The Future Unmarked: Watermark Removal in AI-Generated Images via Next-Frame Prediction
Authors: Huming Qiu
Zhaoxiang Wang
Mi Zhang
Xiaohan Zhang
Xiaoyu You
Min Yang
Venue: NeurIPS 2025 poster ()
Keywords: Deep Learning
Image Watermarking
Watermark Removal Attack
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Image watermarking embeds imperceptible signals into AI-generated images for deepfake detection and provenance verification. Although recent semantic-level watermarking methods demonstrate strong resistance against conventional pixel-level removal attacks, their robustness against more advanced removal strategies remains underexplored, raising concerns about their reliability in practical scenarios. Existing removal attacks primarily operate in the pixel domain without altering image semantics, which limits their effectiveness against semantic-level watermarks.
In this paper, we propose Next Frame Prediction Attack (NFPA), the first semantic-level removal attack. Unlike pixel-level attacks, NFPA formulates watermark removal as a video generation task: it treats the watermarked image as the initial frame and aims to subtly manipulate the image semantics to generate the next-frame image, i.e., the unwatermarked image.
We conduct a comprehensive evaluation on eight state-of-the-art image watermarking schemes, demonstrating that NFPA consistently outperforms thirteen removal attack baselines in terms of the trade-off between watermark removal and image quality. Our results reveal the vulnerabilities of current image watermarking methods and highlight the urgent need for more robust watermarks.

The Future Unmarked: Watermark Removal in AI-Generated Images via Next-Frame Prediction
Huming Qiu', Zhaoxiang Wang', Mi Zhang'; Xiaohan Zhang', Xiaoyu You², Min Yang
FFudan University, Shanghai, China
East China University of Science and Technology, Shanghai, China
(hmqiu230m. zhaoxiangvang256m..
mi mi_ _a_znna th_zhang@, m_yang@)fddan. edu. cn xlaoyuyoudecust.edi
Abstract
Image watermarking embeds imperceptible signals into Al Al-generated images for deepfake detection and provenance verification. Although recent semantic-level watermarking methods demonstrate strong resistance against conventional pixel- level removal attacks, their robustness against more advanced removal strategies remains underexplored, raising concerns about their reliability in practical narios. Existing removal attacks primarily operate in the pixel domain without altering image semanties, which limits their effectiveness against semantic-level watermarks. In this paper, we propose Next Frame Prediction Attack (NFPA), the first semantic-level removal attack. Unlike pixel-level attacks, NFPA formu- lates watermark removal as video generation task: it treats the watermarked image as the initial frame and aims subtly manipulate the image semantics generate the next-frame image, i.c.. the unwatermarked image. We conduct a comprehensive evaluation on eight state-of-the-att image watermarking schemes, demonstrating that NFPA consistently outperforms thirteen removal attack base- lines terms of the trade-off between watermark removal and image quality. Our results reveal the vulnerabilities of current image watermarking methods and highlight the urgent need for more robust watermarks. Code is available btttps://githee com//224774808///FP
1 Introduction
Text-to-image (T21) generation models 34
have found widespread applications across various domains [1 36 23 yet they also face significant risks of malicious misuse, particularly in generating deepfake content [16 1 Numerous cases demonstrate that these models are exploited to produce false information and inappropriate materials [1O]. As an active defense mechanism, image watermarking embeds imperceptible watermarks into generated images to effectively mitigate the negative consequences model abuse [39]. For example, DeepMind employs the SynthID [4] to embed invisible watermarks in Al-generated images for copyright protection and misuse prevention. However, since malicious attackers may become aware of these watermarks and attempt to remove them, watermarks must possess sufficient robustness to withstand potential removal attacks [37].
35
38
To address this issue, many image watermarking schemes prioritize robustness as core design principle, with gradual research shift from pixel-level to semantic-level watermarks that offer greater potential for resilience [48) For example, HiDDeN 49). an early pixel-level watermarking scheme, embeds watermarks by introducing small perturbations in the pixel space and incorporates noise simulation layers to enhance robustness against noise-based distortions. In contrast, TreeRing [43
"Corresponding authors
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Semantic-level Watermarking
Pixel-level Attack
Sementic-level Attock
Add Watermark
Removal
Attack
Original
natermarked Image
Distortion
Regeneration Attack
Adversanial Attock
NFPA (Ours)
Image
Watermark Detector
Undetected
Detectee
Detected
Detecctdd
Detected
Undetected
Figure I: Examples of existing removal attacks. Pixel-level attacks attempt to remove the watermark by modifying pixels, yet the semantic-level watermark remains detectable. In contrast, attack manipulates image semantics to effectively evade watermark detection.
represents recent semantic-level approach that embeds circular watermark patterns in the initial noise freguency domain of T2I models, thereby manipulating the semantic features of the generated images. This design improves the watermark's 's adaptability transformations such as translation and rotation. Compared to pixel-level watermarks, semantic-level watermarks leverage the semantic structure of images for detection, making them inherently more robust to image transformations, denoising, and other perturbations (
However, despite the robustness of state-of-the-art (SOTA) image watermarking schemes against certain removal attacks, their resilience remains insufficiently validated and underexplored. This gap may lead to overestimation of their reliability in real-world applications, fostering false sense of security B [22]. As illustrated in Figure existing attack methods primarily operate at the pixel level, attempting to remove watermarks through minor perturbations the pixel space without modifying the underlying semantic structure. This limitation may explain their reduced effectiveness against semantic-level watermarks. Consequently, natural question arises:
Is there semantic-level removal attack capable of removing SOTA image watermarks?
Our Work. This paper, for the first time, proposes semantic-level watermark removal attack, providing a clear affirmative answer to the question raised above. Unlike traditional pixel-level removal methods, we develop a semantic-level attack that removes watermarks in Al-generated images by manipulating their semantic structure. However, the semantic-level attack faces several key challenges, primarily how to effectively remove watermark while preserving the semantic content of the image as much possible (see deelsection 3 for details).
Inspired by advances in video generation 21 31 30 we propose Next Frame Prediction Attack (NFPA) to address these challenges. Specifically, NFPA formulates the semantic-level watermark removal task next-frame prediction problem: treats the watermarked image as the initial frame and removes the watermark by semantically modifying the image through the prediction of the next frame 21. Since temporal consistency fundamental property of video generation, 2i typically differs only slightly from Zp, and the two frames are generally considered visually equivalent [45). thereby ensuring semantic consistency between the attacked and watermarked images. In addition, NFPA possesses several key properties: (i) universal, effective against all image watermark types, (ii) black-box, requiring no knowledge of the watermark, (iii) data-free, requiring no additional data, and (iv) query-free, requiring no feedback from the detector.
To enable the effectiveness of NFPA, we design novel video (frame) generation framework to support our attack pipeline. This architecture leverages pre-trained T21 generation model and adapts next-frame prediction model zero-shot, tuning-free manner, allowing for the rapid generation of high-quality next-frame images without additional training. Specifically, we take the watermarked image as conditional input and obtain its latent representation through the DDIM inversion process, which serves as the fitial--raae noise. We then construct flow matrix to simulate motion trajectory of the next frame and accordingly warp the initial noise to produce the noise for the next frame. To effectively remove the watermark, we constrain the next-frame noise to lie within a predefined search space while maximizing its distance from the initial noise. Furthermore, replace the standard self-attention mechanism with a frame-level attention mechanism to enhance

---

spatiotemporal consistency between adjacent frames. Finally, we apply the denoising process to generate the next-frame image, which corresponds the unwatermarked image.
Overall, the main contributions of this paper are as follows:
We propose the first semantic-level image watermark removal attack, Next Frame Prediction Attack (NFPA), which focuses on removing watermarks by modifying the semantic structure of the image. Drawing inspiration from video generation, we reframe the semantic-level removal attack as a next-frame prediction task, ensuring that the attacked image maintains semantic consistency with the original watermarked image.
We design a novel zero-shot, tuning-free next-frame prediction framework, which takes the watermarked image the initial frame condition and efficiently generates unwaternarked images through next- coxt-frame prediction. By introducing flow matrix with a maximization search strategy. NFPA effectively facilitates watermark removal.
We conduct a systematic evaluation of NFPA on eight image watermarking schemes and compare it with thirteen removal attack baselines. The experimental results validate that NFPA effectively removes SOTA image watermarks while preserving image quality, further revealing significant shortcomings in the robustness of current image watermarking schemes.
2 Related Work
2.1 Al-Generated Image Watermarks
Watermarking for Al-generated images aims to embed imperceptible watermarks into generated content [26). These watermarks are nearly invisible to the human eye but can be reliably detected by
designated detectors, making them widely applicable in areas such as copyright protection [9 50 27
and deepfake detection [29 47 6
Early developments in this field rely primarily on traditional
handcrafted methods, such as DwtDet 9). which embed watermarks the frequency domain using
wavelet and discrete cosine transforms. Recent research shifts toward leveraging deep learning models to embed watermarks, with the goal of enhancing watermark robustness. Based on the embedding stage, image watermarking schemes are generally categorized into two types []: Post-processing Watermarks, which add watermarks after image generation, and in in-processing watermarks, which integrate watermarking during the generation process.
nost-processing Watermarks. StegaStamp [1 adopts a joint optimization framework of encoder- decoder to encode and decode the watermark, introducing a noise layer to enhance the robustness of the watermark. RivaGAN [46] improves the encoder-decoder framework by incorporating an attention mechanism. SSL watermarking [12] employs a self-supervised training paradigm, using data augmentation to enhance the watermark's adaptability to image transformations, However, these watermarks essentially subtle disturbances and are vulnerable to denoising other more advanced attack methods. Although StegaStamp demonstrates good robustness, may leave noticeable artifacts in the image 41I.
In-procesiing Watermarks. Stable Signature model to ensure the generated image contains a watermark. Gaussian Shading 44 offers a lossless watermarking solution by mapping the watermark message into latent representations that follow standard Gaussian distribution. TreeRing [43) introduces preset patterns into the initial noise of the diffusion model, causing a change the semantic structure of the generated image. RinglD improves upon Tree-Ring, optimizing watermark capacity.
S fine-tunes the VAE decoder of the diffusion
In addition, watermarking methods can also be categorized based on whether they alter the semantic content of the image, distinguishing between pixel-level and semantic-level watermarks. The former, such DwiDet, RivaGAN, SSL, and Stable Signature, typically embed ownership signals directly into the image pixels or frequency domain through perturbations or frequency modulation. These approaches are generally subtle and nearly imperceptible distortions such as compression, cropping, or noise injection. The latter, including TreeRing, RingID, Gaussian Shading, and StegaStamp, typically operate in the latent space of diffusion models, encoding ownership by modifying high-level semantic features. Semantic-level watermarks offer stronger robustness and are considered powerful alternative to pixel-level watermarks (48), but it may also introduce potential sensitivity to changes in semantic structure.
humans but are vulnerable to common
3

---

Image
DDIM
Insersion
Next Frome
Optical Trenstermtion
(Umestermarkec Imagge)
Concet
Convetutoo
Frame-Altention
We
K
Wy
Warg
Wg
Figure 2: Pipeline of NFPA. By adapting pretrained T2I model as next-frame prediction frame-
work. NFPA takes watermarked image input and generates semantically coherent next-frame prediction which the watermark effectively removed.
2.2 Watermark Removal Attacks
Watermark removal attacks aim to remove embedded watermarks in images to evade watermark detection. According to their underlying attack mechanisms, existing methods can be categorized into three types
20]: distortion attacks, regeneration attacks, and adversarial attacks.
Distortion attacks involve common image processing operations applied during image transmission, such as cropping, rotation, and JPEG compression. These attacks are characterized by their simplicity and efficiency often achieve only limited effectiveness removing watermarks [49]. Regeneration attacks seek to remove watermarks by reconstructing the image using generative models. The typical process involves adding noise to the watermarked image and then reconstructing through models such as diffusion models variational autoencoders. While regeneration attacks particularly effective against pixel-level watermarking methods, recent semantic-lewe watermarking techniques demonstrate significant robustness against such attacks [48]. In contrast, adversarial attacks optimize adversarial perturbations to mislead watermark detectors. However, these attacks require stronger attacker capabilities, such knowledge of the watermark access the watermark detector. Attackers may also collect watermarked and clean images to train surrogate detectors, leveraging transferability conduct adversarial attacks. The additional attack cost limits their application, though they show some effectiveness against SOTA semantic-level watermarking schemes [37]
3 Method
In this section, we present a detailed description of NFPA and explain how addresses key challenges associated with semantic-leve removal attacks through its methodological design: (i) watermark removal. how ensures that the semantic changes are effective enough cause watermark detection failure; (ii) semantic preservation, how it ensures that semantic modifications maintain visual consistency with the original image, thus preserving perceptual fidelity.
3.1 Overview
Motivated by advances in video generation, we formulate the semantic-level image watermark removal problem video generation task. However, cxisting video generation methods either fail to provide effective guidance for watermark removal or incur substantial training and computational costs, making them unsuitable for NFPA. To address this, we design novel image-to-video generation framework to enhance the targeting and efficiency of NFPA 's attack. This framework leverages the generation capabilities of T2I models, such Stable Riffusion-v2.. 1-bse (2). to perform zero-shot next-frame prediction, enabling watermark removal without any training or fine-tuning. Notably, NFPA naturally benefits from ongoing improvements in image generation models.
Formally, We define an image-to-vides generation function f, which takes a watermarked image I HWW x3 input and outputs sequence of video frames V gmx H xW where H x W

---

denotes the image resolution and m denotes the number of frames. In our attack setting, we fix m 2 to significantly reduce the computational cost of generation, thereby simplifying f into a frame prediction function. As result, the output video sequence V consists of only two frames, denoted as V = [x=0, x²] E x xxx3 x3, where x. represents the reconstruction of the input watermarked image ar and x² denotes the next frame based on z. Accordingly, the attack pipeline of NFPA is formalized as fxx = [z", x²), where x² serves as the attack target, i.c., the unwatermarked image.
Attack Pipeline. Figure 2jillustrates the architecture of our zero-shot next-frame prediction framework and the overall attack pipeline of NFPA. As the first step, NFPA performs DDIM inversion to map the input watermarked image z to its corresponding noise representation 2r- DDIM inversion approximates the reverse diffusion process, aiming find latent noise øT such that the forward denoising process approximately reconstructs the original image, i.e., 2 ~ venoiser(xT)) By applying this operation, we extract the noise representation 2² from the input watermarked image æ, which serves as the initialization for the next-frame prediction task. To model the dynamics of video frames, we construct an optical flow matrix based on 24 to simulate the spatial motion trajectory of the next frame. Specifically, we apply optical flow transformation to 2/ resulting in candidate next-frame noise representation z4.. To enhance watermark removal, we constrain the optical flow matrix within a restricted search space and optimize it to maximize the distance between 27 and 29. thereby disrupting with the potential watermark signal.
To ensure spatiotemporal consistency between adjacent frames, we replace the self celf-attention module in the diffusion model with a frame-attention module, which better captures semantic dependencies across frames and mitigates artifacts caused by local disturbances. Finally, we concatenate 2²G and o along the frame dimension and feed them into the denoising process. Leveraging the model's forward denoising capability, we generate the corresponding next-frame image x². Since z/ is sufficiently separated from the watermark-relaan distribution of æ4, the resulting image x² naturally removes the embedded watermark, thus achieving semantic-level watermark removal.
3.2 Watermark Removal: Optical Flow Transformation
To enable effective watermark removal, we propose an optimization algorithm over the optical flow matrix that maximizes the perceptual distance between the noise representations of consecutive frames in the latent space. This strategy drives the noise distribution away from sinermark-relatee features, thereby decoupling watermark traces from the latent representation. Specifically, starting from the initial noise representation æ². obtained via DDIM inversion of a watermarked image, we search for a wwo-dimensional optical flow matrix IR #xx22 within a constrained motion space Sç. Applying this flow to 2t. yields candidate next-frame noise representation z The optimization objective is defined as:
f === arg max la (zg. W(a fESs
where W(z): f) = z// denotes the result of backward warping x using flow f, and Ea(-) is perceptual distance metric in latent space (e.g., 1
The search space Sş defines a bounded set of admissible flow perturbations, ensuring that the generated next-frame noise =² remains within a plausible local motion range relative to 2r4. Formally, we define S5 as:
S S ( RR
| I V(ijj,)) e [1, H [1, W] x [1,2]]
where faj,A denotes the k-th component of the flow vector at spatial location (i.j), and > 0 is a predefined motion bound that constrains the maximum displacement per pixel along each spatial axis. This constraint ensures that the generated z/ remains within the local motion subspace of 29. preserving temporal coherence through spatial continuity. Simultancously. z exhibits statistically distinct distribution from z4, disrupting the latent consistency typically exploited by watermarking mechanisms. By integrating this adversarial flow search into the generation pipeline, we enable watermark removal in a black-box setting, without requiring any prior knowledge of the watermarking algorithm or the watermark carrier.
Motion in video sequences typically comprises two components: global transformations induced by camera motion and local variations caused by object motion within the scene. Since watermarked images may lack prominent dynamic objects, we focus on modeling camera-induced motion to guide semantic transformations. To this end, we construct flow-based transformation matrices that simulate
5

---

various camera motions by spatially warping the initial noise representation. We design three basic yet representative types of camera motion evaluate the generality and effectiveness of NFPA under different motion conditions:
Horizontal motion (x-axis): simulates lateral movement of the camera (e.g., from left to right).
Vertical motion (y-axis): simulates vertical displacement of the camera (e.g., from top to bottom).
Combined horizontal and vertical motion (xy-axis): simulates motion along both axes, where the camera can be moved in any direction within the image plane. The resulting flow matrix combines both horizontal and vertical components to form a more complex motion pattern.
is important note that NFPA is agnostic to specific camera motion patterns. Our attack does not rely on any fixed trajectory and can be extended to more complex or naturalistic motion types, such as camera zoom or rotation around an object.
3.3 Semantic Preservation: Frame-Attention
To ensure semantic and visual consistency between the next-frame prediction x' and the initial frame rº, we introduce modified frame-attention mechanism specifically designed for this task. We adapt the self-attentin mechanism in the UNet backbone (i.e., Denoiser) into frame- attentnt mechanism without modifying any model parameters. This mechanism explicitly conditions the generation of the next frame on the first frame in the sequence, thereby preserving semantic information such as object identity, spatial layout, and appearance across frames, despite the perturbations introduced for watermark removal.
In the original self-attention formulation, the input feature map x h is linearly projected into queries Q, keys K, and values V, and the attention output is computed as:
[QK- V,
Self-Attention (Q, V) = Softmax
where denotes the embedding dimension of the features. In our frame-attention setting, we consider a sequence two frames 00:1 = |.", ,-'| E 22xxxxxe, where x serves as the reference frame. For each frame z where & E {0, 1}. we compute attention using the query Q* from frame & and the key-value pairs (K VO) from the reference frame z0:
(
Frame-Attention((?? Q** Kº, VO) Softmax
VO.
Importantly, the reference frame d retains the standard self-attention mechanism to preserve its internal feature consistency and to provide stable semantic anchor during each denoising timestep. Meanwhile, the next frame x² performs cross-attention with respect to x², explicitly inheriting semantic structures such as object arrangement and scene appearance from the reference frame.
This asymmetric attention formulation enforces one-sided semantic dependency: x:1 conditioned on z0. As result, the generated frame x' remains consistent with the original image in terms of semantics, while maintaining sufficient flexibility in the latent noise space to facilitate watermark removal. We find this design essential for balancing the competing objectives of watermark removal and semantic preservation. maintains coherent object boundaries and improves perceptual fidelity. In practice, this condee-ondiiionnng strategy enables NFPA to generate realistic and temporally coherent frames that are perceptually indistinguishable from the original watermarked images.
Evaluation and Analysis
4.1 Evaluation Setup
We use Stable Diffusion-v2.. v.. --bse (SD-v2.1) [2] as the default image generation model. SD-v2.1 a widely adopted open-source generative model capable of producing high-fidelity images. Based on 1 and the image-text descriptions from the MS-COCC-2017 (4] validation set, we generate Al-created images without watermarks to serve as the original images. We use 50 inference steps to generate all images and set random seed for each image to climinate the influence
Model and Dataset.

---

of stochastic variation. On this basis, we apply various image watermarking methods to produce the corresponding watermarked images. All experiments are conducted on a machine equipped with an Nvidia GeForce RTX 4090 GPU.
Proposed Attack Setup. We construct next-frame prediction framework based SID-v2.1 by default and set the maximum search range ó of the optical flow matrix to 40, limiting the motion range of the next-frame image to between -40 and 40 pixels. By adjusting 6 allows us to trade-off Quality-detecaabiiiyy see[Appendix D for details. For DDIM inversion, we set the number of inference steps to 10 by default to improve attack efficiency and use an empty prompt during the inversion process, as the prompt for the watermarked image is unknown during the attack. In the subsequent experimental section, we perform ablation studies to examine the impact of hyperparameters such as the base model, frame-attention, and inference steps.
Watermark Baselines. We consider four post-processing watermark methods, including Dwt- Det (9). RivaGAN [46], StegaStamp [41] and SSL Watermarking [2], as well as four in-processing watermark methods, including Tree-Ring [43), RingID [8], StableSignature [I3], and GaussianShad- ing (44]. These methods cover range of techniques, from traditional pixel-level watermarking to the latest semantic-level watermarking. The watermark embedding process strictly follows the default configurations provided in the official implementations of each method, with detailed information provided in [Appendix A] In the watermark detection phase, we follow prior work [48 43 and set the decision threshold to reject the null hypothesis at a significance level of p < 0.01. The null hypothesis Hg assumes that the image does not contain an embedded watermark. Formally, this hypothesis is defined as: Ho = (") (0.5)" < 0.01, where denotes the total number of embedded watermark bits, and r is the minimum number of correctly extracted bits required to reject Ho- For example, when embedding a 32 bit watermark, if at least 23 bits are correctly extracted, Ho can be rejected, indicating that the image contains a watermark.
Attack Baselines. To comprehensively evaluate the performance of our method in removing image watermarks, we consider seven distortion attack baselines: Rotation, JPEG Compression, Cropping & Scaling, Gaussian Blur, Gaussian Noise, Color Jitter, and Translation. We also consider four regenera- tion attack baselines: Diffusion- Attack (DA) 48 337, VAE-Attack (VA) [88) Curleege++ [25), and comparison baseline that uses Stable Video Diffusion (SVD) [5] to predict the next frame. In addition, we consider two adversarial attack baselines: model substitution adversarial attack (MSAA) 37 and IRA (28) Because there is trade-off between watermark removal effectiveness and image quality, we adjust the attack parameters to faithfully reflect the performance of each baseline, ensuring they produce similar image quality for a fair comparison. Under these settings, the attack with the lowest watermark verification accuracy can reasonably be considered the most effective. See Apeendixx B for detailed attack parameters.
Evaluation Metries. Following prior work 43
we adopt the true positive rate at a false positive rate of 1% (TPR@ @ 1FFRR) as the metric for evaluating watermark robustness. This setting aligns with the null hypothesis defined in watermarking baselines, and it quantifies the ability of the watermark detector to reliably identify watermarked images while maintaining a low false positive rate. To assess the fidelity of attacked images relative to their originals, we use the Frechet Inception
Distance (FID) 17 to measure image quality and the CL.P score 33 7 to evaluate the semantic consistency between the image and its associated prompt. For TPR FPPR we apply all attack baselines to 1,000 watermarked images to compute the metric. To evaluate the FID and CLIP scores, we compute them over 1,000 attacked watermarked images and 1,000 corresponding real image-text pairs from the MS-COCO-201 validation set. Since our attacks operate at the semantic level, pixel-level metrics such as PSNR and SSIM are not applicable, and thus are excluded from this study.
4.2 Evaluation Results
We conducted experiments on eight image watermarking schemes and validated the performance of NFPA by comparing it against thirteen watermark removal attacks. Our extensive experiments aim to answer the following research questions (RQs):
[RQ1] How effective is NFPA in removing image watermarks?
[RQ2] How well does NFPA preserve image quality?
[RQ3] How efficient is NEPA in executing attacks?
[RQ4] How do different modules affect the performance of NFPA?
7

---

Table 1: [RQI] Watermark removal performance of the removal attack across eight image watermark- ing methods, evaluated using TPR@ %FPR. Lower values indicate more effective removal. Bolded values denote the best performance; underlined italicized values indicate the second best.
Attack
DwiDet
RivaGAN
SSI.
StegaStamp
TreeRing
StahleSignauree
RingTD
Gaussianhading
Avg.
None
0.79
1.00
1.00
1,00
1.00
1.00
1.00
1.00
0.97
JPEG Compression
0.01
0.59
0.08
0.97
0.79
Cropping & Scaling
0.01
0.96
0.90
0.00)
0.05
0.99
0.01
0.00
0.36
Gaussian
0.14
1,00
1.00
0.66
0.85
Gaussian Noise
0.00
0.86
0.02
1,00
0.99
0.41
1,00
0.99
0.66
Color
0.16
0.86
0.97
0,96
0.82
Rotation
0.01
0,99
1,00
0.45
0.21
0.98
1,00
0.00
0.58
Translation
0.03
1.00
1.00
0.49
VA
0.02
0,73
0.34
1,00
1.00
0.95
1,00
1,00
0.75
0./
0.08
0.01
0.92
0.00
CtrlRegen+
0.01
0.02
0.03
0.36
0.73
0,00
0.96
1,00
0.39
SVD
0.10
0,53
0.51
0.10
0.61
IRA
0.02
0.02
0.00
0.15
0.04
0.00
0.14
0.00
0.05
0.07
0.53
NFPA-X
0.01
0,15
0.16
0.20
0.25
0,00
0.16
0.00
0.12
NFPA-Y
0.01
0.13
0.16
0.14
0.22
0.00
0.10
0.00
0.10
NFPA-Xy (Ours)
0.01
0.13
0.09
0.02
0.07
0,00
0.02
0.00
0.04
TreeRing Without Attack
TreeRing Under NFPA
0.20
Original Image
0.15
Original Image
0.15
Watermarked Image
Watermarked Image
Density
Density
0.10
0.10
0.05
0.05
0.00
0.00
60
80
75
80
90
LI Distance
Distance
Figure 3: [RQ1] Histogram distributions of TreeRing before and after attack. Images with smaller & distances are more likely to contain watermarks.
RQ1: Analysis of Watermark Removal Effectiveness. Table reports the detection accuracy (TPR@ %FPR) of eight representative image watermarking methods under various attack strategies. We include MSAA only for TreeRing and StegaStamp due to their high computational cost, as it requires training watermark-specific surrogate detectors. We use the official pretrained models released by the authors for these two watermarking methods.
We summarize four key observations from the results: First, traditional distortion attacks (c.g., JPEG compression, blurring, noise) generally fail to remove watermarks effectively. Most watermarking methods still exhibit high detection rates after such perturbations, indicating strong robustness to low-level image degradations. Second, regeneration attacks such diffusion attack (DA) are more effective, particularly for pixel-level watermarking methods like DwtDet and Stable Signature. For these methods, the TPR drops substantially demonstrating that latent-space regeneration can disrupt low-level watermark features. However, DA remains less effective against semantic-level watermarks such TreeRing and RingID, which are embedded through high-level features. Third, adversarial attacks such as MSAA show greater potential in removing semantic-level watermarks. Nevertheless, they incur high attack costs, including training dedicated agent models or running iterative optimization loops, which limits their scalability and practicality. Finally, NFPA achieves consistently superior performance across all evaluated watermarking methods. Regardless of the motion strategy employed (e.g., x-axis, y-axis, or combined xy xy-axis), NFPA significantly reduces detection accuracy for both pixel-level and semantic-level watermarks. It achieves the lowest average TPR @1 1 6FPR (0.04) across all attacks. As illustrated in Figure 3] NFPA substantially increases the E, distance between the attacked images and the watermark patterns of TreeRing, rendering them indistinguishable from unwatermarked images. These results validate our approach that decoupling watermark signals in the latent space (formulated through the optimization in Equation 1) is an effective strategy for watermark removal.
8

---

DwtDet
RivaGAN
SSL
StogaStamp
TreeRing
StableSignature
RingID
GaussianShading
Watermatko meneeed
Inaupe
Attacked
Image
Figure 4: [RQ2] Attacked image examples of NFPA for eight image watermarking schemes.
is worth noting that although IRA demonstrates performance comparable ours, is inherently an adversarial attack whose effectiveness heavily depends on the architectural similarity between the target and surrogate models. As reported the original paper, when the target and surrogate models differ (e.g., SD2.1 vs. SDXL), IRA fails to reduce the TreeRing watermark detection rate below 0.33 even after 100 optimization steps. our implementation, both the target and surrogate models use SD corresponding to IRA's white-box setting and effectively representing its upper-bound performance. contrast, NFPA operates as a stable black-box attack that makes no assumptions about the target model's architecture. This design enables method to achieve state-of-the-a performance in terms of watermark removal effectiveness and practicality.
RQ2: Analysis of Image Quality Preservation. To evaluate the impact of removal attacks on visual quality, we report the average FID and CLIP score across eight watermarking methods in Table 2 with full results provided in Appendix C Notably, we calibrate the parameters of all evaluated attacks to ensure comparable image quality, thereby enabling a fair comparison of watermark removal effectiveness. NFPA achieves image quality par with the original images, demonstrating its ability to preserve visual fidelity during the watermark removal process. Crucially, under similar quality condi- tions, NFPA outperforms all other baselines in watermark removal performance. These results highlight the trade-off achieved by NFPA between effective watermark removal and high perceptual quality. Examples in FFiuure 4 further support these findings, showing that the subtle semantic modifications introduced via next-frame prediction have negligible perceptual impact. Additional image examples for baseline attacks are provided in Appendix C
Table [RQ2] Average FID and CLIP scores of water-
marked images under attack.
Attack
FID,
CLIP1
None
66.37
0.33
JPEG
73.42
0.33
Crop
69.33
0.32
Blur
73.99
0.33
Noise
69.98
0.32
Color Jitter
70.84
0.32
Rotation
73.63
0.32
Translation
68.15
0.31
VA
70.92
0.33
DA
74.89
0.32
CtrlRegen+
66.60
0.32
SVD
67.85
0.32
IRA
66.60
0.32
MSAA
73.34
0.32
Furthermore, control the attack intensity by adjusting the corre- sponding parameters and present the resulting qualitydettecabblitt trade-off in Appendix D NFPA consistently achieves the optimal Pareto frontier across all evaluated scenarios.
NFPA-X
69.40
0.32
NFPA-Y
69.39
0.32
NFPA-XY
69.48
0.32
RQ3: Analysis of Attack Efficiency. Distortion attacks involve simple transformations and incur only millisecond-leyy overhead. In contrast, regeneration and adversarial attacks are more effective but substantially more costly, e.g., IRA takes on average approxi- mately five minutes per image, as shown in Table 3) In this context, NFPA achieves a favorable balance between attack effectiveness and exccution efficiency. By leveraging novel next-frame prediction framework, NFPA substantially reduces the computational cost of video generation, lowering the average removal time for single watermarked image to 1.2 seconds. This design enables NFPA to maintain strong attack performance while ensuring practical runtime efficiency, outperforming existing baselines in terms of overall attack utility.
Table [RQ3] Time cost of different attacks.
Attack
Time (s/image)
VA
0.01 15x
DA
0.30g.01
CtriRegen+
2.41p.48
SVD
79.173.62
IRA
323.87o.88
MSAA
2.48p.25
NEPA-XY
1.27p.02
RQ4: Ablation Study of Different Components. We perform a systematic ablation study to quantify how the choice of base model, the inclusion of the frame-attention mechanism, and the number of inference denoising steps affect NFPA 's watermark removal performance and perceptual quality. All

---

Figure 5: [RQ4] Ablation study results for base models.
TPAGINER
FD
Base Model
TrecRing
Stabie Signature
L
FID
CLIP Score
T@I&F
FII
CLIP Score
1775/9977
SD-v1.4
0.05
69.38
0.33
0.90
69.07
0.33
SD-v15
0.04
69.47
0.33
0.00
69.04
0.33
Stepe
S03v2.0
0.33
0.00
0.33
SD-v2.1
0.07
69.18
0.33
0.80
68.87
0.33
Waternie Image
NEPA 1| (tmmsttttiin
NFRA (scii-ARomiee)
Witnmakel trage
NFPA (bel Alctten)
0.527
CLIF Soure
Figure 7: [RQ4] Performance across in- ference steps for TreeRing watermark.
Figure 6: [RQ4] Effect of frame-attention on image quality.
ablations use two representative watermarking schemes, TreeRing and Stable Signature, to ensure conclusions generalize across different watermark types.
First, Table Figure 5|presents results obtained with several diffusion backbones, ranging from SD-v1.4 to SD-v2.1. As the capacity of the base model increases, we observe a modest improvement in perceptual image quality. Importantly, NFPA is ability to remove watermarks remains consistently strong across all tested model versions. This stability demonstrates that NFPA is largely model agnostic and that its removal capability does not rely on particular backbone architecture.
Second, Figure/Figure coompares outputs produced with and without the frame-atter attention module. Removing this module causes a clear and substantial drop in visual fidelity and inter-framt semantic coherence. These results confirm that the frame-attention mechanism is essential for preserving semantic consistency across frames while allowing effective watermark removal.
Third, Figure Figure 7 anallyes the influence of the number of denoising steps used during inference. Increasing the number of steps yields finer denoising and therefore better pixel-level reconstruction and perceptual quality. At the same time, more steps can slightly reduce attack strength because the reconstruction becomes closer to the original image, which can preserve some watermark evidence at the semantic level. To strike practical balance between removal effectiveness and visual quality, we adopt 10 denoising steps as the default setting. We also study the role of the maximum optical flow search range. denoted by 6, in Appendix D When 5 is set to zero, motion is introduced and NFPA reduces to a latent regeneration attack that performs poorly. As 8 grows, the method can explore a larger motion and feature space better decouple watermark signals from content, but larger values of d may introduce more perceptual distortion. This parameter therefore provides a controllable trade-off between detection evasion and image quality.
5 Conclusion
In this work, we introduce NFPA, the first semantic-leve image watermark removal method, which reveals the vulnerabilities of of-e--ff watermarking techniques. Leveraging our next-frame prediction model, NFPA effectively addresses the dual challenges of watermark removal and semantic preservation. Extensive experimental results demonstrate that NFPA achieves SOTA watermark removal performance, while striking an optimal balance between image quality and attack efficiency. Our findings highlight the inherent weaknesses of current watermarking approaches, underscoring the urgent need for stronger defense mechanisms in Al ---geeerteed image watermarking.
Acknowledgement
We are thankful to the shepherd and reviewers for their careful assessment and valuable suggestions, which have helped us improve this paper. This work was supported in part by the National Natural Science Foundation of China (62472096, 62172104, 62172105, 62102093, 62102091, 62302101, 62202106). Min Yang is faculty of the Shanghai Institute of Intelligent Electronics & Systems and Engineering Research Center of Cyber Security Auditing and Monitoring, Ministry of Education, China.
10

---

References
[1] Shruti Agarwal, Hany Farid, Yuming Gu. Mingming He, Koki Nagano, and Hao Li. leaders against deep fakes. In CVPR workshops, volume 1, 2019.
Protecting world
AL [2] Stability
Stable diffusion 2.1 base.
https: httpg:///uuggagggeooooo///bbbaal
2- 2--bbae 2022.
[3] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng. Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein,
Waves: Benchmarking the robustness of
image watermarks. arXiv preprint arXiv:2401.0857. 2024.
[4] Ashley rest
Belanger.
Ai-faked
images of donald trump's 's imagined ar-
swirl on twitter.
Fake-ai-generated
seappp--arreet-cicclattte - on- twittitter
donald www.dddonnnddeeeeeeddeee-e---dee trumps-
[5] Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets, arXiv preprint ar arXiv:2311.1517,, 2023.
[6] Yunzhuo Chen, Naveed Akhtar, Nur Al Hasan Haldar, and Ajmal Mian. Dynamic watermarks in images generated by diffusion models, February 2025, URL http://arxiv. org a7Xiv:2502.08927 [es].
http:///ardv..or/abb///////// http/aab/2500..000
[7] Mehdi Cherti, Romain Beaumont, Ross Wightman. Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-image learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2818-2829, 2023.
[8] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Computer Vision, pages 338-354. Springer, 2024.
[9] Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmaan, 2007.
[10] Angus Crawford and Tony Smith. Illegal trade ai child sex abuse images exposed. https: https://www.. bbc com/
[11] EveryPixel. People are creating an average of 34 million images per day. statistics for 2024. https [journall.vverppaa com ai ail-aai-immaa image- statistics
[12] Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze, Watermarking images in self supervved latent spaces. In ICAS$P 2022 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054 3058. IEEE, 2022.
[13] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 224677, 2023.
[14] Google DeepMind. SynthID: Identifying Al-generated content with SynthID. httpss//deepmind httaee//echoooooeeeee/ttaaaaaaaa
[15] Yiyang Guo, Ruizhe Li, Mude Hui, Hanzhong Guo, Chen Zhang, Chuangjian Cai, Le Wan, and Shangfei Wang- FreqMark: Invisible Image Waternarking via Frequency Based Optimiza- tion in Latent Space. Advances in Neural Information Processing Systems, 12237111112261 Decemher 2024. URL Ihttps: htstte://proceedingg.. newreeedddnnnnnnnnieeeeeee http://pppp...llee/////////////p (ttpb////55733322266533333333330
Abstract-t-tttt-a-e Conference html
[16] Todd Helmus. Artificial intelligence, deepfakes, and disinformation. Rand Corporation, pages 1-24, 2022.
[17] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[18] Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition. pages 2024.

---

[19] Junqiang Huang, Zhaojun Guo, Ge Luo. Zhenxing Qian, Sheng Li, and Xinpeng Zhang. Disentangled style domain for implicit z-watemmark towards copyright protection. Advances in Neural Information Processing Systems, 37:55810-558333 2024.
[20] Andre Kassis and Urs Hengartner. Unmarker: A universal attack on defensive image watermarking. In 2025 IEEE Symposium on Security and Privacy (SP), volume 2, page 8, 2025.
[21] Levon Khachatryan, Andranik Mowsisyan, Vahram Tadewosyan, Roberto Henschel, Zhangyang Wang. Shant Navasardyan, and Humphrey Shi. Text2video-zero: Text-to-image diffusion models are zero-shot video generators. In Proceedings of the TEEE/CVF International Conference on Computer Vision, pages 15954-15964, 2023.
[22] Vitaliy Kinakh, Brian Pulfer. Yury Belousov, Pierre Fernandez, Teddy Furon, and Slava Voloshynovskiy. Evaluation of security of ml-based watermarking: Copy and removal attacks. In 2024 IEEE International Workshop on Information Forensics and Security (WIFS), pages 6. IEEE, 2024.
[23] Dongxu Li, Junnan Li, and Steven Hoi. Blip-diffusion: Pre-trained subject representation for controllable text-to-image generation and editing. Advances in Neural Information Processing Systems, 36:30146 30166, 2023.
[24] Tsung-Y Yi Lin, Michacl Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECC ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[25] Yepeng Liu, Yiren Song. Hai Ci, Yu Zhang. Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image termarks are removable using controllable regeneration from clean noise, arXiv preprint arXiv:2410.05470. 2024.
[26] Huixin Luo, Li Li, and Juncheng Li. Digital watermarking technology for ai- ai-generated images: A survey, 2025,
[27] Zhiyuan Ma. Guoli Jia, Biqing Qi, and Bowen Zhou. SD: Safe and Traccable Stable Diffusion with Text Prompt Trigger for Invisible Generative Watermarking. In Proceedings of the 32nd ACM International Conference on Multimedia, MM '24, pages 7113-7122, New York, NY, USA, October 2024. doi: 10.1 00.1145/3664647.3666 368117118881..8 URL
Association for Computing Machinery. ISBN 979-8-4007-0686-
https: acm. wrgg////////ooooooooooooooo/o 1145/3664677 3681418
[28] Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 20937-20946, 2025.
[29] Aakash Varma Nadimpalli and Ajita Rattani. Proactive deepfake detection using gan-based visible watermarking, ACM Transactions on Multimedia Computing, Communications and Applications, 20(11): 1-27, 2024.
[30] Haomiao Ni, Changhao Shi, Kai Li, Sharon X Huang, and Martin Renqiang Min. Conditional image- to-video generation with latent flow diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pallem recognition. pages 18444-18555 2023.
[31] Haomiao Ni, Bernhard Egger, Suhas Lohit, Anoop Cherian, Ye Wang. Toshiaki Koike-Akino, Sharon Huang, and Tim K Marks. Ti2v-zero: Zcro-shot image conditioning for text-to-video diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9015-9095 9025, 2024.
[32] Zhihong Pan, Riccardo Gherardi, Xiufeng Xie, and Stephen Huang. Effectiive real image editing with accelerated iterative diffusion inversion. Proceedings of the IEEFICVF International Conference on Computer Vision, pages 15912-15921, 2023.
[33] Alec Radford, Jong Wook Kim, Chris Hallacy. Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748-8763. PmLR, 2021.
[34] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint 2rXiv22204.06125, 1(2):3 2022.
12

---

[35] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[36] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dream- booth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 22500 22510, 2023.
[37] Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaci, Aounon Kumar, Atoosa Chegini, Wenxiao Wang. and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks. arXiv preprint 201002310000076. 2023.
[38] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo I. Lopes, Burcu Karagol Ayan, Tim Salimans, al. Photorealistic text-to- image diffusion models with deep language understanding. Advances neural information processing systems, 35:36479-36444 2022.
[39] Sunpreet Sharma, Ju Jia Zou, Gu Fang, Pancham Shukla, and Weidong Cai. A review of image water- marking for identity protection and verification. Multimedia Tools and Applications, 83(11):1122-3189) 2024.
[40] Vera Sorin, Yiftach Barash, Eli Konen, and Eyal Klang. Creating artificial images for radiology applications using generative adversarial networks (gans)-a systematic review. Academic radiology, 2758)111751 2020.
[41] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 21 17-2126, 2020.
[42] Bram Wallace, Akash Gokul, and Nikhil Naik. Edict: Fxact diffusion inversion via coupled transformations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22532-
22541, 2023.
[43] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffuusion images. Advances in Neural Information Processing Systems, 36:58047-58063, 2023.
[44] Zijin Yang. Kai Zeng, Kejiang Chen, Han Fang. Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-ooss lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162 12171, 2024.
[45] Zhiyu Yin, Kehai Chen, Xuefeng Bai, Ruili Jiang. Juntao Li, Hongdong Li, Jin Liu, Yang Xiang. Jun Yu, and Min Zhang, Asurvey: Spatiotemporal consistency in video generation. arXiv preprint arXiv:2502.1786: 2025.
[46] Kevin Alex Zhang, Lei Xu, Alfredo Infate-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv: 1909.01285 2019.
[47] Lijun Zhang, Xiao Liu, Antoni V. Martin, Cindy X. Bearfield, Yuriy Brun, and Hui Guan. Attack-Resilies Image Watermarking Using Stable Diffusion. Advances in Neural Information Processing Systems, 37: 38480-38507, December 2024. URL https: http::::////rooeeingg...mm
www.se/t----ttaaa--oaoote Conference .ttll
[48] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in Neural Information Processing Systems, 37:8643-8672, 2024.
[49] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the Earopean conference on computer vision (ECCV), pages 657-672, 2018
[50] Peifei Zhu, Tsubasa Takahashi, and Hirokatsu Kataoka. Watermark-emberddedd Adversarial Examples for Copyright Protection against Diffusion Models. pages 24420-24430, 2024. URI.https: htttp:://opeaaceess thecvf wtt.:f.cooooooeee wtcm:/conneent////e2224444/
http://VRR222////// http/22222/hmm//ht/ Wattrrmar--embeddee Adversarivlll Examples_ _0p__peer_______ html
for Norr_oopyright_Pooeettiic otw.raccccocaaaaaaeoee...uuuuuss
13

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justificcton right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No]", ", it is perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
14

---

Justification:
Please see Appendix E
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: The codes are available htttttt:///nnnnnonnnt wtw.ns...i.eencee//EEE......e
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g.. with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibilityy In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: The codes are available lnttps://github com/1249748036/NFF and we use open source model and data, which are cited correctly in the main paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips.cc/publcc/eee.c wttp://dde/eooeeuummieeeeeeeeeee ssi ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
16

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: Please see subsection 4.1 Appendix A and Appendix B
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Please see Table 3
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please subsectttiio 4.1
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
17

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics ltttps:/neurips..
Answer: [Yes]
Justification: The research conducted in the paper conform with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please see Appendix F
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification:
We do not release any models or data.
Guidelines:
The answer NA means that the paper poses such risks.
18

---

Released models that have high risk for misuse or dual-use use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All datasets used public and cited properly.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com /dtaaset has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information is not available online, the authors are encouraged to reach out to the asset's 'ss creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: The codes and data are available at
4open science/
r T/NFPA/
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
19

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods this research? Note that if the L.M used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration not required.
Answer: [NA]
Justification: LLMs not important, original, non-standard component of the methods in this research.
Guidelines:
The answer NA
that the core method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: /tte:::///rrrppe cc/ //onfffrences/222555 for what should or should be described.
20

---

A Watermark Baselines Descriptions
DwtDet is a traditional watermark scheme that implants the watermark in the frequency domain by using combination of Discrete Wavelet Transform (DWT) and Discrete Cosine Transform (DCT). For implementation, we utilize a popular Python library named invisible-walermark and set the watermark length to 30 bits by default.
DwtDet 1::
RivaGAN [46 RivaGAN an encoder-decoder based watermark scheme originally used for video watermarking, and can also be adapted for robust image watermarking. This watermark incorporates a custom attention- baseed mechanism for embedding arbitrary data. Additionally, it employs two independent adversarial networks to maintain video quality and enhance watermark robustness through adversarial optimization. For implementation, we also leverage titiiblle-wttrmarkk @ and we set the watermark length to 32 bits by default.
StegaStamp also uses trained encoder neural network embed the watermark information, and then leverages trained decoder neural network to detect the embedded watermark. However, introduces more human- human-visible artifacts, compromising the image quality. For implementation, we use the code and the pretrained model published by the original authors P and we set the watermark length to 100 bits by default.
StegaStamp 41
SSI. embeds watermarks in selfssupervisee-lateeee spaces by shifting the feature of the image selected region. For implementation, use the code and the pretrained model published by the original authors and we set the watermark length to 30 bits by default.
SSL [2]
StableSignature 13: StableSignature is an in-process watermark mechanism that embeds the watermark during the image generation process. It leverages the watermark decoder from HiDDeN (49. and then fine-tunes the VAE decoder the latent-diffusion model (LDM) to ensure the watermark information can be decoded from the generated images. For implementation, we use the code and the pretrained model published by the original authors and we set the watermark length to 48 bits by default.
TreeRing also belongs to the in- cn-process watermark mechanism. Differing from StableSignature, TreeRing modifies the initial seed of the diffusion model by embed- ding a predefined ring pattern. In the verification stage, the specific pattern can be detected by using the DDIM inversion process on the watermark images. For implementation, we use the code published by the original authors @
TreeRing 43
RingID 8 Based on TreeRing, RingID also embeds the watermark information by modifying the initial seed of the diffusion model. It identifies the limitations in Tree- Ring's s design and introduces a series of approaches for enhanced distinguishability and robustness. For implementation,
use the code published by the original authors !
GaussianShading [44]: Based on TreeRing, GaussianShading develops an initial seed modification watermark that doesn't deteriorate the generated image quality by watermark randomization and distribution preserving sampling. For implementation. we use the code published by the original authors and we set the watermark length to 256 bits by default.
Table 4: Watermark length of different watermark schemes. (Note that TreeRing and RingID watermarks are not binary; thus, this metric is not applicable.)
Watermarking
DwtDet
RivaGAN
StegaStamp
SSL
StableSignature
Shassinn
Length (# bits)
30
100
30
48
256
httppp//ggtaabbcoo//////llt//eed watermark
21

---

B Attack Baselines Descriptions
JPEG Compression:
a widely used image compression method, characterized by a quality factor parameter that controls the degree of compression. A lower quality factor results in greater loss of fine image details and increases the likelihood of watermark degradation. In Section 4, the quality factor is set to 20. In Appendix D the quality factors are set to 10, 20, 30, 40, 50, and 60.
Cropping & Scaling: Crop a common image processing operation. It maintains portions of an image based on the selected crop ratio. A higher crop ratio means more portions remain. Excessive cropping can result in loss of critical image content and may affect the integrity of the embedded watermark. In our experiments, we employ a center crop strategy followed by resizing the cropped image to its original size. In Section 4, the crop ratio is set to 0.7. In Appendix D the crop ratios are 0.6, 0.65, 0.7, 0.75, 0.8, and 0.85.
Gaussian Blur: It involves convolving the watermark image with kernel, such as Gaussian kernel, to make the watermark less detectable. The kernel size determines the degree of distortion applied to the watermark image, and larger kernel size results in stronger attack performance. In Section 4, a Gaussian kernel with a size of 15 is used. In[Appendix D kernel sizes of 5, 9, 11, 13, and 15 are employed.
Gaussian Noise: It introduces Gaussian noise, to each pixel of the watermark images to distort the watermark information. For Gaussian noise, the variance determines the strength of the added noise. A higher variance causes the watermark image to lose more information. In Section 4, the variance is set to 30. In Appendix D variances of 10, 15, 20, 25, 30, 35, and 40 are used.
It modifies the brightness of the watermark images by scaling all the pixels in the watermark images. Larger brightness changes make the watermark harder to detect. In Section 4, the brightness factor is set to 4. In Apppeddix D. brightness factors of 1, 2, 3, 4, 5, and are applied.
Color Jitter:
It is common geometric transformation that alters the orientation of an image by specified angle. Larger rotation angles can cause misalignment of the embedded information and increase the risk of watermark distortion. In Section 4, the rotation angle is set to 10 degrees. In Appendix D rotation angles of 5, 6, 7, 8, 9, and 10 degrees are considered.
Rotation:
VAE-Attack (VA) 48 VA represents a type of regeneration attack, and can remove the watermark during the regeneration process. The watermark image is first mapped to the latent space by the VAE encoder and then mapped to the pixel space by the VAE decoder. Both the encoder and decoder are parameterized with neural networks. Specifically, utilize the VAE-Bai Bmshj2018 8 to perform the VA. The compression factor controls the attack strength of VA, with lower values corresponding to stronger attacks. In Section 4, the compression factor is set to 5. In Appendix D compression factors of 3, 4, 5, 6, 7, and 8 are used.
Diflusion-Attack (DA) 48 DA utilizes diffusion model to first add noise to the water- mark image to eliminate the watermark, and then uses the reverse process to reconstruct the image. Increasing the number of noise steps introduces more noise, thus resulting in better attack performance. In our experiments, we use the Stable Diffusion-v2.. --asee 2 to perform the DA. In Section 4, the number of noise steps is set 100. In Appeediix D noise steps of 70, 80, 90, 100, 110, and 120 are evaluated.
Model Substitute Adversarial Attack (MSAA) [37]: MSAA involves training a substitute classifier and conducting projected gradient descent (PGD) attacks on it to deceive black- box watermark detectors. The perturbation budget e in the PGD attack controls the attack strength of MSAA, and larger perturbation budget induces stronger attack performance. In Section 4, the perturbation budget is set to 8. In Appendix D) perturbation budgets of 5, 6, 7,8,9 9, and 10 are used.
IRA is attack designed remove semantic watermarks using a black-box proxy model. The attack first maps the watermarked image
imprint-Remove Attack (IRA) 28
22

---

Table 5: [RQ2] FID of watermarked images under attack. Lower values indicate better semantic
consistency.
Attack
DwtDet
RivaGAN
SSL.
StegaStump
TreeRing
StahleSignature
RingID
GausianShading
Avg.
None
65.22
65.60
64.89
67.79
67.31
66.48
68.32
66.99
66.57
JPEC
72.09
72.31
73.16
79.56
71.99
72.41
73.13
72.75
73.42
Crop
68.22
67.88
67.
71.19
71.00
69.33
Blur
71.78
70.52
70.07
82.29
74.16
73.10
75.40
74.64
73.99
Noise
69.54
68.89
70.01
73.69
70.50
69.98
Color Jitter
70,60
69.44
71.18
72.41
70.00
69.09
71.23
72.77
70.84
Rotation
72.79
71.12
72.85
79.32
72.56
71.55
74.53
74.28
73.63
VA
69.60
69.97
69.84
74,42
70.53
71.66
70.92
DA
70.29
69.69
70.08
70.82
78.25
79.07
82.17
78.74
74,89
66.11
64.90
66.14
69.70
67.83
66.60
CuiRegenn
66.06
66.24
65.60
65.76
67.10
65.97
68.72
67.32
66.60
MSAA
74,67
72.01
73.34
SVD
66.11
66.80
66.10
69.29
68.55
67.45
69:58
68.91
67.85
Translation
66.51
66.48
65.82
71.65
68.43
67.22
69.77
69.30
68.15
NFPA
67.74
68.54
67.89
70,00
69.65
69.85
71.74
69.77
69.40
NEPA-Y
68.08
68.73
67.95
69.84
69.93
69.17
71.40
69.99
69.39
NEPA xy (Ours)
67.52
68.60
71.47
69.56
69.18
68.87
71.09
69.54
69.48
the proxy model's latent space and inverts it to estimate the latent noise vector. It then performs gradient descent to find a perturbation for the latent image, optimizing loss function that encourages the inverted latent noise to be dissimilar to the original one (e.g., by targeting its negation). The strength of the attack is controlled by the number of optimization steps. More steps generally improve watermark removal but can increase image distortion. the experiments, we set the number of optimization steps to 50 by default.
CtrlRegen+ is an adjustable watermark removal method that uses a controllable regeneration process. The method first encodes the watermarked image into its latent representation and adds a specified number of noise steps to create a noisy latent. then uses controllable diffusion model, guided by semantic and spatial features extracted from the original watermarked image, to denoise this latent and reconstruct the image. The number of noise steps controls the attack strength; watermarks, while the control networks
CtrlRegen+ 25
steps lead to more thorough water-
mark removal, particularly for maintain high image quality and consistency. the experiment, we set the number of noise steps to 500 following the source code.
SVD [5] It uses Stable Video Diffusion (SVD). a trained latent diffusion model for generat- ing short video clips from single conditioning image. We use the watermarked image and an empty text prompt as input conditions to generate the video. To align with our method's setup, we by default use the frame at generated video index (i.e., the next frame) as the attacked image.
Translation is a common geometric transformation that shifts an image hori- zontally or vertically by specified number of pixels. This spatial displacement interferes with the detection of embedded watermarks, especially when the detection process depends on position. Larger translation distances cause more severe displacement and increase the risk of watermark distortion. To align with our method's 's setup, we set the translation distance to 40 pixels both the horizontal and vertical directions.
Translation:
C Analysis of Image Quality Preservation
To comprehensively evaluate the impact removal attacks on image quality, we report detailed results for all eight watermarking schemes in terms of FID and CLIP score. As shown in Table 5 and Table 6 NFPA consistently achieves FID and CLIP scores comparable indicating negligible degradation in visual fidelity. These results confirm that NFPA effectively preserves perceptual quality while successfully removing watermarks. Figuree presents image examples of attacked images produced by each method across all watermarking schemes. Based on our next-frame prediction frame, NFPA introduces only minor semantic modifications, resulting in images that remain visually indistinguishable from their watermarked counterparts. These qualitative results further support the effectiveness of our approach in maintaining high image fidelity across diverse watermarking scenarios.
those of the original images,
23

---

RivaGAN
StegaStamp
TreeRing
StahleSignature
RinglD GaussianShading
TO
Conpge NFPA
IPEG
Noise
ChiRegont
MSSA
Figure 8: [RQ2] Attacked image examples for eight image watermarking schemes.

---

Table 6: [RQ2] CLIP of watermarked images under attack. Higher values indicate better image
quality.
Attack
DwdDet
RivaGAN
SSL
StegaStamp
TreeRing
StableSignature
RingID
GausianShading
Avg.
None
0.32
0.33
0.33
0.32
0.33
0.33
0.33
0.33
0.33
JPEG
0.33
0.33
0.33
0.33
0.33
0.33
Crop
0.31
0.32
0.32
0.32
0.32
0.32
0.32
0.32
0.32
Blur
0.32
0.33
0.33
0.32
0.33
0.33
0.33
0.33
0.33
Noise
0.32
0.32
0.32
0.32
0.32
Color Jitter
0.32
0.32
0.32
0.31
0.32
0.32
0.32
0.32
0.32
Rotation
0.32
0,32
0.32
0.32
0.33
0,33
0.32
0.33
0,32
VA
0.33
0.33
0.33
0.33
0.33
0.33
0.33
0.33
U.33
DA
0.32
0.33
0.33
0.32
0.32
0.32
IRA
0.31
0.32
0.32
0.31
0.32
0.32
0.32
0.32
0,32
CuiRegen+
0,32
0.32
0.32
0.32
0.32
0.32
0.32
0.32
MSAA
0.32
0.32
0.32
SVD
0.32
0.33
0.32
0.32
0.32
0.32
0.32
0.33
0.32
Translation
0.31
0.31
0.31
0.32
0.32
0.32
0.31
0.32
0.31
NFPA-X
0.32
0.31
0.32
0.33
0.33
0.33
0.32
NFPA-Y
0.32
0.32
0.31
0.32
0.33
0.33
0.32
0.33
0.32
NFPA-XY
0.32
0.32
0.31
0.32
0.33
0.33
0.32
0.33
0,32
VA
DA
Adciers
02
NFP
81
NFT
355
1303 0300) 03125 EJIS AENT 9328 03225 1U2M E,273
F1D
CLIP Sore
Figure 9: Trade-off between detectability and FID averaged over eight watermarking schemes tested against all attack methods.
Figure 10: Trade-off between detectability and CLIP score averaged over eight watermarking schemes tested against all attack methods.
D Quality-Deeetabiliit Tradeoff
To further analyze the balance between watermark detectability and visual quality, we adjust the hyperparameters of each attack method (detailed in [Appendix B) to control the attack intensity. thereby characterizing their performance in the quality-detcctablii, trade-off. Figure and Figure 10 illustrate the relationship between detectability and visual quality, measured by FID and CLP scores, respectively. Each curve represents specific attack method, and the results are averaged over eight watermarking schemes to reflect the overall performance.
The results show that NEPA consistently lies on or near the optimal Pareto frontier across. Specifically, NFPA achieves low average detectability while maintaining high perceptual quality, demonstrating su- perior overall attack effectiveness. This indicates that our semantic-level watermark removal approach effectively balances attack strength and image fidelity. In contrast, distortion- -based methods (e.g., JPEG, cropping. noise) generally exhibit better visual quality but limited ability to reduce detectability. Adversarial and regeneration- based attacks, while sometimes effective, fail to consistently suppress detectability across all watermark types, leading to suboptimal removal performance. In comparison, NFPA bridges this gap and consistently reduces watermark detectability across all evaluated schemes, significantly outperforming existing baselines in the quality- detectabittt trade-off.
E
Limitations and Future Work
In this study, we take an important step toward understanding and revealing the vulnerabilities of existing image watermarking schemes. The proposed attack relies pretrained T21 diffusion model to predict the next frame image. While this strategy already demonstrates promising results, future work may explore customized or fine-tuned video generation models to further improve fidelity
25

---

and consistency. In addition, the quality of the generated images in our attack is affected by the accuracy of DDIM inversion. Notably, the inherent information loss during the inversion process may be mitigated by constructing more precise and reversible generative trajectories 18 32 42 could further enhance the attack performance.
which
In formalizing NFPA, we introduce several basic camera motion patterns, such as planar translation. Experimental results show that even with such simple motion patterns, NFPA already effective at removing SOTA image watermarks. Future research may explore more complex camera motion patterns assess their potential and advantages more challenging watermarking scenarios. In our evaluation, we have tried our best to cover influential watermarking schemes published in recent top-tier conferences. Future works may consider further validating our attack in more newly proposed image watermarking.
F
Societal Impacts
This work proposes NFPA and reveals, for the first time, the potential vulnerabilities of several influential image watermarking schemes when facing semantic perturbations. Although such attack methods carry the risk of malicious exploitation, we emphasize that the core purpose of this paper is to promote deeper understanding and open discussion of the limitations of current watermark defense mechanisms, thereby advancing the overall security in this field. Through an extensive evaluation of multiple mainstream image watermarking schemes, demonstrate that these watermarks be effectively removed in practical application scenarios, highlighting the urgent need to design more robust watermarking mechanisms. As the first attack framework that transforms the watermark removal problem into a video frame prediction task, NFPA provides a novel validation benchmark for developing the generation of image watermarking techniques capable of resisting semantic- level perturbations. In general, we believe that this study contributes to the development of image watermarking techniques that will ultimately enhance the detectability and traceability of Al-generated images.
26


Reviews:
[{"review_id": "UyFeRP2JUt", "reviewer": "Reviewer_m5Bd", "summary": "The paper studies removing watermarks from the generated images and proposes a semantic-level removal attack named NFPA. NFPA treated the watermark removal task as a next-frame prediction task and modified the semantic structure of the watermarked image. Experiments validated its removal attack effectiveness and showed it can preserve high image quality after removal.", "questions": "See weakness.", "limitations": "See weakness.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength: \n\n1) This paper presents a relatively novel view to remove image watermarks, ie. conducting a next frame prediction attack, by introducing temporal consistency, the proposed method is able to ensure semantic consistency. This poses a relatively new perspective to image watermark removal area.\n\n2) This work proposed flow-based transformation strategies to simulate camera-induced motions by noise swarping, which were evaluated with different motion conditions. The module was experimentally showed effective in experiments.\n\n3) With the TPR@1%FPR metric, the method showed competitive watermark removal performances with some existing attacks (though more evaluation metrics are suggested to be reported, see weakness).\n\nWeakness:  \n\n1) Though some baselines, such as distortion attacks, DA and VAE-Attack were compared, to be more compelling, I suggest the authors consider more recent baselines, e.g. [1], and I will raise my score if the proposed method could still achieve competitive performance( e.g. sota).\n\n2) Besides, for image quality measurement, it is suggested to use LPIPS [2], which can better reflect the visual fidelity wrt human visual systems. \n\n3) In addition, it is suggested to discuss the applicability of the proposed method, whether it is able to remove some other types of watermarks (rather than T2I generative models), such as conventional image watermarks. \n\n[1] Müller, Andreas, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. \"Black-box forgery attacks on semantic watermarks for diffusion models.\" arXiv 2025, https://arxiv.org/abs/2412.03283\n\n[2] Richard Zhang, et al. The Unreasonable Effectiveness of Deep Features as a Perceptual Metric. CVPR 2018", "was_revised": true, "final_justification": "I thank the authors for the responses, which partially alleviated my concerns. The proposed next frame prediction attack appears interesting to me, and the results show promising (particularly after addressing some baseline issues). After checking comments and responses to other reviewers, I am inclined to borderline accept this work (though the comparison with IRA does not seem quite significant, and the commonly used LPIPS was not evaluated as a metric). The additional results are supposed to be included in the revised manuscript.", "rebuttal": "We sincerely thank the reviewer for the thorough evaluation and insightful feedback. Your recognition of the **novelty** and **performance** of our method is truly encouraging. Below, we provide detailed responses to the three main concerns you raised:\n\n---\n\n## **W1: Attack Baselines: IRA**\n\nWe greatly appreciate your suggestion to include the *Imprint-Removal Attack (IRA)* [1] as an additional strong baseline. Following your recommendation, we have conducted the corresponding experiments and **commit to including the complete results and quantitative analysis** in the final version.\n\nIn our replication, we used SD2.1 as both the target and surrogate model, which corresponds to the white-box setting of the original IRA—effectively representing its upper-bound performance. Our results show that **NFPA outperforms IRA in average attack success rate**. Furthermore, our method exhibits clear advantages over IRA in two key aspects:\n\n### **1. Superior Attack Stability**\n\nIRA is a typical adversarial optimization-based method that is **highly sensitive to the choice of surrogate model**. As noted in the original paper, when using SDXL as the surrogate model, IRA still fails to reduce TreeRing watermark detection below *0.64* after 50 optimization steps. In contrast, **NFPA maintains strong and consistent performance across a wide range of watermarking schemes**, making it more suitable for open-world attack scenarios.\n\n### **2. High Efficiency and Practicality**\n\nIRA requires per-image adversarial optimization, taking **approximately 15 minutes per image**, which is computationally expensive and impractical for large-scale attacks. NFPA, on the other hand, completes watermark removal in **around 1 second per image**, making it highly deployable and scalable in practice.\n\nThe comparative results are shown below (TPR@1%FPR ↓):\n\n| Method | DwtDct | RivaGAN | SSL | StegaStamp | TreeRing | StableSignature | RingID | GaussianShading | Avg. |\n|:------:|:------:|:-------:|:---:|:-----------:|:--------:|:----------------:|:------:|:----------------:|:----:|\n| IRA    | 0.02   | 0.02    |0.00 |    0.15     |  0.04    |       0.00       |  0.14  |       0.00       | 0.05 |\n| **NFPA (ours)** | **0.01** | **0.13** | **0.09** | **0.02** | **0.07** | **0.00** | **0.02** | **0.00** | **0.04** |\n\nThese results clearly demonstrate that **NFPA achieves superior stability, efficiency, and practicality**, thereby strengthening the practical and academic value of our contribution.\n\n---\n\n## **W2: Image Quality Metrics**\n\nThank you for suggesting the use of *LPIPS* [2] to improve perceptual evaluation. While we agree that LPIPS is a widely-used perceptual quality metric, we also recognize that it is fundamentally a *pixel-space metric*, computing L2 distances between features extracted at each pixel location. This makes it *highly sensitive to slight spatial shifts*, which may not accurately reflect performance in *semantic-level removal attack* like ours.\n\nTo better capture perceptual and semantic fidelity, we consider two new metrics:\n\n- *Q-align* [a]: A large multimodal model-based metric aligned with human perceptual judgments. It provides a better approximation of human visual assessment.\n- *Cosine Similarity (CosSim)*: Based on *SimCLR* [b] representations, this metric measures the semantic similarity between the original and attacked image, providing insight into whether the semantic content is preserved.\n\nResults are summarized below:\n\n| Method | None (w/o attack) | JPEG | Crop | Blur | Noise | ColorJitter | Rotation | VA | DA | MSAA | NFPA (ours) |\n|:------:|:----:|:----:|:----:|:----:|:-----:|:-----------:|:--------:|:--:|:--:|:----:|:------------:|\n| **Q-align↑** | 4.02 | 3.48 | 3.20 | 2.19 | 2.07 | 2.08 | 3.07 | 3.96 | 4.10 | 1.97 | **3.88** |\n| **CosSim↑** | 0.30 | 0.27 | 0.29 | 0.30 | 0.29 | 0.29 | 0.30 | 0.30 | 0.29 | 0.30 | **0.30** |\n\nThese results indicate that **NFPA has minimal impact on visual quality and semantic consistency**. This strongly supports our motivation of **preserving semantic integrity through next-frame prediction**.\n\n---\n\n## **W3: On the Applicability to Conventional Image Watermarks**\n\nWe appreciate your attention to the applicability of NFPA beyond T2I watermarks. As discussed in Section 4.2 of our paper, we systematically evaluated NFPA against *four representative conventional watermarking methods* that are *not derived from generative models*: DwtDct, RivaGAN, SSL, and StegaStamp.\n\nTo further validate its practicality, we applied these watermarks to *1,000 real-world photos* randomly sampled from the MIRFLICKR dataset and then evaluated NFPA’s effectiveness on this benchmark. The results (TPR@1%FPR ↓) are as follows:\n\n| Method | DwtDct | RivaGAN | SSL | StegaStamp | Avg. |\n|:------:|:------:|:-------:|:---:|:-----------:|:----:|\n| None (w/o attack) | 0.79   | 1.00    |1.00 |    1.00     | 0.95 |\n| **NFPA** | **0.01** | **0.14** | **0.16** | **0.02** | **0.08** |\n\nThese results confirm that **NFPA is highly effective in removing conventional image watermarks**, **reducing the average detection rate from 0.95 to 0.08**. This demonstrates strong generalizability of our approach in both synthetic and real-world watermarking scenarios.\n\n---\n\nWe once again thank the reviewer for the valuable feedback and encouragement. Your suggestions have significantly helped improve the **completeness, clarity, and evaluation strength** of our submission. We will incorporate all additional results and analyses in the final version to address your concerns comprehensively.\n\n**References**\n\n[1] Müller et al. *Black-box forgery attacks on semantic watermarks for diffusion models.* CVPR 2025.  \n[2] Zhang et al. *The Unreasonable Effectiveness of Deep Features as a Perceptual Metric.* CVPR 2018.  \n[a] Wu et al. *Q-ALIGN: Teaching LMMs for Visual Scoring via Discrete Text-defined Levels.* ICML 2024.  \n[b] Chen et al. *A Simple Framework for Contrastive Learning of Visual Representations.* ICML 2020."}, {"review_id": "kyHw9dccXE", "reviewer": "Reviewer_seke", "summary": "This paper proposes Next Frame Prediction Attack (NFPA), the first semantic-level attack specifically designed to remove watermarks embedded in AI-generated images. NFPA formulates watermark removal as a next-frame prediction problem inspired by video generation: it treats the watermarked image as an initial frame and synthesizes an unwatermarked next frame by subtly modifying the image’s semantic structure. The method leverages a zero-shot, tuning-free framework based on a pre-trained text-to-image diffusion model, performing DDIM inversion to obtain the latent representation of the input and applying an optimized optical flow transformation in the latent space to disrupt watermark signals while preserving perceptual fidelity. The authors conduct extensive experiments on eight state-of-the-art watermarking schemes, covering both pixel-level and semantic-level methods, and compare NFPA with nine established attack baselines, including distortion, regeneration, and adversarial attacks. Results demonstrate that NFPA consistently reduces watermark detectability while maintaining high image quality measured by FID and CLIP scores.", "questions": "Please see the weakness section for detailed concerns that require clarification.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "$\\textbf{Strengths}$\n\n1 -- The paper proposes a novel method for removing semantic-level watermarks by treating the problem as a next-frame prediction task. This approach goes beyond traditional pixel-level attacks and introduces a new perspective for attacking advanced watermarking techniques.\n\n2 -- The paper presents a well-designed methodology by adapting a pre-trained text-to-image diffusion model for next-frame prediction. The authors combine DDIM inversion with an optimized optical flow transformation in the latent space to generate an unwatermarked image that remains visually and semantically similar to the original.\n\n3 -- The proposed attack works in a black-box setting without requiring any information about the watermark or the detector, and it does not rely on additional data or queries. This makes the attack practical and realistic for situations where the attacker has limited knowledge or resources.\n\n$\\textbf{Weaknesses}$\n\n1 -- The paper does not compare NFPA with recent work [1] showing that controllable regeneration from clean noise can remove even semantic-level watermarks, despite claiming that existing semantic watermarking techniques are robust against such attacks; this omission weakens the comparative analysis.\n\n2 -- A relatively simpler approach would be to use off-the-shelf image-to-video generation modules, such as Stable Diffusion-based video models, which can directly generate temporally coherent next frames without requiring the complex inversion and optical flow steps proposed by the authors. However, the paper does not explore or compare these simpler alternatives, leaving it unclear whether NFPA’s complexity is necessary.\n\n3 -- The next-frame images produced by NFPA appear primarily as translated versions of the originals, suggesting that simple image translation alone might remove much of the watermark. The paper should compare NFPA with basic translation attacks, potentially combined with diffusion-based inpainting to reconstruct missing regions created by the translation.\n\n4 --  The attack design is limited to translation-based motion and does not consider other common camera transformations, such as zoom or rotation around the subject, which could lead to more effective or diverse watermark removal strategies.\n\n5 -- While quantitative metrics and qualitative examples are provided, the paper lacks a user study or detailed perceptual evaluation to confirm whether the subtle semantic changes introduced by NFPA degrade the recognizability or utility of attacked images.\n\n[1] - IMAGE WATERMARKS ARE REMOVABLE USING CONTROLLABLE REGENERATION FROM CLEAN NOISE (ICLR, 2025)", "was_revised": true, "final_justification": "I appreciate the authors’ detailed and constructive rebuttal, which addressed several of my initial concerns. They added missing baselines such as CtrlRegen+, explored simpler alternatives like translation and inpainting, and extended comparisons to later SVD frames, showing meaningful improvements. \n\nHowever, I still believe that SVD’s effectiveness could be further improved by tuning the \"noise-aug-strength\" parameter, which controls the degree of semantic drift in generation and can act as an implicit watermark removal strength knob. Additionally, the semantic shifts introduced by NFPA (as seen in Supplementary Fig. 1) raise questions about its alignment with the “next-frame” prediction framing and warrant further discussion. \n\nNonetheless, considering that several concerns were meaningfully addressed and the method is likely to be of interest to the community, I have raised my score to borderline accept.", "rebuttal": "We sincerely thank you for your detailed and insightful review. We are glad that you recognized the **novelty** of our method and its **practical value in black-box, data-free, and query-free** scenarios. Below, we provide detailed responses to each of your valuable concerns:\n\n---\n\n## **W1: Baseline Comparison: CtrlRegen+**\n\nWe greatly appreciate your suggestion to include *CtrlRegen+* [1] as a key baseline. Following your recommendation, we have conducted a thorough evaluation and **commit to including the complete results and quantitative analysis** in the final version.\n\nWe faithfully follow the default hyperparameter (`step=0.5`) in the official open-source implementation. The results are as follows (TPR@1%FPR ↓):\n\n| Method         | DwtDct | RivaGAN | SSL  | StegaStamp | TreeRing | StableSignature | RingID | GaussianShading | Avg. |\n|----------------|--------|---------|------|-------------|----------|------------------|--------|------------------|------|\n| CtrlRegen+     | 0.01   | 0.02    | 0.03 | 0.36        | 0.73     | 0.00             | 0.96   | 1.00             | 0.39 |\n| **NFPA (ours)** | **0.01**   | **0.13**    | **0.09** | **0.02**        | **0.07**     | **0.00**             | **0.02**   | **0.00**             | **0.04** |\n\nClearly, *CtrlRegen+* shows **limited effectiveness** on several watermarking methods, particularly *RingID (0.96)* and *GaussianShading (1.00)*. In contrast, **our NFPA achieves strong generalizability across all watermark types**.\n\nFurthermore, CtrlRegen+ requires training two distinct modules (semantic and spatial controllers), incurring **significantly higher training costs**. In contrast, **NFPA is a zero-shot method**, leveraging pretrained diffusion models for direct next-frame prediction without any fine-tuning or additional training. This makes **NFPA more deployable and practical in real-world attack settings**.\n\n---\n\n## **W2: Baseline Comparison: Video Generation Model**\n\nThank you for the insightful suggestion. To assess this idea, we evaluated *Stable Video Diffusion* (SVD) [a]. We used its second generated frame as the next-frame image. The results are as follows (TPR@1%FPR ↓):\n\n| Method         | DwtDct | RivaGAN | SSL  | StegaStamp | TreeRing | StableSignature | RingID | GaussianShading | Avg. |\n|----------------|--------|---------|------|-------------|----------|------------------|--------|------------------|------|\n| SVD            | 0.10   | 0.53    | 0.51 | 1.00        | 0.91     | 0.10             | 0.99   | 0.76             | 0.61 |\n| **NFPA (ours)** | **0.01**   | **0.13**    | **0.09** | **0.02**        | **0.07**     | **0.00**             | **0.02**   | **0.00**             | **0.04** |\n\nSVD performs substantially worse than NFPA, likely due to two key limitations:\n\n1. It lacks explicit mechanisms for watermark removal;\n2. Its inference time is high (∼31 seconds per image), making it impractical for real-time attacks.\n\nBy contrast, **NFPA leverages flow-guided latent perturbation to remove watermark**, achieving a better trade-off between **efficiency and effectiveness**.\n\n---\n\n## **W3: Baseline Comparison: Translation + Inpainting**\n\nAs suggested, we implemented two baselines for comparison:\n\n- *Translation only*: We follow the NFPA settings to randomly translate the image along the x/y axis using the `ImageChops.offset(.)` function, with a translation range of [-40, 40] pixels;\n- *Translation + Inpainting*: shifted images are completed using the *stable-diffusion-2-inpainting* [b] model.\n\nThe results are as follows (TPR@1%FPR ↓):\n\n| Method                | DwtDct | RivaGAN | SSL  | StegaStamp | TreeRing | StableSignature | RingID | GaussianShading | Avg. |\n|------------------------|--------|---------|------|-------------|----------|------------------|--------|------------------|------|\n| Translation only            | 0.03   | 1.00    | 1.00 | 0.17        | 0.38     | 1.00             | 0.31   | 0.01             | 0.49 |\n| Translate + Inpainting | 0.00   | 0.36    | 0.56 | 0.00        | 0.13     | 0.01             | 0.01   | 0.00             | 0.13 |\n| **NFPA (ours)**        | **0.01**   | **0.13**    | **0.09** | **0.02**        | **0.07**     | **0.00**             | **0.02**   | **0.00**             | **0.04** |\n\nWe summarize two key points of analysis:\n1.  **Naive translation fails to remove most watermarks**, with an average detection rate of 0.49;\n2.  *Translation + Inpainting* improves slightly but **still underperforms NFPA and lacks a clear watermark removal strategy.**\n\nThese results further justify our formulation of the task as **next-frame prediction** rather than simple spatial augmentation.\n\n---\n\n## **W4: More Camera Transformations**\n\nThank you for highlighting this point. We test three basic camera translation motions (X, Y, and XY axes). Regardless of the motion mode, NFPA consistently outperforms state-of-the-art methods, indicating **robustness to motion model choices**. We have extended NFPA to include **zoom-based camera motion** and compared it with the original translation variant. The results are as follows (TPR@1%FPR ↓):\n\n| Method          | DwtDct | RivaGAN | SSL  | StegaStamp | TreeRing | StableSignature | RingID | GaussianShading | Avg. |\n|------------------|--------|---------|------|-------------|----------|------------------|--------|------------------|------|\n| NFPA (zoom)      | 0.01   | 0.08    | 0.08 | 0.18        | 0.11     | 0.00             | 0.01   | 0.00             | 0.06 |\n| NFPA (xy-axis)   | 0.01   | 0.13    | 0.09 | 0.02        | 0.07     | 0.00             | 0.02   | 0.00             | 0.04 |\n\nThe results further verify that **NFPA remains robust across different types of camera motion**, supporting its flexibility and generalization. We plan to explore more advanced transformations as part of our future work.\n\n---\n\n## **W5: Perceptual Quality Evaluation**\n\nWe appreciate your focus on visual quality. To further evaluate perceptual and semantic preservation, we introduce two complementary metrics:\n\n- *Q-align* [c]: A large multimodal model-based metric aligned with human perceptual judgments. It provides a better approximation of human visual assessment.\n- *Cosine Similarity (CosSim)*: Based on *SimCLR* [d] representations, this metric measures the semantic similarity between the original and attacked image, providing insight into whether the semantic content is preserved.\n\n| Method | None (w/o attack) | JPEG | Crop | Blur | Noise | ColorJitter | Rotation | VA | DA | MSAA | NFPA (ours) |\n|:------:|:----:|:----:|:----:|:----:|:-----:|:-----------:|:--------:|:--:|:--:|:----:|:------------:|\n| **Q-align↑** | 4.02 | 3.48 | 3.20 | 2.19 | 2.07 | 2.08 | 3.07 | 3.96 | 4.10 | 1.97 | **3.88** |\n| **CosSim↑** | 0.30 | 0.27 | 0.29 | 0.30 | 0.29 | 0.29 | 0.30 | 0.30 | 0.29 | 0.30 | **0.30** |\n\nThese results show that **NFPA achieves high perceptual quality and semantic fidelity** without compromising on watermark removal. In the final version, we will include more perceptual examples and plan to incorporate user studies as a future extension.\n\n---\n\nWe thank you again for your constructive feedback, which helped us substantially improve our work. We have added key baselines, performed in-depth ablation studies, and provided more comprehensive justifications based on your input. We believe these enhancements significantly strengthen the completeness and persuasiveness of our paper.\n\n**References**  \n\n[1] *Image Watermarks Are Removable Using Controllable Regeneration from Clean Noise*, ICLR 2025\n\n[a] https://huggingface.co/stabilityai/stable-video-diffusion-img2vid\n\n[b] https://huggingface.co/stabilityai/stable-diffusion-2-inpainting\n\n[c] *Q-Align: Human-Aligned Quality Estimation for Text-to-Image Generation*, CVPR 2024\n \n[d] *A Simple Framework for Contrastive Learning of Visual Representations*, ICML 2020"}, {"review_id": "f8eSWoWT6h", "reviewer": "Reviewer_g6pS", "summary": "This paper studied the watermark removal attack problem. Specifically, the authors pointed out that current methods might fall short in terms of semantic-level watermark removal, and to address this issue, they proposed the Next Frame Prediction Attack (NFPA) aimed at semantic-level removal. The NFPA models watermark removal as a video generation task where the goal is to generate the next frame that does not carry the watermark. Experiments were conducted to demonstrate the effectiveness of their proposed method.", "questions": "Some major questions/issues are listed below:\n\n- My main question concerns whether a semantic-watermark removal attack is truly necessary, which relates to the foundation of this paper. Typically, watermarks involve embedding certain signals (e.g., imperceptible noise) into images that can later be extracted to verify ownership when we encounter similar images. Traditional attacks against watermarks essentially aim to remove those embedded signals through techniques like cropping, rotating, or adding noise.\n\nHowever, there's an important constraint: attacks typically cannot be too aggressive, as substantially altering the images would render the original content meaningless. This makes me curious about the practical need for semantic-watermark removal attacks, since they fundamentally change the semantic meaning of images, making them significantly different from the originals. This approach seems to diverge from typical real-world watermark applications. After all, if we change an image's semantic meaning entirely, doesn't it become questionable to make copyright claims on the resulting image?\n\n- In the experimental evaluation section, I noticed metrics focus on FID and CLIP scores rather than PSNR and SSIM. It would be helpful to explain why these traditional image quality metrics were excluded, as they're standard in measuring preservation of image fidelity.\n\n- I would like to see results using a wider variety of diffusion models to demonstrate the robustness of your approach across different frameworks.\n\nOverall, I find the concept interesting but would appreciate more discussion on these aspects to fully understand the practical applications and limitations of semantic watermark removal.", "limitations": "Check above", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Significance: Watermark-related research problems are of potentially great significance in the generative AI era.\n\nClarity: I think the paper does not clearly discuss and distinguish between classical pixel-watermarks and semantic watermarks.\n\nQuality: I think the overall writing and the experiments presented are OK.\n\nOriginality: The idea of casting the watermark removal process as video generation is novel, at least to me.", "was_revised": true, "final_justification": "I think this paper is around the borderline, might be slightly leaning towards acceptance. I am not buying the semantic concept overall because I feel that the semantic watermark is not practical at all. For instance, an artist may not want to sacrifice or change the semantics of his/her work to add a watermark. After all, there are invisible watermarks. In this sense, I do feel this paper's practicality is very limited.", "rebuttal": "We sincerely thank you for the detailed and thoughtful review of our paper. We truly appreciate your recognition of the **novelty**, **significance**, and **overall quality** of our work. Below, we provide detailed responses to your insightful comments and concerns:\n\n---\n\n## **Q1: The Necessity of Semantic-level Attacks**\n\nThank you for raising this fundamental question. We fully understand your concern that *attacks should avoid damaging the semantic integrity of the image*. In fact, one of the core objectives of our proposed method is to achieve **watermark removal with minimal semantic shift**. As shown in *Figure 4* of the main paper, the outputs generated by our method are *visually near-equivalent* to the original watermarked images, indicating that **the image content remains essentially intact**.\n\nMore importantly, **semantic-level removal attacks are necessary**. Recent advances have introduced a new class of *semantic-level watermarking schemes* (e.g., *TreeRing*, *RingID*) that embed signals into the *semantic latent space* of AIGC images by altering the noise or structural priors. These schemes are designed to be significantly more robust than classical pixel-based watermarks. However, without corresponding semantic-level attacks, there is currently no principled way to evaluate their real-world security. This could lead to *false confidence* in these watermarking methods, posing risks for applications like deepfake detection and content provenance.\n\nOur work aims to fill this gap by proposing the **first semantic-level watermark removal attack**. We formulate the problem as a next-frame prediction task, enabling *fine-grained semantic manipulation* while maintaining perceptual consistency through frame attention. Moreover, we would like to emphasize that our goal is to **expose vulnerabilities in existing image watermarking systems**, which can **inspire the development of stronger and more resilient watermarking techniques**. NFPA also serves as a valuable *security evaluation tool*, guiding the design of future watermarking methods and contributing to a more trustworthy AI ecosystem.\n\n---\n\n## **Q2: Image Quality Metrics**\n\nThank you for pointing out the importance of evaluation metrics. We fully agree that *PSNR and SSIM are standard and meaningful for pixel-level fidelity assessments*. However, as you rightly observed, our focus is on *semantic-level watermark removal*, which necessitates a shift in the evaluation perspective:\n\n- *PSNR and SSIM* are designed to measure *pixel-wise reconstruction quality*, suitable for tasks like image compression or denoising where spatial alignment is preserved;\n- In contrast, our method (NFPA) performs **semantic transformations** that may introduce spatial variations (e.g., pixel rearrangements), even though the **semantic content and perceptual quality remain intact**;\n- In such scenarios, *pixel-aligned metrics can produce misleadingly low scores*, failing to reflect true semantic consistency.\n\nTo address this concern and further support our claims, we have introduced two additional evaluation metrics:\n\n- *Q-align* [a]: A large multimodal model-based metric aligned with human perceptual judgments. It provides a better approximation of human visual assessment.\n- *Cosine Similarity (CosSim)*: Based on *SimCLR* [b] representations, this metric measures the semantic similarity between the original and attacked image, providing insight into whether the semantic content is preserved.\n\n| Method | None (w/o attack)| JPEG | Crop | Blur | Noise | ColorJitter | Rotation | VA | DA | MSAA | NFPA (ours) |\n|:------:|:----:|:----:|:----:|:----:|:-----:|:-----------:|:--------:|:--:|:--:|:----:|:------------:|\n| Q-align↑ | 4.02 | 3.48 | 3.20 | 2.19 | 2.07 | 2.08 | 3.07 | 3.96 | 4.10 | 1.97 | 3.88 |\n| CosSim↑ | 0.30 | 0.27 | 0.29 | 0.30 | 0.29 | 0.29 | 0.30 | 0.30 | 0.29 | 0.30 | 0.30 |\n\nThese results demonstrate that **NFPA achieves high perceptual and semantic fidelity**, without compromising watermark removal effectiveness.\n\n---\n\n## **Q3: Evaluation on more diffusion architectures**\n\nWe appreciate your suggestion to extend the experimental scope, as it is crucial to validate the **robustness and generality** of our method. In response, we have conducted additional experiments to evaluate NFPA’s performance on images generated by the *FLUX.1-dev* [c] diffusion model. Since some watermarking schemes lack implementations for alternative diffusion architectures, we focus on *post-hoc watermarking methods* to test cross-model transferability of our attack.\n\nThe results are as follows (TPR@1%FPR ↓):\n\n| Method         | DwtDct | RivaGAN | SSL  | StegaStamp | Avg. |\n|----------------|--------|---------|------|-------------|------|\n| None (w/o attack) | 0.86   | 1.00    | 1.00 | 1.00        | 0.97 |\n| **NFPA (ours)**       | **0.01**   | **0.14**    | **0.15** | **0.01**        | **0.08** |\n\nThese results show that **NFPA remains highly effective even on images generated by a novel diffusion model**, demonstrating strong transferability and adaptability across different generative backbones.\n\n---\n\n## **W1: Clarifying the Distinction Between Pixel-Level and Semantic-Level Watermarking**\n\nWe sincerely appreciate your insightful comment. We fully agree that a clearer and more explicit differentiation between *pixel-level* and *semantic-level* watermarking will enhance the reader's understanding of the distinct threat models, attack surfaces, and potential vulnerabilities associated with each. In the final version of our paper, we will include the following refined description:\n\n- **Pixel-level watermarking methods** (e.g., *DwtDct*, *RivaGAN*, *SSL*, *StableSignature*) embed imperceptible ownership signals directly into the image’s **pixel or frequency domain**, often via spatial perturbations, quantization, or frequency modulation. These techniques are typically vulnerable to classical distortions such as compression, cropping, or noise injection.\n\n- **Semantic-level watermarking methods** (e.g., *TreeRing*, *RingID*, *GaussianShading*, *StegaStamp*) typically operate in the latent space of diffusion models. They encode ownership by perturbing **semantic features**, making them more resilient to low-level attacks but potentially more susceptible to *semantic-space manipulations*, like our proposed method.\n\nThis distinction also highlights the necessity of our attack, where semantic-level watermarking introduces new robustness challenges and requires more advanced removal strategies to verify their robustness.\n\n---\n\nAgain, thank you for your insightful feedback and deep engagement with our work. Your suggestions have significantly helped us **clarify the motivation, strengthen the empirical foundation, and refine the overall presentation** of our paper. We have incorporated the necessary extensions and explanations in the revised version, and we hope the improved clarity and rigor will better communicate our contributions.\n\n**References**\n\n[a] Wu et al. *Q-ALIGN: Teaching LMMs for Visual Scoring via Discrete Text-defined Levels.* ICML 2024.  \n[b] Chen et al. *A Simple Framework for Contrastive Learning of Visual Representations.* ICML 2020.  \n[c] https://huggingface.co/black-forest-labs/FLUX.1-dev"}, {"review_id": "65QRhU6U83", "reviewer": "Reviewer_gigz", "summary": "This paper introduces the Next Frame Prediction Attack (NFPA), a semantic-level watermark removal attack for AI-generated images. Unlike existing pixel-level attacks that modify individual pixels, NFPA formulates watermark removal as a video generation task by treating the watermarked image as an initial frame and generating a semantically coherent \"next frame\" that preserves visual content while removing the watermark. The method leverages a pre-trained text-to-image diffusion model in a zero-shot manner, using DDIM inversion, optical flow transformations, and frame-attention mechanism. Experiments on eight watermarking schemes show the proposed method outperforms nine baseline attacks while maintaining image quality.", "questions": "- How does NFPA perform on watermarked images generated by models other than Stable Diffusion? Would the method work on naturally captured images with post-processing watermarks?\n- The paper tests three basic camera motions (x-axis, y-axis, xy-axis), but how sensitive is the attack to the choice of motion pattern? Could adversarial motion patterns further improve performance?\n- Given the effectiveness of NFPA, what potential defenses could watermarking schemes adopt? Could temporal consistency constraints be incorporated into watermark design?\n- How can we quantitatively measure the semantic preservation beyond FID and CLIP scores? Are there cases where NFPA significantly alters image semantics?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths: \n\n- It’s an interesting idea to frame watermark removal as a next-frame prediction task. This semantic-level approach may address some limitations of existing pixel-level attacks.\n- The paper evaluates against 8 different watermarking methods (both pixel-level and semantic-level) and compares with 9 attack baselines, providing thorough experimental validation.\n- The proposed method combines DDIM inversion, optical flow optimization, and frame-attention mechanism.\n\nWeaknesses:\n\n- The paper lacks theoretical justification for why the next-frame prediction approach should effectively remove semantic watermarks. The connection between temporal consistency and watermark removal could be better explained.\n- NFPA requires ~1.3 seconds per image, which is significantly slower than simple distortion attacks. The paper doesn't adequately discuss scalability for large-scale attacks.\n- The method introduces several hyperparameters (optical flow bounds, inference steps, etc.) but provides limited analysis of sensitivity to these choices beyond brief ablation studies.\n- Only evaluated on MS-COCO dataset with Stable Diffusion-generated images. No evaluation on real-world watermarked images or other generation models.", "was_revised": true, "final_justification": "I have read the rebuttal and my questions have been answered.  I increased my rating to accept.", "rebuttal": "We sincerely thank you for your thorough review and valuable feedback on our paper. We are especially grateful for your recognition of our **method design** and the **comprehensive experimental validation**. Below, we provide detailed responses to your concerns and questions:\n\n## **W1: Theoretical Analysis**  \nThank you for your insightful examination of our theoretical motivation. Our proposed NFPA innovatively formulates the task of semantic watermark removal as a *next-frame prediction* problem. This formulation is grounded in the *inherent semantic continuity and subtle variations across temporal sequences in video*. Specifically, semantic watermarks often rely on particular embedding patterns in the high-dimensional feature space. NFPA leverages the fact that adjacent frames in a video exhibit strong semantic consistency with only slight pixel-level differences.\n\nBy constructing an optical flow field matrix, we introduce fine-grained and controllable perturbations to the latent representations of the image. Coupled with a *frame attention mechanism*, this ensures that the generated next-frame image remains semantically coherent with the original watermarked input. These small but strategic semantic perturbations allow the output image to maintain its core semantic structure and perceptual quality while *escaping the feature subspace where the watermark was originally embedded*. In essence, while the semantic content remains intact, the high-dimensional feature distribution is subtly altered, thereby evading watermark detectors.\n\nThis approach achieves a critical balance between *semantic consistency* and *perturbation effectiveness*, demonstrating that semantic changes can effectively dismantle embedded watermarks without visibly altering the image. We will elaborate more rigorously on the link between temporal consistency and watermark removal in the revised version.\n\n---\n\n## **W2: Scalability of Large-Scale Attacks**  \nThank you for your attention to the efficiency and scalability of our method under large-scale attack scenarios. For semantic-level watermarks, simple and fast pixel-level distortions are generally ineffective. The value of NFPA lies in its ability to remove such *robust watermarks*, which inherently requires modest computational resources.\n\nRegarding scalability, *NFPA*, as a deep learning-based model, exhibits substantial parallelization potential. It can be efficiently **batch-processed** on GPUs, significantly reducing the total runtime when handling large volumes of images. Thus, the average *1.3 seconds per image* runtime reflects a reasonable trade-off for its high attack efficacy, and the method has *ample room for optimization* through parallel processing in practical deployments.\n\n---\n\n## **W3: Hyperparameter Analysis**  \nWe appreciate your suggestion to provide a more detailed sensitivity analysis of our hyperparameters. We have now expanded our analysis as follows:\n\n1. **Base Model Selection**: Our experiments show that NFPA maintains *robust watermark removal performance* across different base models (e.g., SD-v1.4 ~ SD-v2.1). Although larger models yield slightly better image quality, this highlights that NFPA is **insensitive to the choice of base model**, suggesting its continued effectiveness and generalizability even as diffusion models evolve.\n\n2. **Frame Attention Mechanism**: Ablation studies reveal that removing this mechanism significantly degrades image quality, underscoring its **critical role in maintaining inter-frame semantic coherence** during attacks. It ensures that while watermarks are removed, the original semantic structure of the image is preserved — achieving a strong balance between attack strength and visual fidelity.\n\n3. **Number of Inference Steps**: Increasing denoising steps improves image quality but may slightly reduce attack effectiveness. This is because finer denoising and more faithful reconstruction bring the predicted image closer to the original at the pixel level, potentially *weakening the semantic-level perturbation* introduced by NFPA. Thus, we set the default number of steps to 10, as a balanced trade-off between removal performance and perceptual quality.\n\n4. **Maximum Optical Flow Search Range (δ)**: We evaluate this parameter in Appendix D. When δ = 0, no motion is introduced, and NFPA degrades into a reconstruction-based attack, resulting in poor removal performance. As δ increases, it allows more freedom to explore the feature space and decouple watermark signals, albeit with a potential drop in visual quality. This flexibility enables a controllable trade-off between detection evasion and perceptual distortion.\n\nThese detailed analyses will be incorporated in the revised version to better illustrate the impact of hyperparameters on performance.\n\n---\n\n## **Q1&W4: Watermarks from Real Images and Other Diffusion Models**  \nThank you for raising concerns about the applicability of our method to different types of watermarked images. To address this, we conducted two additional sets of experiments:\n\n1. **Watermarks from Other Generative Models**: We evaluate watermarked images generated by the **FLUX.1-dev** [a] model. Since no official semantic watermarking implementation exists for other diffusion architectures, we use post-processing watermarking schemes for validation. The results clearly demonstrate that **NFPA remains highly effective**, even when attacking watermarks from novel diffusion architectures. The results are as follows (TPR@1%FPR ↓):\n\n| Method | DwtDct | RivaGAN | SSL | StegaStamp | Avg. |\n|:------:|:------:|:-------:|:---:|:-----------:|:----:|\n| None   | 0.86   | 1.00    |1.00 |    1.00     | 0.97 |\n| **NFPA (ours)** | **0.01** | **0.14** | **0.15** | **0.01** | **0.08** |\n\n2. **Real-World Watermarked Images**: We further validate NFPA on *real-world photographs* from the **MIRFLICKR** dataset. We randomly sampled 1,000 real photos and embedded watermarks using four conventional methods. NFPA effectively reduced the average watermark detection rate to **0.08**. The results are as follows (TPR@1%FPR ↓):\n\n| Method | DwtDct | RivaGAN | SSL | StegaStamp | Avg. |\n|:------:|:------:|:-------:|:---:|:-----------:|:----:|\n| None   | 0.79   | 1.00    |1.00 |    1.00     | 0.95 |\n| **NFPA (ours)** | **0.01** | **0.14** | **0.16** | **0.02** | **0.08** |\n\nThese results strongly support that NFPA is both **adaptive across various generative architectures** and **practical in real-world scenarios**.\n\n---\n\n## **Q2: Complex Motion Models**  \nThank you for your comments on our choice of motion models and their potential influence on attack performance. We test three basic camera translation motions (X, Y, and XY axes). Regardless of the motion mode, NFPA *consistently outperforms state-of-the-art methods*, indicating **robustness to motion model choices**.\n\nWe also added a new experiment using a **zoom-based motion model**, and the results are as follows (TPR@1%FPR ↓):\n\n| Method | DwtDct | RivaGAN | SSL | StegaStamp | TreeRing | StableSignature | RingID | GaussianShading | Avg. |\n|:------:|:------:|:-------:|:---:|:-----------:|:--------:|:----------------:|:------:|:----------------:|:----:|\n| **NFPA (zoom)** | 0.01 | 0.08 | 0.08 | 0.18 | 0.11 | 0.00 | 0.01 | 0.00 | 0.06 |\n\nThese results further confirm NFPA’s *motion-model-insensitive design*. We recognize that more complex or dynamic motion models could unlock new attack potentials. Exploring such models is part of our future research.\n\n---\n\n## **Q3: Watermark Defenses**  \nWe appreciate your insightful question regarding possible defense strategies against NFPA. The idea of integrating temporal consistency into watermark design is particularly promising. Potential defenses could include:\n\n1. **Enhancing Semantic Resilience**: Watermarks could be embedded in *high-level semantic features*, rather than shallow textures or frequency components. This would make any semantic-level perturbation attempt inevitably affect the image content in a detectable way.\n\n2. **Temporal Consistency Embedding**: Designing watermarks that *persist through semantic shifts or frame predictions* could significantly challenge attacks like NFPA. For example, encoding watermarks to evolve predictably across semantic transitions would require attackers to break temporal coherence, making attacks more detectable.\n\nThis could involve adversarial training to make watermark extraction models resilient to subtle semantic perturbations. We believe this is a highly valuable direction for building **next-generation robust watermarking schemes**.\n\n---\n\n## **Q4: Perceptual Quality Evaluation**  \nThank you for your thoughtful discussion on evaluating semantic fidelity. Beyond **FID** and **CLIP scores**, we incorporated two additional metrics:\n\n- *Q-align* [b]: A large multimodal model-based metric aligned with human perceptual judgments. It provides a better approximation of human visual assessment.\n- *Cosine Similarity (CosSim)*: Based on *SimCLR* [c] representations, this metric measures the semantic similarity between the original and attacked image, providing insight into whether the semantic content is preserved.\n\n| Method | None | JPEG | Crop | Blur | Noise | ColorJitter | Rotation | VA | DA | MSAA | NFPA |\n|-|-|-|-|-|-|-|-|-|-|-|-|\n| **Q-align ↑** | 4.02 | 3.48 | 3.20 | 2.19 | 2.07 | 2.08 | 3.07 | 3.96 | 4.10 | 1.97 | **3.88** |\n| **CosSim ↑** | 0.30 | 0.27 | 0.29 | 0.30 | 0.29 | 0.29 | 0.30 | 0.30 | 0.29 | 0.30 | **0.30** |\n\nThese results demonstrate that **NFPA achieves high semantic and perceptual fidelity**, validating our core motivation: using *next-frame prediction* to effectively remove watermarks *without compromising image quality or semantics*.\n\n---\n\n**References**\n\n[a] https://huggingface.co/black-forest-labs/FLUX.1-dev\n\n[b] Q-Align: Human-Aligned Quality Estimation for Text-to-Image Generation, CVPR 2024\n\n[c] A Simple Framework for Contrastive Learning of Visual Representations, ICML 2020"}]

Author rebuttal:

Meta-review: The paper proposes a ‘next frame prediction attack’ - phrasing the image watermarking removal task as a next frame prediction i.e. video generation task. 

The paper received equivocal reviews initially, but following rebuttal most reviewers shifted to borderline accept (3x BA) and one firm accept (1x A).

m5Bd has concerns over comprehensiveness of baselines and whether the approach worked also for post-hoc watermarks.    The rebuttal added experiments addressing both questions, and these should one included in the final version.  There was another query re: LPIPS but it appears this was due to a technical miscommunication and some improved clarity here in the final paper would be welcome.

seke had several concerns e.g. whether translation i.e. shift would be as effective, and shared concerns over the breadth of comparative evaluation presented.  These were addressed in the rebuttal and should be included in the final version.

g6pS mainly had concerns over the motivation and framing of the task but raised their score post-rebuttal to weak acceptance.

gigz was the most positive reviewer, considering the approach novel with strong validation.

Overall the AC considers this paper a novel approach to watermark attack, that if supported with the additional experiments in the rebuttal, would result in a strong contribution.  The AC notes the consensus view to accept the paper and so also recommends to accept it.
Decision: Accept (poster)