 2025
[37]

MViTv2: Improved Multiscale Vision Transformers for Classification and Detection , isbn =

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffu- sion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, New Orleans, LA, USA, 2022. IEEE. doi: 10.1109/CVPR52688.2022.01042. URL https: //openaccess.thecvf....

work page doi:10.1109/cvpr52688.2022.01042 2022
[38]

Denoising Diffusion Implicit Models

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. InInternational Conference on Learning Representations (ICLR), Virtual Event, Austria, 2021. OpenReview.net. URL https://openreview.net/forum?id= St1giarCHLP. arXiv:2010.02502. Yevin Nikhel Goonatilake and Giuseppe Ateniese

work page internal anchor Pith review Pith/arXiv arXiv 2021
[39]

Stable diffusion v2.1 and dreamstudio updates 7-dec 22, 2022

Stability AI. Stable diffusion v2.1 and dreamstudio updates 7-dec 22, 2022. URL https://stability.ai/news/stablediffusion2-1-release7-dec-2022. Official release post

work page 2022
[40]

Executive order 14110: Safe, secure, and trustworthy develop- ment and use of artificial intelligence

The White House. Executive order 14110: Safe, secure, and trustworthy develop- ment and use of artificial intelligence. Federal Register, Vol. 88, No. 210, 2023. URL https://www.govinfo.gov/link/cpd/executiveorder/14110

work page 2023
[41]

Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. CNN-generated images are surprisingly easy to spot. . . for now. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8692–8701, Seattle, WA, USA, 2020. IEEE. doi: 10.1109/CVPR42600.2020.00872

work page doi:10.1109/cvpr42600.2020.00872 2020
[42]

Tree- rings watermarks: Invisible fingerprints for diffusion images

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree- rings watermarks: Invisible fingerprints for diffusion images. InAd- vances in Neural Information Processing Systems (NeurIPS), New Orleans, LA, USA, 2023. URL https://proceedings.neurips.cc/paper_files/paper/2023/hash/ b54d1757c190ba20dbc4f9e4a2f54149-Abstract-Conference.html

work page 2023
[43]

Human Preference Score v2: A Solid Benchmark for Evaluating Human Preferences of Text-to-Image Synthesis

Xiaoshi Wu, Yiming Hao, Keqiang Sun, Yixiong Chen, Feng Zhu, Rui Zhao, and Hongsheng Li. Human preference score v2: A solid benchmark for evaluating human preferences of text-to-image synthesis, 2023. URL https://arxiv.org/abs/ 2306.09341

work page internal anchor Pith review Pith/arXiv arXiv 2023
[44]

RAW: A robust and agile plug-and-play wa- termark framework for AI-generated images with provable guarantees

Xun Xian, Ganghua Wang, Xuan Bi, Jayanth Srinivasa, Ashish Kundu, Mingyi Hong, and Jie Ding. RAW: A robust and agile plug-and-play wa- termark framework for AI-generated images with provable guarantees. In Advances in Neural Information Processing Systems (NeurIPS), pages 132077– 132105. Neural Information Processing Systems Foundation, Inc., 2024. doi: 1...

work page doi:10.52202/079017-4198 2024
[45]

Leveraging vision language models for specialized agricultural tasks

Rui Xu, Mengya Hu, Deren Lei, Yaxi Li, David Lowe, Alex Gorevski, Mingyu Wang, Emily Ching, and Alex Deng. Invismark: Invisible and robust water- marking for AI-generated image provenance. InProceedings of the Winter Conference on Applications of Computer Vision (W ACV), pages 909–918, 2025. doi: 10.1109/WACV61041.2025.00098. URL https://openaccess.thecvf...

work page doi:10.1109/wacv61041.2025.00098 2025
[46]

In: CVPR

Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12162–12171, Seattle, WA, USA, 2024. IEEE. doi: 10.1109/CVPR52733.2024.01156

work page doi:10.1109/cvpr52733.2024.01156 2024
[47]

Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models

Hanlin Zhang, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks in the sand: Impossibility of strong watermarking for language models. InProceedings of the 41st International Conference on Machine Learning, volume 235 ofProceedings of Machine Learn- ing Research, pages 58851–58880, Vienna, Austria, 2024. ...

work page 2024
[48]

Martin, Cindy X

Lijun Zhang, Xiao Liu, Antoni V. Martin, Cindy X. Bearfield, Yuriy Brun, and Hui Guan. Attack-resilient image watermarking using stable diffusion. InAdvances in Neural Information Processing Systems (NeurIPS), pages 38480–38507, 2024. doi: 10.52202/079017-1215. URL https://proceedings.neurips.cc/paper_files/paper/ 2024/hash/43d33182360378d5c8e69dd706c24f2...

work page doi:10.52202/079017-1215 2024
[49]

Invisible image watermarks are provably removable using generative AI

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative AI. InAdvances in Neural Information Processing Systems (NeurIPS), pages 8643–8672, Vancouver, BC, Canada, 2024. doi: 10.52202/079017-0276. arXiv:2306.01953

work page doi:10.52202/079017-0276 2024
[50]

In2025 IEEE Symposium on Security and Privacy (SP)

Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, Yu-Xiang Wang, and Dawn Song. SoK: Watermarking for AI-generated content. In2025 IEEE Symposium on Security and Privacy (SP), pages 2621–2639, San Francisco, CA, USA, 2025. IEEE. doi: 10.110...

work page doi:10.1109/sp61157.2025.00178 2025
[51]

Frequent Itemset Discovery

Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. HiDDeN: Hiding data with deep networks. InProceedings of the European Conference on Computer Vision (ECCV), pages 682–697, Cham, Switzerland, 2018. Springer. doi: 10.1007/978-3- 030-01267-0_40. A Generative AI Usage We used Claude (Anthropic) and ChatGPT (OpenAI) during the preparation of this pap...

work page doi:10.1007/978-3- 2018