MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation

M ARK N ULL: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation Jie Cao1 , Qi Li1 , Zelin Zhang1 , Xiaodong Wu1 , Lingshuang Liu2 , Xiangman Li1 , Jianbing Ni1,∗ 1 Queen’s University, Canada 2 University of Waterloo, Canada

arXiv:2608.10166v1 [cs.CR] 10 Aug 2026

Abstract Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored. Existing attacks either succeed only against specific generative models or achieve removal at the cost of severe visual degradation. In this paper, we propose M ARK N ULL, a model-agnostic watermark removal attack via on-manifold latent manipulation. M ARK N ULL is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. To quantify this dependency, we introduce the Noise-Latent Alignment Score (NLAS) and formulate an optimization objective that selectively decorrelates the latent representation from the embedded watermark while preserving semantic fidelity. Extensive evaluations across different categories of watermarking paradigms, including post-hoc, finetuning-based, and initial-noise-based schemes, demonstrate that M ARK N ULL reduces average bit accuracy to 53.14%, approaching random-guessing (50%), without perceptible image degradation. To further improve scalability, we propose M ARK N ULL -A, an amortized, optimization-free variant that distills the attack into a single forward pass, achieving 0.50 s/image with modest computational overhead. Notably, our attacks successfully compromise Google’s SynthID-Image system while preserving high visual quality and transfer effectively to video watermarking. Finally, we present an attack detection mechanism as a defensive counterpart to M ARK N ULL and M ARK N ULL -A, highlighting the necessity of developing watermark designs resilient to model-agnostic latent-space attacks.

1

Introduction

Generative AI, particularly Text-to-Image (T2I) models, has fundamentally transformed content creation by enabling the * Corresponding author.

(a) Watermarking

Bob

Watermark

Text prompt

Upload

Online Social Media (b) Watermark Removal Attack

(c) Verification (1) Distortion Attack (2) Regeneration Attack

Attacker

(3) Adversarial Attack

Verification: No watermark!!!

Verification: Bob generated!

Figure 1: Overview of AI-generated image watermarking and verification, and representative removal attacks.

synthesis of highly realistic and semantically rich images. As AI-generated content becomes increasingly indistinguishable from natural imagery, it amplifies risks such as misinformation, deepfakes, and intellectual property infringement. To mitigate the misuse of generative models and synthetic media, digital watermarking has emerged as a key mechanism for copyright verification and content attribution in AI-generated imagery [2]. As an active defense strategy, watermarking embeds imperceptible signals into generated images to support reliable provenance tracking and the detection of unauthorized usage. A prominent real-world deployment is DeepMind’s SynthID [7], a commercial watermarking system designed to embed invisible watermarks into AI-generated images for robust copyright attribution. Existing watermarking techniques can be broadly classified into post-hoc and in-generation approaches. Post-hoc methods, such as DwtDctSvd [27], HiDDeN [49], RivaGan [45], and SynthID [7], embed watermarks directly into images after generation, including both AI-generated and real-world images [23]. These techniques operate purely in the image domain and remain largely decorrelated from the generative model’s internal representations, limiting their robustness and reliability under realistic watermark removal attacks. To address these limitations, recent research has shifted toward ingeneration watermarking, which integrates watermark embed-

ding directly into the image generation process. By aligning watermarks with the model’s semantic and latent representations, this paradigm improves coherence and enables more reliable provenance tracking. In-generation methods can be further divided into two categories: (i) fine-tuning-based watermarking, which modifies model parameters to condition watermark presence in the generated output [4, 19]; and (ii) initial-noise-based watermarking, which encodes watermarks into the sampling initialization of diffusion models [8, 40, 43]. An overview of these paradigms is illustrated in Figure 1. The central challenge of image watermarking lies in robustness, i.e., the ability of watermarks to remain verifiable under distortions and malicious manipulations. While many stateof-the-art (SOTA) image watermarking methods focus on improving watermark verifiability against removal attacks, their security assessment is mainly conducted under white-box assumptions, with a particular focus on pixel-space watermarking. Therefore, critical research gaps remain insufficiently addressed. ❶ Fidelity-removal Trade-off. Strong watermark removal attacks can significantly reduce watermark detectability, but often introduce severe artifacts and semantic inconsistencies; in contrast, fidelity-preserving manipulation tends to be too weak to reliably evade watermark verification. For example, NFPA [30] removes watermarks via next-frame prediction, but induces object misalignment, making it difficult to preserve visual fidelity and content consistency before and after watermark removal. ❷ Limited Model-agnosticism. Existing watermark removal attacks exhibit poor generalization across watermarking schemes. Most are built upon strong assumptions about the embedding mechanism, effectively overfitting to specific watermark patterns (e.g., high-frequency artifacts in the pixel domain). These methods transfer poorly to unseen or SOTA watermarking protocols. For example, UnMarker [16] claims universality but operates exclusively in pixel space via adversarial filtering, rendering it ineffective against initial-noise-based watermarking schemes that embed watermark signals directly within the generative process. ❸ Heavy Computational Overhead. SOTA removal attacks such as Imprint [26] and CtrlRegen+ [21], which target advanced watermarking schemes [40,43], incur substantial computational overhead due to repeated DDIM inversions. This reliance on iterative inversion not only introduces prohibitive latency that limits real-time deployment, but also accumulates reconstruction errors, resulting in noticeable visual degradation. Achieving a high-fidelity single-step DDIM-based attack remains an open problem, as existing methods fail to learn a direct end-to-end restoration that can effectively decorrelate the invisible watermark from complex semantic content without iterative refinement. Contributions. To address the above limitations, we propose M ARK N ULL, a model-agnostic watermark removal framework built on three key ideas: ❶ We introduce the NoiseLatent Alignment Score (NLAS) to measure and weaken the dependency between the generated latent representation and

the initial noise, enabling watermark removal through constrained latent-space decorrelation while preserving image quality. ❷ We design M ARK N ULL for a no-box setting, using only a public proxy model and no access to the target watermarking system, which supports transfer across different watermarking paradigms. ❸ We further develop M ARK N ULL A, an amortized variant that distills the optimization objective into a Watermark Removal Network (WRN), replacing iterative optimization with a single feed-forward pass for more efficient removal. Specifically, the main contributions of this paper include: • We propose M ARK N ULL, a no-box, model-agnostic watermark removal attack based on NLAS. Across nine representative image watermarking schemes, M ARK N ULL reduces the average BA to 53.14%, close to random guessing, while achieving the best overall visual quality among attack baselines. We further provide a theoretical analysis from the perspectives of flow matching and ODE theory to justify the removability of diffusionmodel watermarks and the validity of NLAS. • We develop M ARK N ULL -A, an amortized variant of M ARK N ULL that distills the latent manipulation objective into a WRN. M ARK N ULL -A removes the need for iterative optimization and enables efficient watermark removal, achieving 0.5 seconds per image with 6,282 MB of VRAM. • We further evaluate M ARK N ULL and M ARK N ULL -A against SynthID-Image, achieving a 100% ASR while maintaining superior perceptual quality, and extend evaluation to video watermarking schemes VideoShield and VideoMark, where M ARK N ULL suppresses BA to ∼ 50% and M ARK N ULL -A achieves excellent video quality among successful attack baselines (MUSIQ > 0.6). • We explore an attack detector as a defensive mechanism against M ARK N ULL and M ARK N ULL -A, demonstrating its potential to reliably identify compromised content. These findings further underscore the pressing need for watermarking schemes designed to be intrinsically robust against latent-space manipulation.

2 2.1

Related Work AI-generated Image Watermarking

Digital watermarking has progressed from traditional pixeland frequency-domain methods [18, 27, 37, 38] to deep learning-based frameworks [45, 49], serving as a key tool for provenance tracing and copyright protection. While conventional post-hoc methods watermark existing images, the rise of AIGC has shifted attention toward in-generation watermarking, which embeds signals during synthesis for improved

Table 1: Comparison of watermark removal attacks. We categorize prior attacks by methodology and compare them in terms of proxy-model requirement and key capabilities: optimization-free execution, model-agnosticism, attack speed (seconds per image), fidelity preservation, adversary’s knowledge and attackable modalities. Attack Capabilities

Regeneration

Adv. Attack

Method

Source

Proxy Model

Opt.-free

Model-agn.

Speed

Fidelity

Knowledge

Modality

VA [1] DA [48] NFPA [30]

ICML’24 NeurIPS’24 NeurIPS’25

✓(VAE) ✗(SDM) ✓(SDM)

✓ ✓ ✓

✗ ✗ ✗

0∼1 0∼1 1∼5

High High Low

No box No box No box

Image Image Image

Imprint [26] CtrlRegen+ [21] UnMarker [16] Noiseprints Attack (NPA) [6]

CVPR’25 ICLR’25 S&P’25 −

✓(SDM) ✓(SDM) ✗ ✓(SDM)

✗ ✗ ✗ ✗

✗ ✗ ✗ ✗

10 ∼ 50 5 ∼ 10 > 600 10 ∼ 50

Med. Med. Med. Med.

No box No box No box No box

Image Image Image Image

− −

✓(SDM) ✓(SDM)

✗ ✓

✓ ✓

5 ∼ 10 0∼1

High High

No box No box

Image&Video Image&Video

M ARK N ULL M ARK N ULL -A

stealthiness and robustness. Accordingly, T2I watermarking methods can be broadly categorized as follows: Fine-tuning-based watermarking: Fine-tuning-based watermarking embeds watermarks by modifying generative model parameters, making the watermark an intrinsic property of the output distribution. Representative approaches operate on different components: Stable Signature [4] fine-tunes the Variational Autoencoder (VAE) decoder to embed a fixed model-level watermark. Xiong et al. [41] and WOUAF [19] extend this to user-level attribution via learnable latent injection modules and weight modulation, respectively. SleeperMark [39] instead fine-tunes the U-Net with a trigger-based mechanism, enabling covert watermark activation conditioned on specific prompts. Initial-noise-based watermarking: Initial-noise-based watermarking advances in-generation techniques by embedding watermarks directly into the earliest stage of the generation process. By exploiting the structure of Latent Diffusion Models (LDMs), this paradigm freezes model parameters and subtly modifies the initial Gaussian noise, allowing the watermark to propagate through the denoising trajectory and persist in the final output. TreeRing [40] is a pioneering method that embeds a watermark signal guided by concentric ring patterns into the Fourier domain of the initial noise. Subsequent works enhance security by incorporating cryptographic primitives into the noise sampling process. Gaussian Shading [43] partitions the Gaussian probability space to encode watermark bits, and T2SMark [42] further improves key management and generation diversity. Similarly, Gunn et al. [8] employed Pseudorandom Error-correcting Codes (PRC) to modulate noise signs via watermark-derived sequences, providing strong computational indistinguishability guarantees.

2.2

Watermark Removal Attacks

The widespread dissemination of generative content has intensified research on watermark removal attacks, which seek to undermine verification and attribution by manipulating watermarked images [2,47]. While early attacks relied on simple

distortions with limited effectiveness, modern adversaries employ sophisticated techniques capable of suppressing or eliminating watermarks while preserving perceptual fidelity. Existing removal strategies fall into three paradigms [1,16,30]: distortion attacks, regeneration attacks, and adversarial attacks, with the latter two representing the most effective approaches; representative methods are summarized in Table 1. Distortion attacks are commonly used to assess the baseline robustness of watermarking schemes [5, 19, 39, 40, 43]. They apply standard signal-processing operations, such as geometric transformations and JPEG compression, to degrade watermark signals and reduce detection confidence. Although such attacks can weaken watermarks by introducing irreversible distortions or suppressing detection-relevant highfrequency components, their overall effectiveness is often limited. Regeneration attacks aim to remove watermarks by reconstructing images using non-watermarked generative models. For example, Zhao et al. [48] exploited the information bottleneck of VAEs and LDMs to filter out watermark signals during latent reconstruction. However, this approach relies on lossy encoding and decoding processes, which frequently introduce visual artifacts such as blurring and detail loss. Qiu et al. [30] proposed transforming watermarked images into semantically coherent future frames using an unwatermarked generative model. By optimizing constrained latent warping and applying frame-attention mechanisms to preserve semantic content, their method successfully removes initial-noisebased watermarks in a black-box setting, albeit with potential fidelity trade-offs. Adversarial attacks constitute one of the most extensively studied classes of watermark removal methods. These attacks optimize carefully crafted, imperceptible perturbations to mislead watermark detectors while preserving visual quality, typically formulated as constrained optimization problems. They are effective under varying adversarial knowledge assumptions and have demonstrated strong performance in bypassing detection systems. Hu et al. [14] studied the no-box

watermark evasion via transferable adversarial perturbations generated from surrogate model ensembles. MarkSweep [3] likewise targets the no-box setting, using a noise intensification–denoising pipeline to amplify and suppress imperceptible watermark signals. UnMarker [16] proposes a universal removal framework by optimizing Fourier-domain losses or applying adversarial filtering to alter structural image features. Nevertheless, these adversarial approaches generally fail against initial-noise-based watermarking methods [8, 40, 42, 43] and other highly robust watermarking schemes [23, 39]. Recent works have begun exploiting the generative priors of latent diffusion models for watermark removal under a no-box setting. Zhang et al. [20] and Müller et al. [26] optimized latent perturbations to cross detection boundaries with minimal visual distortion, while Liu et al. [21] guided controllable regeneration from noise using semantic and spatial constraints. Although these approaches differ in methodology, they collectively reveal a growing trend: leveraging the structure and dynamics of the diffusion process itself to suppress or remove embedded watermarks.

3 3.1

Background LDM-Based Image Generation

We formulate our method within the framework of LDMs [31], a class of generative models that has become foundational in diffusion-based image synthesis. Specifically, an LDM is composed of two principal components: (i) A diffusion model U based on U-Net, which governs the stochastic denoising trajectory in latent space; and (ii) a VAE, typically decomposed into an encoder–decoder pair (E , D ), where E maps input images into compact latent representations, and D reconstructs the corresponding images from those latents. The full LDM is denoted as Θ = (E , U , D ). The image generation process begins by sampling a noise vector zT from a standard Gaussian distribution. This latent is then progressively denoised to z0 , using the DDIM [32] or DPM-Solver++ [11, 22], and finally decoded into the image space via the decoder D : I = D (DDIMT →0 (zT ; U )) ,

zT ∼ N (0, I).

(1)

The inverse DDIM [25, 26] procedure reconstructs an image’s generative trajectory by running the deterministic reverse diffusion dynamics backward, which can be interpreted as a discretized ODE/flow trajectory under the probabilityflow ODE interpretation [32, 33]. This yields an approximately invertible mapping between z0 and zT . At each timestep t, the latent is updated by: p √ zt+1 = αt+1 zˆ0 t + 1 − αt+1 U (zt ,t, y), (2) where αt denotes the noise schedule and zˆ0 t is the model’s estimate of the original latent. This formulation inverts the generative process without requiring access to the original

condition y [25], thereby enabling reconstruction of the noise trajectory that could have produced z0 . This inversion underlies the basic principle of initial-noise-based watermarking methods [8, 40, 42, 43], where the watermark is embedded by modifying the zT and is then faithfully propagated through the generative process. We denote this inversion process as: zT = DDIM0→T (z0 ; U ),

3.2

z0 = E (I).

(3)

Formulation of Image Watermarking

The embedding processes of post-hoc watermarking and fine-tuning-based Watermarking can be defined as superimposing a specific noise signal δ onto the original cover image I to obtain the watermarked image Iw . This process can be formalized as: Iw = Θ(zT , y) + δ, (4) where δ denotes the watermark signal (or watermark residual). For post-hoc methods, δ is explicitly produced by the watermark embedding function; for fine-tuning-based methods, δ corresponds to the implicit output shift induced by parameter updates, i.e., Θw (zT , y) − Θ(zT , y). Initial-noise-based watermarking leverages the high sensitivity of diffusion models to initial conditions and the properties of DDIM, allowing the watermark embedded in the initial noise to propagate to the final generated image. This process can be defined as follows: Iw = Θ(zwT , y),

zwT ∼ N (0, I),

(5)

where zwT is constructed in the latent space based on a predefined watermark w using a specific embedding algorithm. Existing watermarking methods generally fall into three paradigms, yet they share a common verification function. Formally, we define a unified detector f : I → R that consists of both watermark extraction and verification. For an input image, it outputs a scalar score compared against a threshold τ to determine watermark presence.

4

Threat Model

In image watermarking, a watermark owner (e.g., image creator, model provider, or copyright holder) employs a watermarking system to embed imperceptible signals into AIgenerated images for provenance tracking and copyright enforcement, while an adversary seeks to evade verification by removing the watermark from the watermarked image while maintaining high visual fidelity of the image. We formalize watermark removal as an evasion attack under a no-box setting, and detail the adversary’s knowledge and objectives.

4.1

Adversary Knowledge

The generative framework employed by the watermark owner typically relies on LDMs [31], such as Stable Diffusion

Proposed Attack

[34–36], to ensure the synthesis of high-fidelity and semantically rich images. Depending on the specific provenance tracking strategy, the backbone model is either utilized as a fixed generator in post-hoc and initial-noise-based schemes or subjected to parameter modification in fine-tuning-based approaches. In this work, we consider a realistic and challenging model-agnostic threat model, in which the adversary aims to remove potential watermarks without relying on any prior knowledge of the specific watermark embedding mechanisms. The adversary’s capabilities are defined as follows:

(a) Per-instance attack: MarkNull 1 x DDIM

NLAS Gradient update

+ Perturbation Gradient update

LPIPS, MSE, SSIM

(b) Amortized attack: MarkNull-A

• No-box Target Access: The adversary can only generate watermarked images from the target generator Θ, but has no access to its internal parameters, gradients, or specific architecture (e.g., the decoder or the extractor).

LPIPS, MSE, SSIM

Watermark Removal Network Dataset

• No-Knowledge of Watermarking Scheme: We assume a strictly no-knowledge setting regarding the target watermarking scheme. The adversary is unaware of the specific paradigm, embedding, extraction, and verification algorithms, or the embedded watermark w. Furthermore, we assume a no-oracle setting in which the adversary has no access to the watermark detection interface and cannot query the verifier for scores or gradients. • Data Constraints: We assume that the adversary lacks access to ground-truth paired samples (i.e., a pair of watermarked and non-watermarked images depicting the same content or generated from the same prompt). • Proxy Model Access: The adversary has full white-box access to a publicly available proxy model ΘA , which is assumed to share a similar generative domain with the image generation model Θ, but is clean.

4.2

Attack Objectives

The adversary aims to achieve effective watermark removal while maintaining high visual fidelity. We formalize these two competing objectives as follows: Watermark Evasion. To compromise the target watermarking system, the attack goal is to suppress the detection score below the decision threshold, thereby causing a false negative: f (IA ) < τ,

(6)

where IA denotes the adversarial image. Visual Stealthiness. The attacked image IA after watermark removal must remain perceptually indistinguishable from the original watermarked image Iw to ensure utility. We require: dimg (IA , Iw ) ≤ η,

(7)

where dimg represents a perceptual distance metric (e.g., LPIPS [46] or MSE), and η is an acceptable distortion budget.

NLAS Loss =

NLAS

+ LPIPS, MSE, SSIM

Watermark Removal Network

Gradient descent

Verification: No watermark!!!

Figure 2: Illustration of the attack pipeline. M ARK N ULL iteratively optimizes latent representations to evade detection; M ARK N ULL -A trains a WRN for rapid end-to-end removal. Both modes leverage a proxy model ΘA .

Generality and Practicality. The proposed attack is modelagnostic and designed to generalize across diverse watermarking paradigms and real-world deployment scenarios. Unlike prior approaches that rely on exploiting scheme-specific embedding artifacts, our attack leverages universal properties of LDMs, enabling consistent effectiveness against posthoc, fine-tuning-based, and initial-noise-based watermarking schemes. Moreover, the attack assumes no access to the target model or watermarking mechanism and must successfully transfer from a publicly available proxy model to unknown or proprietary systems without modification. Meanwhile, we emphasize practicality and stealth. The attack is required to operate under realistic resource constraints, achieving low latency and modest memory overhead suitable for consumergrade hardware, while preserving high perceptual quality to avoid raising suspicion during watermark removal.

5 5.1

Proposed Attacks Overview

We propose M ARK N ULL and its end-to-end version M ARK N ULL -A, as illustrated in Figure 2. M ARK N ULL is a per-instance optimization attack that removes watermark through latent space manipulation. It iteratively optimizes a

perturbation applied to the image’s latent representation z0 , balancing two competing objectives: (i) maximizing deviation from the watermarked initial noise distribution to erase embedded watermark signals, and (ii) minimizing perceptual loss to preserve visual fidelity. To enhance attack efficiency, we further introduce M ARK N ULL -A, an amortized version of the attack designed for rapid inference. M ARK N ULL -A trains a WRN to learn a generalized mapping from watermarked image to watermark-free image in the pixel domain, distilling the iterative optimization objective into a single forward pass, while maintaining the hybrid loss constraints on both latent and pixel spaces, achieving a favorable balance between removal effectiveness and image quality.

5.2

Key Insights

source zT compared to independent random noise. Moreover, the zT → z0 trajectory is constrained by the denoiser and the scheduler. The generated states do not densely cover the ambient Euclidean space; instead, they are concentrated near a structured low-dimensional manifold. Thus, we introduce NLAS to measure the correlation between z0 and zT :   z0 · zT π NLAS(z0 , zT ) = (arccos − )2 . (8) ∥z0 ∥2 ∥zT ∥2 2 Section A validates NLAS as an effective correlation metric: z0 shows high alignment with its coupled zT , whereas it is effectively orthogonal to random standard Gaussian noise zrand ∼ N (0, I). (adv) Therefore, we aim to construct an adversarial latent z0 that is orthogonal to zT , formulated as follows: (adv)

As illustrated in Section 3.1, the watermarked zT can be transported along the denoising trajectory and manifest in z0 and thus in the decoded image, making zT a natural carrier for watermark information. Our proposed approach is driven by the fundamental observation that watermarking paradigms, regardless of their implementation, rely on preserving specific statistical dependencies along the generative trajectory (zT → z0 ). We introduce Latent Space Manipulation to disrupt these dependencies through two complementary mechanisms: Statistical Independence via Orthogonality. For initialnoise-based watermarking schemes, we observe that simple distance maximization in latent space is insufficient to remove watermark signals. Instead, we enforce geodesic orthogonality between the optimized latent zadv 0 and the original initial noise zA,w . In high-dimensional latent spaces, orthogonality T implies statistical independence, severing the causal dependency between the generated image and the watermarked initial noise. As a result, the re-inverted noise is mapped to a pristine, unstructured distribution rather than a watermarkencoded pattern, enabling reliable watermark removal. Manifold Projection and VAE Filtering. For fine-tuning and post-hoc watermarking schemes, our attack performs regeneration. First, the VAE information bottleneck functions as a low-pass filter, suppressing high-frequency, pixel-level artifacts commonly introduced by post-hoc watermark embedding. Second, by optimizing zadv 0 to minimize perceptual distortion while simultaneously enforcing the orthogonality constraint, we induce a controlled distributional shift: the resulting adversarial image maintains high visual fidelity but is projected away from the model’s specific watermarked statistical manifold. This displacement effectively prevents watermark detection while preserving semantic content.

5.3

M ARK N ULL

The initial noise zT leaves a persistent structural trace on the final generation; specifically, the latent representation z0 retains a significantly higher correlation with its originating

(adv)

θ(z0

, zT ) →

z zT π =⇒ ⟨ 0(adv) , ⟩ ≈ 0, 2 ∥z0 ∥ ∥zT ∥

(9)

where ⟨·, ·⟩ denotes the inner product. To promote statistical independence under a Gaussian prior, we enforce orthogonality between z0 and zT . To preserve visual fidelity while optimizing the adversarial (adv) z0 , we incorporate an image quality loss term that constrains the decoded adversarial image to remain close to the original watermarked image. Specifically, we define the quality loss as:

Limg (IA , Iw ) = λ1 LLPIPS (IA , Iw ) + λ2 ∥IA − Iw ∥22
+ λ3 1 − LSSIM (IA , Iw ) ,

(10)

where Iw and IA denote the original watermarked image and the image decoded from the adversarial latent via proxy model, respectively; LLPIPS measures perceptual dissimilarity, ∥ · ∥22 is the pixel-wise Mean Squared Error (MSE), and LSSIM quantifies structural similarity. The weights {λ1 , λ2 , λ3 } balance the perceptual, pixel-level, and structural fidelity terms. This loss ensures that watermark removal does not produce noticeable image degradation. Consequently, we aggregate the aforementioned terms into (adv) a unified objective function and optimize the adversarial z0 via gradient descent. Crucially, this optimization process relies exclusively on the proxy model ΘA = (E A , U A , D A ), adhering strictly to the no-box setting. The optimization procedure is summarized in Algorithm 1. We name this per-instance attack M ARK N ULL. (11) LM ARK N ULL = Limg (IA , Iw ) + λ4 NLAS(z(adv) , zA,w T ). 0 Furthermore, in Section 6, we provide a theoretical analysis of the feasibility and generality of M ARK N ULL. We view the generation dynamics of LDMs as a deterministic ODE flow driven by a learned time-dependent vector field, which allows us to leverage flow matching and ODE theory to establish the existence of an inverse mapping and thus the removability of watermarks across a broad range of watermarking schemes.

Algorithm 1: M ARK N ULL

Algorithm 2: M ARK N ULL -A , proxy model ΘA ,

Input : Watermarked image Iw latent perturbation budget ε; steps N, learning rate κ. Output :Watermark-free image IA . 1 // 1. Initialization A,w 2 z0 ← E A (Iw ) A,w A,w A 3 zT ← DDIM0→T (z0 ; U ) (adv)

z0 ← zA,w 0 5 // 2. Optimization Loop 6 for i ← 1 to N do (i) (adv) 7 IA ← D A (z0 ) 4

(adv)

gi ← ∇ (adv) LM ARK N ULL (z0

8

z0

(i)

, zAT , IA , Iw )

▷ Equation (11) (adv) (adv) z0 ← z0 − κgi (adv) (adv) ← zA,w − zA,w z0 0 + Clip(z0 0 , −ε, ε)

9 10 11

Input: Dataset D , proxy model ΘA , learning rate ξ, image Iw Output: Wφ , watermark-free image IA 1 Initialize φ 2 while not converged do 3 Sample B ∼ D 4 // 1. Forward 5 zAT ← DDIM0→T (E A (B); U A ) 6 Be ← Wφ (B) (adv) e 7 z0 ← E A (B) 8 // 2. Gradient Update (adv) e B) 9 φ ← φ − ξ∇φ LM ARK N ULL -A (z0 , zAT , B, ▷ Equation (12) // 3. End-to-end Attack IA ← D A (E A (Wφ (Iw ))) 12 return Wφ , IA

10 11

// 3. Final Reconstruction (adv)

IA ← D A (z0 13 return IA 12

5.4

)

M ARK N ULL -A

While M ARK N ULL serves as a powerful per-instance attack, its reliance on iterative gradient-based optimization introduces substantial computational latency, limiting scalability in real-time or large-scale deployment scenarios. However, as empirically demonstrated, the perturbations learned by M ARK N ULL are not purely random; they exhibit consistent and transferable structural patterns across different samples. This observation suggests that the transformation required to decorrelate watermark signals from the latent diffusion trajectory is both learnable and generalizable. Motivated by this insight, we introduce M ARK N ULL -A, an amortized variant designed to improve attack efficiency. Rather than performing iterative optimization on individual samples, M ARK N ULL -A employs a WRN to amortize the optimization cost through a single feed-forward model. The WRN is trained to learn a direct mapping from watermarked images to their watermark-free counterparts by minimizing the following objective function over a representative training dataset. h LM ARK N ULL -A = EI∼D λ5 LLPIPS (IA , I) + λ6 ∥IA − I∥22 i (12)
(adv) +λ7 1 − LSSIM (IA , I) + λ8 NLAS(z0 , zAT ) . 5.4.1

WRN

We build the WRN upon a Restormer [44], a SOTA Transformer architecture designed for high-fidelity image restora-

tion. The Restormer is well-suited to our task for two main reasons: (i) its multi-head transposed self-attention mechanism effectively captures long-range dependencies while maintaining computational efficiency for high-resolution inputs; and (ii) its restoration-focused inductive bias, an encoder–decoder hierarchy with multi-scale feature refinement, closely aligns with our goal of removing the watermark without introducing perceptible distortions. To comply with the Data Constraints, we construct the training dataset D utilizing a publicly available proxy model ΘA . D consists exclusively of clean AI-generated images I without any embedded watermarks. Accordingly, the WRN Wφ is trained to produce an output image IA from I that preserves high perceptual fidelity while enforcing latent-space decorrelation and orthogonality between the optimized latent representation zA0 and the initial noise zAT . The training procedure is summarized in Algorithm 2. To further enhance attack efficacy and ensure consistency with the diffusion prior, the output of Wφ is subsequently passed through a VAE regeneration using ΘA .

6

Provable Attack Guarantees of M ARK N ULL

In this section, we theoretically substantiate the effectiveness of M ARK N ULL. The generation dynamics of an LDM can be viewed as a deterministic ODE flow driven by a learned time-dependent vector field [10]. This perspective enables us to leverage flow matching and ODE theory to formalize the existence of an inverse mapping, thereby establishing the removability of watermarks. Our argument is structured around three key observations: (i) because the generative flow is a diffeomorphism, the induced watermark map admits a unique preimage, ensuring well-posed invertibility; (ii) convergence

of the marginal vector fields implies that discrete inversion procedures are asymptotically consistent across model variants; and (iii) a latent-space decorrelation mechanism suppresses alignment-based test statistics, reducing detectability under common alignment metrics. To be consistent with the LDM literature [31], we use zT to denote the initial noise and z0 the generated latent representation. We reparameterize time t ∈ [0, 1] such that X0 ∼ pinit corresponds to zT , and X1 ∼ pdata corresponds to z0 following ODE and flow matching.

6.1 Bijective Structure of Noise-Data Mapping In this section, we establish the theoretical validity of altering the initial noise by manipulating the latent representation. Assumption 1 (Deterministic Marginal Flow Analysis). We define the generative process as a deterministic ODE flow induced by the Marginal Vector Field. Thus, the trajectory satisfies: dXt target = ut (Xt ), dt

X0 = zT =⇒ X1 = z0 ,

(13)

where ut denotes the vector field. This assumption is grounded in the theoretical framework in [10]. This validates the marginalization trick, demonstrating that a marginal vector field governing the target probability path can be constructed by integrating conditional vector fields over the posterior distribution. This establishes the theoretical basis for treating the generation process as a deterministic ODE flow; consequently, deterministic samplers used in practice (e.g., DDIM [32], DPM-Solver [22]) are essentially numerical discretizations of this specific ODE. Proposition 1 (Bijectivity Implies a Unique Preimage). Let ψ : K → ψ(K) be the time-1 flow map induced by an ODE on the compact set K, satisfying z0 = ψ(zT ). If the vector field ut is continuously differentiable and uniformly Lipschitz on K, then ψ is a diffeomorphism. For any generated latent representation z0 ∈ ψ(K), there exists a unique preimage zT = ψ−1 (z0 ). Therefore, any non-zero perturbation ε result(adv) (adv) ing in z0 = z0 + ε (provided z0 ∈ ψ(K)) necessarily (adv)

corresponds to a shifted initial state zT

̸= zT .

Proof. The solution to the ODE satisfying the aforementioned regularity conditions defines a diffeomorphism. Injectivity guarantees the uniqueness of the preimage. Furthermore, since the inverse map ψ−1 is smooth on the compact image set ψ(K), its Jacobian norm is bounded. According to the Mean Value Theorem, the variation in the initial noise is bounded by: (adv) ∥zT − zT ∥ ≤ Linv ∥ε∥, (14) where ε denotes the adversarial perturbation added to z0 , and Linv is the Lipschitz constant of the inverse mapping ψ−1 .

This verifies that perturbations in the latent representation can effectively alter the original watermarked zT .

6.2

Consistency of Watermark Estimation

M ARK N ULL leverages a proxy model ΘA to infer the watermarked initial noise. A key requirement is that the inversion results produced by the proxy model align with those of the target model. Assumption 2 (Proxy-Target Compatibility). We assume that the target model Θ and the proxy model ΘA share the same latent-space parameterization and the same discrete inversion scheme ψ̂−1 (i.e., the same noise schedule and solver type). In practice, ψ̂ is ψ’s discrete approximation. Moreover, A we assume that their vector fields utΘ and utΘ satisfy a uniform Lipschitz condition on a compact set K, and that all intermediate states encountered during inversion remain within K. For watermarking methods built upon SDM-based T2I models, implementing initial-noise-based watermarking typically relies on a largely standardized choice of noise schedule and solver type, which is widely accepted in the community and does not violate the no-box setting. This assumption is grounded in the fundamental objective of generative modeling. Although Θ and ΘA may differ in architecture or training details, both are optimized to approximate the same underlying ground-truth distribution of natural images, denoted as pdata . Consequently, they learn to map Gaussian noise to the same low-dimensional natural image manifold. Since the watermark removal process in M ARK N ULL essentially corresponds to a projection operation that pulls the sample back onto this shared manifold (filtering out off-manifold watermark perturbations), the gradient direction learned from the proxy manifold M (ΘA ) serves as a highly effective approximation for the target manifold M (Θ). This structural alignment ensures attack transferability even across disparate model architectures. Lemma 1. Under Assumption 2 and the stability theory of numerical integration (specifically, the discrete Grönwall lemma), the discrepancy in the inversion results is bounded by the error of the vector fields: −1 sup ∥ψ̂−1 Θ (z)− ψ̂ΘA (z)∥ ≤ Cstab

z∈ψ(K)

sup

A

∥utΘ (x)−utΘ (x)∥.

x∈K,t∈[0,1]

(15) This bound holds for any single-step or multi-step solver satisfying zero-stability and consistency conditions. The constant Cstab depends on the Lipschitz constant, the number of steps, and the time interval. Proposition 2 (Guarantee of Attack Transferability). Let −1 A,w zA,w T = ψ̂ΘA (z0 ) denote the proxy initial noise used in Algow rithm 1 and Algorithm 2, and let zwT = ψ̂−1 Θ (z0 ) denote the

initial noise under the target model. If both models are suffiA ciently aligned such that supt |utΘ − utΘ | ≤ εu , then optimizing (adv) the adversarial latent representation z0 to decorrelate from A,w zT implicitly reduces its correlation with zwT . Proof. The flow matching training objective regresses ut to target a unique marginal vector field ut [10]. Assuming sufficient convergence, the vector field discrepancy εu is minimal. Applying Lemma 1, the inversion error is bounded by: ∥zwT − zA,w T ∥ ≤ Cstab εu .

(16) (adv)

Therefore, M ARK N ULL minimizes NLAS(z0 , zA,w T ), which in turn approximates minimizing the absolute inner product (adv) |⟨z0 , zwT ⟩|. By applying the triangle inequality and CauchySchwarz inequality to the decomposition, we obtain: (adv)

(adv)

, zwT ⟩| = |⟨z0

A,w w , zA,w T + (zT − zT )⟩|

(adv)

(adv)

|⟨z0

≤ |⟨z0

, zA,w T ⟩| + |⟨z0

(adv)

(adv)

≤ |⟨z0 , zA,w ⟩| + ∥z {z T } | 0 | NLAS

, zwT − zA,w T ⟩|

∥ · ∥zwT − zA,w T ∥. {z }

(17)

Cstab εu

(adv)

When normalized ∥z0 ∥ = 1, and by Lemma 1 the error term is upper-bounded by Cstab εu . Therefore, when the optimization drives the correlation (i.e., NLAS) under the proxy model toward 0, the correlation under the target model is guaranteed to remain within Cstab εu . As long as the two models are similar (i.e., εu is small), the attack can be successfully realized using the proxy model.

6.3

Watermark Removal Guarantee

Building upon the transferability guarantee established in the previous section, we now formally analyze the mechanism by which M ARK N ULL removes the watermark signal. While Section 6.2 ensures that our proxy-guided optimization remains valid for the target model, this section demonstrates that the optimization objective itself, minimizing NLAS, mathematically leads to a reduction of correlation-based detection statistics. Proposition 3 (Watermark Removal via Alignment Suppression). This proposition applies to initial-noise-based watermarking schemes that rely on correlation-based detection such as TreeRing [40], Gaussian Shading [43], and PRC [8], where the decision statistic depends on the alignment between the recovered watermark zwT and the original initial noise. By minimizing NLAS, M ARK N ULL reduces the correlation be(adv) tween the adversarial latent z0 and the target watermark zT to the statistical baseline of independent random vectors. Proof. M ARK N ULL explicitly minimizes the NLAS. Since NLAS is defined as a monotonic metric quantifying the

deviation of the included angle from π/2, the condition (adv) NLAS → 0 implies ⟨z0 , zT ⟩ → 0 (i.e., orthogonality). In high-dimensional spaces, according to the Concentration of Measure phenomenon, independent isotropic random vectors are approximately orthogonal with extremely high probability (correlation concentrates around 0). Consequently, this optimization process suppresses the alignment metric to the statistical baseline of "random noise pairs". For detectors relying on this specific alignment structure, the detection statistic will degenerate to the Null Hypothesis H0 , classifying the image as non-watermarked, leading to detection evasion. The analysis above primarily addresses watermarks rooted in the generation dynamics. However, watermarking schemes based on fine-tuning and post-hoc methods operate through different mechanisms. These approaches typically introduce perturbations in the high-frequency domain or alter the statistical distribution of the model. In the following proposition, we extend our theoretical framework to demonstrate that our method remains effective against these paradigms by leveraging the manifold projection property of the VAE decoder. Proposition 4 (Generalization to Fine-tuning and Post-hoc Schemes). The adversarial latent perturbation generated by M ARK N ULL is effective against fine-tuning and post-hoc watermarking schemes. Since these watermarks can be modeled as additive perturbations δ that typically reside in the high-frequency space of the image manifold, M ARK N ULL evades detection by projecting the watermarked image onto the tangent space of the generative manifold, thereby filtering out the watermark signal. Proof. Let M = {D A (z0 ) | z0 ∈ Z } be the image manifold. Post-hoc and fine-tuning watermarks are modeled as Iw = Iclean + δ. M ARK N ULL optimizes the latent representation to minimize the reconstruction loss, which is mathematically equivalent to solving a local projection problem: min ∥D A (z0 + ∆z) − (Iclean + δ)∥22 .

(18)

∆z

By performing a first-order Taylor expansion of the decoder around zclean with Jacobian Jz , the optimization simplifies to a linear least-squares problem: min∆z ∥Jz ∆z − δ∥22 . The closedform solution yields the update in pixel space: ∆IA ≈ Jz ∆z∗ = PT δ,

where PT = Jz (Jz⊤ Jz )−1 Jz⊤ .

(19)

Here, PT is the orthogonal projection matrix onto the tangent space TIclean M . The reconstruction IA effectively retains the component PT δ (on-manifold content) while discarding (I −PT )δ (off-manifold noise). Since fine-tuning and post-hoc watermarks are designed to be imperceptible, they predominantly occupy the high-frequency subspace orthogonal to the semantic manifold (i.e., ∥(I −PT )δ∥ ≫ ∥PT δ∥). Consequently, the projection PT significantly attenuates the watermark energy, rendering it undetectable.

7

Evaluation and Analysis

We conduct comprehensive evaluations of the proposed M ARK N ULL and M ARK N ULL -A across a broad range of tasks, evaluation metrics, and representative baselines. Section 7.1 outlines our experimental setup, including the used datasets and evaluation metrics. In Sections 7.2 to 7.4, we present four key aspects of our analysis: attack effectiveness, image quality preservation, efficiency and usability, and generalization. Together, these experiments demonstrate the capability of our proposed attacks to address key research gaps in watermark removal.

7.1

Experimental Setup

M ARK N ULL and M ARK N ULL -A are implemented with the hyperparameter settings described in Section B, where we also report the corresponding experimental results. Watermarking Baselines. We deploy nine representative AI-generated image watermarking baselines, covering three major paradigms. Post-hoc watermarking methods include DWT-DCT-SVD (DwtDct) [27], RivaGan [45], and HiDDeN [49]. Fine-tuning-based methods include Stable Signature (SS) [4], VINE [23], and SleeperMark [39], which embed watermarks by updating the generative model parameters. Initial-noise-based methods include Gaussian Shading (GS) [43], PRC [8], and TreeRing (TR) [40], which encode watermarks by manipulating the initial noise in the diffusion process. Among these, TR is a zero-bit watermarking scheme that verifies watermark presence without decoding a bit-string watermark. Model and Dataset. We leverage Stable Diffusion 2.1base (SD2.1) [34] as the default backbone for both image generation and watermark embedding. SD2.1 is a widely adopted open-source T2I model known for its high-fidelity outputs, and it serves as an underlying model for constructing AI-generated image watermarking schemes. To benchmark watermarking performance, we randomly sample prompts from the Stable Diffusion Prompts (SDP) dataset [9] and generate 100 watermarked images of resolution 512 × 512 for each watermarking method using SD2.1. All images are generated with a fixed number of 50 inference steps to ensure consistency across comparisons. For post-hoc watermarking baselines, we instead generate 100 images using Stable Diffusion XL-base 1.0 (SDXL1.0) [35], followed by the application of watermarking schemes after image synthesis. In addition, when a proxy model is required by the adversary within attack methods, we instantiate it using Stable Diffusion 1.5 (SD1.5). Attack Baselines. To comprehensively assess our attacks’ capability for image watermark removal, we evaluate M ARK N ULL and M ARK N ULL -A against a broad suite of attack baselines covering both standard distortions and advanced watermark removal attacks. Specifically, five standard distortions include Gaussian noise, Gaussian blur, con-

trast adjustment, brightness adjustment, and JPEG compression. The advanced watermark removal attacks are further grouped into: (i) regeneration attacks, including DiffusionAttack (DA) [48], VAE-Attack (VA) [1], CtrlRegen+ [21], and Next Frame Prediction Attack (NFPA) [30]; and (ii) adversarial attacks, including UnMarker [16], Imprint [26], and NoisePrints (NPA) [6]. For each baseline, we use the attack hyperparameters reported in the original papers, so that the resulting outputs exhibit comparable visual quality, thereby enabling a fair, controlled comparison of watermark removal effectiveness. Evaluation Metrics. We employ five metrics to evaluate both reconstruction fidelity and perceptual realism, including PSNR▲, SSIM▲, LPIPS▼, FID▼, and BRISQUE▼. BRISQUE [24], a no-reference metric, evaluates perceptual quality without the ground truth. To facilitate a holistic assessment of image quality, we introduce a CQS▲. In addition, we evaluate an attack’s ability to evade watermark detection using BA and TPR@1%FPR. Detailed definitions of these metrics are provided in Section C.

7.2

Evaluation Results

7.2.1

Effectiveness of M ARK N ULL and M ARK N ULL -A

We evaluate M ARK N ULL and M ARK N ULL -A in terms of watermark removal effectiveness, focusing on their ability to suppress detection scores across diverse watermarking schemes and against representative attack baselines. Table 2 summarizes watermark detection performance under different attacks. For multi-bit watermarking schemes, we report BA, while for the zero-bit TR, we report TPR@1%FPR. In the absence of attacks, all watermarking methods achieve nearperfect detection or bit extraction accuracy, confirming the correctness of watermark embedding and detection. Across eight multi-bit watermarking schemes, existing attacks remain largely ineffective: most baselines continue to achieve high BA (e.g., VA retains average BA of 80.17%, and UnMarker remains at 91.81%), indicating that the embedded watermarks are still reliably recoverable. VA and DA, which represent simple regeneration attacks, fail to compromise robust watermarking schemes like VINE and SleeperMark. UnMarker, although effective against certain post-hoc watermarking, does not generalize beyond its targeted embedding artifacts. Notably, all the above approaches are ineffective against initial-noise-based watermarking schemes. M ARK N ULL reduces the average BA to 53.14%, approaching the random-guessing baseline (50%), and achieves nearchance performance on robust schemes like GS and SleeperMark. Its amortized variant, M ARK N ULL -A, exhibits comparable performance. Overall, both attacks outperform existing baselines in disrupting multi-bit watermark detection, with M ARK N ULL achieving the strongest average effectiveness. For the zero-bit TR scheme, M ARK N ULL reduces

Table 2: Attack evaluation against watermarking schemes (TPR@1%FPR▼ for zero-bit watermarking; BA[%] ▼ for multi-bit watermarking). Multi-bit

Zero-bit

Attack

DwtDct

RivaGan

HiDDeN

SS

VINE

PRC

Avg.

TR

No Attack

100

99.96

98.99

99.76

99.79

99.96

100

100

99.81

100

Noise Blur Contrast JPEG Brightness

84.81 100 50.64 99.66 50.19

99.81 99.96 99.40 98.62 99.44

53.91 72.12 87.12 77.85 89.63

96.85 85.08 98.16 79.77 98.40

99.45 99.81 99.71 99.74 99.70

99.31 99.98 99.98 99.75 99.94

99.75 100 100 99.93 100

89.94 100 100 95.82 100

90.48 94.62 91.88 93.89 92.16

92 92 98 91 96

VA [48] DA [1] CtrlRegen+ [21] NFPA [30] Imprint [26] UnMarker [16] NPA [6]

78.97 69.64 53.16 52.93 59.81 100 56.91

64.78 61.75 57.90 62.28 54.34 87.84 58.59

60.81 61.87 59.74 58.37 61.22 63.91 60.29

62.66 48.80 47.64 48.36 46.52 93.41 46.73

96.68 91.67 68.96 52.76 73.70 98.59 84.16

95.98 99.81 89.10 85.27 83.71 99.77 92.75

98.59 99.74 91.92 50.60 31.68 99.48 66.77

84.47 96.76 52.18 49.41 47.94 91.47 51.76

80.17 78.76 65.08 57.50 57.37 91.81 64.75

83 78 31 0 34 46 29

M ARK N ULL M ARK N ULL -A

55.10 66.43

59.78 70.53

60.62 59.85

49.12 46.52

64.93 56.00

42.88 39.29

41.55 70.28

51.18 47.94

53.14 57.10

43 63

PRC

TR

Avg.

SleeperMark GS

Table 3: CQS evaluation of various attack methods against watermarking schemes. Attack

DwtDct

RivaGan

HiDDeN

SS

VINE

VA DA CtrlRegen+ NFPA Imprint UnMarker NPA

3.19 3.66 3.17 1.04 3.00 3.09 3.18

3.30 3.71 3.20 1.61 3.09 2.84 3.25

3.16 3.73 3.32 1.89 3.08 2.95 3.24

3.52 3.90 3.41 1.85 3.35 3.05 3.72

3.74 3.75 3.27 1.55 3.20 3.13 3.82

3.39 3.89 3.40 1.13 3.16 3.13 3.74

3.63 3.94 3.55 1.87 3.34 2.92 3.75

3.34 3.63 3.26 1.73 2.85 3.00 3.33

3.50 3.82 3.43 1.62 3.22 3.04 3.66

3.42 3.78 3.33 1.58 3.14 3.02 3.52

M ARK N ULL M ARK N ULL -A

3.66 3.91

3.72 3.94

3.75 3.97

4.09 3.88

3.93 3.68

4.24 3.99

4.11 4.06

3.80 3.85

4.06 3.92

3.93 3.91

TPR@1%FPR from 100% to 43%, while M ARK N ULL -A achieves 63%. Although some baselines achieve slightly lower detection rates on TR, our methods provide broader and more consistent suppression across both multi-bit and presence-only detectors. These results highlight the strong generalizability of our approach. By explicitly decorrelating (adv) zwT and z0 through NLAS minimization, M ARK N ULL remains highly effective even against the stealthiest and most lossless initial-noise-based watermarking schemes (e.g., GS and PRC). 7.2.2

Evaluation of Image Quality Preservation

We conduct a comprehensive quantitative evaluation against seven baseline attacks to demonstrate that M ARK N ULL and M ARK N ULL -A do not compromise the semantic and perceptual fidelity of images. Table 3 shows that M ARK N ULL and M ARK N ULL -A demonstrate SOTA performance in maintaining image quality. M ARK N ULL achieves the highest CQS across all nine tested watermarking schemes, consistently outperforming existing methods such as UnMarker and NPA.

SleeperMark GS

In particular, for generative watermarking schemes like SS and TR, M ARK N ULL achieves a CQS of 4.09 and 4.06, respectively, significantly surpassing the strongest baseline DA. These results indicate that M ARK N ULL effectively suppresses watermark signals while preserving image fidelity, whereas baseline latent-space adversarial attacks (e.g., NPA and Imprint) often induce visible artifacts or blurring, leading to degraded perceptual quality. Figure 3 illustrates the performance distributions across individual quality metrics. The results show that M ARK N ULL and M ARK N ULL -A perform consistently well across both pixel-level metrics (PSNR, SSIM) and perceptual metrics (LPIPS, FID). Additional qualitative comparisons of attacked images are provided in Section D. Takeaway 1: Prior adversarial attacks suffer from an inherent fidelity–removal trade-off. M ARK N ULL effectively breaks this dilemma. By explicitly minimizing NLAS to decorrelate watermark signals from semantic content, it achieves near-perfect removal performance while maintaining SOTA perceptual quality.

LPIPS

LPIPS

BRISQUE

PSNR

SSIM

(a) Legend

BRISQUE

PSNR

FID

SSIM

(b) DwtDct

LPIPS

PSNR

SSIM

FID

PSNR

PSNR

SSIM

(g) SleeperMark

PSNR

SSIM

FID

(h) GS

LPIPS

BRISQUE

PSNR

SSIM

FID

(e) StableSignature

LPIPS

BRISQUE

FID

BRISQUE

FID

(d) HiDDeN

LPIPS

SSIM

(f) VINE

PSNR

SSIM

(c) RivaGan

BRISQUE

LPIPS

BRISQUE

FID

LPIPS

BRISQUE

LPIPS

FID

BRISQUE

PSNR

SSIM

(i) PRC

FID

(j) TR

Figure 3: Quantitative comparison of image quality metrics. For visualization, we normalize all metrics and orient them so that larger values consistently indicate better quality (i.e., lower-is-better metrics are inverted). 7.2.3

Attack Efficiency Assessment

We evaluate the practical deployability of our attacks by measuring attack latency (seconds per image) and GPU memory consumption (VRAM in MB) on a single NVIDIA A100 GPU. As shown in Figure 4, existing optimization-based adversarial attacks (Imprint, UnMarker, and NPA) exhibit substantial computational costs. In particular, UnMarker requires over 700 seconds per image, and NPA takes 33.8 seconds, making both unsuitable for large-scale deployment. In contrast, our proposed M ARK N ULL -A achieves significantly improved efficiency, requiring only 0.50 seconds per image, which is orders of magnitude faster than all optimizationbased baselines. In terms of memory usage, M ARK N ULL -A consumes 6,282 MB of VRAM, comparable to CtrlRegen+ (6,532 MB) and lower than high-resource methods such as UnMarker (14,378 MB). Although M ARK N ULL is more computationally intensive due to iterative optimization, its VRAM usage remains below 10 GB, suggesting its potential compatibility with consumer GPUs. Time

GPU

|

MarkNull

MarkNull-A

Baselines

18000

10

16000

729.3 14378

13952

14000

GPU Memory Usage (MB)

Attack Speed (s/img) [Log Scale]

103

12000

2

44.7

9986

9178

101

6.9

100

10000 8000

8.0

6820

6532

4766

9908

33.8

6282

1.2 0.50

2000

0.18

VA

6000 4000

0.72

DA

CtrlRegen+

NFPA

Imprint UnMarker

NPA

MarkNull MarkNull-A

0

Figure 4: Comparison of attack speed and GPU memory usage across nine watermark removal methods.

Takeaway 2: Existing attacks incur prohibitive computational overhead. M ARK N ULL -A addresses this by replacing iterative DDIM inversions with a single feed-forward pass, achieving real-time inference at low VRAM consumption. These results demonstrate that effective watermark removal requires no costly iterative refinement, enabling scalable deployment on consumer hardware.

7.3

Breaking Google’s SynthID-Image

SynthID-Image [7] is a post-hoc, model-agnostic watermarking scheme designed for large-scale provenance verification of AI-generated images. It employs a learned encoder–detector pair to embed and detect imperceptible watermarks, and has been deployed across Google AI systems1 . We evaluate our M ARK N ULL, M ARK N ULL -A, and baselines on the commercial SynthID-Image watermarking system using 20 AIgenerated images produced by Imagen-3 with prompts from the SDP dataset [9]. After applying each attack, we assess watermark detectability and image fidelity, with results reported in Table 4. Since the official detection code of SynthID-Image is not publicly available, we follow Google’s Gemini (fast mode) verification procedure for watermark detection2 . Table 4 reveals the critical security vulnerabilities of SynthID-Image. Our work is the first study to explore the robustness of a commercial AI-generated image watermarking system against removal attacks. While SynthID-Image exhibits robustness against VA, it suffers a catastrophic failure when subjected to advanced attacks. We attribute this fragility to the limitations of its post-hoc embedding scheme, which 1 https://deepmind.google/models/synthid/ 2 https://support.google.com/gemini/answer/16722517?hl=e

n-SG&co=GENIE.Platform%3DAndroid

Table 4: Attack evaluation against SynthID-Image. Attack

ASR[%]

CQS

VA DA CtrlRegen+ NFPA Imprint UnMarker NPA

0 100 100 100 100 100 100

4.07 3.66 3.29 1.21 3.21 2.86 3.45

M ARK N ULL M ARK N ULL -A

100 100

3.87 3.70

LPIPS

BRISQUE

PSNR

SSIM

FID

VA DA

NFPA Imprint

NPA MarkNull

CtrlRegen

UnMarker

MarkNull-A

Figure 5: Image-quality metrics for SynthID-Image across different attack baselines and our methods.

proves insufficient against latent-space manipulations. However, among all methods achieving a 100% ASR, M ARK N ULL reaches the highest CQS, as illustrated in Figure 5. Furthermore, the results for M ARK N ULL reported above are obtained using the default high-perturbation configuration described in Section B.1. For post-hoc watermarks, a milder configuration (e.g., ε = 1, N = 10, and κ = 0.01) is sufficient to achieve a 100% ASR while preserving high perceptual quality (LPIPS: 0.12, FID: 38.19, PSNR: 25.36, SSIM: 0.80, and BRISQUE: 6.11).

7.4 Breaking AI-generated Video Watermarking To evaluate the scalability of our proposed attacks beyond static images, we extend our evaluation to emerging video watermarking frameworks: VideoShield [12] and VideoMark [13]. VideoShield embeds watermarks by mapping bits into the initial noise of the diffusion process and uses DDIM inversion for watermark extraction. Similarly, VideoMark encodes watermarks into the initial noise with PRC codes on a per-frame basis and introduces a temporal matching module to enhance robustness against temporal distortions. Our evaluation is conducted using the damo-vilab/text-to-

video-ms-1.7b3 text-to-video model. We randomly select 20 prompts from the test set of VBench [15], and generate 16frame videos at a resolution of 256 × 256 using 25 inference steps. For baseline video watermarking attacks, we adapt existing image-based watermark removal methods by applying them independently to each video frame, and then evaluate the resulting video quality based on the processed frames. Following [29], we use MUSIQ [17] as a no-reference perceptual quality metric, averaging frame-level scores to assess overall video quality. As detailed in Table 5, video watermarking schemes exhibit strong robustness: baseline attacks such as VA and DA fail to disrupt initial-noise-based watermarking, retaining BA above 90%. In contrast, M ARK N ULL exhibits superior transferability, successfully suppressing BA to approximately 50%. M ARK N ULL -A achieves an optimal trade-off, attaining the highest video quality (MUSIQ > 0.6) among successful attacks while effectively compromising watermark verification. Although NFPA and NPA reduce VideoMark’s BA to very low values (24.26% and 17.26%), this does not indicate superior watermark removal. For multi-bit watermarking, BA values significantly below the 50% random-guessing baseline reflect bit inversion rather than erasure: the watermark signal remains present but becomes negatively correlated, allowing defenders to recover the original message by simply flipping the decoded bits (e.g., ∼ 83% effective recovery for NPA). Table 5: Attack evaluation against video watermarking. Attack

VideoShield

VideoMark

BA[%]

MUSIQ

BA[%]

MUSIQ

No Attack

100

0.66

100

0.62

VA DA CtrlRegen+ NFPA Imprint UnMarker NPA

99.95 97.31 91.20 56.93 57.74 80.79 82.71

0.59 0.61 0.59 0.65 0.64 0.42 0.47

93.81 66.06 56.80 24.26 52.79 80.74 17.26

0.55 0.59 0.57 0.59 0.61 0.48 0.44

M ARK N ULL M ARK N ULL -A

47.12 76.46

0.57 0.65

50.30 49.48

0.55 0.61

Takeaway 3: M ARK N ULL and M ARK N ULL -A demonstrate unprecedented scalability across the broadest range of watermarking paradigms, achieving a 100% ASR against Google’s SynthID-Image and generalizing seamlessly to video watermarking (VideoShield, VideoMark) without modality-specific adaptation. This confirms their truly model-agnostic nature, establishing a novel benchmark for universal watermark robustness evaluation. 3 https://huggingface.co/ali-vilab/text-to-video-ms-1.7b

Algorithm 3: Watermark Removal Attack Detection Input :Query image IQ , Target Model Θ, Detection Threshold τdete , LPIPS Distance LLPIPS . Output :Binary decision: Attacked or Clean 1 // 1. Regeneration Q 2 z0 = E (IQ ); Q Q 3 ẑT = DDIM0→T (z0 ; U ); Q,rec 4 z0 = DDIMT →0 (ẑQ T ; U ); Q,rec rec 5 IQ = D (z0 ); 6 // 2. Error Calculation rec 7 Serror ← LLPIPS (IQ , IQ ); 8 // 3. Attack Detection 9 if Serror > τdete then 10 return Attacked 11 12

8

else return Clean;

Watermark Removal Defense

In this section, we explore a potential defense strategy against advanced watermark removal attacks by leveraging the distributional properties of LDMs. These models are trained to capture the high-probability distribution of natural images, effectively defining a low-dimensional generative manifold shaped by the model prior. Watermark removal attacks typically add a subtle yet unnatural pixel-space perturbation ∆A = IA − Iw to suppress the watermark signal. Although such perturbations may be visually imperceptible, they often violate the learned prior and push the sample off the generative manifold in a distributional sense. Motivated by the theoretical intuition of DiffPure [28], we perform Inversion → Regeneration for attack detection. As shown in Algorithm 3, given a query image IQ , we perform a full DDIM inversion to obtain ẑQ T and reconstruct the image as IQrec . For clean images that lie close to the natural image manifold, the inversion and regeneration process is approximately self-consistent, resulting in a small discrepancy between IQrec and IQ . In contrast, when IQ contains off-manifold adversarial perturbations in the pixel space, the diffusion prior tends to suppress these unnatural components during regeneration, leading to a noticeably larger reconstruction gap. To quantify this, we adopt the LPIPS reconstruction error LLPIPS (IQrec , IQ ) as the detection statistic. A query image is flagged as attacked if the LPIPS exceeds a predefined threshold τdete . This threshold is selected based on analyzing the empirical distribution of regeneration errors on a held-out validation set. To evaluate our defense, we formulate attack detection as a binary classification task between clean watermarked images and attacked watermark-removed images. We use the reconstruction error, measured by the LPIPS distance

Serror , as the detection statistic. The decision threshold τdete is selected via the Youden Index by sweeping observed scores to construct the Receiver Operating Characteristic (ROC) curve: FPR(τdete ) = P (Serror > τdete | Clean) , TPR(τdete ) = P (Serror > τdete | Attacked) .

(20)

The optimal threshold is then given by: τ∗dete = argmax(TPR(τdete ) − FPR(τdete )),

(21)

τdete

yielding a balance between detection sensitivity and false alarms without using arbitrary error margins. As shown in Figures 6 and 7, attacked images generally exhibit higher LPIPS reconstruction errors than clean watermarked images under both M ARK N ULL and M ARK N ULL A. This separation supports our hypothesis that adversarial perturbations introduce deviations that are amplified during DDIM inversion and regeneration, making reconstruction error a useful forensic signal. The resulting detector achieves promising performance, particularly for in-generation watermarking schemes. For example, it achieves a TPR above 90% for SleeperMark while maintaining a low FPR, indicating clear separation between clean and attacked samples. Nevertheless, partial distribution overlap persists under stealthy attacks such as M ARK N ULL -A, making consistent detection challenging. This validates the imperceptibility of our attacks and highlights the need for more robust forensic defenses in future work.

(a) DwtDct, TPR=0.830, FPR=0.670

(b) RivaGan, TPR=0.780, FPR=0.290

(c) HiDDeN, TPR=0.590, FPR=0.160

(d) SS, TPR=0.860, FPR=0.130

(e) VINE, TPR=0.800, FPR=0.190

(f) SleeperMark, TPR=0.890, FPR=0.060

(g) GS, TPR=0.940, FPR=0.150

(h) PRC, TPR=0.830, FPR=0.130

(i) TR, TPR=0.740, FPR=0.110

Figure 6: Comparison of LPIPS reconstruction error distributions and detection thresholds under M ARK N ULL (watermarked vs. watermark-removed).

research was supported by the Natural Sciences and Engineering Research Council of Canada Discovery Grant, the Canada Research Chair Program, National Cybersecurity Consortium R&D Program, and the NVIDIA Academic Grant Program using A100 GPU-hours. (a) DwtDct, TPR=0.000, FPR=0.000

(b) RivaGan, TPR=0.300, FPR=0.220

(c) HiDDeN, TPR=0.450, FPR=0.160

Ethical Considerations

(d) SS, TPR=0.870, FPR=0.420

(e) VINE, TPR=0.900, FPR=0.540

(f) SleeperMark, TPR=0.970, FPR=0.080

(g) GS, TPR=0.810, FPR=0.210

(h) PRC, TPR=0.910, FPR=0.380

(i) TR, TPR=0.940, FPR=0.400

Figure 7: Comparison of LPIPS reconstruction error distributions and detection thresholds under M ARK N ULL -A (watermarked vs. watermark removed).

9

Conclusion

In this paper, we have proposed M ARK N ULL and its amortized variant, M ARK N ULL -A, which together form a modelagnostic watermark removal attack framework that fundamentally overcomes the fidelity–removal trade-off and computational bottlenecks inherent in prior work. Specifically, M ARK N ULL leverages NLAS to guide an optimization process that provably decorrelates watermark signals from the initial noise via on-manifold latent manipulation, reducing the BA to 53.14%, approaching the 50% random-guessing baseline in watermark verification, while preserving semantic and perceptual fidelity. To support scalable deployment, M ARK N ULL -A distills the optimization objective into a learnable WRN, achieving fast inference speeds of 0.50 s/image while maintaining strong removal effectiveness. Extensive evaluations demonstrate that both M ARK N ULL and M ARK N ULL -A effectively remove watermarks across all major watermarking paradigms, and successfully compromise Google’s SynthID-Image (100% ASR), as well as emerging video watermarking schemes. This attack framework, together with the proposed defense, serves as a rigorous redteaming benchmark, encouraging the community to move beyond simplistic initial-noise-based watermarking and toward next-generation provenance tracking mechanisms that are robust to latent-space manipulation.

Acknowledgments We are grateful to our shepherd and anonymous reviewers for their valuable guidance and insightful comments. This

This paper investigates the robustness limitations of AIgenerated image watermarking by proposing M ARK N ULL and M ARK N ULL -A, which remove watermarks through onmanifold latent manipulation under a no-box, model-agnostic threat model. Our goal is to advance rigorous watermark security evaluation and drive the development of more resilient provenance mechanisms, not to facilitate misuse. Potential misuse. Watermark removal techniques can be misused to evade provenance tracking, undermine copyright attribution, and facilitate AI-generated misinformation. The risk is amplified by our attacks’ model-agnostic nature, requiring no watermark information or detector access. Risk mitigation. We take several steps to reduce misuse potential: (i) experiments are conducted on public datasets without private user data; (ii) we describe methodology at the level necessary for reproducibility, avoiding deploymentoriented instructions that would lower the barrier to attacking production systems; and (iii) we include a defensive counterpart, an attack detection mechanism to encourage balanced red-team and blue-team development. Vulnerability Disclosure. In line with standard security research ethics, we will disclose our findings to Google’s security team regarding SynthID-Image robustness issues. Our evaluation was conducted strictly within the official SynthIDImage API bounds, deliberately rate-limited, and explicitly designed to avoid any denial-of-service behavior. Broader impacts. Our work provides a stronger benchmark for evaluating watermark robustness and highlights that robustness should not rely solely on pixel-domain representations when latent-space manipulation is feasible. We acknowledge disclosure risks, but believe transparent evaluation of failure modes, accompanied by effective defenses, is essential for the responsible deployment of generative models.

Open Science All source code, trained WRN weights, and test samples are publicly available on Zenodo: https://doi.org/10.5281/ zenodo.20201878, accompanied by a detailed step-by-step README.md. Since all models and watermarking schemes evaluated in this paper are publicly released, our artifacts provide a complete basis for reproducing the main experimental results. We fully support open science and release these artifacts to facilitate reproducibility and foster further research.

References [1] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. WAVES: benchmarking the robustness of image watermarks. In Proc. ICML, 2024. [2] Jie Cao, Qi Li, Zelin Zhang, Jianbing Ni, and Rongxing Lu. Secure and robust watermarking for ai-generated images: A comprehensive survey. arXiv preprint arXiv:2510.02384, 2025. [3] Jie Cao, Zelin Zhang, Qi Li, and Jianbing Ni. Marksweep: A no-box removal attack on ai-generated image watermarking via noise intensification and frequencyaware denoising. In Proc. ICASSP, pages 13932–13936. IEEE, 2026. [4] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proc. ICCV, pages 22409–22420, 2023. [5] Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In Proc. ICASSP, pages 3054–3058, 2022.

[13] Xuming Hu, Hanqian Li, Jungang Li, and Aiwei Liu. Videomark: A distortion-free robust watermarking framework for video diffusion models. CoRR, abs/2504.16359, 2025. [14] Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Zhenqiang Gong. A transfer attack to image watermarks. In Proc. ICLR, 2025. [15] Ziqi Huang, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Yuanhan Zhang, Tianxing Wu, Qingyang Jin, Nattapol Chanpaisit, et al. Vbench: Comprehensive benchmark suite for video generative models. In Proc. CVPR, pages 21807–21818, 2024. [16] Andre Kassis and Urs Hengartner. Unmarker: A universal attack on defensive image watermarking. In Proc. IEEE S&P, pages 2602–2620, 2025. [17] Junjie Ke, Qifei Wang, Yilin Wang, Peyman Milanfar, and Feng Yang. MUSIQ: multi-scale image quality transformer. In Proc. of CVPR, pages 5128–5137, 2021. [18] Mohammad Ibrahim Khan, Md. Maklachur Rahman, and Md. Iqbal Hasan Sarker. Digital watermarking for image authenticationbased on combined dct, DWT and SVD transformation. CoRR, abs/1307.6328, 2013.

[6] Nir Goren, Oren Katzir, Abhinav Nakarmi, Eyal Ronen, Mahmood Sharif, and Or Patashnik. Noiseprints: Distortion-free watermarks for authorship in private diffusion models. CoRR, abs/2510.13793, 2025.

[19] Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. WOUAF: weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proc. CVPR, pages 8974–8983, 2024.

[7] Sven Gowal, Rudy Bunel, Florian Stimberg, David Stutz, Guillermo Ortiz-Jimenez, Christina Kouridi, Mel Vecerik, Jamie Hayes, Sylvestre-Alvise Rebuffi, Paul Bernard, et al. Synthid-image: Image watermarking at internet scale. arXiv preprint arXiv:2510.09263, 2025.

[20] De Zhang Lee, Han Fang, Hanyi Wang, and Ee-Chien Chang. Removal attack and defense on ai-generated content latent-based watermarking. In Proc. CCS, pages 2174–2188, 2025.

[8] Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. In Proc. ICLR, 2025.

[21] Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. In Proc. ICLR, 2025.

[9] Gustavosta. Stable-diffusion-prompts. Hugging Face Datasets repository, 2022. (accessed on Oct. 27, 2025). [10] Peter Holderrieth and Ezra Erives. An introduction to flow matching and diffusion models. CoRR, abs/2506.02070, 2025.

[22] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. Mach. Intell. Res., 22(4):730–751, 2025.

[11] Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proc. CVPR, pages 7069–7078, 2024.

[23] Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. In Proc. ICLR, 2025.

[12] Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Videoshield: Regulating diffusion-based video generation models via watermarking. In Proc. of ICLR, 2025.

[24] Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality assessment in the spatial domain. IEEE Trans. Image Process., 21(12):4695–4708, 2012.

[25] Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In Proc. CVPR, pages 6038–6047. IEEE, 2023.

[38] Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226–247, 2022.

[26] Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. In Proc. CVPR, pages 20937–20946, 2025.

[39] Zilan Wang, Junfeng Guo, Jiacheng Zhu, Yiming Li, Heng Huang, Muhao Chen, and Zhengzhong Tu. Sleepermark: Towards robust watermark against fine-tuning text-to-image diffusion models. In Proc. CVPR, pages 8213–8224, 2025.

[27] KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. DWT-DCT-SVD based watermarking. In Proc. COMSWARE, pages 271– 274. IEEE, 2008.

[40] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Proc. NeurIPS, 2023.

[28] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In Proc. ICML, volume 162, pages 16805–16827, 2022.

[41] Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proc. MM, pages 1668–1676. ACM, 2023.

[29] Leyi Pan, Sheng Guan, Zheyu Fu, Luyang Si, Huan Wang, Zian Wang, Hanqian Li, Xuming Hu, Irwin King, Philip S Yu, et al. Markdiffusion: An open-source toolkit for generative watermarking of latent diffusion models. arXiv preprint arXiv:2509.10569, 2025. [30] Huming Qiu, Zhaoxiang Wang, Mi Zhang, Xiaohan Zhang, Xiaoyu You, and Min Yang. The future unmarked: Watermark removal in ai-generated images via next-frame prediction. In Proc. NeurIPS, 2025. [31] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proc. CVPR, pages 10674–10685, 2022.

[42] Jindong Yang, Han Fang, Weiming Zhang, Nenghai Yu, and Kejiang Chen. T2smark: Balancing robustness and diversity in noise-as-watermark for diffusion models. Proc. NeurIPS, 38:118642–118668, 2026. [43] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proc. CVPR, pages 12162–12171, 2024. [44] Syed Waqas Zamir, Aditya Arora, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Ming-Hsuan Yang. Restormer: Efficient transformer for highresolution image restoration. In Proc. CVPR, pages 5718–5729, 2022.

[32] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Proc. ICLR, 2021.

[45] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. CoRR, abs/1909.01285, 2019.

[33] Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Scorebased generative modeling through stochastic differential equations. In Proc. ICLR, 2021.

[46] Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proc. CVPR, pages 586–595, 2018.

[34] Stability AI. Stable diffusion 2.1 base. Hugging Face model repository, 2022.

[47] Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andrés Fábrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, Yu-Xiang Wang, and Dawn Song. Sok: Watermarking for ai-generated content. In Proc. IEEE S&P, pages 2621–2639, 2025.

[35] Stability AI. Stable diffusion xl base 1.0. Hugging Face model repository, 2023. [36] stable-diffusion-v1-5 (community). Stable diffusion v1-5. Hugging Face model repository, 2024. [37] Ron G. van Schyndel, Andrew Z. Tirkel, and Charles F. Osborne. A digital watermark. In Proc. ICIP, pages 86–90, 1994.

[48] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative AI. In Proc. NeurIPS, 2024.

[49] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li FeiFei. Hidden: Hiding data with deep networks. In Proc. ECCV, volume 11219, pages 682–697, 2018.

A

Noise-Latent Alignment Score

To evaluate the correlation within the latent space, we computed the NLAS for the optimized pairs (z0 , zT ) against the randomly initialized (z0 , zrand ), where zrand ∼ N (0, I). As shown in Figure 8, the NLAS between z0 and its corresponding initial noise zT is markedly higher than that between z0 and a randomly initialized latent zrand . Specifically, the (z0 , zT ) pairs exhibit consistently elevated NLAS values with a stable median and interquartile range, whereas the NLAS of (z0 , zrand ) concentrates near zero with negligible variance across samples. These observations indicate that NLAS effectively captures the structured dependence between corresponding latents along the same generation/inversion trajectory, while such dependence is absent when pairing z0 with independent Gaussian noise. This distinct separation underscores the utility of NLAS as a discriminative metric for identifying true latent correspondences.

experiments facilitate a systematic analysis of the trade-off between attack strength and perceptual fidelity under different optimization parameter settings. Experimental results are shown in Figure 9 and Figure 10. These results reveal a clear trade-off between attack strength and perceptual fidelity. When varying the number of gradient steps N (see Figure 9), increasing N from 5 to 25 leads to notable gains in attack success (lower BA and TPR@1%FPR), accompanied by increased perceptual deviation (higher LPIPS). However, beyond N ≥ 50, improvements become marginal: LPIPS plateaus or even slightly decreases, suggesting that once the optimization nears convergence, additional iterations do not further degrade image quality and refine perturbations along more natural directions under the model prior. Correspondingly, the attack strength converges and becomes relatively stable for N in the range of approximately 25 to 50, indicating diminishing returns from further optimization steps.

(a) LPIPS

(b) BA or TPR@1%FPR

Figure 9: Effect of optimization steps (N) on attack strength and perceptual fidelity.

Figure 8: NLAS distributions for matched (z0 , zT ) and random (z0 , zrand ) pairs.

B

Proposed Attack Details (a) LPIPS

B.1

M ARK N ULL

We set the loss weights in Eq. (11) to λ1 = 1, λ2 = 20, (adv) λ3 = 1.5, and λ4 = 3. The adversarial latent variable z0 is optimized using the Adam optimizer with a learning rate κ = 0.05. To ensure the imperceptibility of adversarial perturbations, we impose a distortion budget of ε = 1. The optimization is performed over N = 50 gradient descent steps, obtaining a balance between attack effectiveness and computational efficiency. To investigate the impact of different learning rates and optimization steps on M ARK N ULL’s attack effectiveness and image quality, we conduct two controlled experiments. In the first setting, we fix the learning rate at κ = 0.05 and vary the number of gradient steps N ∈ {5, 10, 25, 50, 100}. In the second setting, we fix the number of steps at N = 50 and vary the learning rate κ ∈ {0.001, 0.01, 0.05, 0.1, 0.2, 0.5}. These

(b) BA or TPR@1%FPR

Figure 10: Effect of learning rate (κ) on attack strength and perceptual fidelity. A similar trend emerges when adjusting the learning rate κ with a fixed step count (see Figure 10). Moderate learning rates often induce the most perceptual change, while larger κ values lead to more stable solutions with comparable or improved attack performance. Sensitivity to κ varies across watermarking schemes: some methods achieve significant BA reductions at moderate κ, while others require higher κ to attain similar effectiveness. It is important to note that BA is not strictly “the lower, the better." An excessively low BA often indicates that the attack drives the watermark detector’s extraction toward the bitwise complement w, rather than erasing the watermark signal. In this case, the detector may still confidently report a watermark (e.g., SleeperMark in Fig. 10b).

Therefore, for bit-string watermark removal, the most desirable outcome is a BA close to 50%, implying that the extracted bit string is indistinguishable from random guessing and the watermark detectability is effectively neutralized. Overall, these findings suggest that a moderate number of optimization steps (N = 50) combined with a properly tuned learning rate (κ = 0.05), as used in Section 7.2, provides a favorable trade-off, achieving strong watermark removal with minimal perceptual degradation.

B.2

M ARK N ULL -A

The WRN in M ARK N ULL -A adopts a hierarchical U-Net architecture based on Restormer [44]4 , featuring a four-level encoder-decoder with symmetric skip connections. Each block integrates MDTA for global context modeling and GDFN for local feature refinement. The encoder and decoder employ pixel-unshuffle and pixel-shuffle for downsampling and upsampling, respectively, with 1 × 1 convolutions for feature fusion. The network concludes with a refinement stage followed by a convolutional layer that predicts the residual image for high-fidelity restoration. We set λ5 = 1, λ6 = 20, λ7 = 1 and λ8 = 4 in Eq. (12). The WRN is optimized for 100 epochs with a batch size of 7 using the Adam optimizer. The initial learning rate is set to 1 × 10−3 . A learning rate scheduler is applied, consisting of a linear warm-up during the first 10% of the training epochs, followed by a cosine decay that gradually reduces the learning rate to 1 × 10−6 . The training set for the WRN consists of 2,000 images at a resolution of 512 × 512, generated by the proxy model SD1.5 using 2,000 randomly sampled prompts from the SDP dataset. We train the WRN on randomly cropped image patches of size 256 × 256.

C

Watermark Detection

The watermark length of each evaluated scheme is summarized in Table 6. Let w ∈ {0, 1}k be the embedded k-bit watermark and ŵ ∈ {0, 1}k the bit string extracted from a query image. Detection is performed by comparing ŵ with w using the matching count M, defined as the complement of the Hamming distance: k

M(w, ŵ) = ∑ I [wi = ŵi ] ,

(22)

i=1

where I[·] is the indicator function. A watermark is detected if the number of matches exceeds a predetermined threshold τ, i.e., M(w, ŵ) > τ. Formally, the detection is formulated as a hypothesis testing. Under the null hypothesis H0 , the image does not contain 4 https://github.com/leftthomas/Restormer.

Table 6: Watermark length and detection threshold of the evaluated methods. Method

Len. (bits)

BA Thres. τ/k [%]

FPR

DwtDct RivaGan HiDDeN SS VINE SleeperMark GS PRC TR

48 32 48 48 96 48 256 512 0

69 75 69 69 62 69 65 60 -

0.01 0.01 0.01 0.01 0.01 0.01 10−6 10−5 0.01

VideoShield VideoMark

512 32

60 75

10−5 0.01

C.2

CQS Image Quality Metric

To provide a holistic assessment of the recovered image quality, we propose the CQS in Section 7.1, which aggregates heterogeneous metrics (i.e., PSNR, SSIM, LPIPS, FID, and BRISQUE) into a unified score. The calculation is:

Attack Effectiveness Metrics

C.1

the target watermark w, and the extracted bits ŵ = {ŵi }ki=1 are modeled as i.i.d. Bernoulli variables. The False Positive Rate (FPR) can be defined as:   1 k k P (M(w, ŵ) > τ | H0 ) = k ∑ = I1/2 (τ + 1, k − τ) , 2 i=τ+1 i (23) which follows the tail probability of a binomial distribution and admits a closed-form expression via the regularized incomplete beta function I p (a, b). The i.i.d. assumption and binomial detection model have been empirically validated in prior works [4,23]. Bit Accuracy (BA) is commonly used to measure watermark detectability and is defined as BA = M(w, ŵ)/k.

CQS = ∑ Sm , m  vm − vmin  m   max , m ∈ {PSNR, SSIM}, min Sm = vmmax− vm vm − v m   , m ∈ {LPIPS, FID, BRISQUE},  max vm − vmin m (24) max where vm denotes the value of metric m and vmin m , vm are its min/max over the compared methods, yielding a per-metric score Sm ∈ [0, 1] and an aggregate CQS ∈ [0, 5].

D

Qualitative Comparison

Figure 11 qualitatively demonstrates the perceptual superiority of M ARK N ULL and M ARK N ULL -A over existing base-

lines. Our attacks produce images that are nearly indistinguishable from the originals. In the video domain, they further maintain temporal consistency without noticeable interframe flickering (Figure 12). This high fidelity arises from on-manifold latent manipulation, which introduces structured, semantically coherent perturbations.

E

Discussion

E.1

Generalization Across Image Resolutions

We discuss whether M ARK N ULL and M ARK N ULL -A can generalize across image resolutions. Although the main experiments are conducted at 512 × 512, the proposed attacks are not inherently resolution-specific. This is because M ARK N ULL operates in the latent space of latent diffusion models rather than directly in the pixel space. When the image resolution changes, the VAE encoder maps the image into a latent tensor with proportionally scaled spatial dimensions. The NLAS measures the normalized angular dependency between z0 and zT , and thus does not rely on a fixed image size. Therefore, the same formulation can be directly applied to images of different resolutions. M ARK N ULL -A’s Restormer is also resolution-agnostic. As shown in Table 7, both M ARK N ULL and M ARK N ULL A remain effective across different image sizes, reducing BA toward the random-guessing level while maintaining low LPIPS for representative schemes, including PRC [8] and SS [4]. This suggests that the attacks are not overfitted to the default 512 × 512 setting. We note that higher resolutions may increase the computational cost of iterative optimization for M ARK N ULL and may introduce mild distribution shifts for M ARK N ULL -A when the training and testing resolutions differ substantially. However, these factors mainly affect efficiency or small performance variations, rather than the validity of the attack itself. Overall, the designs of M ARK N ULL and M ARK N ULL -A provide favorable generalization across image resolutions. Table 7: Size generalization of M ARK N ULL M ARK N ULL -A under three image resolutions Resolution

Method

M ARK N ULL

and

M ARK N ULL -A

BA [%]

LPIPS

BA [%]

LPIPS

128 × 128

PRC SS

51.56 38.09

0.28 0.23

49.24 46.20

0.31 0.29

256 × 256

PRC SS

50.04 43.36

0.24 0.19

49.53 46.16

0.25 0.21

768 × 768

PRC SS

49.40 50.52

0.20 0.14

49.00 46.68

0.23 0.23

E.2

Transferability Across Diverse Backbones

We further examine whether M ARK N ULL can transfer across different generative backbones. In the main experiments, we consider SD models as both the proxy and target backbones. A natural question is whether the attack remains effective when the proxy model is no longer from the SD family, while the target model is still SD-based. To answer this question, we evaluate FLUX.1-dev5 as the proxy model against SD2.1 as the target model. This setting introduces a substantial architectural divergence between the proxy and target models, making it more challenging than transfer within the same SD family. Nevertheless, M ARK N ULL remains effective under this setting, reducing BA to 56.95% for GS, 52.65% for PRC, and 46.67% for SS. These results show that M ARK N ULL does not rely on a proxy model with the same architecture as the target model, and can transfer even when the proxy and target are built upon different generative backbones. We acknowledge that crossbackbone transfer incurs a non-negligible fidelity cost. Using FLUX.1-dev as the proxy widens the proxy-target distribution gap relative to SD-family proxies, revealing a transferability–fidelity trade-off: M ARK N ULL remains effective across heterogeneous backbones, but stronger architectural mismatch can introduce more visible image changes. This transferability stems from the fact that M ARK N ULL does not exploit model-specific implementation details. Instead, it suppresses watermark-related statistical dependencies through latent-space manipulation. Therefore, as long as the proxy model provides a generative prior that supports realistic image reconstruction and latent perturbation, the optimized perturbation can still generalize to the target watermarking pipeline. The FLUX.1-dev-to-SD2.1 results further confirm that M ARK N ULL captures a transferable vulnerability of current watermarking schemes, rather than overfitting to a particular SD backbone.

F

Watermarking Baselines Configuration • DwtDct [27]: DwtDct is a traditional post-hoc watermarking method that embeds signals in the frequency domain combining DWT and DCT. We implement it via the invisible-watermark Python library 6 . • RivaGan [45]: RivaGAN is an encoder–decoder-based watermarking method proposed for video watermarking, which can be naturally extended to robust image watermarking. It employs an attention-based encoderdecoder to embed arbitrary payloads while maintaining visual fidelity. Its dual-discriminator design jointly enforces perceptual quality and watermark robustness 5 https://huggingface.co/black-forest-labs/FLUX.1-dev 6 https://github.com/ShieldMnt/invisible-watermark

DwtDct

RivaGan

HiDDeN

SS

VINE

SleeperMark

GS

PRC

TreeRing

SynthID-Image

No Attack

VA

DA

CtrlRegen+

NFPA

Imprint

UnMarker

NPA

MarkNull

MarkNull-A

Figure 11: Qualitative examples of different attacks against baselines for watermark removal. through adversarial training. We implement it via the invisible-watermark Python library 7 . • HiDDeN [49]: HiDDeN is an end-to-end trainable scheme for image watermarking, combining an encoder, decoder, and adversarial discriminator. It jointly optimizes imperceptibility, robustness, and payload capacity by minimizing reconstruction loss and adversarial detectability. To enhance robustness, it simulates differentiable distortions (e.g., blurring, cropping, JPEG) during training. In our implementation, we use the code and the pretrained model published in 8 . • StableSignature (SS) [4]: SS is an in-generation wa7 https://github.com/ShieldMnt/invisible-watermark

termarking method that embeds the watermark directly during the image synthesis process. It adopts the HiDDeN [49] decoder as the watermark extractor and finetunes the VAE decoder of the LDM to ensure that the watermark remains decodable from the generated outputs. In our implementation, we follow the official code and utilize the pretrained model provided by the original authors 9 . • VINE [23]: VINE leverages a pretrained one-step diffusion model, SDXL-Turbo, as the watermark encoder. It employs a condition adaptor to fuse the watermark with the input image and introduces zero-convolution layers with skip connections to the VAE to ensure that the embedded watermark is both imperceptible and robust

8 https://github.com/facebookresearch/stable_signature/t

ree/main/hidden

9 https://github.com/facebookresearch/stable_signature

VideoShield

VideoMark

No Attack

VA

DA

CtrlRegen+

NFPA

Imprint

UnMarker

NPA

MarkNull

MarkNull-A

Figure 12: Qualitative examples of different attacks against VideoShield and VideoMark. against advanced image editing. In our implementation, we follow the official code and utilize the pretrained model provided by the original authors 10 . • SleeperMark [39]: SleeperMark is designed to protect the copyright of T2I LDMs against unauthorized downstream fine-tuning. It injects a message-embedding backdoor into the diffusion backbone that is activated by a specific text trigger. For LDMs, the watermark is extracted from the latent space to achieve inherent robustness against image distortions with minimal perceptual impact. In our implementation, we follow the official code and utilize the pretrained model provided by the original authors 11 . • Gaussian Shading (GS) [43]: GS is an initial-noised watermarking method that embeds a k-bit message by controlling the initial latent noise via distribution-preserving

sampling. It first diffuses the binary watermark and then encrypts it with a stream key into a uniformly random bitstream, enabling the randomized watermark to drive a sampling procedure that produces a watermarked initial latent noise zwT while preserving the standard Gaussian prior. The model then follows the standard denoising pipeline to obtain the final watermarked image. For extraction, the suspect image is encoded back to the latent space, and DDIM inversion is used to estimate the corresponding zwT ; the inverse sampling map recovers the encrypted bitstream, which is then decrypted and inversediffused, and a majority vote over replicated copies reconstructs the final watermark sequence. In our implementation, we follow the official code provided by the original authors 12 . • PRC [8]: PRC is an initial-noise-based watermarking scheme for diffusion models that embeds a secret key

10 https://github.com/Shilin-LU/VINE 11 https://github.com/taco-group/SleeperMark

12 https://github.com/bsmhmmlf/Gaussian-Shading

G

directly into the sign pattern of the initial noise to ensure undetectability. It generates a pseudorandom codeword and flips the signs of the sampled Gaussian vector to match this codeword while preserving the magnitude, thereby maintaining the marginal distribution of the latent. In our implementation, we follow the official code provided by the original authors 13 .

• Brightness: Brightness adjustment is a common photometric distortion that perturbs watermark signals by uniformly scaling image luminance while largely preserving geometric structure. In our implementation, we use PIL.ImageEnhance.Brightness to re-render each image with a brightness factor of 0.5, i.e., substantially darkening the image.

• TreeRing [40]: TreeRing is the earliest initial-noisebased diffusion watermarking method, but it only supports zero-bit verification. Instead of encoding a binary watermark, TreeRing embeds a fixed ring watermark by modifying the initial noise with a predefined pattern. During verification, the suspect image is inverted via DDIM inversion to recover the corresponding initial noise, and the presence of the ring pattern is then tested in the recovered noise space. In our implementation, we follow the official code provided by the original authors 14 .

• VA [1]: VA is a regeneration attack that removes watermarks by re-synthesizing the image through a VAE. Concretely, the watermarked image is first encoded into a latent representation by a neural VAE encoder and then decoded back to the pixel space by the corresponding neural decoder. In our experiment, we adopt compressai.zoo.cheng2020_anchor to implement VA following [48]. The compression factor governs the attack strength, where smaller values impose a tighter bottleneck and thus induce more aggressive distortion. In this paper, we set the compression factor to 3.

Attack Baselines Configuration • Noise: Gaussian noise injection is a common additive distortion that perturbs watermark patterns by introducing pixel-wise random fluctuations. In our implementation, each image is first normalized to [0, 1], then i.i.d. Gaussian noise is added, where std=0.05 controls the noise intensity. • Blur: Gaussian blur is a smoothing attack that degrades watermarks by attenuating high-frequency image components. This low-pass filtering suppresses fine textures and sharp edges, which can weaken watermark cues especially those encoded in subtle spatial details. In our implementation, we apply cv2.GaussianBlur to each input image with a kernel size of 5 × 5 and Gaussian standard deviation σ = 1. • Contrast: Contrast adjustment is a common photometric distortion that modifies the dynamic range of pixel intensities, thereby perturbing watermark cues while leaving the image geometry unchanged. In Table 2, we apply PIL.ImageEnhance.Contrast with a contrast factor of 0.5, which reduces contrast by compressing intensity variations around the mean. • JPEG: JPEG compression is a widely used lossy postprocessing operation, controlled by a quality parameter that determines the compression strength. Lower quality values induce stronger quantization and larger information loss, which can further impair watermark recoverability. In Table 2, we apply JPEG compression with the quality factor set to 80.

• DA [48]: DA is a regeneration attack that removes watermarks by perturbing the watermarked image with a forward noising process and then reconstructing it via the reverse denoising trajectory. Using more noising steps injects stronger corruption, which typically yields a higher watermark removal rate at the cost of greater perceptual deviation. In our implementation, we follow the official code provided by the original authors 15 . In our experiment, we instantiate DA with SD1.5 and set the number of noise steps to 60. • CtrlRegen+ [21]: CtrlRegen+ is an adjustable watermark removal method that leverages a controllable regeneration process to eliminate embedded signals. It proceeds by projecting the watermarked image into the latent space and introducing noise over a specified number of steps to produce a noisy latent representation. Subsequently, it employs a controllable diffusion model to denoise and reconstruct the image, utilizing semantic and spatial features extracted from the original input to ensure high visual fidelity and consistency. In our implementation, we follow the official code provided by the original authors 16 . • NFPA [30]: NFPA is a regeneration attack that removes watermarks by generating a new, semantically consistent image from the input via a next-frame prediction style diffusion process. It first encodes the input image into the latent representation and applies DDIM inversion to obtain an inverted Latent as the generation starting point. In our implementation, we follow the official code provided by the original authors 17 . 15 https://github.com/XuandongZhao/WatermarkAttacker

13 https://github.com/XuandongZhao/PRC-Watermark

16 https://github.com/yepengliu/CtrlRegen

14 https://github.com/YuxinWenRick/tree-ring-watermark

17 https://github.com/1249748036/NFPA/

• Imprint [26]: Imprint is a removal attack for initial-noisebased watermarking, operating with a proxy model. It first encodes the watermarked image into the proxy model’s latent space and applies inversion to recover an estimate of the corresponding initial noise. It then optimizes a small perturbation to the latent representation via gradient-based updates, with an objective that drives the re-inverted noise away from the original estimate. The attack budget is governed by the number of optimization iterations: using more steps typically strengthens watermark suppression, but may also amplify perceptual distortion and increase computational overhead. In our implementation, we follow the official code provided by the original authors 18 , use 50 optimization steps, and the proxy model is SD1.5. • UnMarker [16]: UnMarker is a universal black-box attack method without requiring detector feedback or specific knowledge of the watermarking algorithm. It operates on the insight that robust watermarks inevitably modify spectral amplitudes, and thus employs two novel adversarial optimization strategies to specifically disrupt these spectral features, effectively erasing the watermark signals while preserving image quality. In our implementation, we follow the official code provided by the original authors 19 and apply both adversarial strategies against all watermarking schemes. • NPA [6]: NoisePrints is a lightweight, distortion-free watermarking scheme originally. It also makes the simple observation that the initial noise can be highly correlated with the generated content. In the appendix of [6], the authors further introduce an attack, which we refer to as NPA. This attack uses a proxy model to compute the cosine similarity between the image and the recovered noise, and performs an iterative optimization that updates a small perturbation in the latent space. The objective is to drive the adversarial latent representation away from the initial noise by minimizing its cosine similarity. Since the authors do not release official code, we implement the attack based on the paper description; in our setting, the number of optimization steps is set to 100.

18 https://github.com/and-mill/semantic-forgery 19 https://github.com/andrekassis/ai-watermark

Related documents

• FARI: Robust One-Step Inversion for Watermarking in Diffusion Models#410939
• Watermark Forensics for Generative Models: An Information-Theoretic Perspective#366189
• Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles#160728
• Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Images#123987
• Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion Perspective#321755