Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal

arXiv:2605.09203 · cs.CR · Submitted 2026-05-09 · Read on arXiv

cs.CR

Submitted: 2026-05-09

Updated: 2026-08-28

Comments: 22 pages, including appendices. v2: substantially revised and expanded, with updated empirical evaluation and theoretical analysis

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Trace — 35× in this paper · explained in 2 episodes
• Verifier — 26× in this paper · explained in 2 episodes
• Provenance — 13× in this paper · explained in 3 episodes
• Benchmark — 10× in this paper · explained in 2 episodes
• Diffusion Model — 7× in this paper · explained in 8 episodes
• Robustness — 7× in this paper · explained in 5 episodes
• Fidelity — 6× in this paper · explained in 2 episodes
• AUC — 5× in this paper · explained in 2 episodes
• Accuracy — 5× in this paper · explained in 1 episode
• Diffusion Models — 5× in this paper · explained in 6 episodes
• Quantization — 5× in this paper · explained in 12 episodes
• In International Conference on Learning Representations — 4× in this paper
• Embeddings — 3× in this paper · explained in 2 episodes
• Generative Model — 3× in this paper · explained in 2 episodes
• Generative Models — 3× in this paper · explained in 2 episodes
• International Conference on Computer Vision — 3× in this paper
• Adversarial Attacks — 2× in this paper · explained in 1 episode
• Benchmarking — 2× in this paper · explained in 3 episodes
• Computer Vision and Pattern Recognition — 2× in this paper
• European Conference on Computer Vision — 2× in this paper
• Generative AI — 2× in this paper · explained in 2 episodes
• IEEE Symposium on Security and Privacy — 2× in this paper
• Latent Diffusion Model — 2× in this paper · explained in 2 episodes
• Latent Diffusion Models — 2× in this paper · explained in 2 episodes
• Spectral Signature — 2× in this paper · explained in 2 episodes
• Adam — 1× in this paper · explained in 2 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Core — 1× in this paper · explained in 2 episodes
• Latent Representation — 1× in this paper · explained in 2 episodes
• Latent Space — 1× in this paper · explained in 7 episodes
• Steering — 1× in this paper · explained in 2 episodes
• Verification — 1× in this paper · explained in 2 episodes

Sources

• SEAL: Semantic Aware Image Watermarking
• The Coding Limits of Robust Watermarking for Generative Models
• SynthID-Image: Image watermarking at internet scale
• An Undetectable Watermark for Generative Image Models
• ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
• UnMarker: A Universal Attack on Defensive Image Watermarking
• Removal Attack and Defense on AI-generated Content Latent-based Watermarking
• Image Watermarks are Removable Using Controllable Regeneration from Clean Noise
• Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances
• Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models
• Denoising Diffusion Implicit Models
• Human Preference Score v2: A Solid Benchmark for Evaluating Human Preferences of Text-to-Image Synthesis
• RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees
• InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenance
• Attack-Resilient Image Watermarking Using Stable Diffusion
• Invisible Image Watermarks Are Provably Removable Using Generative AI

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs