# SPFM-Net: Semantic-Prior-Guided Frequency-Constrained Mamba for Invisible Watermark Attack

arXiv: https://arxiv.org/abs/2607.27811 · HTML: https://mlsanity.com/paper/2607.27811/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Mamba for image restoration, one of 10 directions in State-space sequence models (S4, Mamba).
- Builds on 13 of its 35 references that are in the map.
- First posted on arXiv 30 Jul 2026.

## Placed in

- State-space sequence models (S4, Mamba) / [Mamba for image restoration](https://mlsanity.com/ssm/mamba-for-image-restoration/)

## Builds on (most cited first, 13 of 13)

- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Masked Autoencoders Are Scalable Vision Learners](https://mlsanity.com/paper/2111.06377/) (2021)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [MBRS : Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression](https://mlsanity.com/paper/2108.08211/) (2021)
- [WAVES: Benchmarking the Robustness of Image Watermarks](https://mlsanity.com/paper/2401.08573/) (2024)
- [Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms](https://mlsanity.com/paper/2212.12678/) (2022)
- [TrustMark: Universal Watermarking for Arbitrary Resolution Images](https://mlsanity.com/paper/2311.18297/) (2023)
- [Toward Generalized Image Quality Assessment: Relaxing the Perfect Reference Quality Assumption](https://mlsanity.com/paper/2503.11221/) (2025)
- [Practical Deep Dispersed Watermarking with Synchronization and Fusion](https://mlsanity.com/paper/2310.14532/) (2023)
- [TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity](https://mlsanity.com/paper/2506.23484/) (2025)
- [Detect and remove watermark in deep neural networks via generative adversarial networks](https://mlsanity.com/paper/2106.08104/) (2021)
- [DiffWA: Diffusion Models for Watermark Attack](https://mlsanity.com/paper/2306.12790/) (2023)
- [When There Is No Decoder: Removing Watermarks from Stable Diffusion Models in a No-box Setting](https://mlsanity.com/paper/2507.03646/) (2025)

## Abstract (arXiv)

Existing watermark attacks typically rely on predefined signal-processing operations or locally constrained restoration networks, making it difficult to capture the long-range dependencies of globally distributed watermark signals and resulting in an unfavorable trade-off between removal effectiveness and visual fidelity. In this paper, we propose SPFM-Net, a semantic-prior-guided and frequency-constrained Mamba framework for invisible watermark attack. SPFM-Net first employs high-ratio masking to disrupt the spatial coherence of invisible watermark signals, and then utilizes a partially fine-tuned pretrained Masked Autoencoder to reconstruct semantically consistent image from sparse observations while suppressing watermark-related information. A Multi-scale Residual Frequency Feature Interaction module subsequently aggregates watermark-related residual features across multiple receptive fields, while adaptively suppressing responses from watermark-irrelevant regions. To further capture the long-range dependencies of globally distributed watermark signals, a lightweight Mamba-based Global State-space Feature Modeling (GSFM) unit is introduced to separate watermark-related features from natural image content and suppress the remaining watermark traces. In addition, SPFM-Net is optimized using a multi-level objective that jointly imposes spatial-, frequency-, and edge-domain constraints, enabling effective watermark suppression while preserving perceptual quality. Extensive experiments on representative spatial-domain, transform-domain, orthogonal moment-based, and deep learning-based watermarking schemes demonstrate that SPFM-Net achieves a favorable trade-off between watermark attack effectiveness and perceptual fidelity.