mlsanityData to 14 Oct 2026

Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal

arXiv 2609.31722 ↗First posted 22 Sep 2026cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

Fixed image distortions do not cover an attacker that learns from paired clean and watermarked images. We study this paired-training threat with single-image inference: deployment uses neither the clean reference nor the watermark key, payload, or decoder. An encoder maps each image to a structural latent g and an auxiliary residual latent u. Push supervision reconstructs the watermarked image from D(gw,uw). Pull supervision trains the zero-auxiliary output D(Ag(gw;k),0) toward the paired clean image. At k=1.10,u=0, the four-method sweep gives an average BER of 0.3958, PSNR of 31.07 dB, and SSIM of 0.9554. Restoring u from 0 to 0.15 moves average BER from 0.3893 to 0.3357, while PSNR falls from 30.99 to 28.23 dB. The intervention supports decoder dependence on the auxiliary input in the evaluated setting. The accompanying theory is a conditional, post-hoc account of this behavior rather than an experimentally verified information-relocation result.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 36 of its 51 references that are in the map. First posted on arXiv 22 Sep 2026.

Builds on

36 of 51 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  8. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,694
  9. 2016Understanding deep learning requires rethinking generalizationcited by 1,674
  10. 2017A Closer Look at Memorization in Deep Networkscited by 942
  11. 2018Challenging Common Assumptions in the Unsupervised Learning of Disentangled Representationscited by 941
  12. 2018Variational image compression with a scale hyperpriorcited by 935
24 more
  1. 2016Deep Variational Information Bottleneckcited by 930
  2. 2018MINE: Mutual Information Neural Estimationcited by 683
  3. 2020Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modulescited by 590
  4. 2019On Variational Bounds of Mutual Informationcited by 559
  5. 2018HiDDeN: Hiding Data With Deep Networkscited by 397
  6. 2018Understanding disentangling in β-VAEcited by 335
  7. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Modelscited by 304
  8. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 265
  9. 2020Focal Frequency Loss for Image Reconstruction and Synthesiscited by 206
  10. 2019Robust Invisible Video Watermarking with Attentioncited by 149
  11. 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 134
  12. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 97
  13. 2021Watermarking Images in Self-Supervised Latent Spacescited by 94
  14. 2023How Does Information Bottleneck Help Deep Learning?cited by 93
  15. 2024Watermark Anything with Localized Messagescited by 53
  16. 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 50
  17. 2024Video Seal: Open and Efficient Video Watermarkingcited by 48
  18. 2024Attack-Resilient Image Watermarking Using Stable Diffusioncited by 35
  19. 2023Leveraging sparse and shared feature activations for disentangled representation learningcited by 32
  20. 2025SynthID-Image: Image watermarking at internet scalecited by 31
  21. 2024Stable Signature is Unstable: Removing Image Watermark from Diffusion Modelscited by 20
  22. 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challengecited by 9
  23. 2025Saliency-Aware Diffusion Reconstruction for Effective Invisible Watermark Removalcited by 8
  24. 2023Disentangled Representation Learning with Transmitted Information Bottleneckcited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition
  2. 2026Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal
  3. 2025Class-feature Watermark: A Resilient Black-box Watermark Against Model Extraction Attacks
  4. 2025SEAL: Entangled White-box Watermarks on Low-Rank Adaptation
  5. 2026ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking
  6. 2026SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding
  7. 2026Vanishing Watermarks: Diffusion-Based Image Editing Undermines Robust Invisible Watermarking
  8. 2026MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbation