mlsanityData to 7 Oct 2026

Evading Watermark based Detection of AI-Generated Content

arXiv 2305.03807 ↗First posted 5 May 2023cs.LG cs.CR cs.CVcited by 74

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

A generative AI model can generate extremely realistic-looking content, posing growing challenges to the authenticity of information. To address the challenges, watermark has been leveraged to detect AI-generated content. Specifically, a watermark is embedded into an AI-generated content before it is released. A content is detected as AI-generated if a similar watermark can be decoded from it. In this work, we perform a systematic study on the robustness of such watermark-based AI-generated content detection. We focus on AI-generated images. Our work shows that an attacker can post-process a watermarked image via adding a small, human-imperceptible perturbation to it, such that the post-processed image evades detection while maintaining its visual quality. We show the effectiveness of our attack both theoretically and empirically. Moreover, to evade detection, our adversarial post-processing method adds much smaller perturbations to AI-generated images and thus better maintain their visual quality than existing popular post-processing methods such as JPEG compression, Gaussian blur, and Brightness/Contrast. Our work shows the insufficiency of existing watermark-based detection of AI-generated content, highlighting the urgent needs of new methods. Our code is publicly available: https://github.com/zhengyuan-jiang/WEvade.

Key facts. Cited by 74 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 28 of its 49 references that are in the map. First posted on arXiv 5 May 2023.

Builds on

28 of 49 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
  2. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
  3. 2023A Watermark for Large Language Models24 Jan

Other references · 25

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2022Generative Adversarial Networkscited by 5,603
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 705
  10. 2020Leveraging Frequency Analysis for Deep Fake Image Recognitioncited by 501
  11. 2018HiDDeN: Hiding Data With Deep Networkscited by 384
  12. 2021Multi-attentional Deepfake Detectioncited by 339
13 more
  1. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  2. 2022On the detection of synthetic images generated by diffusion modelscited by 282
  3. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  4. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
  5. 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 121
  6. 2020Distortion Agnostic Deep Watermarkingcited by 88
  7. 2019SteganoGAN: High Capacity Image Steganography with GANscited by 70
  8. 2018On the Suitability of Lp-norms for Creating and Preventing Adversarial Examplescited by 57
  9. 2019Detecting Photoshopped Faces by Scripting Photoshopcited by 55
  10. 2019ROMark: A Robust Watermarking System Using Adversarial Trainingcited by 17
  11. 2021FaceGuard: Proactive Deepfake Detectioncited by 16
  12. 2021Understanding the Security of Deepfake Detectioncited by 6
  13. 2020Towards Robust Data Hiding Against (JPEG) Compression: A Pseudo-Differentiable Deep Learning Approachcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 13; 2024: 34; 2025: 18; 2026: 9.

74 papers.

Sort:

By area:

  1. 2023EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protectioncited by 109
  2. 2023Identifying and Mitigating the Security Risks of Generative AIcited by 90
  3. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  4. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
  5. 2023A Survey on Detection of LLMs-Generated Contentcited by 70
  6. 2023Mark My Words: Analyzing and Evaluating Language Model Watermarkscited by 62
  7. 2023Towards Understanding the Interplay of Generative Artificial Intelligence and the Internetcited by 54
  8. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  9. 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 43
  10. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  11. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitationcited by 37
  12. 2024On the Challenges and Opportunities in Generative AIcited by 31
38 more
  1. 2024WMAdapter: Adding WaterMark Control to Latent Diffusion Modelscited by 29
  2. 2024A Transfer Attack to Image Watermarkscited by 26
  3. 2023Optimizing watermarks for large language modelscited by 22
  4. 2024UnMarker: A Universal Attack on Defensive Image Watermarkingcited by 19
  5. 2024AudioMarkBench: Benchmarking Robustness of Audio Watermarkingcited by 19
  6. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19
  7. 2024Hidden in the Noise: Two-Stage Robust Watermarking for Imagescited by 18
  8. 2023Robust Identity Perceptual Watermark Against Deepfake Face Swappingcited by 17
  9. 2024Stable Signature is Unstable: Removing Image Watermark from Diffusion Modelscited by 16
  10. 2024Moderator: Moderating Text-to-Image Diffusion Models through Fine-grained Context-based Policiescited by 15
  11. 2024A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authenticationcited by 12
  12. 2024Concept Arithmetics for Circumventing Concept Inhibition in Diffusion Modelscited by 11
  13. 2024Optimizing Adaptive Attacks against Watermarks for Language Modelscited by 11
  14. 2025Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Modelscited by 10
  15. 2024JIGMARK: A Black-Box Approach for Enhancing Image Watermarks against Diffusion Model Editscited by 9
  16. 2024Watermark-based Attribution of AI-Generated Contentcited by 8
  17. 2024U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AIcited by 7
  18. 2024AI-generated Image Detection: Passive or Watermark?cited by 7
  19. 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attackscited by 6
  20. 2024Adversarial Robustness of AI-Generated Image Detectors in the Real Worldcited by 6
  21. 2025A Baseline Method for Removing Invisible Image Watermarks using Deep Image Priorcited by 6
  22. 2025WMCopier: Forging Invisible Image Watermarks on Arbitrary Imagescited by 5
  23. 2023A Somewhat Robust Image Watermark against Diffusion-based Editing Modelscited by 4
  24. 2024Securing the Future of GenAI: Policy and Technologycited by 4
  25. 2024The Cat and Mouse Game: The Ongoing Arms Race Between Diffusion Models and Detection Methodscited by 4
  26. 2025Secure and Efficient Watermarking for Latent Diffusion Models in Model Distribution Scenarioscited by 4
  27. 2025VideoMarkBench: Benchmarking Robustness of Video Watermarkingcited by 4
  28. 2023Mesh Watermark Removal Attack and Mitigation: A Novel Perspective of Function Spacecited by 3
  29. 2024Generative Models are Self-Watermarked: Declaring Model Authentication through Re-Generationcited by 3
  30. 2024Evaluating Durability: Benchmark Insights into Multimodal Watermarkingcited by 3
  31. 2024Certifiably Robust Image Watermarkcited by 3
  32. 2024METR: Image Watermarking with Large Number of Unique Messagescited by 3
  33. 2026Attack-Resistant Watermarking for AIGC Image Forensics via Diffusion-based Semantic Deflectioncited by 3
  34. 2024Finding needles in a haystack: A Black-Box Approach to Invisible Watermark Detectioncited by 2
  35. 2024Proactive Schemes: A Survey of Adversarial Attacks for Social Goodcited by 2
  36. 2024Take Fake as Real: Realistic-like Robust Black-box Adversarial Attack to Evade AIGC Detectioncited by 2
  37. 2025A Statistical Hypothesis Testing Framework for Data Misappropriation Detection in Large Language Modelscited by 2
  38. 2025Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulationcited by 2

50 most cited of 74 All 74 (JSON)