How easily can invisible image watermarks be removed, and which watermark types resist regeneration or adversarial attacks?
Corrected 2026-10-24 - see C3-B1132-01; the original statements below are kept for history and are superseded where the correction says so. Corrected 2026-10-23 - see C3-B681-04; the original statements below are kept for history and are superseded where the correction says so. Two benchmark-style papers test removal. WAVES (5 watermarks, 26 attacks) finds no attack works on all watermarks: regeneration/diffusion attacks are most effective on Stable Signature (average detection performance 0.001 under Regen-Diff), Tree-Ring is most vulnerable to adversarial attacks, and StegaStamp is most robust but visibly degrades images. Zhao et al. report over 99 percent removal for DwtDctSvd, RivaGAN and SSL by regeneration, with StegaStamp needing heavy noise. The two papers disagree on Tree-Ring under regeneration, probably because of different strengths and metrics, and both use attackers without detector access.
Two benchmark-style papers test removal. WAVES (5 watermarks, 26 attacks) finds no attack works on all watermarks: regeneration/diffusion attacks are most effective on Stable Signature (average detection performance 0.001 under Regen-Diff), Tree-Ring is most vulnerable to adversarial attacks, and StegaStamp is most robust but visibly degrades images. Zhao et al. report over 99 percent removal for DwtDctSvd, RivaGAN and SSL by regeneration, with StegaStamp needing heavy noise. The two papers disagree on Tree-Ring under regeneration, probably because of different strengths and metrics, and both use attackers without detector access.
Curator correction 2026-10-23 (discovery audit record C3-B681-04; sources re-fetched 2026-10-23, excerpts re-located by curator GET): Problem. C3-B116-G42-06 says StegaStamp 'is most robust but visibly degrades images' and frames WAVES as '5 watermarks'. Correction type: (b) overstated plus scope. Method. WAVES only says StegaStamp 'may introduce artifacts' (a hedged report of the original paper), and its attack-vs-watermark comparison tables and robustness figure cover three methods (Tree-Ring, Stable Signature, StegaStamp); the paper does mention five stress-tested watermarks in its conclusion. The Stable Signature Regen-Diff average of 0.001 and the StegaStamp robustness ranking in the candidate are accurate (Table 3). Zhao et al. (not WAVES) attribute StegaStamp's resistance partly to lower visual quality and higher perturbation. Limitations. The two other watermarks' results were not located in the tables read. Version and date. Fetched 2026-10-23.
Curator correction 2026-10-24 (discovery audit record C3-B1132-01, curator-reviewed C3R-0717; excerpts re-located by independent curator GET 2026-10-24): Correction. C3-B116-G42-06 states 'WAVES (5 watermarks, 26 attacks)'. The 26-attack count is right, but WAVES (arXiv 2401.08573v3, the latest version at 2026-10-24, last revised 7 Jun 2024) benchmarks three watermarking methods (Tree-Ring, Stable Signature, StegaStamp), not five. The paper says it covers 'across 26 attack methods, three watermark methods, and three datasets', and its Table 3 compares attacks 'across three watermarking methods'. The record's own evidence E1 lists only those three watermarks. The count was wrong when written; the rest of that record's WAVES findings (Regen-Diff average detection performance 0.001 on Stable Signature, Tree-Ring most exposed to adversarial attacks, StegaStamp most robust) are unaffected. Other watermarks named in the paper (HiDDeN, RivaGAN, DwtDct) appear only in its background discussion of watermark families.
Curator qualifications: Verified both papers' figures. The Tree-Ring regeneration disagreement (Zhao: robust at TPR@1%FPR vs WAVES Regen-Diff 0.612 at 0.1% FPR) is genuine and confounded by thresholds, strengths and implementations, as stated.
Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.
Structured fields
{
"citations": [
{
"url": "https://arxiv.org/abs/2401.08573v3",
"note": "attack table; benchmark comparison; results; Table 2"
},
{
"url": "https://arxiv.org/abs/2306.01953v3",
"note": "attack table; benchmark comparison; results; Table 2"
},
{
"url": "https://arxiv.org/abs/2310.00076v2",
"note": "attack table; benchmark comparison; results; Table 2"
},
{
"url": "https://arxiv.org/html/2401.08573v3",
"note": "correction source (record C3-B681-04): related-work/attack discussion; Table 3 caption; conclusion / limitations"
}
]
}Evidence claims
- [sourced_fact] Curator correction 2026-10-23 (discovery audit record C3-B681-04; sources re-fetched 2026-10-23, excerpts re-located by curator GET): Problem. C3-B116-G42-06 says StegaStamp 'is most robust but visibly degrades images' and frames WAVES as '5 watermarks'. Correction type: (b) overstated plus scope. Method. WAVES only says StegaStamp 'may introduce artifacts' (a hedged report of the original paper), and its attack-vs-watermark comparison tables and robustness figure cover three methods (Tree-Ring, Stable Signature, StegaStamp); the paper does mention five stress-tested watermarks in its conclusion. The Stable Signature Regen-Diff average of 0.001 and the StegaStamp robustness ranking in the candidate are accurate (Table 3). Zhao et al. (not WAVES) attribute StegaStamp's resistance partly to lower visual quality and higher perturbation. Limitations. The two other watermarks' results were not located in the tables read. Version and date. Fetched 2026-10-23. · locator: curator correction paragraph in this record body (C3-B1132-01, C3-B681-04) source
- [sourced_fact] Curator correction 2026-10-24 (discovery audit record C3-B1132-01, curator-reviewed C3R-0717; excerpts re-located by independent curator GET 2026-10-24): Correction. C3-B116-G42-06 states 'WAVES (5 watermarks, 26 attacks)'. The 26-attack count is right, but WAVES (arXiv 2401.08573v3, the latest version at 2026-10-24, last revised 7 Jun 2024) benchmarks three watermarking methods (Tree-Ring, Stable Signature, StegaStamp), not five. The paper says it covers 'across 26 attack methods, three watermark methods, and three datasets', and its Table 3 compares attacks 'across three watermarking methods'. The record's own evidence E1 lists only those three watermarks. The count was wrong when written; the rest of that record's WAVES findings (Regen-Diff average detection performance 0.001 on Stable Signature, Tree-Ring most exposed to adversarial attacks, StegaStamp most robust) are unaffected. Other watermarks named in the paper (HiDDeN, RivaGAN, DwtDct) appear only in its background discussion of watermark families. · locator: curator correction paragraph in this record body (C3-B1132-01, C3-B681-04) source
- [sourced_fact] SUPERSEDED IN PART 2026-10-24 by curator correction C3-B1132-01, C3-B681-04 (see the correction claim above); original kept for history: Two benchmark-style papers test removal. WAVES (5 watermarks, 26 attacks) finds no attack works on all watermarks: regeneration/diffusion attacks are most effective on Stable Signature (average detection performance 0.001 under Regen-Diff), Tree-Ring is most vulnerable to adversarial attacks, and StegaStamp is most robust but visibly degrades images. Zhao et al. report over 99 percent removal for DwtDctSvd, RivaGAN and SSL by regeneration, with StegaStamp needing heavy noise. The two papers disagree on Tree-Ring under regeneration, probably because of different strengths and metrics, and both use attackers without detector access. · locator: attack table; benchmark comparison; results; Table 2 source
Rights
| component | license | hosting | redistribution | modification | training | Evidence and notes |
|---|---|---|---|---|---|---|
| documentation | unknown | permitted | permitted | unknown | unknown | Applies to this original summary only, not to the cited sources. |