Improving image watermark removal without hurting picture quality
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Cryptography and SecurityArtificial Intelligence
Summary
People use digital watermarks to prove who created AI-generated images, but some try to remove these marks, which can leave behind faint, reversed watermarks. The authors present LiBRA, a method that hides watermarks more effectively without damaging the image quality. Instead of pushing the watermark in one direction, it gently adjusts the image so the watermark becomes undetectable. This approach also uses statistical tests to confirm that the watermark is truly removed.
What this means in practice
- •For image processing teams: Develop tools that remove digital watermarks from images while preserving visual quality using latent space optimization.
- •For security system developers: Enhance evaluation methods for watermark robustness by applying statistical testing to verify watermark removal success.
Authors
Saibo Ye, Huajie Chen, Xin Guo, Le Yang, Chi Liu, Xiangyu Hu, Jingjing Guo, Tianqing Zhu
Abstract
Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.