BrushOff attack removes invisible watermarks by repainting artworks
BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Painting
Computer Vision and Pattern RecognitionCryptography and Security
Summary
Paintings can have invisible marks hidden inside them to prove who owns them. The authors show that simply redrawing the painting with brush strokes, using a special stroke-based tool, can erase these hidden marks without knowing anything about them. This new method, called BrushOff, works better than other ways like AI image changes and keeps the new picture looking very close to the original. The study also shows that different types of hidden marks react differently to these attacks, so testing watermark durability needs multiple methods.
What this means in practice
- •For digital art platforms: Evaluate and improve watermarking methods to resist repainting attacks that remove ownership marks on digital paintings.
- •For image security teams: Develop better detection systems that consider different watermark vulnerabilities to repainting and AI-based image edits.
Authors
Hao Chen, Junnan Xu
Abstract
Invisible watermarks are used to mark who owns a painting. We show that a simple attack removes the most robust one we test. The attack redraws the watermarked painting with brush strokes, using a pretrained stroke-based renderer. We call this attack BrushOff. It needs no training, no knowledge of the watermark, and no generative model. We test four watermarks on 500 paintings from five styles. VINE, a recent watermark built to survive image editing, survives all 14 conventional distortions we test, with at least 97.8% detection. Repainting lowers its detection to 1.8%, while the output keeps a no-reference quality score close to that of the clean paintings. Diffusion regeneration can also remove VINE, but at the same removal level it moves the image twice as far from the painting in DreamSim distance, and it changes what the painting shows. Because the renderer draws a countable number of strokes, we can control the attack strength step by step. Finally, we test what kind of signal survives. A simple probe that stores bits in the relative brightness of neighboring regions survives repainting, while a probe that uses absolute brightness does not. The same probe fails under diffusion regeneration, while VINE fails under repainting. Robustness to these two attacks is therefore a separate property, and benchmarks should test both.