Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal
Authors: Yevin Nikhel Goonatilake, Giuseppe Ateniese
Summary
Removing a watermark from AI-generated images isn't enough if a forensic detector can still tell the image has been tampered with. The authors test six state-of-the-art watermark-removal attacks and show that independent forensic classifiers can distinguish removal-processed outputs from clean images at over 98% true-positive rate (1% FPR). Using UnMarker as a case study, they find removal leaves a characteristic spectral signature that persists under common post-processing and creates a three-way trade-off among watermark evasion, image quality, and forensic stealth. They argue removal benchmarks should measure all three, not just whether the watermark test fails.
Main takeaways:
- Current watermark removers evade the watermark detector but leave forensic traces: independent detectors achieve >98% TPR at 1% FPR distinguishing removal-processed from clean images.
- Removal introduces a detectable spectral deformation that survives common post-processing (JPEG compression, resizing, etc.).
- Three-way tension: removing the watermark, preserving image quality, and staying forensically indistinguishable from clean content are jointly hard to satisfy.
- Existing benchmarks are incomplete because they ignore forensic stealth — a successful remover must not just fool the verifier but also avoid leaving a different detectable signal.
Relevance
Tangential — conceptually related to my pretraining-backdoor and marker-implantation work in the sense that both involve hidden signals and detection/removal trade-offs, but watermarking is about images and provenance rather than behavioral triggers in language models.
Threat model
Potential threat/caveat for clean result "Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start (LOW confidence)": this item discusses benchmark.
Abstract
arXiv:2605.09203v1 Announce Type: new Abstract: Watermarks for AI-generated images are meant to support downstream decisions about provenance, manipulation, and trust. In the settings that motivate watermark removal, therefore, success means more than causing the watermark test to fail. A successful remover must also preserve the utility of the image and make the output forensically indistinguishable from clean content, so that defeating the verifier restores deniability rather than merely replacing one detection signal with another. We show that current watermark removal attacks fail this stronger objective. Across six state-of-the-art removers spanning four attack families, independent forensic detectors distinguish removal-processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget. Thus, current removers often replace the watermark with a different detectable signal. Using UnMarker (IEEE S&P 2025) as a detailed case study, we show that this signal persists under common post-processing, exhibits a characteristic two-regime spectral deformation, and yields a three-way tension among removal success, image quality, and forensic stealth. These results show that existing removal benchmarks are incomplete: they reward verifier evasion and utility preservation while omitting forensic stealth. A workable watermark remover must satisfy all three conditions at once: watermark evasion, utility preservation, and forensic indistinguishability from clean content.