mlsanityData to 7 Oct 2026

Invisible Image Watermarks Are Provably Removable Using Generative AI

arXiv 2306.01953 ↗First posted 2 Jun 2023cs.CR cs.AI cs.CVcited by 124

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. They also prevent people from misusing images, especially those generated by AI models. We propose a family of regeneration attacks to remove these invisible watermarks. The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image. This approach is flexible and can be instantiated with many existing image-denoising algorithms and pre-trained generative models such as diffusion models. Through formal proofs and extensive empirical evaluations, we demonstrate that pixel-level invisible watermarks are vulnerable to this regeneration attack. Our results reveal that, across four different pixel-level watermarking schemes, the proposed method consistently achieves superior performance compared to existing attack techniques, with lower detection rates and higher image quality. However, watermarks that keep the image semantically similar can be an alternative defense against our attacks. Our finding underscores the need for a shift in research/industry emphasis from invisible watermarks to semantic-preserving watermarks. Code is available at https://github.com/XuandongZhao/WatermarkAttacker

Key facts. Cited by 124 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 35 of its 83 references that are in the map. First posted on arXiv 2 Jun 2023.

Builds on

35 of 83 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
  2. 2023PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generators14 Apr
  3. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar

Other references · 32

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  7. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  8. 2022Generative Adversarial Networkscited by 5,603
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2017Neural Discrete Representation Learningcited by 4,650
  11. 2015Variational Inference with Normalizing Flowscited by 2,161
  12. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
20 more
  1. 2016Beyond a Gaussian Denoiser: Residual Learning of Deep CNN for Image Denoisingcited by 1,352
  2. 2018Variational image compression with a scale hyperpriorcited by 910
  3. 2022Pseudo Numerical Methods for Diffusion Models on Manifoldscited by 695
  4. 2017Renyi Differential Privacycited by 643
  5. 2020Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modulescited by 570
  6. 2022Diffusion Models for Adversarial Purificationcited by 469
  7. 2020Plug-and-Play Image Restoration with Deep Denoiser Priorcited by 467
  8. 2018HiDDeN: Hiding Data With Deep Networkscited by 384
  9. 2022DiffusionDB: A Large-scale Prompt Gallery Dataset for Text-to-Image Generative Modelscited by 376
  10. 2013The Composition Theorem for Differential Privacycited by 290
  11. 2020CompressAI: a PyTorch library and evaluation platform for end-to-end compression researchcited by 271
  12. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  13. 2018Improving the Gaussian Mechanism for Differential Privacy: Analytical Calibration and Optimal Denoisingcited by 216
  14. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
  15. 2019Robust Invisible Video Watermarking with Attentioncited by 144
  16. 2021Watermarking Images in Self-Supervised Latent Spacescited by 90
  17. 2019SteganoGAN: High Capacity Image Steganography with GANscited by 70
  18. 2020WDNet: Watermark-Decomposition Network for Visible Watermark Removalcited by 37
  19. 2020Split then Refine: Stacked Attention-guided ResUNets for Blind Single Image Visible Watermark Removalcited by 20
  20. 2019Blind Visual Motif Removal from a Single Imagecited by 18

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 33; 2025: 43; 2026: 44.

124 papers.

Sort:

By area:

  1. 2024Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advancescited by 105
  2. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  3. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Modelscited by 77
  4. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
  5. 2024An Undetectable Watermark for Generative Image Modelscited by 74
  6. 2024Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Modelscited by 48
  7. 2024ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimizationcited by 45
  8. 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 43
  9. 2024SoK: Watermarking for AI-Generated Contentcited by 43
  10. 2024AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRAcited by 42
  11. 2024WMAdapter: Adding WaterMark Control to Latent Diffusion Modelscited by 29
  12. 2024A Transfer Attack to Image Watermarkscited by 26
38 more
  1. 2025SynthID-Image: Image watermarking at internet scalecited by 26
  2. 2024DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Modelcited by 21
  3. 2024InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenancecited by 21
  4. 2024UnMarker: A Universal Attack on Defensive Image Watermarkingcited by 19
  5. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19
  6. 2024GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splattingcited by 18
  7. 2024Hidden in the Noise: Two-Stage Robust Watermarking for Imagescited by 18
  8. 2024Stable Signature is Unstable: Removing Image Watermark from Diffusion Modelscited by 16
  9. 2025Semantic Watermarking Reinvented: Enhancing Robustness and Generation Quality with Fourier Integritycited by 14
  10. 2025SEAL: Semantic Aware Image Watermarkingcited by 13
  11. 2024A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authenticationcited by 12
  12. 2025Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Imagecited by 12
  13. 2024Steganalysis on Digital Watermarking: Is Your Defense Truly Impervious?cited by 10
  14. 2025Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Modelscited by 10
  15. 2024JIGMARK: A Black-Box Approach for Enhancing Image Watermarks against Diffusion Model Editscited by 9
  16. 2023Warfare:Breaking the Watermark Protection of AI-Generated Contentcited by 7
  17. 2024RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guaranteescited by 7
  18. 2024FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Spacecited by 7
  19. 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challengecited by 7
  20. 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attackscited by 6
  21. 2024Watermarking Generative Tabular Datacited by 6
  22. 2024CopyrightMeter: Revisiting Copyright Protection in Text-to-image Modelscited by 6
  23. 2025A Baseline Method for Removing Invisible Image Watermarks using Deep Image Priorcited by 6
  24. 2025WMCopier: Forging Invisible Image Watermarks on Arbitrary Imagescited by 5
  25. 2025MarkDiffusion: An Open-Source Toolkit for Generative Watermarking of Latent Diffusion Modelscited by 5
  26. 2025NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Modelscited by 5
  27. 2026SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarkingcited by 5
  28. 2023A Somewhat Robust Image Watermark against Diffusion-based Editing Modelscited by 4
  29. 2025VideoMarkBench: Benchmarking Robustness of Video Watermarkingcited by 4
  30. 2025A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarkscited by 4
  31. 2025Diffusion-Based Image Editing for Breaking Robust Watermarkscited by 4
  32. 2024Evaluating Durability: Benchmark Insights into Multimodal Watermarkingcited by 3
  33. 2024Certifiably Robust Image Watermarkcited by 3
  34. 2024METR: Image Watermarking with Large Number of Unique Messagescited by 3
  35. 2025On the Coexistence and Ensembling of Watermarkscited by 3
  36. 2025ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clusteringcited by 3
  37. 2026Attack-Resistant Watermarking for AIGC Image Forensics via Diffusion-based Semantic Deflectioncited by 3
  38. 2026SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermarkcited by 3

50 most cited of 124 All 124 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2026Vanishing Watermarks: Diffusion-Based Image Editing Undermines Robust Invisible Watermarking
  2. 2025Removing Watermarks with Partial Regeneration using Semantic Information
  3. 2025On the Information-Theoretic Fragility of Robust Watermarking under Diffusion Editing
  4. 2025Spread them Apart: Towards Robust Watermarking of Generated Content
  5. 2025Optimization-Free Universal Watermark Forgery with Regenerative Diffusion Models
  6. 2025Visual Watermarking in the Era of Diffusion Models: Advances and Challenges
  7. 2025Removal Attack and Defense on AI-generated Content Latent-based Watermarking
  8. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarks