TokenPure: Watermark Removal through Tokenized Appearance and Structural Guidance
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
In the digital economy era, digital watermarking serves as a critical basis for ownership proof of massive replicable content, including AI-generated and other virtual assets. Designing robust watermarks capable of withstanding various attacks and processing operations is even more paramount. We introduce TokenPure, a novel Diffusion Transformer-based framework designed for effective and consistent watermark removal. TokenPure solves the trade-off between thorough watermark destruction and content consistency by leveraging token-based conditional reconstruction. It reframes the task as conditional generation, entirely bypassing the initial watermark-carrying noise. We achieve this by decomposing the watermarked image into two complementary token sets: visual tokens for texture and structural tokens for geometry. These tokens jointly condition the diffusion process, enabling the framework to synthesize watermark-free images with fine-grained consistency and structural integrity. Comprehensive experiments show that TokenPure achieves state-of-the-art watermark removal and reconstruction fidelity, substantially outperforming existing baselines in both perceptual quality and consistency.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 87 of its 109 references that are in the map. First posted on arXiv 1 Dec 2025.
Builds on
87 of 109 references.
Closest ancestors · 21
Same direction, newest first
- 2025A Reinforcement Learning Framework for Robust and Secure LLM Watermarking23 Oct
- 2025Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption21 Oct
- 2025ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generation14 Oct
- 2025Leave No TRACE: Black-box Detection of Copyrighted Dataset Usage in Large Language Models via Watermarking3 Oct
- 2025Semantic Watermarking Reinvented: Enhancing Robustness and Generation Quality with Fourier Integrity9 Sep
- 2025MaXsive: High-Capacity and Robust Training-Free Generative Image Watermarking in Diffusion Models28 Jul
- 2025A Watermark for Auto-Regressive Image Generation Models13 Jun
- 2025Autoregressive Images Watermarking through Lexical Biasing: An Approach Resistant to Regeneration Attack1 Jun
- 2025In-Context Watermarks for Large Language Models22 May
- 2025Defending LLM Watermarking Against Spoofing Attacks with Contrastive Representation Learning9 Apr
- 2025Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs15 Feb
- 2024Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models4 Dec
9 more
- 2024Watermark under Fire: A Robustness Evaluation of LLM Watermarking20 Nov
- 2024An Undetectable Watermark for Generative Image Models9 Oct
- 2024WMAdapter: Adding WaterMark Control to Latent Diffusion Models12 Jun
- 2024Adaptive Text Watermark for Large Language Models25 Jan
- 2023A Survey of Text Watermarking in the Era of Large Language Models13 Dec
- 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks29 Sep
- 2023Invisible Image Watermarks Are Provably Removable Using Generative AI2 Jun
- 2023Evading Watermark based Detection of AI-Generated Content5 May
- 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
Other references · 66
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2020Denoising Diffusion Implicit Modelscited by 9,781
- 2023Visual Instruction Tuningcited by 7,869
- 2022Scalable Diffusion Models with Transformerscited by 6,054
- 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,503
- 2016Gaussian Error Linear Units (GELUs)cited by 3,502
- 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,300
38 more
- 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,109
- 2022DreamFusion: Text-to-3D using 2D Diffusioncited by 3,025
- 2022InstructPix2Pix: Learning to Follow Image Editing Instructionscited by 2,611
- 2022Prompt-to-Prompt Image Editing with Cross Attention Controlcited by 2,431
- 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,245
- 2023IP-Adapter: Text Compatible Image Prompt Adapter for Text-to-Image Diffusion Modelscited by 1,464
- 2023T2I-Adapter: Learning Adapters to Dig out More Controllable Ability for Text-to-Image Diffusion Modelscited by 1,351
- 2021Conceptual 12M: Pushing Web-Scale Image-Text Pre-Training To Recognize Long-Tail Visual Conceptscited by 1,216
- 2022Multi-Concept Customization of Text-to-Image Diffusioncited by 1,106
- 2022Exploring CLIP for Assessing the Look and Feel of Imagescited by 991
- 2020Image Quality Assessment: Unifying Structure and Texture Similaritycited by 811
- 2023Q-Align: Teaching LMMs for Visual Scoring via Discrete Text-Defined Levelscited by 503
- 2018HiDDeN: Hiding Data With Deep Networkscited by 397
- 2023Follow Your Pose: Pose-Guided Text-to-Video Generation using Pose-Free Videoscited by 314
- 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 265
- 2024Follow-Your-Emoji: Fine-Controllable and Expressive Freestyle Portrait Animationcited by 174
- 2019Robust Invisible Video Watermarking with Attentioncited by 149
- 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
- 2023SSR-Encoder: Encoding Selective Subject Representation for Subject-Driven Generationcited by 143
- 2025EasyControl: Adding Efficient and Flexible Control for Diffusion Transformercited by 119
- 2025Echo-4o: Harnessing the Power of GPT-4o Synthetic Images for Improved Image Generationcited by 100
- 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 97
- 2021Watermarking Images in Self-Supervised Latent Spacescited by 94
- 2024RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identificationcited by 91
- 2025Follow-Your-Motion: Video Motion Transfer via Efficient Spatial-Temporal Decoupled Finetuningcited by 81
- 2025Any2AnyTryon: Leveraging Adaptive Position Embeddings for Versatile Virtual Clothing Taskscited by 63
- 2023MagicStick: Controllable Video Editing via Control Handle Transformationscited by 62
- 2025Follow-Your-Creation: Empowering 4D Creation through Video Inpaintingcited by 62
- 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 52
- 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 50
- 2024Stable-Makeup: When Real-World Makeup Transfer Meets Diffusion Modelcited by 45
- 2025MakeAnything: Harnessing Diffusion Transformers for Multi-Domain Procedural Sequence Generationcited by 45
- 2025LayerTracer: Cognitive-Aligned Layered SVG Synthesis via Diffusion Transformercited by 43
- 2024FonTS: Text Rendering with Typography and Style Controlscited by 40
- 2024ProcessPainter: Learn Painting Process from Sequence Datacited by 38
- 2024Stable-Hair: Real-World Hair Transfer via Diffusion Modelcited by 35
- 2025Efficient Diffusion Models: A Surveycited by 35
- 2025OmniConsistency: Learning Style-Agnostic Consistency from Paired Stylization Datacited by 32
50 most cited of 66 All 66 (JSON)
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking
- 2026Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition
- 2026Vanishing Watermarks: Diffusion-Based Image Editing Undermines Robust Invisible Watermarking
- 2026When Denoising Becomes Unsigning: Theoretical and Empirical Analysis of Watermark Fragility Under Diffusion-Based Image Editing
- 2025Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removal
- 2026IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images
- 2025PT-Mark: Invisible Watermarking for Text-to-image Diffusion Models via Semantic-aware Pivotal Tuning
- 2025On the Information-Theoretic Fragility of Robust Watermarking under Diffusion Editing