Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models
Authors: Tomas Soucek
Sylvestre-Alvise Rebuffi
Pierre Fernandez
Nikola Jovanović
Hady Elsahar
Valeriu Lacatusu
Tuan A. Tran
Alexandre Mourachko
Venue: NeurIPS 2025 spotlight ()
Keywords: image watermarking
watermark forging
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: Forging image watermarks from single watermarked image by removing watermarking artifacts via backpropagation through preference model.

Abstract: Recent years have seen a surge in interest in digital content watermarking techniques, driven by the proliferation of generative models and increased legal pressure. With an ever-growing percentage of AI-generated content available online, watermarking plays an increasingly important role in ensuring content authenticity and attribution at scale. There have been many works assessing the robustness of watermarking to removal attacks, yet, watermark forging, the scenario when a watermark is stolen from genuine content and applied to malicious content, remains underexplored. In this work, we investigate watermark forging in the context of widely used post-hoc image watermarking. Our contributions are as follows. First, we introduce a preference model to assess whether an image is watermarked. The model is trained using a ranking loss on purely procedurally generated images without any need for real watermarks. Second, we demonstrate the model's capability to remove and forge watermarks by optimizing the input image through backpropagation. This technique requires only a single watermarked image and works without knowledge of the watermarking model, making our attack much simpler and more practical than attacks introduced in related work. Third, we evaluate our proposed method on a variety of post-hoc image watermarking models, demonstrating that our approach can effectively forge watermarks, questioning the security of current watermarking approaches. Our code and further resources are publicly available.

Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models
Tomáš Souček'
Sylvestre-Alvise Rebuffi
Pierre Fernandez'
Nikola Jovanović
Hady Elsahar?
Valeriu Lacatusu'
Tuan Tran Alexandre Mourachko'
Meta FAIR
2ETH Zurich
soucekdmeta.com
Abstract
Recent years have seen surge in interest in digital content watermarking tech- niques, driven by the proliferation of generative models and increased legal pressure. With wer-growing percentage of Al-generated content available online, wa- termarking plays an increasingly important role in ensuring content authenticity and attribution scale. There have been many works assessing the robustness of watermarking to removal attacks, yet, watermark forging, the scenario when a watermark is stolen from genuine content and applied to malicious content, remains underexplored. In this work, we investigate watermark forging in the context of widely used post-hoc image watermarking. Our contributions are as follows, First, we introduce a preference model to assess whether an image is watermarked. The model trained using ranking loss on purely procedurally generated images without any need for real watermarks. Second, we demonstrate the model's s ca- pability to remove and forge watermarks by optimizing the input image through backpropagation. This technique requires only a single watermarked image and works without knowledge the watermarking model, making our attack much simpler and more practical than attacks introduced in related work. Third, eval- uate our proposed method on a variety of post-hoc image watermarking models, demonstrating that approach can effectively forge watermarks, questioning the security current watermarking approaches. Our code and further resources are publicly available.
Introduction
Digital watermarking is important technology that enables content identification and attribution by embedding imperceptible signals into images without compromising their visual quality. In recent years, the demand for such technology has increased, driven by the growth of online sharing platforms and the development of generative Al models. It is also particularly appealing for moderation and IP protection of user-generated content scale, where copy detection and manual verification insufficient. More importantly, we now also need provenance verification systems to distinguish genuine from machine-generated material, especially in settings involving misinformation, fraud, intellectual property claims. Regulatory frameworks such as the EU AT Act and the U.S. Executive Order on Al now explicitly call for watermarking mechanisms ensure transparency and traceability in Al-generated content. Among the various watermarking approaches, post-hoc watermarking- where the watermark is applied after content generation- has gained popularity for its modularity and ease of deployment, in both of these scenarios. As case in point, it is already integrated into many practical systems to label and trace Al Al-genera images or videos [8, 9, 14], and to protect the authenticity of photos of press agencies or taken with cameras [1, 33].
Work done during an internship at Meta. httppp///.hhhhteeeeccccrrreeaeas
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Watermaniad vnage
Cleaned image
Watermank removal
Profgrence model
-PI -
Watermat
detector
Maximine predicted spore wer. the irpul image
Nor-sellammeaadd
Aice
Walermak dietectto
Waternak dellector
Alce
Watarmaked
Watermareed
Removed
Another Image
Amage Eoraad walarmakk
Wattommook forging
Figure 1: Overview of our attack pipeline. Given single watermarked image (left), Bob's goal is to either remove the watermark (top path) or forge it onto another image (bottom path). He first trains a preference model predict score indicating the likelihood that an image will be watermarked. and then optimizes the input image to maximize this score. This enables both watermark removal (producing clean image classified as von-watermarked) and watermark forging (producing an image classified as watermarked). Notably, the approach does not require access to the watermarking model or paired data.
However, while the robustness of these watermarking schemes to common removal attacks has been widely investigated, their security against adversarial misuse remains rather underexplored. In particular, watermark forging, i.e., the process by which an attacker can steal or create a counterfeit watermark and apply it to new media, can be problematic in many scenarios. Unlike watermark removal, forging does not seek erase watermark, but rather to deceive downstream detection systems and create significant security vulnerabilities. For instance, could flood detection systems with false positives, or, in the case where watermarking is applied authentic images, it could be used to create fake content that appears authentic.
The literature on image-based based watermark attacks predominantly focuses on removal techniques, such as diffusiin--asse purification [32, 48], model inversion [25], or access-based decoding attacks [21, 36). These approaches often assume extensive access to watermarked data, decoding APIs, or the watermark generation aapeline-assumpiitn
that not hold in realistic adversarial settings. Moreover, they tend to induce perceptual degradation or require computationally expensive processes. By contrast, forging attacks are less studied, and existing attempts rely on strong assumptions, such as paired watermarked and clean datasets [41] or the ability to train deep generative models thousands of watermarked samples [10, 23]. These are impractical in real-world, black-box scenarios where adversaries might only observe a single watermarked image.
In this work, we introduce new watermark attack designed specifically for these low-resource and black-box settings. Our pipeline is depicted in Figure 1. We first introduce preference model trained using a ranking-based supervision scheme on synthetically altered images. These artifacts are generated procedurally, requiring no real watermarked data. The model learns to score image candidates based on how likely they are to contain a watermark, implicitly capturing the structure of "unnatural" artifacts. Then, the model can be used optimization, enabling both watermark removal and watermark forging. Notably, this is achieved with no access to the watermarking algorithm, no paired data, and only a single example of watermarked image. Our design of watermark forging from a single watermarked image mirrors realistic attack settings as it allows for attacks against content- aware watermarking models- the scenario where other types of attacks often fail. To this end, our work provides a more credible assessment of post-hoc watermarking scheme vulnerabilities in the wild. Our contributions are threefold:
surrogate loss for backpropagation- bbaedod image
We introduce an image preference model trained solely on procedurally perturbed images using ranking loss, which avoids reliance actual watermarked content or decoding models.
We present gradient-based attack procedure that uses the preference model to remove or forge watermarks via direct optimization on image pixels, requiring no knowledge of the original watermarking scheme.

---

We conduct comprehensive evaluations across a range of post-hoc watermarking schemes, demonstrating that our method achieves strong performance while assuming more realistic threat models. In addition, it provides guidance on which watermarking methods are more robust against forging attacks.
Threat model. A benign actor Alice applies watermarks to her content using a post-hoe watermarking scheme, while an adversary Bob seeks to either remove the watermark to evade detection or forge it onto new, unrelated content to falsely pass it as authentic. We assume that Bob has no access to Alice's watermarking method, paired -eaa-watermrreed data, or any decoding interface. We also assume Bob gains access to single image watermarked by Alice. This setting reflects realistic attack scenarios where the adversary must operate in black-box, data-scarce environment.
2 Related work
Image watermarking. A large body of work for image watermarking focuses on post-hoc water- marking [13]. The post-hoe watermarking, in contrast to other types of watermarking applied the content during its generation [6. 11, 42], has the advantage that it can also be used for attribution and authenticity verification of real content. It adds small, ideally invisible, artifacts to the image that can be later detected to verify the content's authenticity. Some works embed single static water- mark into all images [5. 28], but most works take into account the image and adjust the watermark dynamically [4, 12. 17, 27, 29, 37, 44, 47, 49]. However, during training, the content awareness of the watermark is usually not enforced, often resulting in fairly static watermarks that can be casily forged by averaging many watermarked images [45]. In contrast, we propose method for watermark forging that shows that even some content-aware watermarking schemes can be exploited.
Generation-base attacks. A common image watermark removal attack uses diffusion models [15]. The approach, originally developed for preventing adversarial attacks [32], introduces subtle pertur- bations to watermarked image that are then removed by denoising [36, 483. Although this approach reliably removes subtle watermarks in images, also hallucinates new image details, deviating from the input. To counter the hallucination problem, Liu el al. [25] finetune Stable Diffusion model [35] conditioned on the watermarked image for greater consistency of the purified output image with the input and Lucas et al. [26] do not use diffusion all - they train VAE to remove watermarks from images. On the other hand, to forge watermarks, Wang et al. [41] train a U-Net to replicate third-party watermarker but assume an unrealistic scenario with paired original and watermarked images. To alleviate the need for paired data, Li et al. [23] use a discriminator to train a network that adds the forged watermark to any image. Similarly, Dong al. [10] finetune diffusion model for the same purpose. The downside of these methods is that they require thousands or tens of thousands of watermarked images with the same hidden message, which may be difficult to obtain, especially as the recent watermarking methods allow for different hidden messages based on various factors, including, for example, date or user. In contrast, our method does not require any real watermarked images and, once trained, it can be applied to any watermarked image without any adaptations to a particular watermarking method.
teckkoopagationbaaseeeee based attacks. The straightforward way of evading watermark detection is to perturb the watermarked image by back- propaaatting through the watermark decoder and maximizing the probability of detecting a random message
[18]. However, this attack requires access to the watermark detector, which is not the case in practice. To remove watermarks from images without access to the watermark detector, UnMarker [19] perturbs the image to maximize its difference to its original watermarked copy in the Fourier spectrum while minimizing its difference in Fuclidean and LPIPS [46] metrics. Liang et al. [24] show that the Deep Image Prior [40] framework can remove watermarks produced by modern watermarking methods, yet is prohibitively expensive and needs model training for each watermarked image. Saberi et al. [36] remove watermarks from images using a projected gradient descent on a classifier trained distinguish between watermarked and won-waterrrrked images, requiring access to large collection of watermarked images. Hu et al. [16] replace the need for real watermarked images by training collection of 100 surrogate watermarking models which are then used to compute image perturbation that likely evades detection. Lastly, Müller el al. [3 show that semantic diffusion model-based watermarks can be both removed and forged via backpropagation through the iterative diffusion process of surrogate diffusion model. In contrast to these methods, we can forge watermarks of any post-hoc watermarking method, we not need a large set of surrogate models, and we require only single watermarked image perform our attack.
3

---

3 Method
Given single watermarked image Ee. our goal is to extract forged watermark w that can be added to any image y such that the resulting image yı is detected as watermarked by the respective watermark detector. To produce realistic attacked image, our second criterion is that the forged watermark v should make imperceptibee modifications to the input image y. Otherwise, one could artificially boost the watermark detection performance by increasing the magnitude of the forged watermark ui. Besides having only one watermarked image, the main challenge of this one-shot forging task is that we do not know any prior information about the watermark w, and we do not have access to the watermark detector.
We propose a two-step approach illustrated in Figure where (i) estimate the watermark vi from the single watermarked image ww at our disposal and (ii) we use the estimated watermark i to forge new watermarked images V y W for any given image y. For the key step of estimating the watermark from a single image, we train an image prior model that we use to separate the artifacts produced by a watermarking model from the original content of the image. To build the image prior model, we take inspiration from the Large Language Model literature [34] and train a preference model R using a ranking loss to prefer original images to synthetically corrupted images. Note that we do not use any watermarking model to build the preference model, only the synthetic corruptions detailed in Section 3.1. Then, we can optimize the watermarked image Dw to produce clean image à by maximizing the preference score of the preference model. The estimated watermark can be obtained by simple subtraction v = Twe and it can be used to forge new watermarked images yi
w. In detail, we present the training of our preference model in Section 3.1. Then, in Section 3.2, we describe how to remove and forge image watermarks using the model.
3.1 Preference model training
Our preference model R is a ConvNeXt [43] with an RGB image x as input. The model predicts a single score R(x=) R. Higher score values indicate that the input image preferred, i.e., the image is of high quality and without any artifacts, while lower score values indicate the opposite. We detail how we train the model next.
Preference loss. Suppose we are given two variants xt, x of the image æ where at denotes the preferred and æ dispreferred variants of that image. For example, the two image variants can be different augmentations of the same image, where the dispreferred variant is strongly distorted. Our model R is trained to predict the probability p(x* > x=) that the image x is preferred to x We chose the popular Bradley- Ererl model [3] to define the preference distribution as:
exp (R(x+))
p(
> x x)) exp (R(x+)) exp (R(x-))
Given dataset of the image preference pairs (x", x0 we can train the model R using the negative log-likelihood loss:
-E(xt,
[log (R(æ* R(x ))]
Training data. Our definition of the loss function allows for any source of image preference pairs. For example, these pairs can be obtained by collecting human preferences [46]. However, in this work, we show that artificially generated image preference pairs serve as a powerful signal for the model to learn a strong image prior. In our case, we choose the real image æ as the preferred image x = æc. The dispreferred image created by adding a synthetic artifact w to the real image x + We generate these artifacts in the Fourier space by randomly choosing between wave style artifacts, line style artifacts, and noise. In detail, suppose F(i.j) E IR is the amplitude spectrum of the generated artifact of shape H W with i E (-H -2/ H//2). j E (-W/2,... W/2} and the aero-frequency component centered at (i.j) = (0, 0). The artifacts are created as follows.
Wave style artifacts: The amplitude is non-zero F(i,j) * O for (i.j) e [(rA/5 cos(0), sin()))) where N ~ U42...., ......., Nmar>> ~ L1(0, malll and 0 ~ (10 2m). The notation 21[:] or (/{-3 denotes random sampling from a given range or set, respectively.
Noise: The amplitude is randomly sampled for every (i.j)
F(i,))
u10, exp (-116/o7../00²)1)) where o² ~ U[Ssinn smazl, and || Ip is p-norm with p= 4- 11-3/pppp 1].

---

Wave style
Noise
Line style
Fourier
Image
Fourier
Image
Fourier
Image
Figure 2: Synthetic artifacts. We train our preference model to prefer original images over syn- thetically corrupted images. To cover a broad range of possible artifacts, we use three types of artifacts: style, noise, and line style. The artifacts are first generated in the Fourier space and then transformed to the image space to be added to the original images.
Line style artifacts: The amplitude is non-zero F(i, o 0 for horizontal lines (i,j) such that i or -i {1, where M Lmaz....MMma)): 1 (0, p²) and p ~ L[[s'mnn mmal. Vertical lines are sampled analogously.
The phase component of the Fourier spectrum is selected randomly, and after the transformation into the image space, the artifacts are rescaled to the range |-0.05, 0.05]. Examples of the generated artifacts and their generated Fourier amplitude spectra are shown in Figure 2. To increase the artifact diversity, we randomly sample either RGB or grayscale artifacts. In addition, with 50% probability, randomly multiply w by Just Noticeable Differences (JND) map, effectively localizing the artifacts in high-frequency image regions only, Please see the appendix for details.
Adversarial training. The optimal preference model R' trained using Equation (2) would predict R" (xw) = inf for the watermarked image and R (z) = inf for the original non-watermarker image. Therefore, one would hope that optimizing ww maximize the preference score R( would reduce the watermark artifacts in zu and retrieve an image similar to the original æ. However, observe in experiments that backpropagating through the preference model trained with Equation (2) not only fails to reduce the watermark artifacts but also adds new artifacts such as checkerboard patterns like in Figure 6. This is analogous to what is observed in the robustness literature [7, 38, 39], where image classifiers trained without adversarial training fail to produce interpretable gradients. Therefore, we propose use adversarially perturbed images ă
V. Rix to create an extra image pair (x+ x-) ) as additional training data. The intuition behind this extra image pair is that if we add perturbation smaller than the watermark artifacts, the resulting image should not be preferred over the original image by the preference model.
While adversarial perturbations similar to adversarial training [30] where the goal is to ensure robustness to malicious attacks that commonly do not exist in the real data they are designed such that the preference model produces semantically interpretable gradients that be used to estimate the watermark.
3.2 Watermark removal and forging
Given watermarked image Twe, our goal is to watermark new image in way that is recognized by watermarking detector as genuinely watermarked. We achieve this by first estimating the watermark embedded in a. To do so, we find the image è = w that maximizes the preference model score R()) within a certain number of optimization steps Our objective, written as function of the watermark distortion 8, is follows:
i argmax R(x 8).
We optimize Equation (3) using gradient ascent with a fixed number of steps & and a fixed learning rate. This constrained optimization budget allows us to control the distortion produced on the original image. Once have extracted the estimated watermark i from the single watermarked image Twe we can paste it to any new image y to forge new watermarked images by summing the image and the watermark you y + ú. The whole process is illustrated in Figure
To forge watermarks in any resolution, we adopt the rescaling strategy introduced for watermarking high-resolution images [4]. Given an image T., of size Hori x W the image is first resized to
5

---

smaller resolution H x W using bilinear interpolation. Then, we estimate the watermark w' using the resized image h by optimizing Equation (3). Then, the estimated watermark is resized the resolution of the new image y and summed with it to form the maliciously watermarked image ya:
V y + resize (W")) w' = argmax R (resize (xx) 6).
The watermark removal is performed analogously by computing the watermark free version of zw as
$= = Tw resizcon (2²)).
4 Experiments
In this section, we present the experimental setup and results of our watermark forging approach. First, in Section 1, we describe the key implementation and evaluation details. Then, in Section 4.2, we compare our approach of watermark forging and removal to related methods. Finally, in Section 4.3, we ablate the key design choices. Additional details and results are in the appendix.
4.1 Implementation and evaluation details
Implementation details. We train our model, ConvNeXt V2-Tiny [43] images from the SA-Ib dataset [20]. We resize each image to the resolution of 768x 768 and apply a random synthetic artifact to it. Then, both the image with and without artifact are augmented by the same random image augmentation followed by the same random crop of size 256 x56x The model is trained from scratch for 120k steps on 8 GPUs with batch size of 16 per GPU; the training takes 60 hours using V100 GPUs We use AdamW optimizer with a fixed learning rate of x 1x10- In every second batch, we replace the image with the synthetic artifact by its adversarially perturbed version as described in Section 3. To compute the perturbation, we use two steps of gradient descent with a learning rate randomly chosen from the interval [0.03, 0.09].
Evaluation details and metrics. We watermark 100 images from the SA-1b validation set by all tested watermarking methods: CIN [29], MBRS [17], TrustMark [4], and Video Seal [12]. For each watermarking method, we watermark all 100 images using the same hidden message, as the methods reliant more than a single image to remove or forge a watermark, such as Warfare and Image averaging, cannot work with multiple hidden messages. We measure the bit accuracy of the respective watermark extractor. While the bit accuracy is dependent (90% accuracy of the 32-bit CIN method effectively results in preservation of less information than 70% accuracy of the 256-bit MBRS method), it allows for simple and interpretable comparison of different watermark removal and forging methods. For watermark removal, the bit accuracy is measured the 100 test images with their watermarks removed. For watermark forging, we steal the watermarks from the same 100 test images and apply the stolen watermarks to a new set of 100 images. Please note that virtually any bit accuracy can be achieved by all watermark removal/forging methods if the target image is heavily edited. Therefore, we also report PSNR computed with respect the ground truth watermark- free image. As the PSNR is very similar across different watermarking methods, we report only a single averaged number per method.
the number of bits used by each method
Compared methods. We compare with publicly available watermark forging methods and baselines. (I) Warfare [23] is trained to add watermarks to images using a discriminator loss that distinguishes between watermarked and non-watermarked images. We train separate model for each watermarking method for 6 days on 8 V100 GPUs with 1000 watermarked and non-watermarked images. (2) image averaging is simple method proposed by Yang et al. [45] that recovers the watermark by averaging and subtracting sets of watermarked and non-watermarked images. The recovered watermark can then be pasted onto a new image. In our experiments, we average 100 images. (3) Noise blending [36] pastes a watermarked random noise onto à new image. (4) Gray image blending extracts watermark from uniform gray image. Both Noise blending and Gray image blending serve as basclines only since they require access to watermarking API, making them impractical in real-world scenarios. Additionally, we also evaluate common watermark removal methods. (5) DiffPure [32] is a technique that adds Gaussian noise to a watermarked image and denoises the image using a diffusion model. We use FLUX. 1 [dev] [22] model and denoise for the last timesteps of the default scheduler. We also adapt this method to watermark forging by pasting the residual into new images. (6) CirlRegen [25] finetunes diffusion model specifically to remove watermarks. our setup, we use their model with step 0.1 to preserve more information from the input image. Lastly, bascline, we use (7) VAE

---

Table Watermark forging results. Our approach outperforms the prior works in different water- mark forging scenarios, requiring only single watermarked image with no access to the original watermarking model. While methods such as Image averaging and Warfare are competitive, they require 100s of watermarked images with the same hidden message, which may be difficult to obtain.
CIN
MBRS
TrustMark
Vidco Seal
Method
PSNR(1)
Bit acc, (f)
Bit acc. (t)
Bit acc. (t)
Bit acc, (t)
Gray image blending
1.00
0.80
0.54
0.83
52.9
Noise blending (ax 0.1) [36]
0.82
0.61
0.52
0.53
21.8
Warfare (n 1000) [23]
0.93
0.50
0.53
0.74
39.6
DittPure (FLUX. [dev]) [32]
1.00
0.83
0,59
0.75
26.6
Image averaging (n 100) [45]
1.00
0.91
0.61
0.59
26.2
Ours (n 1)
1.00
0.83
0.61
0.83
31.3
Table Watermark removal results. Our approach remains competitive with related works while not suffering from the hallucination of details and textures that are present in diffusion- methods.
CIN
MBRS
TrustMark
Video Seal
Method
PSNR(t)
Bit acc. (L)
Bit acc. (L)
Bit acc. (1)
Bit acc. (1)
Image averaging (n 100) [45]
0.39
0.50
0.60
0.89
26.3
VAE (FLUX 1 [dev])
1.00
0.99
1.00
0.99
34.3
DittPuur (FLUX. 1 [dev]) [32]
0.86
0,56
0.56
0.60
25.4
CtriRegen (step 0.1) [25]
0.86
0.70
0.56
0.55
24.4
Ours (n 1)
0.82
0.64
0.60
0.49
31.2
encoding and decoding as suggested in the literature [2, 11, 48] to show how robust the watermarking methods are to neural compression.
4.2 Comparison with the state-of-the-art
Watermark forging. We evaluate watermark forging methods on the test in Table We observe strong performance (high bit accuracy) of the image averaging baseline in forging CIN [29] and MBRS [17] watermarks. This can be explained by the fact that these methods produce watermarks that are generally independent of the image content. On the other hand, for Video Seal [12], the image averaging approach fails as Video Seal watermarks are highly dependent on the input image. This where method, which can extract the watermark from single image, significantly outperforms all the related works. Lastly, we can see that TrustMark [4] is very difficult to forge, possibly due to the fact that both embedder's 's and decoder's outputs are greatly dependent on the input image. In the case of Video Seal, the embedder's s output is highly dependent on the input image, but the decoder tends to ignore the image, making watermark forging easier.
Watermark removal. We also evaluate performance in watermark removal. In this case, in contrast to watermark forging, the goal is remove the watermark; therefore, ideally, produce random bit accuracy. As shown in Table 2, our method is highly competitive with the related works, producing high-quality images (high PSNR) while removing most of the watermark information present in the image (low bit accuracy). Similarly to watermark forging, we can see that image averaging performs well for CIN and MBRS watermarks due to their practical independence we can see that CIN watermarks are very difficult to remove this is likely due to the fact that CIN watermarks significantly alter the images, are very visible, and are fairly redundant due to the low bit count of the CIN method.
the input image. Also,
Qualitative results. Results in Figures 3, 4, 5, and in the appendix demonstrate the key strengths of our approach. First, Figure 3, we present the forged watermarks obtained by various methods, averaged over 100 images to eliminate any image-specific artifacts. We can see that our method can reconstruct the watermark faithfully without requiring any per-method tuning or training, which not the case for the Warfare method. In Figure 4, we show extracted watermarks forged into new image.
7

---

octual watermark
Ours
Warfare
DiffPure
Image averaging
CIN
TrustMark
Figure 3: Comparison of the forged watermarks by different watermark forging methods. The shown watermarks averaged from 100 different images remove any image-specific artifacts. The recovered watermark by our method closely resembles the actual watermark (left column), containing the least number of other distracting artifacts, such the noise present in DiffPure watermarks.
image
TrustMark
Video Seal
youree
forged image
Figure 4: Qualitative results for watermark forging. The figure shows a watermarked image (top) with its watermark removed by method (middle row). The watermark is pasted onto image (bottom row). We use k = 50 steps for the watermark extraction.

---

watermarked imane
Image averaging
DifiPure
CiriRegen
Ours
NON MNOREC ROOM
KORPAINN ROOM
MU 2PEAN ROOM
BAME ROOM
IN PA ROOM
GABA ROOM
ardual watermark
Qualitative results for watermark removal. The figure shows a watermarked image (left) with its watermark removed by different methods (top row) and the actual removed watermark by each method (bottom row).
Figure 5:
Table 3: Watermark forging ablation. We test multiple variants of our model to show the effect of individual design decisions. We use the same hyperparameters for the forging process (number of steps, learning rate) for all model variants. The higher PSNR of the variants is caused by less informative gradients that do remove the watermark artifacts effectively.
CIN
MBRS
TrustMark
Video Seal
Method
PSNR<1
Bit acc. (t)
Bit acc. (t)
Bit acc. (f)
Bit acc. (1)
(1) Binary cross cross-entropy loss
0.60
0.53
0.52
0.47
39.9
(2) Hinge loss
0.62
0.55
0.52
0.47
44.1
Without perturbation
0.97
0,65
0.52
0.49
34.7
(4)
Real watermarks training data
1.00
0.67
0.58
0.77
36.9
Ours
1.00
0.83
0.61
0.83
31.3
Lastly, in Figure 5, we present the result of watermark removal, along with the removed watermark itself. While related methods, such as DiftPure and CtrlRegen, modify the input image and add new hallucinated details, our method removes only high-frequency artifacts from the image.
4.3 Ablations
We evaluate the key design decisions of our proposed method, i.e., the use of ranking loss, input perturbation, and the artifacts used during training. Lastly, in the appendix, we also evaluate how the optimization hyperparameters affect the watermark removal.
Training loss. We train our model using the ranking loss as specified in Equation (2), but we also investigate two additional losses. We consider binary cross-entropy, where the two classes are the positive + and negative æ examples, and hinge loss, often used discriminator training [35]. We show in Table 3 that our decision to use the ranking loss (line 5) is crucial to achieving superior performance. The poor, almost random, performance (line 1) can be explained by the fact that the images x and x are very similar, and there exists global decision threshold between the classes.
the model trained with binary cross-entropy
Adversarial perturbation. During training, explained in Section 3.1, we perturb the negative samples the direction of the gradient towards the positive sample. Our perturbation is designed to create different, yet plausible negative samples, making our model more robust to different artifacts. As shown in Table 3, lines and 5, our approach, which utilizes perturbation, significantly improves upon the baseline with no perturbation used. Additionally, the gradients of the baseline without perturbation with respect to the input image are less meaningful compared to our model, whose gradients clearly point to a cleaner, less noisy image (Figure 6, columns 2 and 3).

---

Witermarked image
(1) BCR loss
(2) Hinge loss
(3) Without perturbation
Ours
Figure 6: Watermark removal with tested model variants. Training our model without adversarial perturbation or with different loss results in uninterpretable gradients and various artifacts.
Table 4: The effect of different synthetic artifacts on the watermark removal results. Out of the tested artifacts, the model trained with the wave pattern is the most effective in removing the watermarks.
CIN
MBRS
TrustMark
Video Scal
Artifact type
Bit acc.
Bit acc. ())
Bit acc. (
Bit acc.
Only wave style
0.98
0.83
0.55
0.45
Only noise
1.00
0.97
0,99
0.97
Only line style
1.00
0.95
0.99
0.95
All (Ours)
0.82
0.64
0.60
0.49
Black-box vs. gray-box attack. We train our preference model with procedurally generated artifacts, as described in Section 3.1. We also test the gray-box scenario where we have access to both the original and watermarked images. Therefore, we train our preference model with the actual outputs of the watermarking methods CIN, MBRS, TrustMark, and Video Seal as the negative samples x " As you can see from Table 3, training on the real watermarks (line 4) performs significantly worse procedurally generated artifacts (line 5). We observe that the real watermarks are
than training not as diverse as our generated artifacts, leading the model to overfit to the training data.
Synthetic artifact types. We investigate the contributions of different synthetic artifacts to the performance of the final model by training the model independently for each style of watermark pattern and evaluating its ability to remove watermarks. The results in Table 4 show that the model trained with the wave pattern is the most effective removing the watermarks. However, on average, the model trained using the combination of the three watermark types produces better results.
5
Conclusion
We present method capable of forging watermarks from a single watermarked image. Given its fast speed and reliance on single watermarked image, the presented method is more practical attack on many contemporary post-hoc watermarking techniques than related work. While some content-aware watermarking methods are fairly immune to this type of attack, we show that for other content-aware methods, the watermark can be easily stolen, questioning the security of the current post-hoc watermarking research landscape.
Limitations. Our type forging attack targets post-hoc watermarking methods. Semantic water- marking, such as Tree-Ring [42] or RingID [6]. watermarks Al-generated content by altering the objects and their locations a generated image. Our method cannot semantically change these objects; therefore, different methods must be used for forging these semantic watermarks (e.g., [31]). Also, as shown in the appendix, our method may blur areas with natural high-frequency texture, such as water surfaces. Nonetheless, this issue can be partially mitigated through improved preference model training by introducing image blur as a new synthetic artifact type.
Broader impact and safeguards. The presented work highlights a flaw of many existing post-hoc watermarking methods and introduces a potential attack to easily forge watermarks. The attack is based on the observation that many watermark decoders are not content- aware and will accept watermark from a different source image. To mitigate this issue, we recommend ensuring the decoder is truly content-aware, e.g., by explicitly training the decoder to reject watermarks from different source image. We believe that our insights will help to strengthen current and future watermarking techniques and contribute towards making AI safe and responsible.
10

---

References
[1] AFP. Aíp successfully tests technology verify the authenticity of its photos during the us elections, 2025. Accessed on May 12, 2025.
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, al. Waves: Benchmarking the robustness of image watermarks. In JCML. PMLR, 2024. 7
[3] Ralph Allan Bradlcy and Milton E Terry. Rank analysis incomplete block designs: I. the method of paired comparisons. Biometrika, 1952. 4
[4] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:2311.18297 2023 5, 6.
[5] Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. Rostcals: Robust steganography using autocncoder latent space. In CVPR, 2023. 3
[6] Hai Ci, Pei Yang. Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In ECCV, 2024. 3, 10
[7] Francesco Croce, Christian Schlarmann, Naman Deep Singh, and Matthias Hein. Adversarially robust clip models can induce better (robust) perceptual metrics. 2025. 5
[8] Google DeepMind. Identifying ai- ai-generated images with synthid, 2023. Accessed May 13, 2025.
[9] Google DeepMind. Watermarking ai-generated text and video with synthid, 2024. Accessed on May 2, 2024.
[10] Ziping Dong. Chao Shuai, Zhongjie Ba. Peng Cheng, Zhan Qin, Qinglong Wang, and Kui Ren. Im- perceptible but forgeable: Practical invisible watermark forgery via diffusion models. arXiv preprint arXiv:2503.22330 2025. 3,
[11] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In ICCV, 2023. 3,7
[12] Pierre Fernandez, Hady Elsahar, Zeki Yalniz, and Alexandre Mourachko. Vidco seal: Open and efficient vidco watermarking. arXiv preprint arXiv:2412.099999 2024, 3, 6,7
[13] Pierre Fernandez, Hady Elsahar, Sylvestre- Alvise Rebufli, Tomas Soucek, Valeriu Lacatusu, Tuan Tran, and Alexandre Mourachko. A taxonomy of watermarking methods for Al-generated content. In The Ist Workshop GenAl Watermarking, 2025. 3
[14] Elizabeth Hilbert, Gretchen Greene, Michael Godwin, and Sarah Shirazyan. Watermarking and metadata for genai transparency scale-lessons learned and challenges ahead. In The 1st Workshop GenAl Watermarking, 2025.
[15] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Demoising diffusson probabilistic models. In NeurIPS, 2020.
[16] Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Zhenqiang Gong. A transfer attack to image watermarks. In ICLR, 2025. 3
[17] Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of ann-baaedd watermarking by mini-batch of real and simulated jpeg compression. In ACM MM, 2021. 3, 6,
[18] Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai generated content. In ACM SIGSAC Conference on Computer and Communications Security, 2023. 3
[19] Andre Kassis and Urs Hengartner. Unmarker: A universal attack on defensive watermarking. arXiv preprint 2rX5::2405.08363 2024. 3
[20] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan-Yen Yen Lo, et al. Segment anything. In ICCV, 2023. 6
[21] Ismail Labiad, Thomas Bäck, Pierre Fernandez, Laurent Najman, Tom Sander, Furong Yc, Mariia Zameshina, and Olivier Teytaud. Log-normal mutations and their use in detecting surreptitious fake images. TMLR, 2024. 2
[22] Black Forest Labs. Flux. https://githubbcom// http://www...eaaaaaaooeettteetee
2024.
11

---

[23] Guanlin Li, Yifei Chen, Jie Zhang, Jiwei Li, Shangwei Guo, and Tianwei Zhang. Warfare: Breaking the watermark protection of ai-generated content. arXiv preprint arXiv:2310.07726, 2023. 2, 6.
[24] Hengyue Liang. Taihui Li, and Ju Sun. A baseline method for removing invisible image watermarks using deep image prior. arXiv preprint arXiv:2502. 139988 2025.
[25] Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang. Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. In ICLR, 2025. 2, 3, 6,
[26] Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschhaum. Leveraging optimization for adaptive attacks on image watermarks. In ICLR, 2024. 3
[27] Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In CVPR, 2020. 3
[28] Xiyang Luo, Michael Goebel, Elnaz Barshan, and Feng Yang. Leca: A learned approach for efficient cover-agnostic watermarking, arXiv preprint arXiv:2206.1083 2022. 3
[29] Rui Ma, Mengxi Guo, Yi Hou, Fan Yang. Yuan Li, Huizhu Jia, and Xiaodong Xic. Towards blind watermarking: Combining invertible and non-invertible mechanisms. In ACM MM, 2022. 3, 6,
[30] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2017. 5
[31] Andreas Müller, Denis Lukovnikov, Jonas Thictke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. arXiv preprint arXiv:2412.03223,, 2024. 3, 10
[32] Weili Nic, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. ICML, 2022. 2, 3, 6,
[33] Nikon. Nikon and afp collaborate verify the implementation of image provenance function in nikon cameras, 2024. Accessed on May 12, 2025.
[34] Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. In NeurlPS, 2022. 4
[35] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. CVPR, 2022. 3, 9
[36] Mehrdad Saheri, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks. In ICLR, 2024. 2, 3. 7,
[37] Tom Sander, Pierre Fernandez, Alain Durmus, Teddy Furon, and Matthijs Douze. Watermark anything with localized messages. ICLR, 2025.
[38] Shibani Santurkar, Andrew Ilyas, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Image synthesis with a single (robust) classifier. In NeurlPS, 2019. 5
[39] Dimitris Tsipras, Shihani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robust- ness may be at odds with accuracy. ICLR, 2019.
[40] Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Deep image prior. In CVPR, 2018.
[41] Ruowei Wang, Chenguo Lin, Qijun Zhao, and Feiyu Zhu. Watermark faker: towards forgery of digital image watermarking, In IEEE International Conference on Multimedia and Expo (ICME), 2021. 2,
[42] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In NewrIPS, 2023. 3, 10
[43] Sanghyun Woo, Shoubhik Debnath, Ronghang Hu, Xinlei Chen, Zhuang Liu, In So Kweon, and Saining Xie. Convnext v2: Co-designing and scaling convnets with masked autoencoders. In CVPR, 2023. 4, 6
[44] Rui Xu, Mengya Hu, Deren Lei, Yaxi Li, David Lowe, Alex Gorevski, Mingyu Wang. Emily Ching, and Alex Deng. Invismark: Invisible and robust watermarking for ai- ai-generated image provenance. In WACV, 2025. 3
[45] Pei Yang. Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks? In NewrlPS, 2024. 3, 6.7
12

---

[46] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable elfectiveness of deep features perceptual metric. In CVPR, 2018. 3,4
[47] Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In CVPR, 2024. 3
[48] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, llya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks provably removable using generative ai. In NeurfPS, 2024. 2, 7.
[49] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In ECCV, 2018.
13

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and introduction match the paper's contributions.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The limitations are highlighted the main paper, further details are presented in the appendix.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
14

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The key implementation details are presented in the paper. Additional details are available in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
15

---

Answer: [Yes]
Justification:
We provide the code and trained model at https://github. com/
www.aaaawrr..dddeeeeeeeeeeeeeeee Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.c cc/
publicc/giides/odeeSuueeee (ooooooessiiissssooooooolrrr for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run reproduce the results. See the NeurlPS code and data submission guidelines (https: /nips. ccips.cc/pullicguut ggtgg/uies////// /Cooeeubeiiiieeee cembbbmsssionnn ssionnolicyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The key details are presented in the paper. Additional details are available in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: The variance between different experiment runs is small relative to the differ- ence between most of the tested methods.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
16

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: The key details are presented in the paper. Additional details are available in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: //tee///nsuupaeee wwtppppppccppccppppppppppppppttt htlpppullbhliiccoceeepppipppppel wtwiiiieeellleeeeeee ines?
Answer:
[Yes]
Justification:
The research conforms with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
The societal impact is discussed in the conclusion of the paper.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
17

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [Yes]
Justification: We present broader impact and safeguards discussion in the conclusion of the paper.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Proper credits are given where applicable.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
18

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Documentation in the form of README files is attached to our code.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/cooe/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
19

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: This research does not involve LLMs.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy (https: httpps:///euripsss /tt.:////c...c.eeeeee//////////0 for what should or should not be described.
20

---

Appendix
A Additional results
Qualitative results. We show additional qualitative results for both watermark forging and removal. The watermark forging shown for various watermarking methods in Figure 10. Our method can extract the key features of the watermarks, such as the green dots of CIN, the noise grid of MBRS, the waves of TrustMark, and the Video Seal blobs. Similarly, watermark removal in Figure 11 and 12. Compared to the related methods, our approach makes smaller changes to the input image while removing the watermark more effectively.
show the qualitative results for
Watermark detection results. Multi-bit watermarking can be repurposed for simple watermark detection with false positive rate guarantee by using a fixed binary message. In this setup, the detection is performed by computing the number of detected bits that match the fixed binary message. The associated false positive rate is then computed by assuming that the number of matching bits for non-watermarked images follows binomial distribution. We test our method in this detection setup and show the ROC curves for the watermark forging in Figure 7. The results show that our method is very competitive while maintaining good visual quality.
Limitations. As mentioned in the main paper, method may blur some parts of image, such as water surfaces, trees, grass, and clouds. These limitations are shown in Figure 9.
B Additional ablations
Backpropagation steps. To forge remove watermark from image, perturb the input image to maximize the score of our preference model. This optimization is done via gradient descent for & steps. We show the difference in performance for different number of steps for watermark forging in Table and for watermark removal in Table 6. We also show the effect of watermark removal visually in Figure 8. In the figure, can see that even for k 50, the watermark is almost completely removed. For larger k, more high-free frequency noise-like artifacts are removed from the image, effectively smoothing uniform areas while keeping the edges sharp (see the Ferris wheel support cables).
C Additional implementation details
Fourier artifact hyper-parameters. For the wave style artifacts, we use Nmax 50, and sample one Tmaz per image from the uniform distribution 24 (60, 200]. For the noise artifacts, we use Smin 20 and Smaz 50. For the line style artifacts, we use Mmaz 10, s and 8maar = 35. We use the same number of vertical and horizontal lines for each image.
Runtime details. For watermark removal, we rescale input images resolution 768 768. We run the SGD optimizer with a learning rate of 0.05 for 50 to k 500 steps. The SGD runtime for single image using Quatro GP100 GPU six seconds for 50 steps using vanilla Py PoTcc without JIT optimization.
TrustMark
Video
Image avaraging
Image aver
Image averaging
Tue Pevitive Date
0.5
Curs
01.5
Ours
Frue Pesilivee Haite
0..5
Gurs
Ful Pasiiive
0.4
0.4
0.4
02
0.2
0.2
10 10 30 30 10 10-M
20
10-27
10-11
10
10
30
30
10-11 10
10 10"
Salse Positive ling scale)
Posiitvv Dln
Posttivv lng
Figure 7: The ROC curves for watermark forging.
21

---

Table The effect of the number of backpropagation steps & used for watermark forging. A larger
number of steps forges more bits of information while distorting the image more.
CIN
MBRS
TrustMark
Video Seal
Method
PSNR(())
Bit acc. (1)
Bit acc. (1)
Bit acc. (t)
acc. (t)
: 50
0.99
0.75
0.56
0.75
39.3
100
1.00
0.79
0.57
0.80
37.4
A 200
1.00
0,81
0,59
0.82
35.0
A 300
1.00
0.82
0,60
0.83
33.4
è: 500 (Ours)
1.00
0.83
0.61
0.83
31.3
Table The effect of the number of backpropagation steps used for watermark removal. A larger number of steps removes more bits of information while distorting the image more.
CIN
MBRS
TrustMark
Video Seal
Method
PSNR(1)
acc. (J)
Bit acc. (4)
Bit acc. (4)
acc. (4)
A 50
1.00
0.83
0.95
0.85
38.8
100
0.97
0.77
0.86
0.64
37.0
:: 200
0.93
0.70
0.73
0.50
34.6
A 300
0.89
0.67
0.66
0.50
33.3
K: 500 (Ours)
0.82
0.64
0.60
0.49
31.2
watermarked image actual watermark
k 50
= 100
A: 200
k 500
Figure 8: Qualitative example showing the distortion of the input watermarked image (left) for different number of backpropagation steps k. More image details are removed for larger k.
Figure 9: Method limitations. The distortion created by our method (right) by optimizing the input image (left) can lead to unnatural smoothing of some surfaces when the number of backpropagation steps A is high (k- = 500).
Code and visualizations. We provide code for image preference model training and wa- termark removal as well pretrained preference model weights at https://githi facebookresearchh hatebbbrrrerrrr///eeeeeeeeeeeeee wateeeee//rreemaaan/eeeeeeeeeeee
com/ The visualizations of all watermarks in the paper done clip(n |w], 0, 255) where the factor is chosen to magnify the watermark. The same factor a is chosen for watermarks in a figure.
22

---

clean image
CIN
MBRS
TrustMark
Video Seal
soorree image
extracted watermork
forged image
Figure 10: Qualitative results for watermark forging. The figure shows a watermarked image (top) with its watermark removed by method (middle row). The watermark is pasted onto new image (bottom row). We use k 50 steps for the watermark extraction.
watermarked image
Image averaging
DiffPure
ChrlRegen
Ours
Figure 11: Qualitative results for watermark removal. The figure shows a watermarked image (left) with watermark removed by different methods (top row) and the actual removed watermark by each method (bottom row).
23

---

watermarked image
Imuge averaging
DillPure
CiriRegen
Ours
actual watemmark
actuol watermark
actual watermork
Figure 12:
Qualitative results for watermark removal. The figure shows a watermarked image (left) with its watermark removed by different methods (top row) and the actual removed watermark by each method (bottom row).
24


Reviews:
[{"review_id": "VkBpImnUOp", "reviewer": "Reviewer_sN3U", "summary": "This paper proposes a generalizable black-box watermark extraction attack that requires only a single watermarked image to extract the underlying watermark pattern for forging or removal. Specifically, the authors synthesize artifacts to simulate invisible watermark patterns and train a preference model to distinguish between watermarked and clean images. This trained model is then used as a surrogate model to perform adversarial optimization and extract the watermark pattern from any given watermarked image. The method is evaluated on four watermarking techniques—CIN, MBRS, TrustMark, and VideoSeal—demonstrating its effectiveness.", "questions": "Why did the authors choose wave-, noise-, and line-style synthetic artifacts? What is the individual contribution of each type? Which one is most effective in mimicking real watermark patterns?", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n* The proposed watermark attack is both novel and effective. Compared to previous extraction methods, the ability to attack using only a single watermarked image significantly improves its practicality.\n* The paper is well-written, and the experiments are thorough.\n\n**Weaknesses**\n\n* The attack would be more convincing if it were evaluated on diffusion-based watermarking methods such as RingID and GaussianShading.", "was_revised": true, "final_justification": "The author's reply resolved my concerns about which synthetic artifact is most effective. I would like to maintain my previous score.", "rebuttal": "We thank the reviewer for their thoughtful comments. We are pleased that they find our work novel and thorough. We respond to the specific points raised below and kindly ask the reviewer to let us know if these address their concerns.\n\n**Q1: Contribution of synthetic artifacts**\\\n We thank the reviewer for raising this insightful question. To address it, we conducted an additional experiment focusing on the choice of synthetic artifact types, which are motivated by common artifact patterns observed in computer vision, such as noise and checkerboard patterns. Specifically, we trained our model independently for each style of watermark pattern to evaluate their individual effectiveness. From the watermark removal results in the table below, we can see that the wave pattern is the most effective in removing watermarks. But on average, the combination of the three watermark types produces significantly better results than only the wave style pattern. We will include this analysis in the paper.\n\n|  | CIN (bit. acc.) ↓ | MBRS (bit. acc.) ↓ | TrustMark (bit. acc.) ↓ | VideoSeal (bit. acc.) ↓ |\n| --- | :---: | :---: | :---: | :---: |\n| Ours | 0.82 | 0.64 | 0.60 | 0.49 |\n| Only wave style | 0.98 | 0.83 | 0.55 | 0.45 |\n| Only noise | 1.00 |  0.97 | 0.99 | 0.97 |\n| Only line style | 1.00 | 0.95 | 0.99 | 0.95 |\n\n**W1: Diffusion-based watermarking**\\\nOur method’s focus is on the post-hoc watermarking, which is a widely used approach that has broad applications beyond diffusion models and beyond generated content in general. In diffusion watermarking, such as RingID, watermark is encoded into an image by altering objects and their locations in the generated image. Our method cannot semantically change these objects, therefore, different methods must be used for forging these semantic watermarks (e.g., see [31]).\n\n[31] Black-box forgery attacks on semantic watermarks for diffusion models. CVPR 2025."}, {"review_id": "1cpsuyxmid", "reviewer": "Reviewer_JknL", "summary": "This paper presents a method for watermark forging and removal that requires only a single watermarked image and no access to the watermarking algorithm or decoder, representing a realistic black-box threat model. The core of the method is an image preference model trained on synthetically corrupted images to learn to detect unnatural visual artifacts. This preference model is then used as a surrogate loss function to guide gradient-based optimization that can remove or forge watermarks in a generic and transferable manner. The authors validate their method across several state-of-the-art post-hoc watermarking schemes and show strong empirical results, outperforming prior work that requires significantly more data and assumptions.", "questions": "1: Have you evaluated your method on AI-generated content from diffusion models (e.g., Stable Diffusion) that may contain embedded watermarks or platform fingerprints? How do you anticipate your method will generalize to such real-world scenarios?\n\n2: Your method performs well on synthetic and high-frequency watermarks. How would it perform on semantic or learned watermarks (e.g., those embedded in latent space or object features)?\n\n3: Did you test whether the forged images can evade watermark detectors used by platforms (e.g., Google SynthID)?\n\n4: Have you compared your preference model to traditional image quality metrics (e.g., LPIPS)?", "limitations": "Partly: while the authors mention some safeguards and discuss a bit the ethical aspects, the justification (there are already methods out there that do the same thing, in essence) is not a great reasoning. This should be further discussed.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The attack assumes only access to a single watermarked image and no interaction with the underlying watermark model or decoder, making it applicable to realistic black-box settings—unlike prior methods that require many samples or access to APIs.\n- The proposed method is transferable and data-efficient, working across different watermarking methods with minimal assumptions and no need for model-specific adaptation or multiple samples.\n- The preference model, trained on synthetic perturbations, provides a general-purpose signal for guiding watermark removal and synthesis—without requiring real watermarked data\n- The paper is evaluated on four major watermarking systems and reports both quantitative metrics (bit accuracy, PSNR) and qualitative visual results. It includes detailed ablation studies that strengthen the empirical claims.\n\nWeaknesses:\n- While strong overall, the method underperforms on TrustMark, which uses a highly content-dependent decoder. This suggests limitations when watermarking schemes are deeply entangled with semantic content.\n- All evaluations are performed on benchmark datasets and simulated watermarking schemes. The effectiveness on real-world dataset remains uncertain.\n- The preference model is based on synthetic noise and may not fully capture semantic-level indicators of watermarks—especially if the watermark is adaptively designed or learned jointly with the content.\n- The experimental section lacks statistical significance analysis or variance reporting, which would strengthen claims about generalizability and robustness. Some additional theoretical analysis and/or results would strengthen the paper.\n- The paper does not provide robustness evaluations under adversarial detection or detection-aware defense schemes.", "was_revised": true, "final_justification": "Based on the response and clarifications, I have updated my rating and am in favor of acceptance, under the assumption the authors clarify better potential safeguards and ethical considerations, given the potential for misuse of this type of work, as the current justification for lack of safeguards is not reasonable.", "rebuttal": "We thank the reviewer for their insightful comments and questions, as well as for finding our work relevant and empirically strong. We respond to the specific points raised below and kindly ask the reviewer to let us know if these address their concerns.\n\n**Q1: Evaluation of our method on the Stable Diffusion watermark**\\\nTo the best of our knowledge, the only watermarked Stable Diffusion images come from the original CompVis GitHub repository. Other Stable Diffusion proxies, such as HuggingFace do not contain any watermarking. Images generated by Stable Diffusion from the CompVis GitHub repository are watermarked using the dwtDct method from the invisible-watermark library. This method has been proven to be very brittle and not to have good performance, as demonstrated in [11, 42]. However, to mitigate any doubts, we also run watermark removal on images watermarked using the dwtDct method and we observe that our method is able to completely remove the watermark, i.e., the bit accuracy for the resulting images is 50%. We would be happy to include any other publicly available method.\n\n[11] The stable signature: Rooting watermarks in latent diffusion models. ICCV 2023.\\\n[42] Tree-rings watermarks: Invisible fingerprints for diffusion images. NeurIPS 2023.\n\n**Q2 & W3: Semantic watermarks**\\\nOur method’s focus is on the post-hoc watermarking, which cannot introduce large semantic changes to the input image. This is especially true in the case when the post-hoc watermarking is used to ensure authenticity of images (e.g., if a photo comes from a reputable news source). Semantic watermarking, such as Tree-Ring or RingID, watermarks AI generated content by altering the objects and their locations in a generated image. Our method cannot semantically change these objects, therefore, different methods must be used for forging these semantic watermarks (e.g., see [31]).\n\n[31] Black-box forgery attacks on semantic watermarks for diffusion models. CVPR 2025.\n\n**Q3: Google SynthID forging**\\\nGoogle SynthID is a closed source product where the watermark detector is not available, therefore, we were unable to evaluate against that. We note that at Google’s developer conference on May 20, 2025, i.e., after the NeuIPS paper deadline, waitlist-based access to SynthID has been announced. However, we were unable to gain access to the API yet. For other providers (HuggingFace, Ideogram, Flux, etc.), there is very little information on if/how they do watermarking, and even less on how to get access to the detection. Therefore we were unable to test against the detectors used by all these platforms, although doing so would have indeed strengthened the paper.\n\n\n**Q4: Additional qualitative metrics**\\\nWe were unsure about the reviewer’s question, specifically, whether they were (a) asking us to compare our attack using the preference model against other qualitative metrics, or (b) suggesting that the preference model itself be used as a qualitative metric, in which case it would be compared to LPIPS for evaluating the quality of other images.\n\nIf **(a)** We show the requested LPIPS quality metric and CVVDP quality metric [B] for watermark removal in the table below. We observed that CVVDP metric correlates with human judgement better than many standard metrics. We will add the new metrics into the paper.\n\n|   | PSNR ↑ | LPIPS ↓ | CVVDP ↑ |\n| --- | :---: | :---: | :---: |\n| VAE (FLUX.1 [dev]) | 34.3 | 0.060 | 9.58 |\n| DiffPure (FLUX.1 [dev]) | 25.4 | 0.278 | 7.14 |\n| CtrlRegen (step = 0.1) | 24.4 | 0.204 | 7.10 |\n| Ours | 31.2 | 0.198 | 8.08 |\n\nIf **(b)** This is an interesting suggestion, although it goes beyond the scope of our current paper. It would indeed be a valuable direction to explore, as we have observed that traditional metrics like PSNR, SSIM, LPIPS, and CVVDP can sometimes yield high scores for watermark distortions that are clearly visible, or, conversely, give low scores (e.g., PSNR < 30dB) for distortions that are barely perceptible. That said, using the preference model as a metric could be challenging, as its outputs may vary significantly depending on the type of image (typically textured vs flat) and could therefore be hard to calibrate. Moreover, properly evaluating the metric would require assessing its correlation with human judgments and comparing it to LPIPS, which would demand substantial effort to design and carry out a robust user study.\n\n[B] ColorVideoVDP: A visual difference predictor for image, video and display distortions. Arxiv 2024.\n\n**W1: Lower performance for TrustMark**\\\nIndeed, the TrustMark watermarks are difficult to forge using any forging method. However, 61% bit accuracy is not random, and there are still individual forged images with bit accuracy close to 90%. Therefore, with enough effort, it is still possible to confidently fool TrustMark’s detector with a forged watermarked image. The key contribution of this work is highlighting this potential attack vector for watermarking methods and we believe this work will motivate further research into watermarking methods that utilize highly content-dependent decoders, thus making any forgery very difficult.\n\n**W2: Effectiveness on real-world dataset**\\\nOur experiments are done on the SA-1b dataset. This is a high-resolution and high-quality dataset of real-world photos. To mitigate any doubts, we also test our method on AI generated images from Stable Diffusion. From the results on watermark forging in the table below, we can see our method performs very similarly on both real-world photos as well as AI generated images. We are happy to include any other dataset in our experiments.\n\n|  | CIN (bit. acc.) ↑ | MBRS (bit. acc.) ↑ | TrustMark (bit. acc.) ↑ | VideoSeal (bit. acc.) ↑ |\n| --- | :---: | :---: | :---: | :---: |\n| SA-1b | 1.00 | 0.83 | 0.61 | 0.83 |\n| Images generated by SD | 1.00 | 0.82 | 0.61 | 0.82 |\n\n**W4: Statistical significance analysis**\\\nWe train 3 additional preference models, each with different random seed and report standard deviation for our watermark removal results in the table below. The table shows there is not much difference in performance across different models.\n\n|  | CIN (bit. acc.) ↓ | MBRS (bit. acc.) ↓ | TrustMark (bit. acc.) ↓ | VideoSeal (bit. acc.) ↓ |\n| --- | :---: | :---: | :---: | :---: |\n| Ours (as reported in the paper) | 0.82 | 0.64 | 0.60 | 0.49 |\n| Ours (mean/std, 4 models) | 0.84 ± 0.02 | 0.64 ± 0.01 | 0.62 ± 0.02 | 0.47 ± 0.02 |\n\n**W5: Robustness evaluations under detection-aware defense schemes**\\\nUnfortunately, we are not aware of any such work in the context of watermarking. We are happy to include any evaluation if we are given the reference to such work or additional details on how to conduct such evaluation.\n\n**Safeguards and ethical aspects**\\\nThank you for the feedback. We will include further discussion and clarification on the method’s impact in these areas, and would be interested in any further feedback the reviewer could give."}, {"review_id": "IsDgN8JcFD", "reviewer": "Reviewer_S7WC", "summary": "The authors address watermark forging from a single image in a black-box setting. They (1) train a preference model on procedurally corrupted images using a ranking loss, (2) treat the model’s score as a surrogate objective to optimize pixels and extract an estimated watermark, and (3) paste this estimate onto arbitrary targets to forge or remove post-hoc watermarks, all without access to the underlying watermarking system. Experiments on four recent schemes (CIN, MBRS, TrustMark, VideoSeal) show competitive removal accuracy.", "questions": "Please review the Weaknesses section. If all of my concerns are fully resolved, I’ll gladly raise my rating further; if they aren’t, I may lower it.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "## Strengths\n1. Introduces a ranking-based preference model trained without any real watermarks.\n2. The design of artifact types for the training preference model is reasonable.\n3. The idea is clearly conveyed.\n\n## Weaknesses\n1. The evaluated watermarking models lack sufficient robustness. Leading models such as StegaStamp [1] and VINE [2], known for their enhanced robustness, were not included in the tests. Incorporating experiments with these robust watermarking models into Tables 1, 2, and 3 is recommended, particularly for VINE, which claims resilience to image editing. A comprehensive evaluation of these models would significantly strengthen this work.\n\n2. Do forged watermarks exhibit the same robustness as their original counterparts? Specifically, are forged watermarked images from VINE equally resistant to image editing? Investigating the impact on robustness would provide valuable insights.\n\n[1] [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://arxiv.org/abs/1904.05343)\n\n[2] [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://github.com/Shilin-LU/VINE)", "was_revised": true, "final_justification": "Thank you very much for your effort and thorough response. \n\nI have carefully read all the review comments as well as the authors’ responses. I believe the authors have adequately addressed my concerns, and I have raised my score.", "rebuttal": "We thank the reviewer for their thoughtful comments. We are pleased that they find our paper clear and well motivated. We respond to the specific points raised below and kindly ask the reviewer to let us know if these address their concerns.\n\n**Q1: Results for StegaStamp and VINE**\\\nWe considered StegaStamp and VINE. Unfortunately, the official StagaStamp weights are no longer available online. Nonetheless, we considered the community implementation of StegaStamp [A] and show the watermark forging results in the table below. Please note that StegaStamp is robust only because it makes very big unnatural changes to the input image – this is also reported by the authors of StegaStamp where the method achieves a very low PSNR/SSIM score of 28.5/0.905 for the 100 bit model. In contrast, the tested watermarking methods in our paper (CIN, MBRS, TrustMark and VideoSeal) reach values of more than 0.99 in SSIM and more than 40 in PSNR. The very visible changes to the input images make StegaStamp less useful in practice.\n\nVINE claims leading robustness to various attacks such as image editing, however, this is achieved by embedding the watermark message very visibly at the image edges (see the bottom right corner of the watermarked image in the official demo_colab.ipynb of the VINE GitHub repository). The watermark can be removed from the image by simple cropping by 10 pixels, i.e., running the detection on `Image.fromarray(np.array(output_pil)[:-10, :-10])` in the official colab yields bit accuracy 55%. However, as requested, we also show the watermark forging results for VINE in the table below.\n\n| Method | StegaStamp (bit acc.) ↑ | VINE (bit acc.) ↑ |\n| --- | :---: | :---: |\n| Image averaging (n=100) | 0.70 | 0.98 |\n| DiffPure (FLUX.1 [dev]) | 0.56 | 0.80 |\n| Ours | 0.60 | 0.84 |\n\nWe use the same setup and data as for the other methods in Table 1 in the paper. The extremely high score of Image averaging for the VINE method indicates that VINE watermarks are not content dependent in practice. In comparison, the benefit of our method is that it requires only a single image to forge the watermark. Also, our method can be applied to watermarks that are highly content-dependent, e.g., VideoSeal watermarks, where the Image averaging method does not work and cannot work by principle.\n\n[A] WAVES: Benchmarking the Robustness of Image Watermarks\n\n\n**Q2: Robustness of forged watermarks.**\\\nRobustness is valuable because it allows watermark owners to identify their images even if modified by various transformations that may appear in the wild on the Internet (e.g., image compression, cropping, etc.). In the context of forging, the goal of the attacker is to create forged watermarked images that appear legitimate (i.e. they are detected as watermarked by a detector). Thus, robustness to transformations is less relevant in this thread model.\n\nNonetheless, prompted by the reviewer, we evaluated the robustness of the forged VINE watermarks.\nWe apply the VINE image editing script (image_editing.py from the official VINE GitHub repository) to the images with forged watermarks. We achieve bit accuracy of 66% (down from 84%). This result indicates the forged watermarks are less robust than their original counterparts but they cannot be stripped completely."}, {"review_id": "0UPAzN3Av2", "reviewer": "Reviewer_NQzv", "summary": "The paper proposes a novel watermark forging method that leverages a preference model to extract the watermark from a single watermarked image. By optimizing the input image, the method recovers the watermark without access to the underlying watermarking model. This makes the process more practical than prior approaches, which typically require multiple watermarked examples or white-box access.", "questions": "1. The watermarking methods referenced in your work (e.g., CIN, MBRS, etc.) are all learning-based, and as such, the encoding process is non-linear and specifically non-additive. Given this, what is the intuition behind the subtraction and addition operations used in your framework to retrieve and apply the watermark?\n2. Have you considered incorporating an image regularization loss to mitigate the unnatural smoothing artifacts observed in Figure 2 of the appendix?\n3. Could you clarify how the watermark is selected in your experiments?", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n1. The paper is generally well-written and easy to follow. The methodology and results are clearly described, and the topic is relevant.\n2. The proposed approach improves practicality by not requiring access to the watermark decoder and by working with only a single watermarked image.\n3. The authors conduct a comprehensive set of experiments and ablation studies to validate the effectiveness of their method.\n\n**Weaknesses**\n1. From the results, it appears that the proposed approach only outperforms prior work on the Video Seal case in terms of bit accuracy. It does not seem to generalize well to other use cases and does not show improvements in image quality as measured by PSNR.\n2. The small sample size (100) may limit the reliability of the findings.\n3. Including additional empirical results, such as AUROC, could provide a more complete picture of detection performance.", "was_revised": true, "final_justification": "The authors have addressed most of my concerns, so I will raise my score.", "rebuttal": "Thank you for your thoughtful feedback. In this rebuttal, we show that our method is the **best available one‑shot, black‑box attack**, clearly outperforming alternatives like DiffPure in image quality while remaining highly effective. As requested, we also provide **new experiments on 1000 test images** confirming reliability, along with **AUROC/ROC analysis** to highlight detector performance in realistic FPR ranges. We hope the reviewer finds these arguments and results compelling, and if so, we would be very grateful if they could consider raising their score.\n\n**W1: Our method’s results with respect to the related work**\\\nWe thank the reviewer for this comment. While the numbers may appear mixed at first glance, we argue that our method is the best attack for real‑world watermark forging and removal because it is the only practical one‑shot, black‑box method that combines strong accuracy with high perceptual quality. Here’s why:\n\nForging (Table 1): Our method achieves 1.00 bit accuracy on CIN, 0.83 on MBRS, and 0.83 on VideoSeal, on par with or better than DiffPure (0.75 on VideoSeal). Crucially, we preserve 31.3 PSNR, significantly higher than DiffPure (26.6 PSNR). The only method with higher quality (but lower bit accuracy) is Warfare (39.6 PSNR), but it requires 1000 watermarked images with the same hidden message, which is infeasible in realistic scenarios.\n\nRemoval (Table 2): Our method delivers 31.2 PSNR, while DiffPure and CtrlRegen degrade to 25.4 and 24.4 PSNR, respectively. The only method with higher PSNR is VAE (34.3), but it is not a functional attack: watermark bit accuracy remains ≥99%, meaning the watermark is essentially intact. In contrast, our method meaningfully reduces bit accuracy (e.g., 0.82 on CIN, 0.49 on VideoSeal) while preserving high visual quality.\n\nIn summary, **our method is the most practical and effective one‑shot, black‑box attack available** today as it:\n- **Matches or surpasses other one-shot black-box methods** (e.g. DiffPure) in bit accuracy while improving PSNR by +5–6 points.\n- **Outperforms Image Averaging and Warfare in feasibility**, requiring only a single image instead of hundreds or thousands.\n\n\n**W2: Small sample size**\\\nWe chose the sample size of 100 images due to the long run time of all the experiments and baselines. To alleviate any doubts, we also evaluate our method on 1000 test images for watermark removal (see the table below) with minimal difference to the reported numbers for 100 images.\n\n|  | CIN (bit. acc.) ↓ | MBRS (bit. acc.) ↓ | TrustMark (bit. acc.) ↓ | VideoSeal (bit. acc.) ↓ |\n| --- | :---: | :---: | :---: | :---: |\n| Ours (test set 100 images) | 0.82 | 0.64 | 0.60 | 0.49 |\n| Ours (test set 1000 images) | 0.84 | 0.65 | 0.60 | 0.47 |\n\n**W3: Reporting AUROC**\\\nThank you very much for the suggestion on AUROC. The paper currently focuses purely on multi-bit watermarking and introducing an experiment in a more practical scenario of watermark detection makes it more relevant. We therefore present the AUROC values for watermark forging in the table below. For watermarking, a very low false positive rate is crucial, therefore, we will also include in the paper the full ROC curves highlighting the performance of various models in the [10^(-6), 10^(-4)] FPR range.\n\nFor this experiment, we first forge the watermark with the same setup as the main paper, then extract the binary message and compute the number of matching bits with regards to the original one. We then compute the ROC, considering theoretical FPRs (assuming that the number of matching bits for non-watermarked images follows a binomial distribution). The AUROC results show, similarly to the bit accuracy results in Table 1, that our method is very competitive or outperforms the related methods while maintaining good visual quality.\n\n|  | CIN (AUROC) ↑ | MBRS (AUROC) ↑ | TrustMark (AUROC) ↑ | VideoSeal (AUROC) ↑ |\n| --- | :---: | :---: | :---: | :---: |\n| Image averaging (n=100) | 1.00 | 1.00 | 0.88 | 0.51 |\n| DiffPure (FLUX.1 [dev]) | 1.00 | 1.00 | 0.78 | 0.91 |\n| Ours | 1.00 | 1.00 | 0.79 | 0.93 |\n\n\n**Q1: Non-additive Watermarks**\\\nThis is an excellent remark. Recent work (Yang et al., NeurIPS 2024) shows that even simple additive operations can remove or forge watermarks in state‑of‑the‑art systems. We argue this vulnerability arises because detectors are not trained to enforce image–watermark consistency: nothing prevents a watermark from image x from being valid on image y, making it easier for embedders to collapse toward non‑content‑aware solutions. In our experiments, swapped watermarks were still detected with high accuracy (CIN 100%, MBRS 94%, TrustMark 77%, VideoSeal 87%).\nThis is why we urge the community to develop truly content‑aware detectors — for example, by using antiforging losses that penalize when a watermark from one image is validated on another. We will add this point in the paper.\n\nYang, P., Ci, H., Song, Y., & Shou, M. Z. (2024). Can Simple Averaging Defeat Modern Watermarks? NeurIPS 2024. \n\n**Q2: Image regularization loss to mitigate smoothing artifacts**\\\nAfter the submission, we tested adding blurring to the set of synthetic artifacts. This substantially decreased the smoothing artifacts in the images. We will include these new findings in the paper.\n\n**Q3: Watermark selection details**\\\nAs described in Section 4.1, we watermarked 100 images from the SA‑1b validation set using CIN, MBRS, TrustMark, and VideoSeal, with random messages of the appropriate length. For comparability, each method used the same hidden message across all 100 images, since approaches like Warfare and Image Averaging cannot handle multiple messages. We measured bit accuracy of the respective extractors for both removal and forging."}]

Author rebuttal:

Meta-review: The paper proposes a method to remove of forge post-hoc watermarks from images. Therefore, it requires only one watermarked image. The method relies on first programmatically generating artifacts (without knowledge of the watermark) and then to train a preference model on watermarked and natural images. This preference model yields a surrogate loss function that can guide gradient-based optimization to remove or forge generic watermarks.

**Strengths**: The proposed novel and practical, requiring access only to one watermarked image and does not make assumptions on the watermarking scheme. The evaluation is thorough, both in comparison baselines and ablations on the inner-workings of the method. The rebuttal backed the strong initial results up further by adding additional qualitative metrics and experiments on additional data.

**Weaknesses:** The reviewers suggest the authors to tune down their claims on being the *only* practical solution and discussing more in detail for which setups the methods is best suited and for which applications it is limited (e.g. semantic watermarks). 

As a future direction, it is suggested to extend the work towards in-generation watermarks.
Decision: Accept (spotlight)