# UnMarker: A Universal Attack on Defensive Image Watermarking

arXiv: https://arxiv.org/abs/2405.08363 · HTML: https://mlsanity.com/paper/2405.08363/

## Key facts

- Cited by 24 papers in the map (data through 14 Oct 2026).
- Builds on 35 of its 68 references that are in the map.
- First posted on arXiv 14 May 2024.

## Builds on (most cited first, 30 of 35)

- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Microsoft COCO: Common Objects in Context](https://mlsanity.com/paper/1405.0312/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Deep Unsupervised Learning using Nonequilibrium Thermodynamics](https://mlsanity.com/paper/1503.03585/) (2015)
- [Photorealistic Text-to-Image Diffusion Models with Deep Language Understanding](https://mlsanity.com/paper/2205.11487/) (2022)
- [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018)
- [LAION-5B: An open large-scale dataset for training next generation image-text models](https://mlsanity.com/paper/2210.08402/) (2022)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [Alias-Free Generative Adversarial Networks](https://mlsanity.com/paper/2106.12423/) (2021)
- [Ensemble Adversarial Training: Attacks and Defenses](https://mlsanity.com/paper/1705.07204/) (2017)
- [Thinking in Frequency: Face Forgery Detection by Mining Frequency-aware Clues](https://mlsanity.com/paper/2007.09355/) (2020)
- [Leveraging Frequency Analysis for Deep Fake Image Recognition](https://mlsanity.com/paper/2003.08685/) (2020)
- [Diffusion Models for Adversarial Purification](https://mlsanity.com/paper/2205.07460/) (2022)
- [Face X-ray for More General Face Forgery Detection](https://mlsanity.com/paper/1912.13458/) (2019)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [Multi-attentional Deepfake Detection](https://mlsanity.com/paper/2103.02406/) (2021)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [On the detection of synthetic images generated by diffusion models](https://mlsanity.com/paper/2211.00680/) (2022)
- [Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data](https://mlsanity.com/paper/2007.08457/) (2020)
- [Do GANs leave artificial fingerprints?](https://mlsanity.com/paper/1812.11842/) (2018)
- [A Recipe for Watermarking Diffusion Models](https://mlsanity.com/paper/2303.10137/) (2023)
- [Invisible Image Watermarks Are Provably Removable Using Generative AI](https://mlsanity.com/paper/2306.01953/) (2023)
- [WAVES: Benchmarking the Robustness of Image Watermarks](https://mlsanity.com/paper/2401.08573/) (2024)
- [Responsible Disclosure of Generative Models Using Scalable Fingerprinting](https://mlsanity.com/paper/2012.08726/) (2020)
- [Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks](https://mlsanity.com/paper/2310.00076/) (2023)
- [Evading Watermark based Detection of AI-Generated Content](https://mlsanity.com/paper/2305.03807/) (2023)
- [BiHPF: Bilateral High-Pass Filters for Robust Deepfake Detection](https://mlsanity.com/paper/2109.00911/) (2021)
- [Exposing GAN-generated Faces Using Inconsistent Corneal Specular Highlights](https://mlsanity.com/paper/2009.11924/) (2020)
- [Leveraging Optimization for Adaptive Attacks on Image Watermarks](https://mlsanity.com/paper/2309.16952/) (2023)
- [A Loss Function for Generative Neural Networks Based on Watson's Perceptual Model](https://mlsanity.com/paper/2006.15057/) (2020)

## Built on by (most cited first, 24 of 24)

- [DiffBreak: Is Diffusion-Based Purification Robust?](https://mlsanity.com/paper/2411.16598/) (2024)
- [Secure and Robust Watermarking for AI-generated Images: A Comprehensive Survey](https://mlsanity.com/paper/2510.02384/) (2025)
- [MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoising](https://mlsanity.com/paper/2602.15364/) (2026)
- [Authenticated Contradictions from Desynchronized Provenance and Watermarking](https://mlsanity.com/paper/2603.02378/) (2026)
- [Towards Robust Content Watermarking Against Removal and Forgery Attacks](https://mlsanity.com/paper/2604.06662/) (2026)
- [The Coding Limits of Robust Watermarking for Generative Models](https://mlsanity.com/paper/2509.10577/) (2025)
- [RAVEN: Erasing Invisible Watermarks via Novel View Synthesis](https://mlsanity.com/paper/2601.08832/) (2026)
- [Robustness of Watermarking on Text-to-Image Diffusion Models](https://mlsanity.com/paper/2408.02035/) (2024)
- [DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defenses](https://mlsanity.com/paper/2601.16473/) (2026)
- [Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes](https://mlsanity.com/paper/2602.22197/) (2026)
- [Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction](https://mlsanity.com/paper/2603.01067/) (2026)
- [Understanding Semantic Perturbations on In-Processing Generative Image Watermarks](https://mlsanity.com/paper/2603.27513/) (2026)
- [On the Robustness of Watermarking for Autoregressive Image Generation](https://mlsanity.com/paper/2604.11720/) (2026)
- [Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal](https://mlsanity.com/paper/2605.09203/) (2026)
- [MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation](https://mlsanity.com/paper/2608.10166/) (2026)
- [PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarking](https://mlsanity.com/paper/2505.12296/) (2025)
- [Unmasking Synthetic Realities in Generative AI: A Comprehensive Review of Adversarially Robust Deepfake Detection Systems](https://mlsanity.com/paper/2507.21157/) (2025)
- [MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbation](https://mlsanity.com/paper/2602.01513/) (2026)
- [FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack](https://mlsanity.com/paper/2607.27800/) (2026)
- [Understanding Security and Privacy Perceptions of Content Creators Regarding AI Labels of AI-Generated Content](https://mlsanity.com/paper/2608.08129/) (2026)
- [Optimizing and Securing the Modern Watermarking Channel for Images](https://mlsanity.com/paper/2609.34744/) (2026)
- [Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking](https://mlsanity.com/paper/2610.02010/) (2026)
- [LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization](https://mlsanity.com/paper/2610.03166/) (2026)
- [WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models](https://mlsanity.com/paper/2610.12952/) (2026)

## Abstract (arXiv)

Reports regarding the misuse of Generative AI (GenAI) to create deepfakes are frequent. Defensive watermarking enables GenAI providers to hide fingerprints in their images and use them later for deepfake detection. Yet, its potential has not been fully explored. We present UnMarker -- the first practical universal attack on defensive watermarking. Unlike existing attacks, UnMarker requires no detector feedback, no unrealistic knowledge of the watermarking scheme or similar models, and no advanced denoising pipelines that may not be available. Instead, being the product of an in-depth analysis of the watermarking paradigm revealing that robust schemes must construct their watermarks in the spectral amplitudes, UnMarker employs two novel adversarial optimizations to disrupt the spectra of watermarked images, erasing the watermarks. Evaluations against SOTA schemes prove UnMarker's effectiveness. It not only defeats traditional schemes while retaining superior quality compared to existing attacks but also breaks semantic watermarks that alter an image's structure, reducing the best detection rate to 43% and rendering them useless. To our knowledge, UnMarker is the first practical attack on semantic watermarks, which have been deemed the future of defensive watermarking. Our findings show that defensive watermarking is not a viable defense against deepfakes, and we urge the community to explore alternatives.