# Removal Attack and Defense on AI-generated Content Latent-based Watermarking

arXiv: https://arxiv.org/abs/2509.11745 · HTML: https://mlsanity.com/paper/2509.11745/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 10 of its 34 references that are in the map.
- First posted on arXiv 15 Sep 2025.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 10 of 10)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis](https://mlsanity.com/paper/2307.01952/) (2023)
- [Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models](https://mlsanity.com/paper/2404.04956/) (2024)
- [An Undetectable Watermark for Generative Image Models](https://mlsanity.com/paper/2410.07369/) (2024)
- [SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)](https://mlsanity.com/paper/2108.04974/) (2021)
- [Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models](https://mlsanity.com/paper/2412.03283/) (2024)
- [Compute Better Spent: Replacing Dense Layers with Structured Matrices](https://mlsanity.com/paper/2406.06248/) (2024)
- [Stable Signature is Unstable: Removing Image Watermark from Diffusion Models](https://mlsanity.com/paper/2405.07145/) (2024)
- [PixelMan: Consistent Object Editing with Diffusion Models via Pixel Manipulation and Generation](https://mlsanity.com/paper/2412.14283/) (2024)

## Built on by (most cited first, 7 of 7)

- [Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal](https://mlsanity.com/paper/2605.09203/) (2026)
- [Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion Perspective](https://mlsanity.com/paper/2606.29807/) (2026)
- [MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation](https://mlsanity.com/paper/2608.10166/) (2026)
- [mAVE: A Watermark for Joint Audio-Visual Generation Models](https://mlsanity.com/paper/2603.07090/) (2026)
- [Proof-of-Authorship for Diffusion-based AI Generated Content](https://mlsanity.com/paper/2603.17513/) (2026)
- [RaMark: Radioactive Watermarking for Generated Tabular Data](https://mlsanity.com/paper/2607.09000/) (2026)
- [LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization](https://mlsanity.com/paper/2610.03166/) (2026)

## Abstract (arXiv)

Digital watermarks can be embedded into AI-generated content (AIGC) by initializing the generation process with starting points sampled from a secret distribution. When combined with pseudorandom error-correcting codes, such watermarked outputs can remain indistinguishable from unwatermarked objects, while maintaining robustness under whitenoise. In this paper, we go beyond indistinguishability and investigate security under removal attacks. We demonstrate that indistinguishability alone does not necessarily guarantee resistance to adversarial removal. Specifically, we propose a novel attack that exploits boundary information leaked by the locations of watermarked objects. This attack significantly reduces the distortion required to remove watermarks -- by up to a factor of 15 × compared to a baseline whitenoise attack under certain settings. To mitigate such attacks, we introduce a defense mechanism that applies a secret transformation to hide the boundary, and prove that the secret transformation effectively rendering any attacker's perturbations equivalent to those of a naive whitenoise adversary. Our empirical evaluations, conducted on multiple versions of Stable Diffusion, validate the effectiveness of both the attack and the proposed defense, highlighting the importance of addressing boundary leakage in latent-based watermarking schemes.