A Baseline Method for Removing Invisible Image Watermarks using Deep Image Prior
Authors: Hengyue Liang
Taihui Li
Ju Sun
Venue: Accepted by TMLR ()

Abstract: Image watermarks have been considered a promising technique to help detect AI-generated content, which can be used to protect copyright or prevent fake image abuse. In this work, we present a black-box method for removing invisible image watermarks, without the need of any dataset of watermarked images or any knowledge about the watermark system. Our approach is simple to implement: given a single watermarked image, we regress it by deep image prior (DIP). We show that from the intermediate steps of DIP one can reliably find an evasion image that can remove invisible watermarks while preserving high image quality. Due to its unique working mechanism and practical effectiveness, we advocate including DIP as a baseline invasion method for benchmarking the robustness of watermarking systems. Finally, by showing the limited ability of DIP and other existing black-box methods in evading training-based visible watermarks, we discuss the positive implications on the practical use of training-based visible watermarks to prevent misinformation abuse.

Published in Transactions on Machine Learning Research (07/2025)
A Baseline Method for Removing Invisible Image Watermarks using Deep Image Prior
Hengyue Liang
lang656 edu
Electrical and Computer Engineering University of Minnesola, Twin Cities
Taihui Li
kkrx:5027 edu
Computer Science and Engineering University of Minnesota, Twin Cities
Ju Sun
jusun Drmmn. edu
Computer Science and Engineering University of Minnesota, Turin Citics
Reviewed on OpenReview: /ttps:///pperevvtee net/ forum? id- g85Vvlrg00
Abstract
Image watermarks have been considered a promising technique to help detect AT-generated content, which can be used to protect copyright or prevent fake image abuse. In this work, we present a black-box method for removing invisible image watermarks, without the need of any dataset of watermarked images or any knowledge about the watermark system. Our approach simple to implement: given single watermarked image, regress it by deep image prior (DIP). We show that from the intermediate steps of DIP one can reliably find an evasion image that can remove invisible watermarks while preserving high image quality. Due to its unique working mechanism and practical effectiveness, we advocate including DIP as baseline invasion mothod for benchmarking the robustncss of watermarking systems. Finally, by showing the limited ability of DIP and other existing black-box methods in evading training-base based visible watermarks, we discuss the positive implications on the practical use of training-beat based visible watermarks prevent misinformation abuse. Our code is publicly available at: htttps://github. cww.eoooocuuuueeeeeeeeee umn umn/DIP. DIP Watermark BatiiaarreEaaiii__T_II_T_
1 Introduction
In this prosperous era of generative AI, the traceability of Al-generated content (e.g., language, images, and videos) to its source has been frequently mentioned as promising solution to promote the responsible use of generative AT (Fan et al. 2023), e.g., to protect copyright or to curb misinformation. In particular, the traceability of Al-generated images has become increasingly urgent, as many Al products, such as DALL-E [Ramesh et al. 2022) and Stable Diffusson (Rombach el al.] 2022), ; can create highly photorealistic and artistic images that are hard to distinguish from natural photos or human drawings. Unsurprisingly, some Al-generated images have caused false beliefs social media (Wendling). Thus, major tech companics such Google, OpenAl (Bartz & Hu 2023) have recently opted to incorporate watermarks into their image generation products to improve traceability and promote responsible use.
Manually designed vs. training-based watermarks Watermarking met can be generally divided into two categories: (i) non-blind methods (Cox et al. 1997 Hsieh et al.) 2001 Pereira & Pun 1999 and (ii) blind methods (Bi et al.) (200)) which are divided by whether access original clean images required correctly decode the watermarked images (Zhao et al. 2024ah. In what follows, we focus only on blind methods (and refer to them watermarks)). as they do not require access to clean images and fit. better in

---

Published in Transactions on Machine Learning Research (07 2025)
Wotermenk
(a)
(b)
(c)
Figure 1: Example of (a) a clean image, (b) an image with an overlaid logo watermark and (c) an image with steganography watermark.
large-scale application scenarios, such as tracing AT AT-generated content. Watermarks are typically embedded
in images in terms of an overlaid logo or steganography (Morkel et al., 2005); see Fig. for an example. The embedded watermarks then are typically detected by human eyes or by algorithmic decoders (Voyatzis Zhu el al. 2018). In early research, various manually designed watermarks were proposed and applied to copyright protection, e.g., visible watermarks (detectable by human eyes) such as an overlaid layer (Kankanhalli et al. 1999) or a color code signature (such as the example in Appendix A invisible watermarks (detectable by algorithmic decoders) such as Tirkel et al. (1993); Pereira & Pun (2000); Navas et al. (000)). However, these manually designed watermarks are challenged by robustness concerns, i.e., imperceptible corruption, digital editing, or deliberate attacks the watermarked image can make them undetectable (Mishra 2022 Zhao al. 2024bb; ; see also Fig. To address these challenges, recent work has shifted to training-based watermarking systems using deep neural networks (DNNs). By incorporating ideas from data augmentation (Mumuni & Mumuni 2022) and adversarial training (Goodfellow et al. 2014b),
& Pilas 1999
the robustness of training-basse watermarks against common digital corruptions consistently beats that of
manually designed ones (Zhu el al. 2018 Zhang el. al. 2019b Tancik el al. 2020 Jia el al. 2021
Original Image
Watermarked Image
Attacked Image
Attacker Remove
Encoder
Watermark
Decoder
B
Watermark detected G
No watermark
No watermark
Figure 2: Illustration of the watermarking system and the robustness concern concern-wateeeee wattrnarks may be removod with little loss of image quality.
Evaluating the robustness of watermark systems Robustness evaluation of watermark systems often operates under either the white-box or the black-box evasion (i.e., attack) setting (Zhao al.) 2024a An et al. 2024). In white-box evasion, the decoder and the groundtruth watermark are accessible to a dedicated evader (Jiang et al. 2023), which easily leads to a. high threat. In cont rast, the threat can be greatly reduced by maintaining secrecy of the system (An et al.) 2024), ie.. under the black-boz model, where the decoder and the groundtruth watermark remain unknown to the evader. Nowadays, it is common for companics not to open-source their generative products, e.g., DALLE-3 from OpenAI, Midjourney, Imagen from Google. Thus, being robust against potential black-box evasions is of higher priority in practical scenarios.
The main focus of this paper is to explore black-boz evasion techniques that generate evasion images with the best possible quality. We stress the image quality alongside the evasion success, because for a dedicated evader, the higher the quality of the evasion images they can produce, the more benefit they can potentially
SSteganography: detectable messages embedded in image but are invisible human eyes.
2

---

Published in Transactions on Machine Learning Research (07 (07/2025)
gain, e.g., breaking the copyright protection without compromising the image quality misleading people to use highly naturally-looking fake images. Recently, researchers are putting effort into standardizing the robustness benchmark of image watermarks (An et al.) 2024). Although the selected black-box evasion methods are effective in bypassing watermark detection, their evasion images can still introduce visible defects; see [Section 4] and Fig. 8] Thus, the search for new methods to provide stronger stress lests of watermarking systems is still a pressing problem.
Our contributions In this paper, we propose a new black-box watermark evasion method using the Deep Image Prior (DIP) (Ulyanov et al. 2018) an untrained DNN-based prior that proves powerful in solving single-image blind denoising and numerous single-instance inverse problems (Qayyum et al., 2023 Tirer et al. 2023 Zhuang 2023). Our main contributions include: (i) We show that DIP-based blind denoising can be used to generate high-quality evasion images effective against many existing invisible watermarks, both training-baser bastd and manually designed; (ii) We elucidate the principle behind DIP's evasion performance its faster rate in picking up low frequencies than high ones empowers its image-agnostic watermark purification ability. Due to (i) and (ii), we advocate including DIP evasion as an integral component in the robustness evaluation of watermarking systems (Saberi et al.) 2023; An et al. 2024); (iii) Basod on our analysis, we further recommend that to counteract black-box watermark evasions, a reliable watermark scheme should focus modifying low-frequency components and have reasonable magnitude.
2 Background and related work
(Blind) image steganography refers to the technique of hiding secret but retrievable messages in an image with minimal change to the image (Zhu et al., 2018). Given an ar arbitrary natural image I E I, where I denotes the set of natural images, and arbitrary n-bit message E 10, an image steganography system typically consists of encoder E-which takes any image I and any message w and produces an encoded image, decoder D which takes any image and produces informative message, and its system goal: (o means function composition)
(D o [I, w) w, D(T) = 0.
VI E I, Vw E (0,
(correctly encode and decode w)
(1a)
E
(no useful message decoded from a clean image) (1b)
1, 1,
VI E I, Yw E 10.
(minimal encoding distortion to the image)
(1c)
Existing steganography methods differ by whether the encoder and decoder are manually designed or learned from data. Manually designed encoder pairs rely on ideas such as manipulating the least significant bit (LSB) (Tirkel et al. 1993), template matching in the Fourier domain (Pereira & Pun, 20000, discrete wavelet transform (DWT), discrete cosine transform (DCT), and singular value decomposition (SVD) (Bi et al. 2007 Pereira & Pun 2000 Navas et al.] 2008). In cont.rstt, training- methods often learn MNNNbasee encoder-decoder pairs from data, based on variants of a model formulation derived from the goal stated in Eq. (1)
min fnr,rmmuu [w. (Do (T) w]) 0.0
(lo ensure Eq. (1a)
(2)
t. Eg (1, (L, w)) 8, VI I, Vw {0, (to ensure Eq. (1c)
where & and 0 are learnable weights of the DNNs in E and D, respectively; e, and lg are two losses measuring the error of message recovery and the quality distortion to the image, respectively; and o is the maximally allowed perturbation to the image caused by watermarking embedding. Representative training-based methods
include HIDDEN and its variants (Zhu et al. 2018 Wen & Aydore|
2020). SteganoGAN (Zhang et al. 2019a), Stable Signature Fernandez et al. (023). rivaGAN (Zhang et al. 2019b), StegaStamp Tanncik et. al. 2020), Mbrs/ (Jia et al. 2021 and Mark (Bui el al. 2023a). These methods typically also
2019 Luo et al.
incorporate regularization terms to encourage the distribution of the encoded images to be close to that of the original images based on generative adversarial networks (GAN) (Goodfellow et al., 2014a). SSL (Fernandez) et al. (022) and RoSteALS (Bui et al. 2023b) are similar in spirit but perform learning in different spaces. In theory, solving Eq. (2) with a reasonably small 8 can always produce distortion patterns that are invisible
3

---

Published in Transactions on Machine Learning Research (07 (07/2025)
Clean
DWDDdBVD
AVAGAN
ThustMark
Histogram of watermark pattern
10a
x
X
10*
SSL
RoSteALS
StegalStamp
207
102
Figure 3: Visualization of a clean image (from COCO) and its steganography versions by different methods. Below each steganography image is the histogram of the pixel magnitude in the corresponding distortion (i.e., difference between the steganography image and the clean image): y-axis in log scale and the vertical dashed line marks the 90% quantile. While DwtDetSVD, rivaGAN and TrustMark induce distortions that are almost invisible, SSL., RoSteATS and StegaStamp produce relatively more visible distortions loccll color jitters for SSL, global color jitters for StegaStamp, and global smoothing for RoSteALS. All images presented above are in uint8 format with value in [0, 255] with resolution 512 x 512.
to human eyes. However, existing methods typically work with heuristic penalty or regularization forms of Eq. (2) and therefore do not necessarily find feasible solutions to Eq. (2) e.g., (Zhu et al. 2018 In addition, the choice of Eg can differ, e.g., mean squared error (MSE) (Zhu et al. 2018 Zhang et al. 2019a), LPIPS distance (Zhang et al., 2018). Therefore, different methods lead to different levels of visible distortions. Fig. 3 visualizes several popular training-baat based methods (together with the manually designed DwtDctSVD) and highlights the different distortion levels that they lead to.
(Blind) image watermarking Based on steganography, a natural way to trace Al Al-generated images is assign a fired message the signature of the content owner (e.g., company) and apply steganography to generate images containing the signature, i.e. watermarked images, to achieve (Jiang et al. 2023):
D( w)) w,
VI I,
(w fixed message representing the signature) (messages decoded from unwatermarked images should not be w)
(3a)
D(I)+ * w, () R
VI E I,
(3b)
VT I.
(minimal encoding distortion to the image)
(3c)
In practice, whether image is watermarked by w can be detected by comparing the decoded message with w:
I(BA(D(I),)) > 7].
(4)
where BA denotes the bitwise accuracy and f is preset task-dependent threshold (Jiang al. 2023
Fernandez et al. 2023 Yu et al. 2021| Due to the similarity between Eq. (3) and Eq. (1)
most existing
work considers image watermarking as a special application of steganography, e.g., Zhu et al.
2018); g Tancik
et al. (2 An et al. (2024): Zhao et al.] (2024a). As a result, the learning formulation in Eq. (2) is also
widely adopted in works that only focus on watermarking systems, egg, Zhang et al. (2019b
Fernandez et al.
(2033)
4

---

Published in Transactions on Machine Learning Research (07 (07/202) 2025)
The above watermark methods post- processing in nature, as the watermark is em- bedded on any given image that is already generated. There is an emerging line of in- processing watermark methods that directly modify the image generation process (Zhao jet al. 2024a An et al. 2024], ; including TreeR- ing watermark (Wen al. 2023), stable signa- ture (Fernandez et al. 2023), Gaussian shading watermark (Yang et al. 2024), and pseudo- random error-correcting code watermark Gunn et al. 2024). In these in-processing methods, there is no notion of "clean images" I and every generated watermark image exhibits a semantic shift compared to the image generated without the in-process watermarking; see Fig. for an example generated by the TreeRing watermark.
(a) w/ TreeRing watermark
(b) with TreeRing watermark
Figure 4: Visualization of TreeRing watermark example, where (a) and (b) are images generated from the same text prompt input using the same image diffusion model without and with the in-process watermarking, respectively.
In this paper, we focus on post-processing watermark methods due to their flexibility, as they are agnostic to the image generation process.
Robustness of watermarking systems Robustness of an image watermarking system refers to the extent of the watermark remain detectable by the decoder D when the watermarked image is manipulated (also called "evaded" if such manipulation is deliberate attack). Thus, robustness is typically associated with the potential of a watermarking system to be applied to copyright protection and misinformation delection. To stress test the robustness of watermark systems, various watermark evasion techniques have been proposed. These techniques are broadly classified into white-box and black-box evasions, depending on whether any component of the watermark system is known to the evader (An et al. 2024p. In this paper, we focus on black-box evasions where nothing about the watermark system is known, as practice, companies tend keep their watermark system private. Existing black-box evasions can be classified into two groups: Corruption methods try to distort watermarked images so that watermarks become corrupted and undetectable. Classical digital editing (e.g., applying Gaussian noise, Gaussian blur, JPEG compression, etc. (Voyatzis & Pitas 1999 ), the query-based adversarial attack (WevadeBQ) in Jiang et al. 2023 and the surrogate attack in Saberi et al. (2023) belong to this group; Purification methods treat embedded watermark patterns as noise signals and attempt to remove them using denoising and regeneration techniques,
such as BM3D (Dabov et al. 2007), diffusion models (Saberi et al. 2023 Zhao et al. 2024b) and VAE (Zhao) ct al. 2024b). The rationale behind the purification methods is rooted Eq. (3) where the original image, if recovered successfully, is always an evasion. In addition, the original image will be the ultimate threat to any
watermarking system the watermark is evaded by image without any loss of quality.
3
Our method: DIP for black-box watermark evasion
3.1 Watermark evasion via DIP-based blind denoising
Deep Image Prior (DIP) refers to the technique of using untrained DNN as an implicit prior for natural images in solving image recovery problems, without training on massive data: for any natural image I, DIP parametrizes it as I = Gz)z), where Go is typically a trainable convolutional neural network (CNN) and z is a fixed input (typically randomly drawn). Now consider the canonical optimization- based formulation for image recovery problems:
min, E(y, f(T) AR(T),
55)
where y R fI) is the observation model, f()) measures the recovery error, and R(-) denotes regularization on DIP transforms the formulation into
ming ( (Go())) AR(G(()))
(6)
5

---

Published in Transactions on Machine Learning Research (07/2025)
Algorithm 1 DIP-based watermark evasion
Require: A single watermarked image Tw: a CNN Go(z) where 0 collects the trainable parameters and z fixed vector (randomly drawn as iid Gaussian); a watermark detection API whose input can be an arbitrary image and returns "Yes/No" the detection output.
Randomly initialize (())
Solve ming (T Gz())) using the ADAM optimizer for a sufficient number of iterations N; record all intermediate results T, = Cgto(2), Vi I N, where i denotes the iteration number.
Query the detection API using DIP intermediate steps (4's);; return the 4ss that have no watermark detected.
Note that the optimization is only with respect to the CNN weights 0. The resulting formulation is then solved by first-order optimizers, such as ADAM (Kingma & Ba 2014 Such a simple strategy, in combination with appropriate early stopping methods (Li et al. 2021 Wang et al. 2021 Shi et al. 2022b) that pick the best intermodiate recovered images, has proved highly successful in solving a wide range of image recovery
problems, from simple denoising (Ulyanov et al. 2018) to advanced scientific and medical reconstruction
problems (Tirer al., 2023 Qayyum al. 2023 2023b a).
Zhuang
2023
Zhuang et al.. 2024
2023
Li et al. 2024
Watermark evasion via DIP-based blind denoising Now, consider arbitrary watermarked image L = (L1, w), where we do not know E or w. Since In R I as required in Eq. (3) and is clearly a successful invasion, it is sensible to try to "purify" or "denoise" Iw toward I-the intuition behind all
26
24
PSNR
22
20
PSNR
18
purification methods for black-box evasion (Dabov et al.) 2007
16
Saberi et al. 2023 Zhao et al. 2024b).
14-
12-
DIP has proven effective in single-image denoising, c.g., with Gaussian, impulse, shot noise, etc., when combined with appro- priate early stopping strategies (Mataev et al.
10
2019 Jo et al.
500
1000
1500
2000 2500 Iteration
2023a b 2024). 2021 Li et al. 2021 Wang et al.) 2021 Li et al.
Figure A typical image quality (measured by peak signal-to-noise ratio, PSNR) vs. it- cration curve when DIP is used in blind denoising tasks. An early stopping hod is used to detect the iteration achieving the peak performance (red dashed line). (Figure adapted from Wang et al. (2021) under the Creative Commons 4.0 license)
In particular, when the noise level is low which is true for typical watermarking systems as Tu is supposed to be very close to 1, a simple formulation with the standard mean-squared- error (MSE) loss and the additive noise model can perform "blind" simultancous denoising for multiple types of noise Li et al. 22021 9; Wang et al. (2021). Inspired by this, we propose a simple DiP-based blind watermark-evaasonn formulation
ming || Go(z)) DDIP-based watermark evasion)
for any given watermarked image Iw- Unlike DiP-based blind denoising which requires appropriate early stopping strategies to find optimal denoising, we only need to check the evasion success of all iterates when iteratively solving Eq. (7) by querying the watermark decoder. Our entire algorithm pipeline is summarized in Algorithm 1. Although we do not invent DIP-based blind denoising, we are the first to explore it for blind evasion of invisible watermarks. While Rishik (2020) also performs DIP-based watermark removal, it aims at different setup: [Rishik (2020) trics to remove visible watermarks by basod image inpainting, which requires the ezact watermark location as its inpainting mask; in contrast, here we try remove invisible watermarks using based denoising, which requires only the watermarked image and nothing else.
3.2 Why including DiP-based evasion as a baseline method?
The primary obstacle for purification methods that the "noise" patterns induced by watermark methods, especially those traiiig-based ones, may not follow any simple noise model. Consequently, classical denoising methods that target specific noise types, such as BM3D, may struggle to remove the watermark. The recent.
6

---

Published in Transactions on Machine Learning Research (07/202) /025)
Clean
DwiDeiSVD
rivaGAN
SSL
10P
Cean
BUSGAN
10
10a
Figure 6: Visualization of 2D Fourier spectra of the clean and watermarkod images from Fig. (magnitudes visualized in log scale). The histogram below each spec- trum plot shows the band-wise en- ergy distribution in the radial di- rection (i.e., the dashed arrow di- rection), where the y-axis is log scale.
Mark
RoSteALS
StegaStamp
10a
ThusMMrk
RoStoALS
StogaStamp
10a
10a
regeneration techniques via diffusion models or VAE effectively perform learned denoising. However, a priori, it is unclear they can generalize well novel watermark patterns. In contrast, our DIP-based evasion operates a different principle: it leverages the different rates at which different frequency components captured during DIP learning through Eq. (7) which has been consistently observed in prior DIP literature [Ulyanov et al. 2018: Shi et al. 2022a Li et al. 2021 Wang et al., 2021). Specifically, the Gø(z) term in Eq. (7) picks up the low-frequency components which dominate natural images, much faster than picking up the for our case.
components which tend to be noise-induced, likely watermark-indue
In Fig. we compare the Fourier spectrum of the clean image from Fig. 3 those of various watermarked versions: clearly, the spectrum of the clean image concentrates low frequencies, but different watermark methods reshape the Fourier spectrum by mostly changing the mid-to- -iithhh frequencies. For example, RoSteALS and StegaStamp mostly affect the low-mid frequencies, DwtDetSVD and SSL mostly focus on mid-high frequencies, and rivaGAN alters high frequencies. The only exception is TrustMark, whose watermark pattern hard to observe from the frequency spectrum.
Next, in Fig. 7] we visualize the different learning paces of DIP across different frequency bands, by tracking the frequency band errors (FBEs) similar Wang al. (2024); Li et al. (2023a); Zhuang first compute the relative per-frequency error in the frequency domain, i.e., [F((w) F(Gg()) )/ ((w)())) ww], where F(-) is the discrete Fourier transform, then divide all frequencies into five radial bands from the lowest (1) to the highest (5), and compute the mean errors within each band. It is evident that the lower the frequencies, the faster the FBFs decay.
(202)): we
DwtDetSVD
rivaGAN
SSL
1.0
Figure 7: Evolution of the Fourier band errors (FBEs) of DIP's inter- mediate iterates (x-axis: iteration count; y-axis: relative band error). We visualize FBEs by dividing all frequency components into five dif- ferent bands in the radial direction, from the lowest (1) to hightest (5).
0.3
0
200
400
0
200 RoSteALS
400
0
200
400
TrustMark
StegaStamp
1.0
0.5
0
200
400
0
200
400
0
200
400

---

Published in Transactions on Machine Learning Research (07/2025)
Such disparate learning paces imply that certain intermediate iterates enjoy sufficient separation of the low-frequency image content and high-frequency watermark patterns, hence the potential for successful evasion. In summary, compared to alternative purification methods that depend on either explicit noise modoling or data-driven priors, our DIP-based evasion relics on frequency separation that is noise-agnostic and distribution-free. Hence, our DIP-based evasion method largely complements the existing ones.
3.3 Remarks DIP-based watermark evasion
Algorithm 1 presents a template algorithm of our DIP-based watermark evasion. Depending on the downstream application, we may need to query a decoder (e.g., detection API) as stated in Line 3 of Algorithm 1 For example, when the goal is to evade detection while maintaining high image quality, it is essential to query the decoder multiple times to identify the optimal I,. In contrast, for single-shot evasion where image quality is less critical, querying the decoder becomes unnecessary. The consideration applies to all existing black-box evasion methods (e.g., those evaluated in Section 4).
On the other hand, querying the decoder in every intermediate iterate, as described in Algorithm 1 be possible, especially since the algorithm often requires up to ~ 1000 iterations for example, the decoder server may impose rate limits on individual user to ensure safety and fairness. It is therefore important to reduce the number of decoder queries and improve query efficiency. One potential approach is to selectively query only high-quality iterates- although the clean image I is unknown, the watermarked image Iw is, by design (see Eq. (3) very close to I, and thus can serve as a proxy for estimating the image quality of intermediate iterates; see Appendix D] for sample trajectories of image quality and watermark detectability across different watermarks and evasion methods.
may not
Finally, although DIP evasion relies on iterative optimization, it remains computationally efficient in practice. For details its runtime performance, we refer the reader to Appendix C
4 Qualitative and quantitative evaluation
Experiment setup (1) Datasets: We use images from two large-scale datasets: (i) MS-COCO (Lin
et al. (2014) composed of 328K real images and (ii) DiffusionDDB (Wang et al.) 2022) composed of 14 million high-quality Al-gencrated images. We randomly sample 2000 images from each datasct- the typical scale for the robustness evaluation of watermark systems (An et al. 2024), resize them to 512 x 512, and generate images with different watermarks, respectively; (2) Watermark methods: We focus on 6 representative and publicly available post-processing watermark methods: DwtDetSVD, rivaGAN, SSL, MruktMark, RoSteALS, and StegaStamp, whose watermark patterns vary in the visibility level and Fourier spectrum; see Figs. 3 and 0 and Table 1 for visual and quantitative comparisons, respectively. We also evaluate on the SOTA in in-processing TreeRing watermark, where 2000 watermarked images are generated using Gustavosta stable diffusion prompts from HuggingFace (Santana); (3) Evasion methods: In addition to our DIP-based evasion method described in Algorithh 1P we also consider the following classical digital editing methods: (i) brightness, (ii) contrast, (iii) Gaussian noise, (iv) JPEG compression, (v) bm3d denoising, and recent
SOTA purification methods: (vi) DiffPure (Saberi el. al. 2023). (vii) Diffuser (Diffusion attack from Zhao
et al. 2024b) and (viii) VAE regeneration (VAE attack from (Zhao et al. 2024b
Evaluation protocol As we argue in Section 1 quality are two essential dimensions of watermarking systems. Therefore, we report the best image quality each evasion method can achieve while failing watermark detection. To find the "optimal" tradcoff image, we perform an exhaustive search over the allowable ranges of the hyperparameters for each evasion method and look for images with (i) watermark undetected and (ii) the highest PSNR value with respect to the watermarked image Iw; see Section 3.3 for justification on why In is used and Appendix B for details about all hyperparameters. Finally, to quantify the quality of such images, we use three metrics: (i) PSNR, (ii) Structural Similarity Tndex Measure (SSTM) (Hore& Ziou 2010) and (iii) 90% quantile of pixel-wise
(see also An et al. (2024)), ), evasion success and image
We use the default 'skip' network in the original DIP repo: httpa://github cowm//mmitttyllllaooo/eeeepppppp image prior VAE regeneration using model from Cheng et al. 2020). which gives the best VAE performance as Jiang et al. 2023
a
8

---

Published in Transactions on Machine Learning Research (07/2025)
Table 1: Quantitative visual distortion induced by different watermark methods. We report the mean and standard deviation (in parathesis) of all three quality metrics, calculated over 100 randomly drawn test images. All images are in uint8 format with value in [0, 255]. RivaGAN has the least visible watermarks, while StegaStamp has the most.
COCO dataset
DiffusionDB dataset
Watermark
PSNR t
SSIM f
90% Quantile +
PSNR t
SSIM
90% Quantile
DwtDetSVD
38.31 (2.67)
0.98 (0.01)
4.66 (0.90)
37.88 (3.60)
0.97 (0.02)
4.87 (1.56)
rivaGAN
40.57 (0.21)
0.98 (0.01)
3.00 (0.03)
40.61 (0.24)
0.98 (0.01)
3.00 (0.03)
SSL
33.03 (0.23)
0.88 (0.04)
7.19 (0.74)
33.14 (0.55)
0.88 (0.04)
7.10 (0.72)
TrustMark
40.46 (1.85)
0.99 (0.01)
3.84 (0.85)
40.67 (2.62)
0.99 (0.01)
3.84 (1.14)
RoSteALS
30.83 (2.71)
0.95 (0.02)
12.8 (3.98)
30.88 (4.12)
0.95 (0.03)
12.5 (5.71)
StegaStamp
28.34 (1.61)
0.90 (0.03)
15.9 (3.18)
26.58 (2.01)
0.84 (0.04)
19.3 (4.96)
difference, all with respect to the clean image The quantile metric mainly serves as a supplement, as PSNR and SSIM focus on the average difference while it reflects the difference on the tail watermark-indueed distortion to an image may be highly localized and hence spatially sparse, which might not be captured by averaging metrics; see Fig. 3 and TTble for sense of the visual and quantitative distortions caused by different watermark met hods. Since the TreeRing watermark lacks a notion of clean image, we use I as the reference in all evaluation experiments related to TreeRing watermark.
Experiment results As mentioned in Section 2 Eq. (4) is highly task-dependentt It determines the true positive rate (TPR) and the false positive rate (FPR) in watermark TRR measures the fraction of watermarked images correctly detected, and FPR measures the fraction of clean images wrongly flagged as watermarked images. In general, the higher the y used in the decoder, the lower the true positive rate (TPR) and the false positive rate (FPR). A practically useful watermark decoder should have a TPR close to one and a FPR close to zero. On the other hand, the higher the y, the higher the quality of the evasion image can achieve. To account for the effect of in robustness evaluation, we report in Table 2 the evasion performance of different methods under different y's on COCO images, and Table on DiffusionDB images, together with the TPR/FPR achieved.
the choice of y in the watermark decoder, as shown in
From Tables to we observe that: (1) The effect of y on TPR/FPR values as well as image quality of different watermarks against. the detection threshold agrees with our discussion above. This is true also for the TreeRing watermark, whose detection threshold is based the & distance, very different from those for other watermark methods; (2) The performance of watermark evasion shown by the column with 7 0.55 in Tables 2 and 3 is not quite meaningful the very high FPR renders the decoder hardly useful in practice; (3) In other cases, there is no clear winner among all the evasion mothods we evaluate. For example, our bap-b evasion has the best performance on Dwi and rivaGAN, and is comparable to the best on SSL; DiffPure is the most effective evasion on TrustMark, RoSteAT.S and StegaStamp; TreeRing seems most vulnerable to JPEG compression. This highlights the need to include diverse sources of evasion methods for faithful robustness evaluation of watermarking systems, we argue in Section 3.2
Moreover, comparing the results of our DaP-b evasion on different watermarks, we observe that evasion images for DetSVD, rivaGAN, and SSL watermarks can achieve very high quality when > 0.65, with reasonable TPR/FPU values. This is well expected, as these watermarks mainly cause high-frequency distortions (see Fig. 6), and DiP-based evasion is good at separating high- and low- freqqueeycc components and thereby largely removing the watermark during iteration, as argued in Secction 3.2 In contrast, bas-d evasion shows limited performance on TrustMark, RoSteALS, and StegaStamp. This is because these watermark methods induce substantial mid- and low-frequency distortions, which DIP picks up in early stages and so are hard to separate from the clean image content.
To better undersland this, we compute the average relative FBE across 10 radial frequency bands using 100 images watermarked by each method, This is done by partitioning the Fourier spectrum of the watermark pattern (I,, - T) into different radial bands-2 a quantitative analysis of qualitative results in Fig. 6 As shown in Table 5) Trustmark, RoSteALS, and StegaStamp exhibit significantly higher FBE in the lower mid-frequency bands (Bands 3-5) compared to DwtDetSVD, rivaGAN, and SSL.. Notably, comparing SST.
9

---

Published in Transactions on Machine Learning Research (07/2025)
Table 2: The best image quality produced by different evasion methods under different detection threshold y the COCO dataset. Hcre, report the mcan value of PSNR-SSIM-90% Quantile (Q.). We highlight
the best evasion method under each watermark and in boldface. For fair comparison, we mask out cases
where one evasion method cannot evade 2 90% of the watermarked images.
C000 datases
7= 0.55
y= 0.65
0.75
2 0.85
DwtD
TPRL / FPR
1.000020
0.90 0.00
0.99 /001
0.90 0.00 /0000/0.00000 0.00
brightness
PSNR 8SIM Q
19.22 - 0.88 52.6
20.00 - 0.90 47.5
20.67
0.91 43.4
21.52 0.93 39.0
contrast
25:27
26.7
26.02
24.1
26.67
0.91 22.0
27.52
0.92 19.7
Gaussian noise
16.30 0.19 66.1
17.54 0.23 56.8
18.62 0.26 50.3
20.05 0.31
42.3
JPEG
31.52 0.88 11.2
31.74 0.89 10.9
31.89 0.89 10.7
32.13 0.90
10.4
bmnkl
vewe
30.26 0.87 9.6
DiffPure
0.79
14.2
20.90 0.84 13.6
29.94
13.6
Difluser
"25.87 0.74 20.7
26.61 0.76
19.2
VAE
32,38
0.88
10.5
33.47 0.90 9.2
34,51
0.92 8.1
DIP (OurS)
34.87
0.96
7.2
35.50 0.96
6.7
35.85
0.96
6.4
36.22
0.97
6.1
rivaGAN AN
TPR / FPR]
0.99 / 0.25
0.99 0.003
0.99 / 0.01
0.99/ 0.00
brightness
PSNR SSIM
6.91 - 0.12 181
7.31 0.17 - 173
8.02 0.27 159
contrast
13.16 0.50 90.0
13.53 0.53 86.1
14:20 0.58 79.8
Gaussian noise
0.07 121
13.07 0.11 96.3
14.61 0.14 80.7
16.42 - 0.19 65.7
JPEG
28.22 0.79 16.7
30.16 0.85 13.2
bm3d
DiffPure
26.51
0.73 21.7
28.84 0.80 15.9
29.72 0.83 14.1
29.96 0.84 13.5
Diffuser
225.40
22.1
'20.28
0.74 20.0
26.78
18.9
VAE
332.44
0.88 10.3
33.28
0.90
9.3
34.21
0.91 8.3
DIP (ours)
29.87
32.64 0.92
11.1
34.02
0.94
8.9
35.20
0.95
SSL
TPR / FPR]
1.00 0.33
1.00 / 0.07
0.99 / 0.01
0.99 0.00
brightness
PSNR SSIM-
****
13.92 0.41 1/19
contrast
"19.12 0.67 38.6
Gaussian noise
188.9 - 0.28 51.
21.67 0.39 36.7
23. 33.98
0.48
27.8
25.42- 0.54 22.7
JPEG
18.18 0.79 16.7
30.05 0.81 13.4
31 28
0.86
11.4
32.73 - 0.89
9.5
bm33d
27.99 0.79 14.4
29.50 0.84
11.7
30.79 0.87
9.6
31.18- 0.89
8.9
DitfPure
27.18 0.75 19.7
28.85 0.80
15.6
29.32 0.82
14.6
29.38- 0.82 144
Diffuser
*25.30
0.68
22.1
225.80
0.69
21.1
225.90
0.69 20.8
VAE
31.21 0.85 11.9
'32.03
10.8
32.83
0.90
9.8
33.50
0.91 9.0
DIP (ours)
23.73 0.76 31.4
25.21 0.85 17.4
31.46
0.90
11.2
33.64
0.92
8.4
TrrstMark
TPR FPRJ PSNR SSIM - Q.
/ 0.13
/ 0.00
1,00
1.00 / 0.00
brightness
-6.86-0.11- 182
*7.27 0.17 0.17- 173
contrnet
*13331 0.511 88.3
*13.81- 0.58 88.2
Ganssian noise
9.57 0.05 144 *8*
11.17 0.07 119
12.72 0.09
09.0
14.49 0.13 80.9
JPEG
$25 18 0.70
22.9
*26.35 0.73
bm3dd
DiffPure
26.34 0.73 20.4
27.81 0.77 - 17.3
29.09 0.80 15.3
30.22
0.84 13.2
Diffuser
21.1
*2..19 0.75 19.7
VAE
DIP (ours)
13.64 0.48 91.1
15.88
0.56
18.97
RoSteALS
TPRt/ / FPR
1.00 0.29
1.00 / 0.01
1.00
0.00
1.00 0.00
brightnes
PSNI- SSIM
contrast
Gaussian noise
*9.53 0.H 145
JPEG
6.0.
bm3dd
DiflPure
199112
0.49 50.6
22.98 0.62 30.7
24.91
0.69 24.3
26.28 0.74 20.6
Diffuser
VAE
DIP (OurS)
111.08 0.38 113
12.09 0.12 105
16.36 0.56 73.5
StegaStamp
TPR FPR. PSNR- SSIM -
1.00 / 0.18
1.00 / 0.01
1.00 / 0.00
1.00 0.00
brightness
contrast
*13.22 - 0.52 88.9
Gaussian moise
77.8 - 0.03 175
9.26 0.05 148
11.24 - 0.08 118
JPEG
0.00
..*.
0.0.
*0
bm33d
DiflPure
19.57 0.50 45.6
22.42
0.61 31.5
23.81
0.66
26.7
2 24.67
0.70 24.1
Diffuser
24
VAE
DIP (ours)
122229 0.10 102
14:00 0.17 87.5
16.05 0.55 70.9
The following markurs used for the purpose of fair comparison the best evasion image quality:
Evasion method only successfully evade < 10% of the watermarked images.
Evusion method only succesfully evade < 75% the watermarked images.
Evasion method only succesfully evade < 90%
watermarked liagee.. Evasion method succesfuuly evade 2 90% of the watermarked images, but < 100%.
10

---

Published in Transactions on Machine Learning Research (07/2025)
Table The best image quality produced by different evasion methods under different delection threshold y on the DiffusionDB dataset. Here, we report the mean value of PSNR-SSIM- Quantile (Q.). We highlight the best evasion method under cach watermark and in boldface. For fair comparison, mask out cases
where evasion method cannot evade 90% of the watermarked images.
DiffusionDB dataset
0.55
0.65
0.75
0.85
Dw
TPRt / PPRL
1.01 / 0.23
0.99 / 0.03
0.99 / 0.01
0.99 /0000
brightnsss
PSNR SSIM Q
21.25 0.90 43.0
21.94 0.91 39.1
22.54
0.02 35.9
23.34 0.93 32.3
contrast
26.89 0.91 22.2
27.56
0.92 20.1
28.11 0.93 18.6
28.85
0.94 16.8
Gaussin
16.32 0.22
17.73
20.07
JPEG
30.47 0.86 13.2
30.81
0.87 12.7
0.88 31.00
12.4
31.30 0.88 12.0
bm3dd
"28.91 0.85 11.6
DiffPure
27.69 0.78 18.8
29.09 0.82 15.8
29.52
0.83
15.0
29.36 0.83 14.9
Diffuser
'25.88 0.75
*26.51 0.77 20.5
VAE
31.91
0.87
11.5
32.90
0.89
10.3
32.92 0.91 9.0
DIP (ours)
35.91
0.96
6.4
36.25
6.1
36.53
0.97
5.9
rivaGAN
TPRI / FPR.
0.00 / 0.25
0.99 0.00
0.99 0.00
0.99 /_000
brightness
PSNR SSIM Q
'7.38 0.13 173
7.83
0.19 165
8.70 0.31 150
contrust
13.44 0.51 86.8
13.93
0.55
82.5
14.73
0.60 75.5
Ganssian noise
10.96 0.08 123
12.98 0. 97.3
14.55 0.16 81.4
16.56 0.21 64.8
JPEG
"26.31
"27.84
29.61 0.84
bmn3d
****
DiflPure
26.11
0.73 22.9
28.25 0.79 16,8
28.88
0.81
15.4
29.02 0.82 15.1
Diffuser
225.43 0.73 22.5
126.12
0.75
20.8
26.47
0.76 20.0
VAE
32.29
333.13
0.90
33.91 0.91- 8.3
DIP (ours)
31.91
0.89 14.5
34.48
0.93
9.1
35.72
0.95
7.4
36.75 0.96 6.2
SSL
TPR; FPR.
1.00
0.33
1.00
0.07
0.99 / 0.01
0.99 0.00
brightmess
PSNR SSIM Q
0.53 97.9
-173
Ganssian noise
17.44
0.26 63.8
20.90 0.38 41.0
23.48
0.48
29.7
25.31 -.56-- 23.0
JPEG
27.07
0.77 19.4
28.97 0.82 - 15.4
30.47 - 0.85
12.7
32.30 0.89 9.9
bin3d
25.00 0.82
29.25 0.56
DifiPure
26.67 0 21.0
25.05 0.79 17.3
28.40 0.80 16.3
28.43 0.50 16.2
Diffuser
"25.00 0.68 23.6
25.43 0.09
22.5
25.49 0.70 22.4
VAE
30.22 0.85 12.3
"31.79
0.88 11.0
32.43
0.90
9.9
33.01 0.91 9.2
DIP (ours)
23. 14 0.72 35.2
27.95 0.84 18.2
31.27
0.80
11.8
33.84
0.92 8.2
TrustMark
TPR FPR.
1.00 / 0.13 x8**
1.00 0.00
1.00 / 0.00
1.00 0.00
brightnees
PSNR- SSIM Q.
'7.08 0.10 0.10-1 179
*7.43 0.15
contrest
13.52 0.55 87.3
113.9 0.50 88.22
Ganssia naise
9.62 0.05 143
11.17 0.08 119
12.67 - 0.10 100
14.45
0.14 81.7
JPEG
x***
255.0
*26.0
22.4
bandkl
DiffPure
26.60 0.73 21.8
27.91 0.77 18.7
28.99
0.79 16.6
30.07
0.83 14.4
Diffuser
225.70
0.74 21.9
226.40 0.76 20.4 .*8*
26.96 0.77 19.2 **.*
VAE
DIP (ours)
14411
0.5 85.4
16.19
0.57 73.0
19.07 0.65 54.6
RoSteALS
TPR1/ / FPRI
1.00 0.29
0.01 1.00
0.01
1.00 0.00
1.00 0.00
brightness
PSNR SSIM Q
Gaussian noise
*9.92 0.05 139
JPEG
bm3dd
DiffPure
20.86 0.57 43.7
24.06 0.60 29.3
25.74
23.8
26.93 0.76 20.6
Diffuser
VAE
DIP (ours)
'11.7 0.42 108
12.83 0.46 98.9
17.47 0.60 67.0
StegaStamp
TPRi / FPR PSNR SSIM Q
1.00 / 0.18
1.00 / 0.01
1.00
0.00
1.00
0.00
brightness
contrast
Gaussion noise
'8.03 0.04 - 170
9.19 - 0.06 145
11.66 0.09 113
JJEG
bm3kl
DiffPure
119.70 0.54 45.6 22.42
0.63 32.2
23.73
0.68 27.5
24.55
0.71 24.9
Diffuser
21..7
0.61
32.4
DIP fours)
13.01 - 0.44 96.7
14.60 - 0.50 82.7
16.54
0.57
68.5
The following markers used the purpose of fair comparison of the evasion image quality:
Evasion method only successfully evade 10% of the watermarked images.
Evasion method only successfully evade < 75% of the watermacked images.
Evasion method only succrssfllly evade 90% the watermarked images.
Evasion method succesfulll evade 90% of the watermarked images, but 100%.
11

---

Published in Transactions on Machine Learning Research (07/2025)
Table 4: The best image quality produced by different evasion methods under different detection threshold on Tree-Ring watermarked images. Here, we report the mean value of PSNR-SSTM-90% Quantile (Q.). We highlight the best number under each watermark and threshold. Note that TreeRing relies on thresholding the l distance for pattern matching, which is different from used in other watermarks. For fair comparison, we mask out cases where one evasion method cannot evade 2 90% of the watermarked images.
Tree-Ring
Threshold
TPRL / EPRI
1.00 0.00
1.00 [ 0.00
0.99 / 0,000
0.96 / (.00)
Ganssion naise
PSNR SSIM
16.49 0.19 70.6
23.06
32.9
25.75 0.53 22.3
JPEG
228.45 0.78 17.2
31.37 - 0.86 12.3
34.61 0.92 8.4
ban3d
"26.10 0.79 14.6
28 03.00- 0.85 10.2
29.17 0.88 8.5
DitiPure
23.20 0.63 31.8
27.79
0.77 18.7
29.79 0.83 14.1
30.16 0.84 13.0
Diffuser
"28.01 0.84 16.1
"44.0 0.89 9.0
"35.58 0.93 7.2
DIP (ours)
12.28 0.12 102.7
17.67 0.59 61.4
26.14 0.79 26.1
31.11 - 0.93 - 9.6
The following markers used for purpose of comparison the best evasion image quality:
Evasion method only succesefully ovade < 10% of the watermarked images.
Evasion mothod only sucresfullyy evade < 75% of the waternarked images.
Evasion method only successfully evade 90% of the watermarked images.
Evasion method successfully evade 2 90% of the watermacked images, but < 100%.
Watermarks
(Low)
Band
Band 2
Band 3
Band 4
Band
Band 6
Band 7
Band 8
Band 9
Band 10 (High)
dweDetSvd
0.025
0.011
0.059
0.074
0.091
0.103
0.109
0.109
0.110
0,371
rivaGAN
0.016
0.196
0.214
0.237
0.240
SSL
0.011
0.036
0.070
0.119
0.174
0.222
0.289
0.331
0.377
0.765
Trustmark
0.017
0.075
0.177
0.187
0.189
0.175
0.148
0.113
0.094
0.109
Rosteals
0.085
0.282
0.386
0.315
0.411
0.436
0.475
0.556
0.620
0.307
StegaStamp 0.166
0.350
0.432
0.443
0.192
0.518
0.503
0.481
0.434
1.708
Table 5: Average relative Fourier Band Error (FBE) across 10 radial frequency bands for different watermarking methods. Values in bold indicate watermarks with notably high energy in the mid-frequency bands. SSL and Trustmark are also highlighted for comparison: SSL exhibits higher energy in high-frequency components but is vulnerable to DIP evasion, whereas Trustmark shows stronger mid-frequency energy and is more resistant to DIP evasion.
(whose FBE has larger magnitudes on Band 6-10) and Trustmark (whose FBE has larger magnitudes on Band 3-5), it is even clearer that leveraging lower frequency bands is the key to counter DIP evasions.
Clean
JPEG
bm3d
DillPure
Dilfuser
DIP (curs)
10a
23
10>
16a
10
J 23
10
X 29
10a
107
107
10?
10
235
255
255
255
255
Figure& 8: Visualization of the evasion images found by different evasion methods on StegaStamp watermarked image (with 7 0.75; top row) and the respective histograms of the pixel difference (y-axis in log scale) between the evasion image and the clean image (bottom row). The vertical dashed line marks the 90% quantile.
12

---

Published in Transactions on Machine Learning Research (07/2025)
5 Conclusion and discussion
With the results and the analysis above, we can conclude that there is no universal best evasion methods for existing watermarking systems. In general, our DIP-based evasion is most effective in evading invisible watermarks that induce high-frequency distortions (e.g., DwtDetSVD, rivaGAN and SSL), and is partially successful in evading in-processing watermarks such as TreeRing. Its limited performance for RoSteALS and StegaStamp implies that exploiting low- and mid-frequency distortions is a viable way for walermarking systems to counteract our DIP-based evasion. Also, for these watermark methods, the regeneration evasion DiffPure has proved effective.
Moreover, for relatively visible watermarks (e.g., StegaStamp), the evasion images generated by all evasion methods always contain visible artifacts; see Fig. 8 for example. Therefore, the future of learning-basee watermarks is not all pessimistic: they may not be reliable for copyright protection, but may be promising in misinformation prevention. This is because of the distinct requirements of these two kinds of applications: for copyright protection, watermarks are expected to remain detectable as long as the image content is rocognizable even under severe corruptions due to wrasion-whide may be too hard to achieve. In contrast, to prevent misinformation, might be sufficient to achieve either of the following to mitigate the harm: (i) the watermark patterus can be detected by eyes, e.g., an overlaid logo or unnatural perturbations such Figs. and g raising suspicion that the image is already manipulated or fake; (fi) the watermark can be detected by an algorithnnic decoder. For this purpose, watermarks such as StegaSlamp may be sufficient.
6 Ethical statement
One potential ethical concern regarding this paper is that it could facilitate the unauthorized removal of watermarks, thereby enabling copyright infringement. However, this concern may be unfounded: Tutorials on using Deep Image Prior (DIP) to remove visible watermarks (e.g., Rishik (2020) are already publicly available; While research on invisible watermarking is active, such methods have not yet been widely deployed in real-world applications. Rather than promoting misuse, our work aims to proactively identify limitations in current invisible watermarking techniques and to offer concrete recommendations for developing more robust watermarking strategies.
References
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, al. Benchmarking the robustness image watermarks. arXiv preprinl orXiv:24010885 088573,, 2024.
Kasra Arabi, Benjamin Feuer, R Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two-stage robust watermarking for images. arXiv preprint 2rXiv:241.04663. 2024.
Diane Bartz and Krystal Hu. Openai, google, others pledge to watermark ai content for safety, white house wewpreollleeeteeeeeeeeee---eeeee
says. https://wwnn http:///wwwww.ueers.oooo house-2023-077- 2022227--22 2023.
Ning Bi, Qiyu Sun, Daren Huang, Zhihua Yang, and Jiwu Huang. Robust image watermarking based on multiband wavelets and empirical mode decomposition. IEEE Trunsactions on Image Processing, 16(8): 1956-1966, 2007.
Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. arXio preprint xrXiw:2311.18297 2023a.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. Rostcals: Robust steganography using autoencoder latent space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 933 942, 2023b.
13

---

Published in Transactions on Machine Learning Research (07 (07/2025)
Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the TEEE/CVT conference on computer vision and pattern recognition, pp. 7939 7948, 2020.
Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing, 6(12):1673 1687, 1997.
Kostadin Dabov, Alessandro Foi, Vladimir Katkovnik, and Karen Egiazarian. Image denoising by sparse 3-d transform-domain collaborative filtering. IEEE Transactions on image processing, :008) 2080-2095,, 2007.
Mingyuan Fan, Cen Chen, Chengyu Wang, and Jun Huang. On the trustworthiness landscape of state-of-the art generative models: A comprehensive survey. arXiv preprint arXiv:23771666: 2023.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054 3058. IEEE, 2022.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pp. 22466 22477, 2023.
Tan Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advonces in neural information processing systems, 27, 2014a.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy, Explaining and harnessing adversarial examples. Xrxiv preprint arxiv: 12. 6372, 2014b.
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. IACR Cryptol. ePrint Arch., 2024:1597, 2024. URL http:://ppp...enntt..ccoo..... org/ ott.s//cco....oooooooooooooooaa.
Cor2pssDD
Alain Hore and Djemel Ziou. Image quality metrics: Psnr vs. ssim. In 2010 20th intermational conference on pattern recognition, pp. 2366-23666 IEFE, 2010.
Ming-Shing Hsieh, Din Din-Chang Tseng, and Yong-Huai Huang. Hiding digital watermarks using multiresolution wavelet transform. IEEE Transactions industrial electronics, 48(5):875- 882, 2001.
Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, pp. 41-49, 2021.
Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong, Evading watermark based detection of ai- generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 1168- 1181, 2023.
Yeonsik Jo, Se Young Chun, and Jonghyun Choi. Rethinking deep image prior for denoising. In 2021 IEFE/CVF International Conference on Computer Vision, ICCV 2021, Montreal, QC, Canada, October 10-17, 2021, pp. 5067 5076. IEEE, 2021. doi: 01.1109/00C449922222..0000 URL https://doi..org 10.
2021. 2021.00504
Mohan S Kankanhalli, KR Ramakrishnan, et al. Adaptive visible watermarking images. In Proceedings IEEE International Conference on Multimedia Computing and Systems, volume 1, pp. 568-573 IEFE, 1999.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv:1412.6880 11111122169,, 2014.
arXiv preprint
Taihui Li, Zhong Zhuang, Hengyue Liang, Le Peng, Hengkang Wang, and Ju Sun. Self-validation Early stopping for single-instance deep generative priors. arXiv preprint arXiv:2110. 12271, 2021.
14

---

Published in Transactions on Machine Learning Research (07/2025)
Taihui Li, Hengkang Wang, Zhong Zhuang, and Ju Sun. Deep random projector: Accelerated deep image prior. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patlern Recognilion, pp- 18176 18185, 2023a.
Taihui Li, Zhong Zhnang, Hengkang Wang, and Ju Sun. Random Projector: Efficient Deep Image Prior. In ICASSP 2023 2023 IEEE International Conference on Acoustics, Speech and Signall Processing (ICASSP), pp. 1-5, June 2023b. doi: 10.1109/ICAA SAL00/ICASSS49957..00 10972......
Taihui Li, Anish Lahiri, Yutong Dai, and Owen Mayer. Joint demosaicing and denoising with double deep image priors. In ICASSP 2024 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4005 1005-4009, 2024. doi: 10.1109/ICASSPAA ICCASSP4845.2224..0000
Tsung-Yr Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740-755. Springer, 2014.
Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In Proceedings of the IEEE/CY /CF conference on computer vision and pattern recognition, pp. 13548 13557, 2020.
Gary Mataev, Peyman Milanfar, and Michael Elad. Deepred: Deep image prior powered by red. In Proceedings of the IEEE/CVF International Conference on Computer Vision Workshops, pp. 0-0, 2019.
Jennifer Mishra. How to remove dall-e watermark, 2022. URL GEMROCxGCIA
Tayana Morkel, Jan HP Eloff, and Martin Olivier. An overview of image steganography, In ISSA, volume 1, pp. 11, 2005.
Alhassan Mumuni and Fuseini Mununi. Data augmentation: A comprehensive survey of modern approaches. Array, 16: 16:100258, 2022.
KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy Archana, and M Sasikumar. Dwt-dct-svd basod watermarking. In 2008 3rd international conference on communication systems software and middleware and workshops CCOMSWARE'O pp. 271-274. IEEE, 2008.
Shelby Pereira. and Thierry Pun. Fast robust template matching for affine resistant image watermarks. Tn International Workshop on Information Hiding, pp. 199 210. Springer, 1999.
Shelby Percira and Thierry Pun. Robust template matching for affine resistant image watermarks. IEEE transactions on image Processing, 966):1123-1 1129, 2000.
Adnan Qayyum, Inaam Ilahi, Fahad Shamshad, Farid Boussaid, Mohammed Bennamoun, and Junaid Qadir. Untrained neural network priors for inverse imaging problems: A survey. IEEE Trans. Pattern Anal. Mach. Intell., (565:11111 6536, 2023. doi: 10.1109 10.1109/TPAMI 2P2....22..300...22.. TPAMI. 2022. 3204527
URL httpss///oii https::/boo..rr/11...000
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hiorarchical text-conditional
image generation with clip latents. arXiv preprint arXiv:2204.06130 1(2):3, 2022.
Mouryam Rishik.
Watermark removal using deep image priors with pytorch. https:/ http://ttttthhhhog commbnee http///bbnooii////oo///oooooo./a Watermark- Remarrll--e ctttoorrcccmmmsss////
2020.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-rosolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVE conference on computer vision and pattern vecognition, pp. 10684-10695, 2022.
15

---

Published in Transactions on Machine Learning Research (07/2025)
Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaci, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks. arXiv preprint XrX::22310.000 0.0006, 2023.
Gustavo Santana. Stable diffusion dataset.
Stable--Diffusioo--rroooo Accessod: 2025-02-16.
Zenglin Shi, Pascal Mettes, Subhransu Maji, and Cees G. M. Snoek. On measuring and controlling the spectral bias of the doep image prior. Int. J. Comput, Vis., 130(():885-90)) -908, 2022a. doi: 11.1007/$1122-021--000
URL http:////....aoo.....0/00/111100
Zenglin Shi, Pascal Mettes, Subhransu Maji, and Cees GM Snoek. On measuring and controlling the spectral bias of the deep image prior. International Journal of Computer Vision, 130(4):885-4) -000,90,, 2022b.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the FEEE/CVF conference on computer vision and pattern recognition, pp. 2117-2126, 2020.
Tom Tirer, Raja Giryes Se, Young Chun, Yonina C. Eldar, @SHUTTERSIOCK COM, and Andrew Kraso- vitckii. Deep internal learning: Deep learning from single input. IEEE Signal Processing Magazine, 41: 40-57, 2023. URL https: semanticschoarr org/ (orpusIDD2661740018
Anatol Z Tirkel, GA Rankin, RM Van Schyndel, WJ Ho, NRA Mee, and Charles F Osborne. Electronic watermark. Digital Image Computing, Technology and Applications (DICTA '98), pp. 666 666-673, 1993.
Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Deep image prior. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9446 9466,9454, 2018.
George Voyatzis and Ioannis Pitas. Protecting digital image copyrights: framework. IEEE Computer Graphics and Applications, 10(1):18-24, 1999.
Hengkang Wang, Taihui Li, Zhong Zhuang. Tiancong Chen, Hengyue Liang, and Ju Sun. Farly stopping for deep image prior. arXiv preprint ar 0617: 2021.
Hengkang Wang, Xu Zhang, Taihui Li, Yuxiang Wan, Tiancong Chen, and Ju Sun. Dmplug: A plug-in method for solving inverse problems with diffusion models. arXie preprint arXiv:2405.16749 2024.
Zijie J Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. Diffusiondb: A large-scale prompt gallery dataset for text-to-image generative models. arXie preprint arXiv:2210114996 2022.
Bingyang Wen and Sergul Aydore. Romark: A robust watermarking system using adversarial training. ai preprint xrX:::1910.01222 2019.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint ar xri::23055.000 2023.
Mike Wendling, Ai can be easily used to make fake election photos report. https://www.bb. bbc. us-canada-68,, 684 71/1d25 71258.
www.coo./cc.coooooooooooo.cocc com hom/newss/worll
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Wei Ming Zhang, and Neng H. Yu. Gaussian shading: Provable performaance-losless image watermarking for diffusson models. 2024 IEEE/CVE Conference Compuler Vision and Pattern Recognition (CVPR), pp.
2024. URL
org/Corpus (ts/CorruuDDD229045558 269004589
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision, pp. 14457,, 2021.
Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arxi:: 901. 190.00389, 2019a.
16

---

Published in Transactions on Machine Learning Research (07 (07/2025)
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. or preprinl ar 1rXiu:1909.01288 2019b.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features perceptual metric. In Proceedings of the IEEE conference on computer vision ond potlern recognition, pp. 586 595, 2018.
Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramer, Somesh Jha, Lei Li, Yu-X Yu-Xiang Wang, and Dawn Song. Sok: Watermarking for ai-generated content. ArXiv, abs/2411.18477 2024a. URL https::/app semanticscholar. htt.:/ooo.....rroooooopar////350
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Tlya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generalive ai. Advances in neural information processing systems, 1116643-86723 2024b.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference computer vision (ECCV), pp. 657 672, 2018.
Zhong Zhuang. Advancing Deep Learning for Scientific Inverse Problems. PhD thesis, University of Minnesota, 2023.
Zhong Zhuang, David Yang, Felix Hofmann, David Barmherzig, Ju Sun, David Yang, Felix Hofmann, David Barmherzig, and Ju Sun. Practical phase retrieval using double deep image priors. Electronic Imaging, 35:1-6, Jamuary 2023. ISSN 2470-1173. doi: FF.52/2..022.355 15.. URL https //library beabbrar..maging.r http:///ww.geeeerttc//////////// Technology.
Publisher: Society for Imaging Science and
Zhong Zhuang, Taihui Li, Hengkang Wang, and Ju Sun. Blind image deblurring with unknown kernel size and substantial noise. International Journal of Computer Vision, 132(2):319 348, 2024.
A DALLE-2 visible watermark
An example of a visible DALLE-2 watermark in colored blocks is shown Fig. 9
Figure 9: An example image generated by DALLE-2 from the official website: https:// openai himmiindexddall-ee color code watermark visible the bottom-right corner.
where the
17

---

Published in Transactions on Machine Learning Research (07 (025))
Table 6: Details of hyperparameters used in our exhaustive search
Evasion method
Hyperpaarameter
Search range
Search resolution
Common default value
brightness
Enhancement factor
[0.01,
0.01
0.5
contrast
Enhancement factor
[0.01.
0.01
Gaussian Noise
Standard deviation
[0.01.
0.01
JPEG
Quality factor
[1, 100]
50
bm3d
Noise standard deviation
0011, 5]
0.05
0.1
DiffPure
Diffusion noise level
00.1 1]
0.1
Diffuser
Diffusion inverse steps
[10, 100)
10
60
VAE- Cheng2020
VAE compression quality indenx
[1. 6]
1
DIP (ours)
Number of iteration
5000
B Ranges of hyperparameters of various evasion methods
Table 6 presents the range of each hyperparameter and the grid resolution in our exhaustive search. If we simply use these typical values without exhaustive search, is very likely that we will overestimate the level of robustness and underestimate the evasion image quality. Fig. 10 shows an example of the exhaustive search process on our DIP-based evasion.
In Table the "quality index" for the VAE refers to the selection of specific pretrained model (among the six provided in the original work), hence the minimal grid resolution for this hyperparamcter is 1. The final column lists the default values commonly used in the literature for robustness evaluation (e.g.. Zhao et al. (2024b); Saberi et al. (2023)) ). To the best of our knowledge, the rationale behind the choice of these default. settings is not well documented.
C Runtime comparison of different watermark evasions
Table Runtime comparison of evading single watermarked image by different watermark evasion methods
Method
Evasion configuration
Time (s)
Diffuser
different diffusion steps
3.85
BM3D
5 different standard deviation parameters
18.2
DIP
500 iterations
26.6
DiffPure
10 different diffusion steps
290.75
We perform runtime comparison of different watermark evasion methods mentioned in this paper. The experiment is carried out on a local desktop with Windows OS equipped with an Intel Core 17-12700X processor and an NVIDIA RTX 3080 GPU, on the evasions of a single image. The result can be found Table 7| Our DIP-based evasion comparable Diffuser and BM3D, and is substantially faster than DrffPure. Moreover, we note that recent research has tried accelerate DIP-based denoising, e.g., Li et al. (2023a), which-althoue beyond the scope of this compulational efficiency of our DIP-based watermark evasion.
promising directions for further improving the
D Image quality v.s. evasion success
Fig. 10 presents several illustrative trajectories of the relationship between image quality and the evasion success evaluated on our DIP-based evasion.
E
Additional visualization of evasion image quality on rivaGAN
Fig. 11 presents evasion images with the best visual quality from the different evasion methods considerod in this paper. Note that all other methods except for DIP results in visual artifacts in the evasion image, e.g., pixel jitters (Gaussian Noise, JPEG and Diffuser) overly smoothing effect (bm3d, DiffPure and VAF).
18

---

Published in Transactions on Machine Learning Research (07 (07/202) 2025)
DwiDeSVD
rivaGAN
SSL
StegaStamp
40
PSNR (I)
20
PSNR (fw)
MM
Bitwise Acc.
200
200
400
200
400
Figure 10: The PSNR trajectories of Dased evasion (top row) with respect the watermarked image (in blue) and with respect to the original image (orange), and the corresponding trajectory of evasion performance (bottom row, measured by BA); for different watermark systems. Consider the BA threshold 7 = 0.75 for detection (marked by horizontal orange lines). The vertical black lines mark the best-quality evasion images.
Clean
Brightness
Contrast
Gaussian noise
JPEG
10
144
10
X
70
10
64
10
x
10a
10a
255
293
255
bm33
DiffPure
Diffuser
VAE-Cheng2020
DIP (ours)
16.
X 25
10a
10
x 14
10a
10t
x67
10a
10
255 Figure 11: Visualization of the evasion images found by different evasion methods on a rivaGAN watermarked image (with 7 0.75; top row) and the respective histograms of the pixel difference (y-axis in log scale) between the evasion image and the clean image (bottom row). The vertical dashed line marks the 90% quantile. We can observe that the evasion image produced by DIP has almost no loss of image quality.
235
19

---

Published in Transactions on Machine Learning Research (07 (07/2025)
F Additional discussion on the WIND watermark
Arabi et al. (2024) proposes an inpainting-based variant of the WIND watermark (WIND impainting ) whose underlying principle is similar to that of TreeRing (Wen et al. 2023 and aims to extend catssion-bsedd in-processing watermarking methods to post-processing scenarios. The primary focus of Arabi et al. (2024) is
the identification (i.e., recovery) of the watermark key, but not watermark detection the binary classification of watermarked vs. non-warn watermarked images; see the evaluation Table in Wen et al. (2023).
To evaluate the detection performance of WIND iiNDinpaintin we perform the following experiment: We sample 100 images from the COCO dataset and generate the corresponding watermarked versions using WINDimpainti Arabi et al. 2024). We then apply the WINDmupantinng decoder to all 200 images (clean and watermarked) and record the first-stage distance for each. As described in Arabi et al. (2024), this distance serves as the basis for watermark detection. We plot the histogram of the first-stage distance for clean and watermarked
images, respectively, as shown in
ig. 12
We observe that thresholding the first-stage distance produced by
Distribution of the first-stage distances
Clean Watermarked
Count
60
75
90
105
Distance
Figure 12: Distribution of the first-stage distance for clean and watermarked images decoded by WIND impainting
the WINDimpainting decoder is insufficient for reliably distinguishing between clean and watermarked images. Consequently, we do not include WiNDimpannting in comparison.
20


Reviews:
[{"review_id": "Yepsz8kMXp", "reviewer": "Reviewer_13f4", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strength\n\n1. The paper is well-written and easy to follow. I appreciate the comprehensive review of related work, which systematically summarizes prior approaches to watermark.\n2. The experimental evaluation is solid. The paper benchmarks its method against various watermarking techniques and compares results with several baseline methods. It also clearly acknowledges its limitations, particularly with watermarks embedded in the high-frequency domain—consistent with the theoretical basis of DIP. Although the proposed method does not achieve state-of-the-art performance across all datasets, it still provides valuable insights and contributions to the field.\n\n## Weakness\n\n1. The technical novelty of the paper is limited, especially considering the [prior work](https://github.com/braindotai/Watermark-Removal-Pytorch) cited by the authors. The methodology appears to be largely the same as in the earlier work, which also employed DIP without requiring watermark patterns or location priors. The main distinction seems to be that this paper focuses on invisible watermarks, where DIP performs better—unlike in the prior work that targeted visible watermarks, which were more challenging to remove effectively.\n\n2. The method’s reliance on a decoder makes it less practical for real-world applications, especially since, to my knowledge, none of the baseline methods share this requirement. This constraint significantly limits the usability and generalizability of the approach.\n\n3. This paper lacks a direct computation efficiency comparison of this method and baseline, as DIP requires optimization of thousands of iterations per image.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper investigates the use of Deep Image Prior (DIP) — a technique that leverages the inherent bias of convolutional neural networks (CNNs) for image denoising—as a method for removing watermarks from images. Through extensive experiments, they demonstrate that DIP is also effective at erasing watermarks, particularly those embedded in the high-frequency components of an image. The underlying mechanism is similar to denoising: due to the architectural bias of CNNs, the network tends to reconstruct low-frequency structures first. By employing early stopping, we can prevent the network from fully reconstructing the high-frequency details where watermarks typically reside, effectively removing them from the output.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Equation 2 seems to have some problems, there is no constraint on equation (1b).\n2. What is the baseline method diffuser? The paper lacks citations over this method.", "broader_impact_concerns": "No concerns on the ethical implications", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "MxvmLKdTBK", "reviewer": "Reviewer_afR8", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The approach is refreshingly simple, requiring no model training or specialized architecture.\n2. The empirical evaluation is broad, covering different watermarking methods and image datasets.\n3. The authors provide some insight into the failure cases and offer informal guidelines for improving watermark design.\n\nWeaknesses:\n1. Limited novelty: The method is essentially a direct application of DIP in a new context, without any technical innovation or extension to the original framework.\n2. Underdeveloped analysis: The frequency analysis, while intuitive, lacks rigor or quantitative support.\n3. Practical limitations unaddressed: The method requires iterative optimization and is computationally expensive. Its use in real-world attack settings or benchmarking pipelines is questionable.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper explores the application of Deep Image Prior (DIP) for the task of invisible watermark removal. By leveraging DIP’s tendency to reconstruct low-frequency image content before high-frequency details, the authors propose a simple black-box attack that requires no access to the watermarking method, training data, or model parameters. The method shows promising results in removing certain types of watermarks and is positioned as a strong baseline for evaluating watermark robustness. A frequency-domain analysis is used to support the effectiveness of the approach.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Deepen theoretical and failure analysis: Go beyond intuition to provide more systematic insight into when and why the method works or fails.\n2. Expand comparative experiments: Include comparisons with other unsupervised denoising or inpainting techniques to contextualize the performance of DIP.\n3. Discuss efficiency tradeoffs: Quantify runtime and clarify whether this method is meant for practical attacks or offline benchmarking only.", "broader_impact_concerns": "The method reveals a potential vulnerability in some watermarking techniques, but the paper falls short in addressing the ethical and practical implications of enabling watermark removal in the public domain. While the stated goal is to motivate more robust watermark design, this point is not sufficiently emphasized or developed in the manuscript.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "DKn6vNYKkW", "reviewer": "Reviewer_FSQv", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1. The paper presents clear and accessible content throughout most sections.\n2. The authors provide extensive background information and thoroughly discuss the motivation behind the research.\n3. The effectiveness of the method is analyzed in terms of its impact on different frequency bands.\n\nWeaknesses:\n1. The method requires access to a watermark detector for hyperparameter optimization.\n2. Several important baselines are omitted from the evaluation, including:\na. A recent regeneration attack that has demonstrated exceptional effectiveness against watermarks [1]\nb. An advanced watermarking technique that improves upon tree-ring watermarking and is applicable across all image sources [2]\n3. The proposed method does not consistently outperform alternatives but rather excels only in specific scenarios.\n4. The extensive tables on pages 9-10 would be more appropriately placed in an appendix. A condensed summary table highlighting key findings would better serve readers in the main text.\n\n[1] Zhao, Xuandong, et al. \"Invisible image watermarks are provably removable using generative ai.\" Advances in Neural Information Processing Systems 37 (2024): 8643-8672.\n[2] Arabi, Kasra, et al. \"Hidden in the Noise: Two-Stage Robust Watermarking for Images.\" The Thirteenth International Conference on Learning Representations (2025).", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The author presents a Deep Image Prior (DIP) technique for watermark removal that requires no access to additional information. This method demonstrates superior effectiveness against certain types of watermarks when compared to other evaluated approaches. Through frequency domain analysis, the author examines how this technique affects different aspects of the image. Based on these findings, they recommend including DIP-based watermark removal in future evaluation frameworks to better assess watermark robustness.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Critical:\n1. Please add the evaluations I mentioned in point 2 under Weaknesses.\n\nNon-critical:\n1. Please summarize the large tables in more concise ones. It would be nice to include more graphical results in their place.\n2. Please add a discussion about the assumption of access to a watermark detector for optimization.", "broader_impact_concerns": "No Broader Impact Concerns", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: After a short rebuttal stage, all three reviewers leaned towards acceptance. I personally enjoyed reading the paper. The proposed method is simple and effective, and while the approach echoes the idea established in previous work (e.g. [1]), I agree with the authors that (a) the use of Deep Image Priors (DIP) for watermark evasion is sensible, and (b) DIP-based evasion can be used as a fruitful baseline for future work in this direction. I recommend acceptance and request the authors to update their manuscript to reflect the discussions with the reviewers while preparing the final version.
Decision: Accept (poster)