Paper deep dive

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation

Jie Cao, Qi Li, Zelin Zhang, Xiaodong Wu, Lingshuang Liu, Xiangman Li, Jianbing Ni

Year: 2026Venue: arXiv preprintArea: cs.CRType: PreprintEmbeddings: 105

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%

Last extracted: 8/13/2026, 4:36:47 AM

Summary

The paper introduces MarkNull, a model-agnostic watermark removal attack for AI-generated images that utilizes on-manifold latent manipulation. It proposes the Noise-Latent Alignment Score (NLAS) to decorrelate latent representations from embedded watermarks while preserving semantic fidelity. The authors also present MarkNull-A, an amortized variant using a Watermark Removal Network for efficient, optimization-free removal. The method successfully compromises systems like Google's SynthID-Image and video watermarking schemes with high visual quality.

Entities (9)

MarkNull · method · 98%SynthID-Image · system · 97%MarkNull-A · method · 95%Noise-Latent Alignment Score · metric · 92%Latent Diffusion Models · model-class · 90%Watermark Removal Network · model-component · 90%DDIM · algorithm · 88%VideoMark · system · 85%VideoShield · system · 85%

Relation Signals (7)

MarkNull-A → isvariantof → MarkNull

confidence 98% · To further improve scalability, we propose MarkNull-A, an amortized, optimization-free variant

MarkNull → compromises → SynthID-Image

confidence 97% · our attacks successfully compromise Google's SynthID-Image system

MarkNull-A → uses → Watermark Removal Network

confidence 95% · distills the attack into a Watermark Removal Network (WRN)

MarkNull → uses → Noise-Latent Alignment Score

confidence 95% · To quantify this dependency, we introduce the Noise-Latent Alignment Score (NLAS)

MarkNull → targets → Latent Diffusion Models

confidence 92% · MARKNULL is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise.

MarkNull → appliesto → VideoShield

confidence 85% · transfer effectively to video watermarking... VideoShield

MarkNull → appliesto → VideoMark

confidence 85% · transfer effectively to video watermarking... VideoMark

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored. Existing attacks either succeed only against specific generative models or achieve removal at the cost of severe visual degradation. In this paper, we propose MarkNull, a model-agnostic watermark removal attack via on-manifold latent manipulation. MarkNull is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. To quantify this dependency, we introduce the Noise-Latent Alignment Score (NLAS) and formulate an optimization objective that selectively decorrelates the latent representation from the embedded watermark while preserving semantic fidelity. Extensive evaluations across different categories of watermarking paradigms, including post-hoc, fine-tuning-based, and initial-noise-based schemes, demonstrate that MarkNull reduces average bit accuracy to 53.14%, approaching random-guessing (50%), without perceptible image degradation. To further improve scalability, we propose MarkNull-A, an amortized, optimization-free variant that distills the attack into a single forward pass, achieving 0.50 s/image with modest computational overhead. Notably, our attacks successfully compromise Google's SynthID-Image system while preserving high visual quality and transfer effectively to video watermarking. Finally, we present an attack detection mechanism as a defensive counterpart to MarkNull and MarkNull-A, highlighting the necessity of developing watermark designs resilient to model-agnostic latent-space attacks.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

103,276 characters extracted from source content.

Expand or collapse full text

MARKNULL: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation Jie Cao 1 , Qi Li 1 , Zelin Zhang 1 , Xiaodong Wu 1 , Lingshuang Liu 2 , Xiangman Li 1 , Jianbing Ni 1,∗ 1 Queen’s University, Canada 2 University of Waterloo, Canada Abstract Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored. Existing attacks either succeed only against specific generative models or achieve removal at the cost of severe visual degradation. In this paper, we propose MARKNULL, a model-agnostic watermark removal attack via on-manifold latent manipula- tion. MARKNULL is grounded in a key observation: water- marked images exhibit a strong statistical dependency be- tween the generated latent representation and the embedded initial noise. To quantify this dependency, we introduce the Noise-Latent Alignment Score (NLAS) and formulate an opti- mization objective that selectively decorrelates the latent rep- resentation from the embedded watermark while preserving semantic fidelity. Extensive evaluations across different cate- gories of watermarking paradigms, including post-hoc, fine- tuning-based, and initial-noise-based schemes, demonstrate that MARKNULL reduces average bit accuracy to 53.14%, approaching random-guessing (50%), without perceptible im- age degradation. To further improve scalability, we propose MARKNULL-A, an amortized, optimization-free variant that distills the attack into a single forward pass, achieving 0.50 s/image with modest computational overhead. Notably, our attacks successfully compromise Google’s SynthID-Image system while preserving high visual quality and transfer effec- tively to video watermarking. Finally, we present an attack de- tection mechanism as a defensive counterpart to MARKNULL and MARKNULL-A, highlighting the necessity of developing watermark designs resilient to model-agnostic latent-space attacks. 1 Introduction Generative AI, particularly Text-to-Image (T2I) models, has fundamentally transformed content creation by enabling the * Corresponding author. Upload Watermark Ver ificatio n: Bob generated! Bob (a) Watermarking Online Social Media Text prompt (b) Watermark Removal Attack (1) Distortion Attack Ver ificatio n: No watermark!!! (2) Regeneration Attack (3) Adversarial Attack Attacker (c) Verification Figure 1: Overview of AI-generated image watermarking and verification, and representative removal attacks. synthesis of highly realistic and semantically rich images. As AI-generated content becomes increasingly indistinguishable from natural imagery, it amplifies risks such as misinforma- tion, deepfakes, and intellectual property infringement. To mitigate the misuse of generative models and synthetic media, digital watermarking has emerged as a key mechanism for copyright verification and content attribution in AI-generated imagery [2]. As an active defense strategy, watermarking em- beds imperceptible signals into generated images to support reliable provenance tracking and the detection of unauthorized usage. A prominent real-world deployment is DeepMind’s SynthID [7], a commercial watermarking system designed to embed invisible watermarks into AI-generated images for robust copyright attribution. Existing watermarking techniques can be broadly classified into post-hoc and in-generation approaches. Post-hoc meth- ods, such as DwtDctSvd [27], HiDDeN [49], RivaGan [45], and SynthID [7], embed watermarks directly into images af- ter generation, including both AI-generated and real-world images [23]. These techniques operate purely in the image domain and remain largely decorrelated from the generative model’s internal representations, limiting their robustness and reliability under realistic watermark removal attacks. To ad- dress these limitations, recent research has shifted toward in- generation watermarking, which integrates watermark embed- arXiv:2608.10166v1 [cs.CR] 10 Aug 2026 ding directly into the image generation process. By aligning watermarks with the model’s semantic and latent representa- tions, this paradigm improves coherence and enables more reliable provenance tracking. In-generation methods can be further divided into two categories: (i) fine-tuning-based wa- termarking, which modifies model parameters to condition watermark presence in the generated output [4, 19]; and (i) initial-noise-based watermarking, which encodes watermarks into the sampling initialization of diffusion models [8, 40, 43]. An overview of these paradigms is illustrated in Figure 1. The central challenge of image watermarking lies in robust- ness, i.e., the ability of watermarks to remain verifiable under distortions and malicious manipulations. While many state- of-the-art (SOTA) image watermarking methods focus on im- proving watermark verifiability against removal attacks, their security assessment is mainly conducted under white-box as- sumptions, with a particular focus on pixel-space watermark- ing. Therefore, critical research gaps remain insufficiently addressed.❶Fidelity-removal Trade-off. Strong watermark removal attacks can significantly reduce watermark detectabil- ity, but often introduce severe artifacts and semantic incon- sistencies; in contrast, fidelity-preserving manipulation tends to be too weak to reliably evade watermark verification. For example, NFPA [30] removes watermarks via next-frame pre- diction, but induces object misalignment, making it difficult to preserve visual fidelity and content consistency before and after watermark removal.❷Limited Model-agnosticism. Ex- isting watermark removal attacks exhibit poor generalization across watermarking schemes. Most are built upon strong as- sumptions about the embedding mechanism, effectively over- fitting to specific watermark patterns (e.g., high-frequency artifacts in the pixel domain). These methods transfer poorly to unseen or SOTA watermarking protocols. For example, UnMarker [16] claims universality but operates exclusively in pixel space via adversarial filtering, rendering it ineffective against initial-noise-based watermarking schemes that embed watermark signals directly within the generative process.❸ Heavy Computational Overhead. SOTA removal attacks such as Imprint [26] and CtrlRegen+[21], which target ad- vanced watermarking schemes [40, 43], incur substantial com- putational overhead due to repeated DDIM inversions. This reliance on iterative inversion not only introduces prohibitive latency that limits real-time deployment, but also accumulates reconstruction errors, resulting in noticeable visual degrada- tion. Achieving a high-fidelity single-step DDIM-based attack remains an open problem, as existing methods fail to learn a direct end-to-end restoration that can effectively decorre- late the invisible watermark from complex semantic content without iterative refinement. Contributions. To address the above limitations, we pro- pose MARKNULL, a model-agnostic watermark removal framework built on three key ideas:❶We introduce the Noise- Latent Alignment Score (NLAS) to measure and weaken the dependency between the generated latent representation and the initial noise, enabling watermark removal through con- strained latent-space decorrelation while preserving image quality.❷We design MARKNULL for a no-box setting, using only a public proxy model and no access to the target wa- termarking system, which supports transfer across different watermarking paradigms.❸We further develop MARKNULL- A, an amortized variant that distills the optimization objective into a Watermark Removal Network (WRN), replacing iter- ative optimization with a single feed-forward pass for more efficient removal. Specifically, the main contributions of this paper include: •We propose MARKNULL, a no-box, model-agnostic wa- termark removal attack based on NLAS. Across nine rep- resentative image watermarking schemes, MARKNULL reduces the average BA to 53.14%, close to random guessing, while achieving the best overall visual quality among attack baselines. We further provide a theoret- ical analysis from the perspectives of flow matching and ODE theory to justify the removability of diffusion- model watermarks and the validity of NLAS. •We develop MARKNULL-A, an amortized variant of MARKNULL that distills the latent manipulation objec- tive into a WRN. MARKNULL-A removes the need for iterative optimization and enables efficient watermark removal, achieving 0.5 seconds per image with 6,282 MB of VRAM. •We further evaluate MARKNULL and MARKNULL-A against SynthID-Image, achieving a 100% ASR while maintaining superior perceptual quality, and extend eval- uation to video watermarking schemes VideoShield and VideoMark, where MARKNULL suppresses BA to∼ 50%and MARKNULL-A achieves excellent video qual- ity among successful attack baselines (MUSIQ > 0.6). • We explore an attack detector as a defensive mechanism against MARKNULL and MARKNULL-A, demonstrat- ing its potential to reliably identify compromised content. These findings further underscore the pressing need for watermarking schemes designed to be intrinsically ro- bust against latent-space manipulation. 2 Related Work 2.1 AI-generated Image Watermarking Digital watermarking has progressed from traditional pixel- and frequency-domain methods [18, 27, 37, 38] to deep learning-based frameworks [45, 49], serving as a key tool for provenance tracing and copyright protection. While con- ventional post-hoc methods watermark existing images, the rise of AIGC has shifted attention toward in-generation water- marking, which embeds signals during synthesis for improved Table 1: Comparison of watermark removal attacks. We categorize prior attacks by methodology and compare them in terms of proxy-model requirement and key capabilities: optimization-free execution, model-agnosticism, attack speed (seconds per image), fidelity preservation, adversary’s knowledge and attackable modalities. MethodSourceProxy Model Attack Capabilities Opt.-freeModel-agn.SpeedFidelityKnowledgeModality Regeneration VA [1]ICML’24 ✓(VAE)✓✗0∼ 1HighNo boxImage DA [48]NeurIPS’24 ✗(SDM)✓✗0∼ 1HighNo boxImage NFPA [30]NeurIPS’25 ✓(SDM)✓✗1∼ 5LowNo boxImage Adv. Attack Imprint [26]CVPR’25 ✓(SDM)✗10∼ 50Med.No boxImage CtrlRegen+ [21]ICLR’25 ✓(SDM)✗5∼ 10Med.No boxImage UnMarker [16]S&P’25✗> 600Med.No boxImage Noiseprints Attack (NPA) [6] −✓(SDM)✗10∼ 50Med.No boxImage MARKNULL−✓(SDM)✗✓5∼ 10HighNo boxImage&Video MARKNULL-A−✓(SDM)✓0∼ 1HighNo boxImage&Video stealthiness and robustness. Accordingly, T2I watermarking methods can be broadly categorized as follows: Fine-tuning-based watermarking: Fine-tuning-based wa- termarking embeds watermarks by modifying generative model parameters, making the watermark an intrinsic property of the output distribution. Representative approaches oper- ate on different components: Stable Signature [4] fine-tunes the Variational Autoencoder (VAE) decoder to embed a fixed model-level watermark. Xiong et al. [41] and WOUAF [19] extend this to user-level attribution via learnable latent injec- tion modules and weight modulation, respectively. Sleeper- Mark [39] instead fine-tunes the U-Net with a trigger-based mechanism, enabling covert watermark activation conditioned on specific prompts. Initial-noise-based watermarking: Initial-noise-based watermarking advances in-generation techniques by embed- ding watermarks directly into the earliest stage of the genera- tion process. By exploiting the structure of Latent Diffusion Models (LDMs), this paradigm freezes model parameters and subtly modifies the initial Gaussian noise, allowing the water- mark to propagate through the denoising trajectory and persist in the final output. TreeRing [40] is a pioneering method that embeds a watermark signal guided by concentric ring patterns into the Fourier domain of the initial noise. Subsequent works enhance security by incorporating cryptographic primitives into the noise sampling process. Gaussian Shading [43] par- titions the Gaussian probability space to encode watermark bits, and T2SMark [42] further improves key management and generation diversity. Similarly, Gunn et al. [8] employed Pseu- dorandom Error-correcting Codes (PRC) to modulate noise signs via watermark-derived sequences, providing strong com- putational indistinguishability guarantees. 2.2 Watermark Removal Attacks The widespread dissemination of generative content has in- tensified research on watermark removal attacks, which seek to undermine verification and attribution by manipulating wa- termarked images [2, 47]. While early attacks relied on simple distortions with limited effectiveness, modern adversaries em- ploy sophisticated techniques capable of suppressing or elimi- nating watermarks while preserving perceptual fidelity. Exist- ing removal strategies fall into three paradigms [1, 16, 30]: dis- tortion attacks, regeneration attacks, and adversarial attacks, with the latter two representing the most effective approaches; representative methods are summarized in Table 1. Distortion attacks are commonly used to assess the base- line robustness of watermarking schemes [5, 19, 39, 40, 43]. They apply standard signal-processing operations, such as geometric transformations and JPEG compression, to degrade watermark signals and reduce detection confidence. Although such attacks can weaken watermarks by introducing irre- versible distortions or suppressing detection-relevant high- frequency components, their overall effectiveness is often limited. Regeneration attacks aim to remove watermarks by recon- structing images using non-watermarked generative models. For example, Zhao et al. [48] exploited the information bot- tleneck of VAEs and LDMs to filter out watermark signals during latent reconstruction. However, this approach relies on lossy encoding and decoding processes, which frequently introduce visual artifacts such as blurring and detail loss. Qiu et al. [30] proposed transforming watermarked images into semantically coherent future frames using an unwatermarked generative model. By optimizing constrained latent warping and applying frame-attention mechanisms to preserve seman- tic content, their method successfully removes initial-noise- based watermarks in a black-box setting, albeit with potential fidelity trade-offs. Adversarial attacks constitute one of the most extensively studied classes of watermark removal methods. These at- tacks optimize carefully crafted, imperceptible perturbations to mislead watermark detectors while preserving visual qual- ity, typically formulated as constrained optimization prob- lems. They are effective under varying adversarial knowledge assumptions and have demonstrated strong performance in bypassing detection systems. Hu et al. [14] studied the no-box watermark evasion via transferable adversarial perturbations generated from surrogate model ensembles. MarkSweep [3] likewise targets the no-box setting, using a noise intensifica- tion–denoising pipeline to amplify and suppress impercepti- ble watermark signals. UnMarker [16] proposes a universal removal framework by optimizing Fourier-domain losses or applying adversarial filtering to alter structural image features. Nevertheless, these adversarial approaches generally fail against initial-noise-based watermarking methods [8, 40, 42, 43] and other highly robust watermarking schemes [23, 39]. Recent works have begun exploiting the generative priors of latent diffusion models for watermark removal under a no-box setting. Zhang et al. [20] and Müller et al. [26] optimized la- tent perturbations to cross detection boundaries with minimal visual distortion, while Liu et al. [21] guided controllable re- generation from noise using semantic and spatial constraints. Although these approaches differ in methodology, they col- lectively reveal a growing trend: leveraging the structure and dynamics of the diffusion process itself to suppress or remove embedded watermarks. 3 Background 3.1 LDM-Based Image Generation We formulate our method within the framework of LDMs [31], a class of generative models that has become foundational in diffusion-based image synthesis. Specifically, an LDM is composed of two principal components: (i) A diffusion model Ubased on U-Net, which governs the stochastic denoising tra- jectory in latent space; and (i) a VAE, typically decomposed into an encoder–decoder pair(E,D), whereEmaps input im- ages into compact latent representations, andDreconstructs the corresponding images from those latents. The full LDM is denoted asΘ = (E,U,D). The image generation process begins by sampling a noise vectorz T from a standard Gaus- sian distribution. This latent is then progressively denoised toz 0 , using the DDIM [32] or DPM-Solver++[11, 22], and finally decoded into the image space via the decoder D : I = D (DDIM T→0 (z T ; U)),z T ∼ N (0, I).(1) The inverse DDIM [25, 26] procedure reconstructs an im- age’s generative trajectory by running the deterministic re- verse diffusion dynamics backward, which can be interpreted as a discretized ODE/flow trajectory under the probability- flow ODE interpretation [32, 33]. This yields an approx- imately invertible mapping betweenz 0 andz T . At each timestep t, the latent is updated by: z t+1 = √ α t+1 ˆz 0 t + p 1− α t+1 U(z t , t, y),(2) whereα t denotes the noise schedule andˆz 0 t is the model’s estimate of the original latent. This formulation inverts the generative process without requiring access to the original conditiony[25], thereby enabling reconstruction of the noise trajectory that could have producedz 0 . This inversion under- lies the basic principle of initial-noise-based watermarking methods [8, 40, 42, 43], where the watermark is embedded by modifying thez T and is then faithfully propagated through the generative process. We denote this inversion process as: z T = DDIM 0→T (z 0 ; U),z 0 = E(I).(3) 3.2 Formulation of Image Watermarking The embedding processes of post-hoc watermarking and fine-tuning-based Watermarking can be defined as superim- posing a specific noise signalδonto the original cover image Ito obtain the watermarked imageI w . This process can be formalized as: I w = Θ(z T , y)+ δ, (4) whereδdenotes the watermark signal (or watermark residual). For post-hoc methods,δis explicitly produced by the water- mark embedding function; for fine-tuning-based methods,δ corresponds to the implicit output shift induced by parameter updates, i.e., Θ w (z T , y)− Θ(z T , y). Initial-noise-based watermarking leverages the high sen- sitivity of diffusion models to initial conditions and the prop- erties of DDIM, allowing the watermark embedded in the initial noise to propagate to the final generated image. This process can be defined as follows: I w = Θ(z w T , y),z w T ∼ N (0, I),(5) wherez w T is constructed in the latent space based on a pre- defined watermark w using a specific embedding algorithm. Existing watermarking methods generally fall into three paradigms, yet they share a common verification function. Formally, we define a unified detectorf : I → Rthat consists of both watermark extraction and verification. For an input image, it outputs a scalar score compared against a threshold τ to determine watermark presence. 4 Threat Model In image watermarking, a watermark owner (e.g., image creator, model provider, or copyright holder) employs a wa- termarking system to embed imperceptible signals into AI- generated images for provenance tracking and copyright en- forcement, while an adversary seeks to evade verification by removing the watermark from the watermarked image while maintaining high visual fidelity of the image. We formalize watermark removal as an evasion attack under a no-box set- ting, and detail the adversary’s knowledge and objectives. 4.1 Adversary Knowledge The generative framework employed by the watermark owner typically relies on LDMs [31], such as Stable Diffusion [34–36], to ensure the synthesis of high-fidelity and seman- tically rich images. Depending on the specific provenance tracking strategy, the backbone model is either utilized as a fixed generator in post-hoc and initial-noise-based schemes or subjected to parameter modification in fine-tuning-based approaches. In this work, we consider a realistic and challeng- ing model-agnostic threat model, in which the adversary aims to remove potential watermarks without relying on any prior knowledge of the specific watermark embedding mechanisms. The adversary’s capabilities are defined as follows: •No-box Target Access: The adversary can only generate watermarked images from the target generatorΘ, but has no access to its internal parameters, gradients, or specific architecture (e.g., the decoder or the extractor). •No-Knowledge of Watermarking Scheme: We assume a strictly no-knowledge setting regarding the target wa- termarking scheme. The adversary is unaware of the spe- cific paradigm, embedding, extraction, and verification algorithms, or the embedded watermarkw. Furthermore, we assume a no-oracle setting in which the adversary has no access to the watermark detection interface and cannot query the verifier for scores or gradients. • Data Constraints: We assume that the adversary lacks access to ground-truth paired samples (i.e., a pair of watermarked and non-watermarked images depicting the same content or generated from the same prompt). • Proxy Model Access: The adversary has full white-box access to a publicly available proxy modelΘ A , which is assumed to share a similar generative domain with the image generation model Θ, but is clean. 4.2 Attack Objectives The adversary aims to achieve effective watermark removal while maintaining high visual fidelity. We formalize these two competing objectives as follows: Watermark Evasion. To compromise the target watermark- ing system, the attack goal is to suppress the detection score below the decision threshold, thereby causing a false negative: f(I A ) < τ,(6) where I A denotes the adversarial image. Visual Stealthiness. The attacked imageI A after watermark removal must remain perceptually indistinguishable from the original watermarked image I w to ensure utility. We require: d img (I A , I w )≤ η,(7) whered img represents a perceptual distance metric (e.g., LPIPS [46] or MSE), andηis an acceptable distortion budget. 1 x DDIM NLAS LPIPS, MSE, SSIM Perturbation + Gradient descent Gradient update Dataset NLAS LPIPS, MSE, SSIM Watermark Removal Network (a) Per-instance attack: MarkNull (b) Amortized attack: MarkNull-A Loss = NLASLPIPS, MSE, SSIM + Gradient update Ver ificatio n: No watermark!!! Watermark Removal Network Proposed Attack Figure 2: Illustration of the attack pipeline. MARKNULL iteratively optimizes latent representations to evade detection; MARKNULL-A trains a WRN for rapid end-to-end removal. Both modes leverage a proxy model Θ A . Generality and Practicality. The proposed attack is model- agnostic and designed to generalize across diverse water- marking paradigms and real-world deployment scenarios. Un- like prior approaches that rely on exploiting scheme-specific embedding artifacts, our attack leverages universal proper- ties of LDMs, enabling consistent effectiveness against post- hoc, fine-tuning-based, and initial-noise-based watermarking schemes. Moreover, the attack assumes no access to the target model or watermarking mechanism and must successfully transfer from a publicly available proxy model to unknown or proprietary systems without modification. Meanwhile, we emphasize practicality and stealth. The attack is required to operate under realistic resource constraints, achieving low latency and modest memory overhead suitable for consumer- grade hardware, while preserving high perceptual quality to avoid raising suspicion during watermark removal. 5 Proposed Attacks 5.1 Overview We propose MARKNULL and its end-to-end version MARKNULL-A, as illustrated in Figure 2. MARKNULL is a per-instance optimization attack that removes watermark through latent space manipulation. It iteratively optimizes a perturbation applied to the image’s latent representationz 0 , balancing two competing objectives: (i) maximizing devia- tion from the watermarked initial noise distribution to erase embedded watermark signals, and (i) minimizing perceptual loss to preserve visual fidelity. To enhance attack efficiency, we further introduce MARKNULL-A, an amortized version of the attack designed for rapid inference. MARKNULL-A trains a WRN to learn a generalized mapping from watermarked image to watermark-free image in the pixel domain, distill- ing the iterative optimization objective into a single forward pass, while maintaining the hybrid loss constraints on both latent and pixel spaces, achieving a favorable balance between removal effectiveness and image quality. 5.2 Key Insights As illustrated in Section 3.1, the watermarkedz T can be trans- ported along the denoising trajectory and manifest inz 0 and thus in the decoded image, makingz T a natural carrier for watermark information. Our proposed approach is driven by the fundamental observation that watermarking paradigms, regardless of their implementation, rely on preserving spe- cific statistical dependencies along the generative trajectory (z T → z 0 ). We introduce Latent Space Manipulation to disrupt these dependencies through two complementary mechanisms: Statistical Independence via Orthogonality. For initial- noise-based watermarking schemes, we observe that simple distance maximization in latent space is insufficient to remove watermark signals. Instead, we enforce geodesic orthogonal- ity between the optimized latentz adv 0 and the original initial noisez A,w T . In high-dimensional latent spaces, orthogonality implies statistical independence, severing the causal depen- dency between the generated image and the watermarked initial noise. As a result, the re-inverted noise is mapped to a pristine, unstructured distribution rather than a watermark- encoded pattern, enabling reliable watermark removal. Manifold Projection and VAE Filtering. For fine-tuning and post-hoc watermarking schemes, our attack performs re- generation. First, the VAE information bottleneck functions as a low-pass filter, suppressing high-frequency, pixel-level artifacts commonly introduced by post-hoc watermark em- bedding. Second, by optimizingz adv 0 to minimize perceptual distortion while simultaneously enforcing the orthogonality constraint, we induce a controlled distributional shift: the re- sulting adversarial image maintains high visual fidelity but is projected away from the model’s specific watermarked statistical manifold. This displacement effectively prevents watermark detection while preserving semantic content. 5.3MARKNULL The initial noisez T leaves a persistent structural trace on the final generation; specifically, the latent representationz 0 retains a significantly higher correlation with its originating sourcez T compared to independent random noise. Moreover, thez T → z 0 trajectory is constrained by the denoiser and the scheduler. The generated states do not densely cover the ambient Euclidean space; instead, they are concentrated near a structured low-dimensional manifold. Thus, we introduce NLAS to measure the correlation between z 0 and z T : NLAS(z 0 , z T ) = (arccos z 0 · z T ∥z 0 ∥ 2 ∥z T ∥ 2 − π 2 ) 2 .(8) Section A validates NLAS as an effective correlation met- ric:z 0 shows high alignment with its coupledz T , whereas it is effectively orthogonal to random standard Gaussian noise z rand ∼ N (0, I). Therefore, we aim to construct an adversarial latentz (adv) 0 that is orthogonal to z T , formulated as follows: θ(z (adv) 0 , z T )→ π 2 =⇒ ⟨ z (adv) 0 ∥z (adv) 0 ∥ , z T ∥z T ∥ ⟩ ≈ 0,(9) where⟨·,·⟩denotes the inner product. To promote statistical independence under a Gaussian prior, we enforce orthogonal- ity between z 0 and z T . To preserve visual fidelity while optimizing the adversarial z (adv) 0 , we incorporate an image quality loss term that con- strains the decoded adversarial image to remain close to the original watermarked image. Specifically, we define the qual- ity loss as: L img (I A , I w ) = λ 1 L LPIPS (I A , I w )+ λ 2 ∥I A − I w ∥ 2 2 + λ 3 1− L SSIM (I A , I w ) , (10) whereI w andI A denote the original watermarked image and the image decoded from the adversarial latent via proxy model, respectively;L LPIPS measures perceptual dissimilarity, ∥·∥ 2 2 is the pixel-wise Mean Squared Error (MSE), andL SSIM quantifies structural similarity. The weightsλ 1 , λ 2 , λ 3 bal- ance the perceptual, pixel-level, and structural fidelity terms. This loss ensures that watermark removal does not produce noticeable image degradation. Consequently, we aggregate the aforementioned terms into a unified objective function and optimize the adversarialz (adv) 0 via gradient descent. Crucially, this optimization process re- lies exclusively on the proxy modelΘ A = (E A ,U A ,D A ), ad- hering strictly to the no-box setting. The optimization proce- dure is summarized in Algorithm 1. We name this per-instance attack MARKNULL. L MARKNULL = L img (I A , I w )+ λ 4 NLAS(z (adv) 0 , z A,w T ). (11) Furthermore, in Section 6, we provide a theoretical analysis of the feasibility and generality of MARKNULL. We view the generation dynamics of LDMs as a deterministic ODE flow driven by a learned time-dependent vector field, which allows us to leverage flow matching and ODE theory to establish the existence of an inverse mapping and thus the removability of watermarks across a broad range of watermarking schemes. Algorithm 1: MARKNULL Input : Watermarked image I w , proxy model Θ A , latent perturbation budgetε; stepsN, learning rate κ. Output : Watermark-free image I A . 1 // 1. Initialization 2 z A,w 0 ← E A (I w ) 3 z A,w T ← DDIM 0→T (z A,w 0 ;U A ) 4 z (adv) 0 ← z A,w 0 5 // 2. Optimization Loop 6 for i← 1 to N do 7I (i) A ← D A (z (adv) 0 ) 8g i ← ∇ z (adv) 0 L MARKNULL (z (adv) 0 , z A T , I (i) A , I w ) ▷ Equation (11) 9z (adv) 0 ← z (adv) 0 − κg i 10z (adv) 0 ← z A,w 0 + Clip(z (adv) 0 − z A,w 0 ,−ε, ε) 11 // 3. Final Reconstruction 12 I A ← D A (z (adv) 0 ) 13 return I A 5.4MARKNULL-A While MARKNULL serves as a powerful per-instance attack, its reliance on iterative gradient-based optimization intro- duces substantial computational latency, limiting scalability in real-time or large-scale deployment scenarios. However, as empirically demonstrated, the perturbations learned by MARKNULL are not purely random; they exhibit consistent and transferable structural patterns across different samples. This observation suggests that the transformation required to decorrelate watermark signals from the latent diffu- sion trajectory is both learnable and generalizable. Moti- vated by this insight, we introduce MARKNULL-A, an amor- tized variant designed to improve attack efficiency. Rather than performing iterative optimization on individual samples, MARKNULL-A employs a WRN to amortize the optimiza- tion cost through a single feed-forward model. The WRN is trained to learn a direct mapping from watermarked im- ages to their watermark-free counterparts by minimizing the following objective function over a representative training dataset. L MARKNULL-A = E I∼D h λ 5 L LPIPS (I A , I)+ λ 6 ∥I A − I∥ 2 2 +λ 7 1− L SSIM (I A , I) + λ 8 NLAS(z (adv) 0 , z A T ) i . (12) 5.4.1 WRN We build the WRN upon a Restormer [44], a SOTA Trans- former architecture designed for high-fidelity image restora- Algorithm 2: MARKNULL-A Input: Dataset D , proxy model Θ A , learning rate ξ, image I w Output: W φ , watermark-free image I A 1 Initialize φ 2 while not converged do 3Sample B∼ D 4 // 1. Forward 5z A T ← DDIM 0→T (E A (B);U A ) 6 e B← W φ (B) 7z (adv) 0 ← E A ( e B) 8 // 2. Gradient Update 9φ← φ− ξ∇ φ L MARKNULL-A (z (adv) 0 , z A T , e B, B) ▷ Equation (12) 10 // 3. End-to-end Attack 11 I A ← D A (E A (W φ (I w ))) 12 return W φ , I A tion. The Restormer is well-suited to our task for two main rea- sons: (i) its multi-head transposed self-attention mechanism effectively captures long-range dependencies while maintain- ing computational efficiency for high-resolution inputs; and (i) its restoration-focused inductive bias, an encoder–decoder hierarchy with multi-scale feature refinement, closely aligns with our goal of removing the watermark without introducing perceptible distortions. To comply with the Data Constraints, we construct the training datasetDutilizing a publicly available proxy model Θ A .Dconsists exclusively of clean AI-generated imagesI without any embedded watermarks. Accordingly, the WRN W φ is trained to produce an output imageI A fromIthat pre- serves high perceptual fidelity while enforcing latent-space decorrelation and orthogonality between the optimized latent representationz A 0 and the initial noisez A T . The training proce- dure is summarized in Algorithm 2. To further enhance attack efficacy and ensure consistency with the diffusion prior, the output ofW φ is subsequently passed through a VAE regener- ation using Θ A . 6Provable Attack Guarantees of MARKNULL In this section, we theoretically substantiate the effectiveness of MARKNULL. The generation dynamics of an LDM can be viewed as a deterministic ODE flow driven by a learned time-dependent vector field [10]. This perspective enables us to leverage flow matching and ODE theory to formalize the existence of an inverse mapping, thereby establishing the re- movability of watermarks. Our argument is structured around three key observations: (i) because the generative flow is a diffeomorphism, the induced watermark map admits a unique preimage, ensuring well-posed invertibility; (i) convergence of the marginal vector fields implies that discrete inversion procedures are asymptotically consistent across model vari- ants; and (i) a latent-space decorrelation mechanism sup- presses alignment-based test statistics, reducing detectability under common alignment metrics. To be consistent with the LDM literature [31], we usez T to denote the initial noise andz 0 the generated latent represen- tation. We reparameterize timet∈ [0, 1]such thatX 0 ∼ p init corresponds toz T , andX 1 ∼ p data corresponds toz 0 following ODE and flow matching. 6.1Bijective Structure of Noise-Data Mapping In this section, we establish the theoretical validity of altering the initial noise by manipulating the latent representation. Assumption 1 (Deterministic Marginal Flow Analysis). We define the generative process as a deterministic ODE flow induced by the Marginal Vector Field. Thus, the trajectory satisfies: dX t dt = u target t (X t ),X 0 = z T =⇒ X 1 = z 0 ,(13) where u t denotes the vector field. This assumption is grounded in the theoretical framework in [10]. This validates the marginalization trick, demonstrat- ing that a marginal vector field governing the target prob- ability path can be constructed by integrating conditional vector fields over the posterior distribution. This establishes the theoretical basis for treating the generation process as a deterministic ODE flow; consequently, deterministic sam- plers used in practice (e.g., DDIM [32], DPM-Solver [22]) are essentially numerical discretizations of this specific ODE. Proposition 1 (Bijectivity Implies a Unique Preimage). Let ψ : K → ψ(K)be the time-1 flow map induced by an ODE on the compact setK, satisfyingz 0 = ψ(z T ). If the vector fieldu t is continuously differentiable and uniformly Lipschitz onK, thenψis a diffeomorphism. For any generated latent representationz 0 ∈ ψ(K), there exists a unique preimage z T = ψ −1 (z 0 ). Therefore, any non-zero perturbationεresult- ing inz (adv) 0 = z 0 + ε(providedz (adv) 0 ∈ ψ(K)) necessarily corresponds to a shifted initial state z (adv) T ̸= z T . Proof.The solution to the ODE satisfying the aforemen- tioned regularity conditions defines a diffeomorphism. In- jectivity guarantees the uniqueness of the preimage. Further- more, since the inverse mapψ −1 is smooth on the compact image setψ(K), its Jacobian norm is bounded. According to the Mean Value Theorem, the variation in the initial noise is bounded by: ∥z (adv) T − z T ∥≤ L inv ∥ε∥,(14) whereεdenotes the adversarial perturbation added toz 0 , and L inv is the Lipschitz constant of the inverse mappingψ −1 . This verifies that perturbations in the latent representation can effectively alter the original watermarked z T . 6.2 Consistency of Watermark Estimation MARKNULL leverages a proxy modelΘ A to infer the water- marked initial noise. A key requirement is that the inversion results produced by the proxy model align with those of the target model. Assumption 2 (Proxy-Target Compatibility). We assume that the target modelΘand the proxy modelΘ A share the same latent-space parameterization and the same discrete in- version scheme ˆ ψ −1 (i.e., the same noise schedule and solver type). In practice, ˆ ψisψ’s discrete approximation. Moreover, we assume that their vector fieldsu Θ t andu Θ A t satisfy a uniform Lipschitz condition on a compact setK, and that all interme- diate states encountered during inversion remain withinK. For watermarking methods built upon SDM-based T2I mod- els, implementing initial-noise-based watermarking typically relies on a largely standardized choice of noise schedule and solver type, which is widely accepted in the community and does not violate the no-box setting. This assumption is grounded in the fundamental objec- tive of generative modeling. AlthoughΘandΘ A may differ in architecture or training details, both are optimized to ap- proximate the same underlying ground-truth distribution of natural images, denoted asp data . Consequently, they learn to map Gaussian noise to the same low-dimensional natu- ral image manifold. Since the watermark removal process in MARKNULL essentially corresponds to a projection operation that pulls the sample back onto this shared manifold (filtering out off-manifold watermark perturbations), the gradient di- rection learned from the proxy manifoldM (Θ A )serves as a highly effective approximation for the target manifoldM (Θ). This structural alignment ensures attack transferability even across disparate model architectures. Lemma 1. Under Assumption 2 and the stability theory of numerical integration (specifically, the discrete Grönwall lemma), the discrepancy in the inversion results is bounded by the error of the vector fields: sup z∈ψ(K) ∥ ˆ ψ −1 Θ (z)− ˆ ψ −1 Θ A (z)∥≤ C stab sup x∈K,t∈[0,1] ∥u Θ t (x)− u Θ A t (x)∥. (15) This bound holds for any single-step or multi-step solver satisfying zero-stability and consistency conditions. The con- stantC stab depends on the Lipschitz constant, the number of steps, and the time interval. Proposition 2 (Guarantee of Attack Transferability). Let z A,w T = ˆ ψ −1 Θ A (z A,w 0 ) denote the proxy initial noise used in Algo- rithm 1 and Algorithm 2, and letz w T = ˆ ψ −1 Θ (z w 0 ) denote the initial noise under the target model. If both models are suffi- ciently aligned such thatsup t |u Θ t − u Θ A t |≤ ε u , then optimizing the adversarial latent representationz (adv) 0 to decorrelate from z A,w T implicitly reduces its correlation with z w T . Proof. The flow matching training objective regressesu t to a unique marginal vector fieldu target t [10]. Assuming suffi- cient convergence, the vector field discrepancyε u is minimal. Applying Lemma 1, the inversion error is bounded by: ∥z w T − z A,w T ∥≤ C stab ε u .(16) Therefore, MARKNULL minimizesNLAS(z (adv) 0 , z A,w T ) , which in turn approximates minimizing the absolute inner product |⟨z (adv) 0 , z w T ⟩| . By applying the triangle inequality and Cauchy- Schwarz inequality to the decomposition, we obtain: |⟨z (adv) 0 , z w T ⟩| =|⟨z (adv) 0 , z A,w T +(z w T − z A,w T )⟩| ≤|⟨z (adv) 0 , z A,w T ⟩|+|⟨z (adv) 0 , z w T − z A,w T ⟩| ≤|⟨z (adv) 0 , z A,w T ⟩| |z NLAS +∥z (adv) 0 ∥·∥z w T − z A,w T ∥ |z C stab ε u . (17) When normalized∥z (adv) 0 ∥ = 1, and by Lemma 1 the error term is upper-bounded byC stab ε u . Therefore, when the opti- mization drives the correlation (i.e., NLAS) under the proxy model toward0, the correlation under the target model is guar- anteed to remain withinC stab ε u . As long as the two models are similar (i.e.,ε u is small), the attack can be successfully realized using the proxy model. 6.3 Watermark Removal Guarantee Building upon the transferability guarantee established in the previous section, we now formally analyze the mechanism by which MARKNULL removes the watermark signal. While Section 6.2 ensures that our proxy-guided optimization re- mains valid for the target model, this section demonstrates that the optimization objective itself, minimizing NLAS, mathe- matically leads to a reduction of correlation-based detection statistics. Proposition 3 (Watermark Removal via Alignment Sup- pression). This proposition applies to initial-noise-based wa- termarking schemes that rely on correlation-based detection such as TreeRing [40], Gaussian Shading [43], and PRC [8], where the decision statistic depends on the alignment between the recovered watermarkz w T and the original initial noise. By minimizingNLAS, MARKNULL reduces the correlation be- tween the adversarial latentz (adv) 0 and the target watermark z T to the statistical baseline of independent random vectors. Proof.MARKNULL explicitly minimizes the NLAS. Since NLAS is defined as a monotonic metric quantifying the deviation of the included angle fromπ/2, the condition NLAS→ 0implies⟨z (adv) 0 , z T ⟩→ 0 (i.e., orthogonality). In high-dimensional spaces, according to the Concentration of Measure phenomenon, independent isotropic random vectors are approximately orthogonal with extremely high probabil- ity (correlation concentrates around 0). Consequently, this optimization process suppresses the alignment metric to the statistical baseline of "random noise pairs". For detectors rely- ing on this specific alignment structure, the detection statistic will degenerate to the Null HypothesisH 0 , classifying the image as non-watermarked, leading to detection evasion. The analysis above primarily addresses watermarks rooted in the generation dynamics. However, watermarking schemes based on fine-tuning and post-hoc methods operate through different mechanisms. These approaches typically introduce perturbations in the high-frequency domain or alter the statis- tical distribution of the model. In the following proposition, we extend our theoretical framework to demonstrate that our method remains effective against these paradigms by leverag- ing the manifold projection property of the VAE decoder. Proposition 4 (Generalization to Fine-tuning and Post-hoc Schemes). The adversarial latent perturbation generated by MARKNULL is effective against fine-tuning and post-hoc watermarking schemes. Since these watermarks can be mod- eled as additive perturbationsδthat typically reside in the high-frequency space of the image manifold, MARKNULL evades detection by projecting the watermarked image onto the tangent space of the generative manifold, thereby filtering out the watermark signal. Proof.LetM =D A (z 0 )| z 0 ∈ Zbe the image manifold. Post-hoc and fine-tuning watermarks are modeled asI w = I clean + δ . MARKNULL optimizes the latent representation to minimize the reconstruction loss, which is mathematically equivalent to solving a local projection problem: min ∆z ∥D A (z 0 + ∆z)−(I clean + δ)∥ 2 2 .(18) By performing a first-order Taylor expansion of the decoder aroundz clean with JacobianJ z , the optimization simplifies to a linear least-squares problem:min ∆z ∥J z ∆z− δ∥ 2 2 . The closed- form solution yields the update in pixel space: ∆I A ≈ J z ∆z ∗ = P T δ,where P T = J z (J ⊤ z J z ) −1 J ⊤ z .(19) Here,P T is the orthogonal projection matrix onto the tan- gent spaceT I clean M. The reconstructionI A effectively retains the componentP T δ(on-manifold content) while discarding (I− P T )δ(off-manifold noise). Since fine-tuning and post-hoc watermarks are designed to be imperceptible, they predomi- nantly occupy the high-frequency subspace orthogonal to the semantic manifold (i.e.,∥(I− P T )δ∥≫∥P T δ∥). Consequently, the projectionP T significantly attenuates the watermark en- ergy, rendering it undetectable. 7 Evaluation and Analysis We conduct comprehensive evaluations of the proposed MARKNULL and MARKNULL-A across a broad range of tasks, evaluation metrics, and representative baselines. Sec- tion 7.1 outlines our experimental setup, including the used datasets and evaluation metrics. In Sections 7.2 to 7.4, we present four key aspects of our analysis: attack effectiveness, image quality preservation, efficiency and usability, and gen- eralization. Together, these experiments demonstrate the ca- pability of our proposed attacks to address key research gaps in watermark removal. 7.1 Experimental Setup MARKNULL and MARKNULL-A are implemented with the hyperparameter settings described in Section B, where we also report the corresponding experimental results. Watermarking Baselines. We deploy nine representa- tive AI-generated image watermarking baselines, covering three major paradigms. Post-hoc watermarking methods in- clude DWT-DCT-SVD (DwtDct) [27], RivaGan [45], and HiDDeN [49]. Fine-tuning-based methods include Stable Sig- nature (S) [4], VINE [23], and SleeperMark [39], which embed watermarks by updating the generative model parame- ters. Initial-noise-based methods include Gaussian Shading (GS) [43], PRC [8], and TreeRing (TR) [40], which encode watermarks by manipulating the initial noise in the diffusion process. Among these, TR is a zero-bit watermarking scheme that verifies watermark presence without decoding a bit-string watermark. Model and Dataset. We leverage Stable Diffusion 2.1- base (SD2.1) [34] as the default backbone for both image generation and watermark embedding. SD2.1 is a widely adopted open-source T2I model known for its high-fidelity outputs, and it serves as an underlying model for constructing AI-generated image watermarking schemes. To benchmark watermarking performance, we randomly sample prompts from the Stable Diffusion Prompts (SDP) dataset [9] and generate 100 watermarked images of resolution512× 512 for each watermarking method using SD2.1. All images are generated with a fixed number of 50 inference steps to ensure consistency across comparisons. For post-hoc watermarking baselines, we instead generate 100 images using Stable Diffu- sion XL-base 1.0 (SDXL1.0) [35], followed by the application of watermarking schemes after image synthesis. In addition, when a proxy model is required by the adversary within attack methods, we instantiate it using Stable Diffusion 1.5 (SD1.5). Attack Baselines. To comprehensively assess our at- tacks’ capability for image watermark removal, we evalu- ate MARKNULL and MARKNULL-A against a broad suite of attack baselines covering both standard distortions and advanced watermark removal attacks. Specifically, five stan- dard distortions include Gaussian noise, Gaussian blur, con- trast adjustment, brightness adjustment, and JPEG compres- sion. The advanced watermark removal attacks are further grouped into: (i) regeneration attacks, including Diffusion- Attack (DA) [48], VAE-Attack (VA) [1], CtrlRegen+ [21], and Next Frame Prediction Attack (NFPA) [30]; and (i) ad- versarial attacks, including UnMarker [16], Imprint [26], and NoisePrints (NPA) [6]. For each baseline, we use the attack hyperparameters reported in the original papers, so that the resulting outputs exhibit comparable visual quality, thereby enabling a fair, controlled comparison of watermark removal effectiveness. Evaluation Metrics. We employ five metrics to evalu- ate both reconstruction fidelity and perceptual realism, in- cluding PSNR▲, SSIM▲, LPIPS▼, FID▼, and BRISQUE▼. BRISQUE [24], a no-reference metric, evaluates perceptual quality without the ground truth. To facilitate a holistic as- sessment of image quality, we introduce a CQS▲. In addition, we evaluate an attack’s ability to evade watermark detection using BA and TPR@1%FPR. Detailed definitions of these metrics are provided in Section C. 7.2 Evaluation Results 7.2.1 Effectiveness of MARKNULL and MARKNULL-A We evaluate MARKNULL and MARKNULL-A in terms of watermark removal effectiveness, focusing on their ability to suppress detection scores across diverse watermarking schemes and against representative attack baselines. Table 2 summarizes watermark detection performance under different attacks. For multi-bit watermarking schemes, we report BA, while for the zero-bit TR, we reportTPR@1%FPR. In the absence of attacks, all watermarking methods achieve near- perfect detection or bit extraction accuracy, confirming the correctness of watermark embedding and detection. Across eight multi-bit watermarking schemes, existing at- tacks remain largely ineffective: most baselines continue to achieve high BA (e.g., VA retains average BA of80.17%, and UnMarker remains at91.81%), indicating that the embedded watermarks are still reliably recoverable. VA and DA, which represent simple regeneration attacks, fail to compromise ro- bust watermarking schemes like VINE and SleeperMark. Un- Marker, although effective against certain post-hoc water- marking, does not generalize beyond its targeted embedding artifacts. Notably, all the above approaches are ineffective against initial-noise-based watermarking schemes. MARKNULL reduces the average BA to 53.14%, approach- ing the random-guessing baseline (50%), and achieves near- chance performance on robust schemes like GS and Sleeper- Mark. Its amortized variant, MARKNULL-A, exhibits com- parable performance. Overall, both attacks outperform ex- isting baselines in disrupting multi-bit watermark detection, with MARKNULL achieving the strongest average effective- ness. For the zero-bit TR scheme, MARKNULL reduces Table 2: Attack evaluation against watermarking schemes (TPR@1%FPR▼for zero-bit watermarking; BA[%]▼for multi-bit watermarking). Multi-bitZero-bit AttackDwtDctRivaGanHiDDeNSSVINESleeperMarkGSPRCAvg.TR No Attack10099.9698.9999.7699.7999.9610010099.81100 Noise84.8199.8153.9196.8599.4599.3199.7589.9490.4892 Blur10099.9672.1285.0899.8199.9810010094.62 92 Contrast50.6499.4087.1298.1699.7199.9810010091.8898 JPEG99.6698.6277.8579.7799.7499.7599.9395.8293.8991 Brightness50.1999.4489.6398.4099.7099.9410010092.16 96 VA [48]78.9764.7860.8162.6696.6895.9898.5984.4780.1783 DA [1]69.6461.7561.8748.8091.6799.8199.7496.7678.76 78 CtrlRegen+[21]53.1657.9059.7447.6468.9689.1091.9252.1865.0831 NFPA [30]52.9362.2858.3748.3652.7685.2750.6049.4157.500 Imprint [26]59.8154.3461.2246.5273.7083.7131.6847.9457.37 34 UnMarker [16]10087.8463.9193.4198.5999.7799.4891.4791.81 46 NPA [6]56.9158.5960.2946.7384.1692.7566.7751.7664.7529 MARKNULL55.1059.7860.6249.1264.9342.8841.5551.1853.1443 MARKNULL-A66.4370.5359.8546.5256.0039.2970.2847.9457.1063 Table 3: CQS evaluation of various attack methods against watermarking schemes. AttackDwtDctRivaGanHiDDeNSSVINESleeperMarkGSPRCTRAvg. VA3.193.303.163.523.743.393.633.343.503.42 DA3.663.713.733.903.753.893.943.633.823.78 CtrlRegen+3.173.203.323.413.273.403.553.263.433.33 NFPA1.041.611.891.851.551.131.871.731.621.58 Imprint3.003.093.083.353.203.163.342.853.223.14 UnMarker3.092.842.953.053.133.132.923.003.043.02 NPA3.183.253.243.723.823.743.753.333.663.52 MARKNULL3.663.723.754.093.934.244.113.804.063.93 MARKNULL-A3.913.943.973.883.683.994.063.853.923.91 TPR@1%FPRfrom100%to43%, while MARKNULL-A achieves63%. Although some baselines achieve slightly lower detection rates on TR, our methods provide broader and more consistent suppression across both multi-bit and presence-only detectors. These results highlight the strong generalizability of our approach. By explicitly decorrelating z w T andz (adv) 0 through NLAS minimization, MARKNULL re- mains highly effective even against the stealthiest and most lossless initial-noise-based watermarking schemes (e.g., GS and PRC). 7.2.2 Evaluation of Image Quality Preservation We conduct a comprehensive quantitative evaluation against seven baseline attacks to demonstrate that MARKNULL and MARKNULL-A do not compromise the semantic and percep- tual fidelity of images. Table 3 shows that MARKNULL and MARKNULL-A demonstrate SOTA performance in maintain- ing image quality. MARKNULL achieves the highest CQS across all nine tested watermarking schemes, consistently out- performing existing methods such as UnMarker and NPA. In particular, for generative watermarking schemes like S and TR, MARKNULL achieves a CQS of 4.09 and 4.06, re- spectively, significantly surpassing the strongest baseline DA. These results indicate that MARKNULL effectively suppresses watermark signals while preserving image fidelity, whereas baseline latent-space adversarial attacks (e.g., NPA and Im- print) often induce visible artifacts or blurring, leading to de- graded perceptual quality. Figure 3 illustrates the performance distributions across individual quality metrics. The results show that MARKNULL and MARKNULL-A perform con- sistently well across both pixel-level metrics (PSNR, SSIM) and perceptual metrics (LPIPS, FID). Additional qualitative comparisons of attacked images are provided in Section D. Takeaway 1: Prior adversarial attacks suffer from an inherent fidelity–removal trade-off. MARKNULL effec- tively breaks this dilemma. By explicitly minimizing NLAS to decorrelate watermark signals from semantic content, it achieves near-perfect removal performance while maintaining SOTA perceptual quality. (a) Legend LPIPS PSNR FIDSSIM BRISQUE (b) DwtDct LPIPS PSNR FIDSSIM BRISQUE (c) RivaGan LPIPS PSNR FIDSSIM BRISQUE (d) HiDDeN LPIPS PSNR FIDSSIM BRISQUE (e) StableSignature LPIPS PSNR FIDSSIM BRISQUE (f) VINE LPIPS PSNR FIDSSIM BRISQUE (g) SleeperMark LPIPS PSNR FIDSSIM BRISQUE (h) GS LPIPS PSNR FIDSSIM BRISQUE (i) PRC LPIPS PSNR FIDSSIM BRISQUE (j) TR Figure 3: Quantitative comparison of image quality metrics. For visualization, we normalize all metrics and orient them so that larger values consistently indicate better quality (i.e., lower-is-better metrics are inverted). 7.2.3 Attack Efficiency Assessment We evaluate the practical deployability of our attacks by mea- suring attack latency (seconds per image) and GPU memory consumption (VRAM in MB) on a single NVIDIA A100 GPU. As shown in Figure 4, existing optimization-based adversarial attacks (Imprint, UnMarker, and NPA) exhibit substantial computational costs. In particular, UnMarker re- quires over 700 seconds per image, and NPA takes 33.8 sec- onds, making both unsuitable for large-scale deployment. In contrast, our proposed MARKNULL-A achieves significantly improved efficiency, requiring only 0.50 seconds per image, which is orders of magnitude faster than all optimization- based baselines. In terms of memory usage, MARKNULL-A consumes 6,282 MB of VRAM, comparable to CtrlRegen+ (6,532 MB) and lower than high-resource methods such as UnMarker (14,378 MB). Although MARKNULL is more com- putationally intensive due to iterative optimization, its VRAM usage remains below 10 GB, suggesting its potential compati- bility with consumer GPUs. VADACtrlRegen+NFPAImprintUnMarkerNPAMarkNullMarkNull-A 10 0 10 1 10 2 10 3 Attack Speed (s/img) [Log Scale] 0.18 0.72 6.9 1.2 44.7 729.3 33.8 8.0 0.50 TimeGPU | MarkNullMarkNull-A Baselines 0 2000 4000 6000 8000 10000 12000 14000 16000 18000 GPU Memory Usage (MB) 4766 9178 6532 6820 9986 14378 13952 9908 6282 Figure 4: Comparison of attack speed and GPU memory usage across nine watermark removal methods. Takeaway 2: Existing attacks incur prohibitive computa- tional overhead. MARKNULL-A addresses this by replac- ing iterative DDIM inversions with a single feed-forward pass, achieving real-time inference at low VRAM con- sumption. These results demonstrate that effective wa- termark removal requires no costly iterative refinement, enabling scalable deployment on consumer hardware. 7.3 Breaking Google’s SynthID-Image SynthID-Image [7] is a post-hoc, model-agnostic watermark- ing scheme designed for large-scale provenance verification of AI-generated images. It employs a learned encoder–detector pair to embed and detect imperceptible watermarks, and has been deployed across Google AI systems 1 . We evaluate our MARKNULL, MARKNULL-A, and baselines on the com- mercial SynthID-Image watermarking system using 20 AI- generated images produced by Imagen-3 with prompts from the SDP dataset [9]. After applying each attack, we assess wa- termark detectability and image fidelity, with results reported in Table 4. Since the official detection code of SynthID-Image is not publicly available, we follow Google’s Gemini (fast mode) verification procedure for watermark detection 2 . Table 4 reveals the critical security vulnerabilities of SynthID-Image. Our work is the first study to explore the robustness of a commercial AI-generated image watermark- ing system against removal attacks. While SynthID-Image exhibits robustness against VA, it suffers a catastrophic failure when subjected to advanced attacks. We attribute this fragility to the limitations of its post-hoc embedding scheme, which 1 https://deepmind.google/models/synthid/ 2 https://support.google.com/gemini/answer/16722517?hl=e n-SG&co=GENIE.Platform%3DAndroid Table 4: Attack evaluation against SynthID-Image. AttackASR[%]CQS VA04.07 DA1003.66 CtrlRegen+1003.29 NFPA1001.21 Imprint1003.21 UnMarker1002.86 NPA1003.45 MARKNULL1003.87 MARKNULL-A1003.70 LPIPS PSNR FIDSSIM BRISQUE VA DA CtrlRegen NFPA Imprint UnMarker NPA MarkNull MarkNull-A Figure 5: Image-quality metrics for SynthID-Image across different attack baselines and our methods. proves insufficient against latent-space manipulations. How- ever, among all methods achieving a 100% ASR, MARKNULL reaches the highest CQS, as illustrated in Figure 5. Further- more, the results for MARKNULL reported above are obtained using the default high-perturbation configuration described in Section B.1. For post-hoc watermarks, a milder configuration (e.g.,ε = 1,N = 10, andκ = 0.01) is sufficient to achieve a 100% ASR while preserving high perceptual quality (LPIPS: 0.12, FID: 38.19, PSNR: 25.36, SSIM: 0.80, and BRISQUE: 6.11). 7.4 Breaking AI-generated Video Watermark- ing To evaluate the scalability of our proposed attacks beyond static images, we extend our evaluation to emerging video watermarking frameworks: VideoShield [12] and Video- Mark [13]. VideoShield embeds watermarks by mapping bits into the initial noise of the diffusion process and uses DDIM inversion for watermark extraction. Similarly, VideoMark en- codes watermarks into the initial noise with PRC codes on a per-frame basis and introduces a temporal matching module to enhance robustness against temporal distortions. Our evaluation is conducted using the damo-vilab/text-to- video-ms-1.7b 3 text-to-video model. We randomly select 20 prompts from the test set of VBench [15], and generate 16- frame videos at a resolution of256× 256using 25 inference steps. For baseline video watermarking attacks, we adapt ex- isting image-based watermark removal methods by applying them independently to each video frame, and then evaluate the resulting video quality based on the processed frames. Fol- lowing [29], we use MUSIQ [17] as a no-reference perceptual quality metric, averaging frame-level scores to assess overall video quality. As detailed in Table 5, video watermarking schemes ex- hibit strong robustness: baseline attacks such as VA and DA fail to disrupt initial-noise-based watermarking, retaining BA above 90%. In contrast, MARKNULL exhibits superior trans- ferability, successfully suppressing BA to approximately 50%. MARKNULL-A achieves an optimal trade-off, attaining the highest video quality (MUSIQ> 0.6) among successful at- tacks while effectively compromising watermark verification. Although NFPA and NPA reduce VideoMark’s BA to very low values (24.26% and 17.26%), this does not indicate su- perior watermark removal. For multi-bit watermarking, BA values significantly below the 50% random-guessing baseline reflect bit inversion rather than erasure: the watermark signal remains present but becomes negatively correlated, allowing defenders to recover the original message by simply flipping the decoded bits (e.g.,∼ 83% effective recovery for NPA). Table 5: Attack evaluation against video watermarking. Attack VideoShieldVideoMark BA[%]MUSIQBA[%]MUSIQ No Attack1000.661000.62 VA99.950.5993.810.55 DA97.310.6166.060.59 CtrlRegen+91.200.5956.800.57 NFPA56.930.6524.260.59 Imprint57.740.6452.790.61 UnMarker80.790.4280.740.48 NPA82.710.4717.260.44 MARKNULL47.120.5750.300.55 MARKNULL-A76.460.6549.480.61 Takeaway 3: MARKNULL and MARKNULL-A demon- strate unprecedented scalability across the broadest range of watermarking paradigms, achieving a 100% ASR against Google’s SynthID-Image and generalizing seamlessly to video watermarking (VideoShield, Video- Mark) without modality-specific adaptation. This con- firms their truly model-agnostic nature, establishing a novel benchmark for universal watermark robustness evaluation. 3 https://huggingface.co/ali-vilab/text-to-video-ms-1.7b Algorithm 3: Watermark Removal Attack Detection Input : Query image I Q , Target Model Θ, Detection Threshold τ dete , LPIPS Distance L LPIPS . Output : Binary decision: Attacked or Clean 1 // 1. Regeneration 2 z Q 0 = E(I Q ); 3 ˆz Q T = DDIM 0→T (z Q 0 ; U); 4 z Q,rec 0 = DDIM T→0 ( ˆz Q T ; U); 5 I rec Q = D(z Q,rec 0 ); 6 // 2. Error Calculation 7 S error ← L LPIPS (I Q , I rec Q ); 8 // 3. Attack Detection 9 if S error > τ dete then 10return Attacked 11 else 12return Clean; 8 Watermark Removal Defense In this section, we explore a potential defense strategy against advanced watermark removal attacks by leveraging the dis- tributional properties of LDMs. These models are trained to capture the high-probability distribution of natural images, effectively defining a low-dimensional generative manifold shaped by the model prior. Watermark removal attacks typically add a subtle yet un- natural pixel-space perturbation∆ A = I A − I w to suppress the watermark signal. Although such perturbations may be visu- ally imperceptible, they often violate the learned prior and push the sample off the generative manifold in a distributional sense. Motivated by the theoretical intuition of DiffPure [28], we perform Inversion→Regeneration for attack detection. As shown in Algorithm 3, given a query imageI Q , we perform a full DDIM inversion to obtainˆz Q T and reconstruct the image as I rec Q . For clean images that lie close to the natural image mani- fold, the inversion and regeneration process is approximately self-consistent, resulting in a small discrepancy between I rec Q andI Q . In contrast, whenI Q contains off-manifold adversar- ial perturbations in the pixel space, the diffusion prior tends to suppress these unnatural components during regeneration, leading to a noticeably larger reconstruction gap. To quantify this, we adopt the LPIPS reconstruction errorL LPIPS (I rec Q , I Q ) as the detection statistic. A query image is flagged as attacked if the LPIPS exceeds a predefined thresholdτ dete . This thresh- old is selected based on analyzing the empirical distribution of regeneration errors on a held-out validation set. To evaluate our defense, we formulate attack detection as a binary classification task between clean watermarked images and attacked watermark-removed images. We use the reconstruction error, measured by the LPIPS distance S error , as the detection statistic. The decision thresholdτ dete is selected via the Youden Index by sweeping observed scores to construct the Receiver Operating Characteristic (ROC) curve: FPR(τ dete ) = P(S error > τ dete | Clean), TPR(τ dete ) = P(S error > τ dete | Attacked). (20) The optimal threshold is then given by: τ ∗ dete = argmax τ dete (TPR(τ dete )− FPR(τ dete )),(21) yielding a balance between detection sensitivity and false alarms without using arbitrary error margins. As shown in Figures 6 and 7, attacked images generally exhibit higher LPIPS reconstruction errors than clean water- marked images under both MARKNULL and MARKNULL- A. This separation supports our hypothesis that adversarial perturbations introduce deviations that are amplified during DDIM inversion and regeneration, making reconstruction er- ror a useful forensic signal. The resulting detector achieves promising performance, particularly for in-generation water- marking schemes. For example, it achieves a TPR above 90% for SleeperMark while maintaining a low FPR, indicating clear separation between clean and attacked samples. Nevertheless, partial distribution overlap persists under stealthy attacks such as MARKNULL-A, making consistent detection challenging. This validates the imperceptibility of our attacks and highlights the need for more robust forensic defenses in future work. (a) DwtDct, TPR=0.830, FPR=0.670(b) RivaGan, TPR=0.780, FPR=0.290(c) HiDDeN, TPR=0.590, FPR=0.160 (d) S, TPR=0.860, FPR=0.130(f) SleeperMark, TPR=0.890, FPR=0.060(e) VINE, TPR=0.800, FPR=0.190 (g) GS, TPR=0.940, FPR=0.150(h) PRC, TPR=0.830, FPR=0.130(i) TR, TPR=0.740, FPR=0.110 Figure 6: Comparison of LPIPS reconstruction error distri- butions and detection thresholds under MARKNULL (water- marked vs. watermark-removed). (a) DwtDct, TPR=0.000, FPR=0.000(b) RivaGan, TPR=0.300, FPR=0.220(c) HiDDeN, TPR=0.450, FPR=0.160 (d) S, TPR=0.870, FPR=0.420(f) SleeperMark, TPR=0.970, FPR=0.080(e) VINE, TPR=0.900, FPR=0.540 (g) GS, TPR=0.810, FPR=0.210(h) PRC, TPR=0.910, FPR=0.380(i) TR, TPR=0.940, FPR=0.400 Figure 7: Comparison of LPIPS reconstruction error distribu- tions and detection thresholds under MARKNULL-A (water- marked vs. watermark removed). 9 Conclusion In this paper, we have proposed MARKNULL and its amor- tized variant, MARKNULL-A, which together form a model- agnostic watermark removal attack framework that funda- mentally overcomes the fidelity–removal trade-off and com- putational bottlenecks inherent in prior work. Specifically, MARKNULL leverages NLAS to guide an optimization pro- cess that provably decorrelates watermark signals from the initial noise via on-manifold latent manipulation, reducing the BA to 53.14%, approaching the 50% random-guessing baseline in watermark verification, while preserving seman- tic and perceptual fidelity. To support scalable deployment, MARKNULL-A distills the optimization objective into a learn- able WRN, achieving fast inference speeds of 0.50 s/im- age while maintaining strong removal effectiveness. Ex- tensive evaluations demonstrate that both MARKNULL and MARKNULL-A effectively remove watermarks across all ma- jor watermarking paradigms, and successfully compromise Google’s SynthID-Image (100% ASR), as well as emerg- ing video watermarking schemes. This attack framework, together with the proposed defense, serves as a rigorous red- teaming benchmark, encouraging the community to move beyond simplistic initial-noise-based watermarking and to- ward next-generation provenance tracking mechanisms that are robust to latent-space manipulation. Acknowledgments We are grateful to our shepherd and anonymous reviewers for their valuable guidance and insightful comments. This research was supported by the Natural Sciences and Engineer- ing Research Council of Canada Discovery Grant, the Canada Research Chair Program, National Cybersecurity Consortium R&D Program, and the NVIDIA Academic Grant Program using A100 GPU-hours. Ethical Considerations This paper investigates the robustness limitations of AI- generated image watermarking by proposing MARKNULL and MARKNULL-A, which remove watermarks through on- manifold latent manipulation under a no-box, model-agnostic threat model. Our goal is to advance rigorous watermark se- curity evaluation and drive the development of more resilient provenance mechanisms, not to facilitate misuse. Potential misuse. Watermark removal techniques can be mis- used to evade provenance tracking, undermine copyright attri- bution, and facilitate AI-generated misinformation. The risk is amplified by our attacks’ model-agnostic nature, requiring no watermark information or detector access. Risk mitigation. We take several steps to reduce misuse potential: (i) experiments are conducted on public datasets without private user data; (i) we describe methodology at the level necessary for reproducibility, avoiding deployment- oriented instructions that would lower the barrier to attacking production systems; and (i) we include a defensive counter- part, an attack detection mechanism to encourage balanced red-team and blue-team development. Vulnerability Disclosure. In line with standard security re- search ethics, we will disclose our findings to Google’s se- curity team regarding SynthID-Image robustness issues. Our evaluation was conducted strictly within the official SynthID- Image API bounds, deliberately rate-limited, and explicitly designed to avoid any denial-of-service behavior. Broader impacts. Our work provides a stronger benchmark for evaluating watermark robustness and highlights that ro- bustness should not rely solely on pixel-domain representa- tions when latent-space manipulation is feasible. We acknowl- edge disclosure risks, but believe transparent evaluation of failure modes, accompanied by effective defenses, is essential for the responsible deployment of generative models. Open Science All source code, trained WRN weights, and test samples are publicly available on Zenodo:https://doi.org/10.5281/ zenodo.20201878 , accompanied by a detailed step-by-step README.md. Since all models and watermarking schemes eval- uated in this paper are publicly released, our artifacts provide a complete basis for reproducing the main experimental re- sults. We fully support open science and release these artifacts to facilitate reproducibility and foster further research. References [1] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. WAVES: benchmarking the robustness of image watermarks. In Proc. ICML, 2024. [2]Jie Cao, Qi Li, Zelin Zhang, Jianbing Ni, and Rongxing Lu. Secure and robust watermarking for ai-generated images: A comprehensive survey.arXiv preprint arXiv:2510.02384, 2025. [3]Jie Cao, Zelin Zhang, Qi Li, and Jianbing Ni. Mark- sweep: A no-box removal attack on ai-generated image watermarking via noise intensification and frequency- aware denoising. In Proc. ICASSP, pages 13932–13936. IEEE, 2026. [4]Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proc. ICCV, pages 22409–22420, 2023. [5]Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In Proc. ICASSP, pages 3054–3058, 2022. [6]Nir Goren, Oren Katzir, Abhinav Nakarmi, Eyal Ro- nen, Mahmood Sharif, and Or Patashnik. Noiseprints: Distortion-free watermarks for authorship in private dif- fusion models. CoRR, abs/2510.13793, 2025. [7]Sven Gowal, Rudy Bunel, Florian Stimberg, David Stutz, Guillermo Ortiz-Jimenez, Christina Kouridi, Mel Vecerik, Jamie Hayes, Sylvestre-Alvise Rebuffi, Paul Bernard, et al. Synthid-image: Image watermarking at internet scale. arXiv preprint arXiv:2510.09263, 2025. [8]Sam Gunn, Xuandong Zhao, and Dawn Song. An un- detectable watermark for generative image models. In Proc. ICLR, 2025. [9] Gustavosta. Stable-diffusion-prompts. Hugging Face Datasets repository, 2022. (accessed on Oct. 27, 2025). [10]Peter Holderrieth and Ezra Erives.An introduc- tion to flow matching and diffusion models. CoRR, abs/2506.02070, 2025. [11]Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hye- won Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proc. CVPR, pages 7069–7078, 2024. [12] Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Videoshield: Regulating diffusion-based video generation models via watermark- ing. In Proc. of ICLR, 2025. [13]Xuming Hu, Hanqian Li, Jungang Li, and Aiwei Liu. Videomark: A distortion-free robust watermark- ing framework for video diffusion models.CoRR, abs/2504.16359, 2025. [14] Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Zhenqiang Gong. A transfer attack to image water- marks. In Proc. ICLR, 2025. [15] Ziqi Huang, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Yuanhan Zhang, Tianxing Wu, Qingyang Jin, Nattapol Chanpaisit, et al. Vbench: Comprehensive benchmark suite for video generative models. In Proc. CVPR, pages 21807–21818, 2024. [16]Andre Kassis and Urs Hengartner. Unmarker: A univer- sal attack on defensive image watermarking. In Proc. IEEE S&P, pages 2602–2620, 2025. [17] Junjie Ke, Qifei Wang, Yilin Wang, Peyman Milanfar, and Feng Yang. MUSIQ: multi-scale image quality transformer. In Proc. of CVPR, pages 5128–5137, 2021. [18]Mohammad Ibrahim Khan, Md. Maklachur Rahman, and Md. Iqbal Hasan Sarker. Digital watermarking for image authenticationbased on combined dct, DWT and SVD transformation. CoRR, abs/1307.6328, 2013. [19] Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. WOUAF: weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proc. CVPR, pages 8974–8983, 2024. [20]De Zhang Lee, Han Fang, Hanyi Wang, and Ee-Chien Chang. Removal attack and defense on ai-generated content latent-based watermarking. In Proc. CCS, pages 2174–2188, 2025. [21]Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image wa- termarks are removable using controllable regeneration from clean noise. In Proc. ICLR, 2025. [22]Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongx- uan Li, and Jun Zhu.Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. Mach. Intell. Res., 22(4):730–751, 2025. [23]Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From bench- marking to advances. In Proc. ICLR, 2025. [24]Anish Mittal, Anush Krishna Moorthy, and Alan Con- rad Bovik. No-reference image quality assessment in the spatial domain. IEEE Trans. Image Process., 21(12):4695–4708, 2012. [25]Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In Proc. CVPR, pages 6038–6047. IEEE, 2023. [26]Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. In Proc. CVPR, pages 20937–20946, 2025. [27] KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. DWT-DCT-SVD based watermarking. In Proc. COMSWARE, pages 271– 274. IEEE, 2008. [28] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In Proc. ICML, volume 162, pages 16805–16827, 2022. [29]Leyi Pan, Sheng Guan, Zheyu Fu, Luyang Si, Huan Wang, Zian Wang, Hanqian Li, Xuming Hu, Irwin King, Philip S Yu, et al. Markdiffusion: An open-source toolkit for generative watermarking of latent diffusion models. arXiv preprint arXiv:2509.10569, 2025. [30]Huming Qiu, Zhaoxiang Wang, Mi Zhang, Xiaohan Zhang, Xiaoyu You, and Min Yang. The future un- marked: Watermark removal in ai-generated images via next-frame prediction. In Proc. NeurIPS, 2025. [31]Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proc. CVPR, pages 10674–10685, 2022. [32]Jiaming Song, Chenlin Meng, and Stefano Ermon. De- noising diffusion implicit models. In Proc. ICLR, 2021. [33]Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score- based generative modeling through stochastic differen- tial equations. In Proc. ICLR, 2021. [34]Stability AI. Stable diffusion 2.1 base. Hugging Face model repository, 2022. [35]Stability AI. Stable diffusion xl base 1.0. Hugging Face model repository, 2023. [36]stable-diffusion-v1-5 (community). Stable diffusion v1-5. Hugging Face model repository, 2024. [37]Ron G. van Schyndel, Andrew Z. Tirkel, and Charles F. Osborne. A digital watermark. In Proc. ICIP, pages 86–90, 1994. [38]Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226–247, 2022. [39]Zilan Wang, Junfeng Guo, Jiacheng Zhu, Yiming Li, Heng Huang, Muhao Chen, and Zhengzhong Tu. Sleep- ermark: Towards robust watermark against fine-tuning text-to-image diffusion models. In Proc. CVPR, pages 8213–8224, 2025. [40]Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Proc. NeurIPS, 2023. [41]Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proc. M, pages 1668–1676. ACM, 2023. [42]Jindong Yang, Han Fang, Weiming Zhang, Nenghai Yu, and Kejiang Chen. T2smark: Balancing robustness and diversity in noise-as-watermark for diffusion models. Proc. NeurIPS, 38:118642–118668, 2026. [43] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weim- ing Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proc. CVPR, pages 12162–12171, 2024. [44]Syed Waqas Zamir, Aditya Arora, Salman Khan, Mu- nawar Hayat, Fahad Shahbaz Khan, and Ming-Hsuan Yang.Restormer: Efficient transformer for high- resolution image restoration. In Proc. CVPR, pages 5718–5729, 2022. [45]Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video water- marking with attention. CoRR, abs/1909.01285, 2019. [46]Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proc. CVPR, pages 586–595, 2018. [47] Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andrés Fábrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramèr, Somesh Jha, Lei Li, Yu-Xiang Wang, and Dawn Song. Sok: Wa- termarking for ai-generated content. In Proc. IEEE S&P, pages 2621–2639, 2025. [48] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative AI. In Proc. NeurIPS, 2024. [49]Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei- Fei. Hidden: Hiding data with deep networks. In Proc. ECCV, volume 11219, pages 682–697, 2018. A Noise-Latent Alignment Score To evaluate the correlation within the latent space, we com- puted the NLAS for the optimized pairs(z 0 , z T )against the randomly initialized(z 0 , z rand ), wherez rand ∼ N (0,I). As shown in Figure 8, the NLAS betweenz 0 and its correspond- ing initial noisez T is markedly higher than that between z 0 and a randomly initialized latentz rand . Specifically, the (z 0 , z T )pairs exhibit consistently elevated NLAS values with a stable median and interquartile range, whereas the NLAS of(z 0 , z rand )concentrates near zero with negligible variance across samples. These observations indicate that NLAS ef- fectively captures the structured dependence between cor- responding latents along the same generation/inversion tra- jectory, while such dependence is absent when pairingz 0 with independent Gaussian noise. This distinct separation un- derscores the utility of NLAS as a discriminative metric for identifying true latent correspondences. Figure 8: NLAS distributions for matched(z 0 , z T )and random (z 0 , z rand ) pairs. B Proposed Attack Details B.1MARKNULL We set the loss weights in Eq. (11) toλ 1 = 1,λ 2 = 20, λ 3 = 1.5, andλ 4 = 3. The adversarial latent variablez (adv) 0 is optimized using the Adam optimizer with a learning rate κ = 0.05. To ensure the imperceptibility of adversarial per- turbations, we impose a distortion budget ofε = 1. The op- timization is performed overN = 50gradient descent steps, obtaining a balance between attack effectiveness and compu- tational efficiency. To investigate the impact of different learning rates and optimization steps on MARKNULL’s attack effectiveness and image quality, we conduct two controlled experiments. In the first setting, we fix the learning rate at κ = 0.05 and vary the number of gradient stepsN∈5, 10, 25, 50, 100. In the second setting, we fix the number of steps atN = 50and vary the learning rateκ∈0.001, 0.01, 0.05, 0.1, 0.2, 0.5. These experiments facilitate a systematic analysis of the trade-off between attack strength and perceptual fidelity under different optimization parameter settings. Experimental results are shown in Figure 9 and Figure 10. These results reveal a clear trade-off between attack strength and perceptual fidelity. When varying the number of gra- dient stepsN(see Figure 9), increasingNfrom 5 to 25 leads to notable gains in attack success (lower BA and TPR@1%FPR), accompanied by increased perceptual devia- tion (higher LPIPS). However, beyondN≥ 50, improvements become marginal: LPIPS plateaus or even slightly decreases, suggesting that once the optimization nears convergence, ad- ditional iterations do not further degrade image quality and refine perturbations along more natural directions under the model prior. Correspondingly, the attack strength converges and becomes relatively stable forNin the range of approxi- mately25to50, indicating diminishing returns from further optimization steps. (a) LPIPS(b) BA or TPR@1%FPR Figure 9: Effect of optimization steps (N) on attack strength and perceptual fidelity. (a) LPIPS(b) BA or TPR@1%FPR Figure 10: Effect of learning rate (κ) on attack strength and perceptual fidelity. A similar trend emerges when adjusting the learning rate κwith a fixed step count (see Figure 10). Moderate learning rates often induce the most perceptual change, while larger κvalues lead to more stable solutions with comparable or improved attack performance. Sensitivity toκvaries across watermarking schemes: some methods achieve significant BA reductions at moderateκ, while others require higherκto at- tain similar effectiveness. It is important to note that BA is not strictly “the lower, the better." An excessively low BA often indicates that the attack drives the watermark detector’s ex- traction toward the bitwise complementw, rather than erasing the watermark signal. In this case, the detector may still con- fidently report a watermark (e.g., SleeperMark in Fig. 10b). Therefore, for bit-string watermark removal, the most desir- able outcome is a BA close to 50%, implying that the extracted bit string is indistinguishable from random guessing and the watermark detectability is effectively neutralized. Overall, these findings suggest that a moderate number of optimization steps (N = 50) combined with a properly tuned learning rate (κ = 0.05), as used in Section 7.2, provides a favorable trade-off, achieving strong watermark removal with minimal perceptual degradation. B.2MARKNULL-A The WRN in MARKNULL-A adopts a hierarchical U-Net architecture based on Restormer [44] 4 , featuring a four-level encoder-decoder with symmetric skip connections. Each block integrates MDTA for global context modeling and GDFN for local feature refinement. The encoder and decoder employ pixel-unshuffle and pixel-shuffle for downsampling and upsampling, respectively, with1× 1convolutions for fea- ture fusion. The network concludes with a refinement stage followed by a convolutional layer that predicts the residual image for high-fidelity restoration. We setλ 5 = 1,λ 6 = 20, λ 7 = 1andλ 8 = 4in Eq. (12). The WRN is optimized for 100 epochs with a batch size of 7 using the Adam optimizer. The initial learning rate is set to1× 10 −3 . A learning rate scheduler is applied, consisting of a linear warm-up during the first 10% of the training epochs, followed by a cosine decay that gradually reduces the learning rate to1× 10 −6 . The training set for the WRN consists of 2,000 images at a resolution of512× 512, generated by the proxy model SD1.5 using 2,000 randomly sampled prompts from the SDP dataset. We train the WRN on randomly cropped image patches of size 256× 256. C Attack Effectiveness Metrics C.1 Watermark Detection The watermark length of each evaluated scheme is summa- rized in Table 6. Letw∈0, 1 k be the embeddedk-bit wa- termark andˆw∈0, 1 k the bit string extracted from a query image. Detection is performed by comparingˆwwithwus- ing the matching countM, defined as the complement of the Hamming distance: M(w, ˆw) = k ∑ i=1 I[w i = ˆw i ],(22) whereI[·]is the indicator function. A watermark is detected if the number of matches exceeds a predetermined threshold τ, i.e., M(w, ˆw) > τ. Formally, the detection is formulated as a hypothesis test- ing. Under the null hypothesisH 0 , the image does not contain 4 https://github.com/leftthomas/Restormer. the target watermarkw, and the extracted bitsˆw = ˆw i k i=1 are modeled as i.i.d. Bernoulli variables. The False Positive Rate (FPR) can be defined as: P(M(w, ˆw) > τ| H 0 ) = 1 2 k k ∑ i=τ+1 k i = I 1/2 (τ+ 1, k− τ), (23) which follows the tail probability of a binomial distribution and admits a closed-form expression via the regularized in- complete beta function I p (a, b). The i.i.d. assumption and binomial detection model have been empirically validated in prior works [4,23]. Bit Accuracy (BA) is commonly used to measure watermark detectability and is defined as BA = M(w, ˆw)/k. Table 6: Watermark length and detection threshold of the evaluated methods. MethodLen. (bits)BA Thres. τ/k [%]FPR DwtDct48690.01 RivaGan32750.01 HiDDeN48690.01 S48690.01 VINE96620.01 SleeperMark48690.01 GS2566510 −6 PRC5126010 −5 TR0-0.01 VideoShield5126010 −5 VideoMark32750.01 C.2 CQS Image Quality Metric To provide a holistic assessment of the recovered image qual- ity, we propose the CQS in Section 7.1, which aggregates heterogeneous metrics (i.e., PSNR, SSIM, LPIPS, FID, and BRISQUE) into a unified score. The calculation is: CQS = ∑ m S m , S m =        v m − v min m v max m − v min m , m∈PSNR, SSIM, v max m − v m v max m − v min m , m∈LPIPS, FID, BRISQUE, (24) wherev m denotes the value of metricmandv min m , v max m are its min/max over the compared methods, yielding a per-metric score S m ∈ [0, 1] and an aggregate CQS∈ [0, 5]. D Qualitative Comparison Figure 11 qualitatively demonstrates the perceptual superior- ity of MARKNULL and MARKNULL-A over existing base- lines. Our attacks produce images that are nearly indistin- guishable from the originals. In the video domain, they fur- ther maintain temporal consistency without noticeable inter- frame flickering (Figure 12). This high fidelity arises from on-manifold latent manipulation, which introduces structured, semantically coherent perturbations. E Discussion E.1 Generalization Across Image Resolutions We discuss whether MARKNULL and MARKNULL-A can generalize across image resolutions. Although the main experiments are conducted at512× 512, the proposed at- tacks are not inherently resolution-specific. This is because MARKNULL operates in the latent space of latent diffusion models rather than directly in the pixel space. When the im- age resolution changes, the VAE encoder maps the image into a latent tensor with proportionally scaled spatial dimensions. The NLAS measures the normalized angular dependency be- tweenz 0 andz T , and thus does not rely on a fixed image size. Therefore, the same formulation can be directly applied to images of different resolutions. MARKNULL-A’s Restormer is also resolution-agnostic. As shown in Table 7, both MARKNULL and MARKNULL- A remain effective across different image sizes, reducing BA toward the random-guessing level while maintaining low LPIPS for representative schemes, including PRC [8] and S [4]. This suggests that the attacks are not overfitted to the default512× 512setting. We note that higher resolutions may increase the computational cost of iterative optimization for MARKNULL and may introduce mild distribution shifts for MARKNULL-A when the training and testing resolutions differ substantially. However, these factors mainly affect effi- ciency or small performance variations, rather than the valid- ity of the attack itself. Overall, the designs of MARKNULL and MARKNULL-A provide favorable generalization across image resolutions. Table 7:Size generalization of MARKNULL and MARKNULL-A under three image resolutions ResolutionMethod MARKNULLMARKNULL-A BA [%]LPIPSBA [%]LPIPS 128× 128 PRC51.560.2849.240.31 S38.090.2346.200.29 256× 256 PRC50.040.2449.530.25 S43.360.1946.160.21 768× 768 PRC49.400.2049.000.23 S50.520.1446.680.23 E.2Transferability Across Diverse Backbones We further examine whether MARKNULL can transfer across different generative backbones. In the main experiments, we consider SD models as both the proxy and target backbones. A natural question is whether the attack remains effective when the proxy model is no longer from the SD family, while the target model is still SD-based. To answer this question, we evaluate FLUX.1-dev 5 as the proxy model against SD2.1 as the target model. This setting introduces a substantial architectural divergence be- tween the proxy and target models, making it more challeng- ing than transfer within the same SD family. Nevertheless, MARKNULL remains effective under this setting, reducing BA to 56.95% for GS, 52.65% for PRC, and 46.67% for S. These results show that MARKNULL does not rely on a proxy model with the same architecture as the target model, and can transfer even when the proxy and target are built upon different generative backbones. We acknowledge that cross- backbone transfer incurs a non-negligible fidelity cost. Using FLUX.1-dev as the proxy widens the proxy-target distribution gap relative to SD-family proxies, revealing a transferabil- ity–fidelity trade-off: MARKNULL remains effective across heterogeneous backbones, but stronger architectural mismatch can introduce more visible image changes. This transferability stems from the fact that MARKNULL does not exploit model-specific implementation details. In- stead, it suppresses watermark-related statistical dependencies through latent-space manipulation. Therefore, as long as the proxy model provides a generative prior that supports realistic image reconstruction and latent perturbation, the optimized perturbation can still generalize to the target watermarking pipeline. The FLUX.1-dev-to-SD2.1 results further confirm that MARKNULL captures a transferable vulnerability of cur- rent watermarking schemes, rather than overfitting to a partic- ular SD backbone. F Watermarking Baselines Configuration • DwtDct [27]: DwtDct is a traditional post-hoc water- marking method that embeds signals in the frequency domain combining DWT and DCT. We implement it via the invisible-watermark Python library 6 . • RivaGan [45]: RivaGAN is an encoder–decoder-based watermarking method proposed for video watermark- ing, which can be naturally extended to robust image watermarking. It employs an attention-based encoder- decoder to embed arbitrary payloads while maintain- ing visual fidelity. Its dual-discriminator design jointly enforces perceptual quality and watermark robustness 5 https://huggingface.co/black-forest-labs/FLUX.1-dev 6 https://github.com/ShieldMnt/invisible-watermark VA DA CtrlRegen+ NFPA Imprint UnMarker NPA MarkNull MarkNull-A DwtDct No Attack RivaGanHiDDeNSSVINESleeperMarkGSPRCTreeRing SynthID-Image Figure 11: Qualitative examples of different attacks against baselines for watermark removal. through adversarial training. We implement it via the invisible-watermark Python library 7 . •HiDDeN [49]: HiDDeN is an end-to-end trainable scheme for image watermarking, combining an encoder, decoder, and adversarial discriminator. It jointly opti- mizes imperceptibility, robustness, and payload capacity by minimizing reconstruction loss and adversarial de- tectability. To enhance robustness, it simulates differen- tiable distortions (e.g., blurring, cropping, JPEG) during training. In our implementation, we use the code and the pretrained model published in 8 . • StableSignature (S) [4]: S is an in-generation wa- 7 https://github.com/ShieldMnt/invisible-watermark 8 https://github.com/facebookresearch/stable_signature/t ree/main/hidden termarking method that embeds the watermark directly during the image synthesis process. It adopts the HiD- DeN [49] decoder as the watermark extractor and fine- tunes the VAE decoder of the LDM to ensure that the watermark remains decodable from the generated out- puts. In our implementation, we follow the official code and utilize the pretrained model provided by the original authors 9 . •VINE [23]: VINE leverages a pretrained one-step diffu- sion model, SDXL-Turbo, as the watermark encoder. It employs a condition adaptor to fuse the watermark with the input image and introduces zero-convolution lay- ers with skip connections to the VAE to ensure that the embedded watermark is both imperceptible and robust 9 https://github.com/facebookresearch/stable_signature VA DA CtrlRegen+ NFPA Imprint UnMarker NPA MarkNull No Attack MarkNull-A VideoMarkVideoShield Figure 12: Qualitative examples of different attacks against VideoShield and VideoMark. against advanced image editing. In our implementation, we follow the official code and utilize the pretrained model provided by the original authors 10 . •SleeperMark [39]: SleeperMark is designed to protect the copyright of T2I LDMs against unauthorized down- stream fine-tuning. It injects a message-embedding back- door into the diffusion backbone that is activated by a specific text trigger. For LDMs, the watermark is ex- tracted from the latent space to achieve inherent robust- ness against image distortions with minimal perceptual impact. In our implementation, we follow the official code and utilize the pretrained model provided by the original authors 11 . •Gaussian Shading (GS) [43]: GS is an initial-noised wa- termarking method that embeds ak-bit message by con- trolling the initial latent noise via distribution-preserving 10 https://github.com/Shilin-LU/VINE 11 https://github.com/taco-group/SleeperMark sampling. It first diffuses the binary watermark and then encrypts it with a stream key into a uniformly random bitstream, enabling the randomized watermark to drive a sampling procedure that produces a watermarked initial latent noisez w T while preserving the standard Gaussian prior. The model then follows the standard denoising pipeline to obtain the final watermarked image. For ex- traction, the suspect image is encoded back to the latent space, and DDIM inversion is used to estimate the cor- respondingz w T ; the inverse sampling map recovers the encrypted bitstream, which is then decrypted and inverse- diffused, and a majority vote over replicated copies re- constructs the final watermark sequence. In our imple- mentation, we follow the official code provided by the original authors 12 . •PRC [8]: PRC is an initial-noise-based watermarking scheme for diffusion models that embeds a secret key 12 https://github.com/bsmhmmlf/Gaussian-Shading directly into the sign pattern of the initial noise to ensure undetectability. It generates a pseudorandom codeword and flips the signs of the sampled Gaussian vector to match this codeword while preserving the magnitude, thereby maintaining the marginal distribution of the la- tent. In our implementation, we follow the official code provided by the original authors 13 . •TreeRing [40]: TreeRing is the earliest initial-noise- based diffusion watermarking method, but it only sup- ports zero-bit verification. Instead of encoding a binary watermark, TreeRing embeds a fixed ring watermark by modifying the initial noise with a predefined pattern. Dur- ing verification, the suspect image is inverted via DDIM inversion to recover the corresponding initial noise, and the presence of the ring pattern is then tested in the re- covered noise space. In our implementation, we follow the official code provided by the original authors 14 . G Attack Baselines Configuration •Noise: Gaussian noise injection is a common additive distortion that perturbs watermark patterns by introduc- ing pixel-wise random fluctuations. In our implementa- tion, each image is first normalized to[0, 1], then i.i.d. Gaussian noise is added, wherestd=0.05controls the noise intensity. • Blur: Gaussian blur is a smoothing attack that degrades watermarks by attenuating high-frequency image com- ponents. This low-pass filtering suppresses fine textures and sharp edges, which can weaken watermark cues es- pecially those encoded in subtle spatial details. In our implementation, we applycv2.GaussianBlurto each input image with a kernel size of5× 5and Gaussian standard deviation σ = 1. •Contrast: Contrast adjustment is a common photometric distortion that modifies the dynamic range of pixel inten- sities, thereby perturbing watermark cues while leaving the image geometry unchanged. In Table 2, we apply PIL.ImageEnhance.Contrastwith a contrast factor of 0.5, which reduces contrast by compressing intensity variations around the mean. • JPEG: JPEG compression is a widely used lossy post- processing operation, controlled by a quality parameter that determines the compression strength. Lower quality values induce stronger quantization and larger informa- tion loss, which can further impair watermark recover- ability. In Table 2, we apply JPEG compression with the quality factor set to 80. 13 https://github.com/XuandongZhao/PRC-Watermark 14 https://github.com/YuxinWenRick/tree-ring-watermark •Brightness: Brightness adjustment is a common pho- tometric distortion that perturbs watermark signals by uniformly scaling image luminance while largely pre- serving geometric structure. In our implementation, we usePIL.ImageEnhance.Brightnessto re-render each image with a brightness factor of 0.5, i.e., substantially darkening the image. •VA [1]: VA is a regeneration attack that removes watermarks by re-synthesizing the image through a VAE. Concretely, the watermarked image is first en- coded into a latent representation by a neural VAE en- coder and then decoded back to the pixel space by the corresponding neural decoder. In our experiment, we adoptcompressai.zoo.cheng2020_anchorto imple- ment VA following [48]. The compression factor governs the attack strength, where smaller values impose a tighter bottleneck and thus induce more aggressive distortion. In this paper, we set the compression factor to 3. •DA [48]: DA is a regeneration attack that removes wa- termarks by perturbing the watermarked image with a forward noising process and then reconstructing it via the reverse denoising trajectory. Using more noising steps injects stronger corruption, which typically yields a higher watermark removal rate at the cost of greater perceptual deviation. In our implementation, we follow the official code provided by the original authors 15 . In our experiment, we instantiate DA with SD1.5 and set the number of noise steps to 60. •CtrlRegen+[21]: CtrlRegen+is an adjustable water- mark removal method that leverages a controllable re- generation process to eliminate embedded signals. It proceeds by projecting the watermarked image into the latent space and introducing noise over a specified num- ber of steps to produce a noisy latent representation. Subsequently, it employs a controllable diffusion model to denoise and reconstruct the image, utilizing semantic and spatial features extracted from the original input to ensure high visual fidelity and consistency. In our imple- mentation, we follow the official code provided by the original authors 16 . •NFPA [30]: NFPA is a regeneration attack that removes watermarks by generating a new, semantically consistent image from the input via a next-frame prediction style diffusion process. It first encodes the input image into the latent representation and applies DDIM inversion to obtain an inverted Latent as the generation starting point. In our implementation, we follow the official code provided by the original authors 17 . 15 https://github.com/XuandongZhao/WatermarkAttacker 16 https://github.com/yepengliu/CtrlRegen 17 https://github.com/1249748036/NFPA/ •Imprint [26]: Imprint is a removal attack for initial-noise- based watermarking, operating with a proxy model. It first encodes the watermarked image into the proxy model’s latent space and applies inversion to recover an estimate of the corresponding initial noise. It then opti- mizes a small perturbation to the latent representation via gradient-based updates, with an objective that drives the re-inverted noise away from the original estimate. The attack budget is governed by the number of optimiza- tion iterations: using more steps typically strengthens watermark suppression, but may also amplify perceptual distortion and increase computational overhead. In our implementation, we follow the official code provided by the original authors 18 , use 50 optimization steps, and the proxy model is SD1.5. •UnMarker [16]: UnMarker is a universal black-box at- tack method without requiring detector feedback or spe- cific knowledge of the watermarking algorithm. It op- erates on the insight that robust watermarks inevitably modify spectral amplitudes, and thus employs two novel adversarial optimization strategies to specifically disrupt these spectral features, effectively erasing the watermark signals while preserving image quality. In our imple- mentation, we follow the official code provided by the original authors 19 and apply both adversarial strategies against all watermarking schemes. •NPA [6]: NoisePrints is a lightweight, distortion-free wa- termarking scheme originally. It also makes the simple observation that the initial noise can be highly corre- lated with the generated content. In the appendix of [6], the authors further introduce an attack, which we refer to as NPA. This attack uses a proxy model to compute the cosine similarity between the image and the recov- ered noise, and performs an iterative optimization that updates a small perturbation in the latent space. The ob- jective is to drive the adversarial latent representation away from the initial noise by minimizing its cosine sim- ilarity. Since the authors do not release official code, we implement the attack based on the paper description; in our setting, the number of optimization steps is set to 100. 18 https://github.com/and-mill/semantic-forgery 19 https://github.com/andrekassis/ai-watermark

Instant research discovery