Latent frequency masking weakens invisible watermarks in ai images
Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking
Computer Vision and Pattern RecognitionArtificial IntelligenceMultimedia
Summary
Invisible watermarks help track AI-generated images but can sometimes be removed by clever attacks. The authors found a new way to erase these watermarks by changing specific frequency parts inside the hidden data of an image. Their method can either use random noise or a more advanced technique to keep the image looking good while removing the watermark. They tested this attack on different watermark systems and showed it can often hide or remove the watermark without hurting the image's quality. This shows that image watermarking needs to be tested against this kind of frequency-based attack.
What this means in practice
- •For ai model security teams: Evaluate and improve watermarking methods by testing resistance to latent frequency masking attacks on generated images.
- •For digital forensics teams: Identify attempts to remove watermarks from AI-generated images by analyzing changes in latent frequency components.
Authors
Kirill Aistov, Khaled Abud, Irina Serzhenko, Egor Kovalev, Aleksey Yakushev, Aleksandr Akimenkov, Dmitry Obydenkov, Yury Markin, Sergey Lavrushkin, Dmitriy Vatolin, Anastasia Antsiferova
Abstract
Invisible watermarking has become a central tool for tracing AI-generated images, but its robustness against adaptive removal attacks remains an open security question. We introduce Latent Frequency Masking, an attack that erases watermark evidence by replacing selected Fourier coefficients in the latent representation of a watermarked image. The replacement can be sampled from Gaussian noise for efficiency or derived from diffusion regeneration for improved image preservation. We provide a theoretical distortion bound relating the change between the reconstructed adversarial image and the masked latent-frequency perturbation. We evaluate the proposed attack against six diffusion watermarking methods on images generated from DiffusionDB and MS-COCO prompts. Latent Frequency Masking removes or substantially weakens several watermarks while preserving perceptual quality and achieving favorable runtime compared with existing attacks. These results identify latent-frequency manipulation as a practical attack surface and highlight the need to include such attacks in robustness evaluations of generative image watermarking.