Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal

[2605.09203] Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal Skip to main content Search Submit Donate Log in Computer Science > Cryptography and Security arXiv:2605.09203 (cs) [Submitted on 9 May 2026 ( v1 ), last revised 28 Aug 2026 (this version, v2)] Title: Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal Authors: Yevin Nikhel Goonatilake , Giuseppe Ateniese View PDF HTML (experimental) Abstract: The literature on watermark removal has largely asked whether an attacker can make the watermark verifier fail while preserving the appearance of the image. This is a useful test, but it does not capture the purpose of removal in applications where watermarks support provenance. In such settings, the attacker wants the image to pass as ordinary content. If the removal process leaves a recognizable statistical trace, the watermark may have disappeared, but deniability has not been restored. We call this missing requirement forensic stealth. We evaluate six recent attacks spanning four different removal strategies and find that all leave strong forensic traces. At a 1% false-positive target, attack-specific detectors identify at least 99% of the removal outputs. In a separate image-by-image assessment of five attacks, only one of 750 outputs removes the watermark, remains within the fidelity budget, and evades forensic detection. The consistency of this result across different mechanisms shows that current evaluation practice overlooks a central part of the security problem. We also ask whether forensic stealth is possible in principle. Under explicit idealized assumptions, we show that exact forensic stealth is possible when a remover preserves source content and resamples the remaining detail from the corresponding clean distribution. In this model, the resulting outputs exactly match the clean-image distribution while remaining within the distortion budget. This shows that removal traces are not inevitable and places the practical difficulty in generating source-appropriate clean variation without damaging the image. We argue that forensic stealth should become part of the standard by which watermark removal is judged. Comments: 22 pages, including appendices. v2: substantially revised and expanded, with updated empirical evaluation and theoretical analysis Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2605.09203 [cs.CR] (or arXiv:2605.09203v2 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2605.09203 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Yevin Goonatilake [ view email ] [v1] Sat, 9 May 2026 22:45:48 UTC (14,122 KB) [v2] Fri, 28 Aug 2026 04:11:40 UTC (10,397 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Additional Features Audio Summary Current browse context: cs.CR < prev | next > new | recent | 2026-05 Change to browse by: cs References & Citations SciX Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab)

Related documents

• Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal#682672
• Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking#1161081
• Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking#1157358
• Official Review · NEURIPS 2024#787081
• DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory#985586