Title: The Future Unmarked: Watermark Removal in AI-Generated Images via Next-Frame Prediction
Venue: NeurIPS 2025
Accepted: yes
Keywords: Deep Learning

Image Watermarking

Watermark Removal Attack
Abstract: Image watermarking embeds imperceptible signals into AI-generated images for deepfake detection and provenance verification. Although recent semantic-level watermarking methods demonstrate strong resistance against conventional pixel-level removal attacks, their robustness against more advanced removal strategies remains underexplored, raising concerns about their reliability in practical scenarios. Existing removal attacks primarily operate in the pixel domain without altering image semantics, which limits their effectiveness against semantic-level watermarks.
In this paper, we propose Next Frame Prediction Attack (NFPA), the first semantic-level removal attack. Unlike pixel-level attacks, NFPA formulates watermark removal as a video generation task: it treats the watermarked image as the initial frame and aims to subtly manipulate the image semantics to generate the next-frame image, i.e., the unwatermarked image.
We conduct a comprehensive evaluation on eight state-of-the-art image watermarking schemes, demonstrating that NFPA consistently outperforms thirteen removal attack baselines in terms of the trade-off between watermark removal and image quality. Our results reveal the vulnerabilities of current image watermarking methods and highlight the urgent need for more robust watermarks.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces the Next Frame Prediction Attack (NFPA), a semantic-level watermark removal attack for AI-generated images. Unlike existing pixel-level attacks that modify individual pixels, NFPA formulates watermark removal as a video generation task by treating the watermarked image as an initial frame and generating a semantically coherent \"next frame\" that preserves visual content while removing the watermark. The method leverages a pre-trained text-to-image diffusion model in a zero-shot manner, using DDIM inversion, optical flow transformations, and frame-attention mechanism. Experiments on eight watermarking schemes show the proposed method outperforms nine baseline attacks while maintaining image quality.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n\n- It’s an interesting idea to frame watermark removal as a next-frame prediction task. This semantic-level approach may address some limitations of existing pixel-level attacks.\n- The paper evaluates against 8 different watermarking methods (both pixel-level and semantic-level) and compares with 9 attack baselines, providing thorough experimental validation.\n- The proposed method combines DDIM inversion, optical flow optimization, and frame-attention mechanism.\n\nWeaknesses:\n\n- The paper lacks theoretical justification for why the next-frame prediction approach should effectively remove semantic watermarks. The connection between temporal consistency and watermark removal could be better explained.\n- NFPA requires ~1.3 seconds per image, which is significantly slower than simple distortion attacks. The paper doesn't adequately discuss scalability for large-scale attacks.\n- The method introduces several hyperparameters (optical flow bounds, inference steps, etc.) but provides limited analysis of sensitivity to these choices beyond brief ablation studies.\n- Only evaluated on MS-COCO dataset with Stable Diffusion-generated images. No evaluation on real-world watermarked images or other generation models.\n\nQUESTIONS:\n- How does NFPA perform on watermarked images generated by models other than Stable Diffusion? Would the method work on naturally captured images with post-processing watermarks?\n- The paper tests three basic camera motions (x-axis, y-axis, xy-axis), but how sensitive is the attack to the choice of motion pattern? Could adversarial motion patterns further improve performance?\n- Given the effectiveness of NFPA, what potential defenses could watermarking schemes adopt? Could temporal consistency constraints be incorporated into watermark design?\n- How can we quantitatively measure the semantic preservation beyond FID and CLIP scores? Are there cases where NFPA significantly alters image semantics?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-15"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studied the watermark removal attack problem. Specifically, the authors pointed out that current methods might fall short in terms of semantic-level watermark removal, and to address this issue, they proposed the Next Frame Prediction Attack (NFPA) aimed at semantic-level removal. The NFPA models watermark removal as a video generation task where the goal is to generate the next frame that does not carry the watermark. Experiments were conducted to demonstrate the effectiveness of their proposed method.\n\nSTRENGTHS AND WEAKNESSES:\nSignificance: Watermark-related research problems are of potentially great significance in the generative AI era.\n\nClarity: I think the paper does not clearly discuss and distinguish between classical pixel-watermarks and semantic watermarks.\n\nQuality: I think the overall writing and the experiments presented are OK.\n\nOriginality: The idea of casting the watermark removal process as video generation is novel, at least to me.\n\nQUESTIONS:\nSome major questions/issues are listed below:\n\n- My main question concerns whether a semantic-watermark removal attack is truly necessary, which relates to the foundation of this paper. Typically, watermarks involve embedding certain signals (e.g., imperceptible noise) into images that can later be extracted to verify ownership when we encounter similar images. Traditional attacks against watermarks essentially aim to remove those embedded signals through techniques like cropping, rotating, or adding noise.\n\nHowever, there's an important constraint: attacks typically cannot be too aggressive, as substantially altering the images would render the original content meaningless. This makes me curious about the practical need for semantic-watermark removal attacks, since they fundamentally change the semantic meaning of images, making them significantly different from the originals. This approach seems to diverge from typical real-world watermark applications. After all, if we change an image's semantic meaning entirely, doesn't it become questionable to make copyright claims on the resulting image?\n\n- In the experimental evaluation section, I noticed metrics focus on FID and CLIP scores rather than PSNR and SSIM. It would be helpful to explain why these traditional image quality metrics were excluded, as they're standard in measuring preservation of image fidelity.\n\n- I would like to see results using a wider variety of diffusion models to demonstrate the robustness of your approach across different frameworks.\n\nOverall, I find the concept interesting but would appreciate more discussion on these aspects to fully understand the practical applications and limitations of semantic watermark removal.\n\nLIMITATIONS:\nCheck above", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes Next Frame Prediction Attack (NFPA), the first semantic-level attack specifically designed to remove watermarks embedded in AI-generated images. NFPA formulates watermark removal as a next-frame prediction problem inspired by video generation: it treats the watermarked image as an initial frame and synthesizes an unwatermarked next frame by subtly modifying the image’s semantic structure. The method leverages a zero-shot, tuning-free framework based on a pre-trained text-to-image diffusion model, performing DDIM inversion to obtain the latent representation of the input and applying an optimized optical flow transformation in the latent space to disrupt watermark signals while preserving perceptual fidelity. The authors conduct extensive experiments on eight state-of-the-art watermarking schemes, covering both pixel-level and semantic-level methods, and compare NFPA with nine established attack baselines, including distortion, regeneration, and adversarial attacks. Results demonstrate that NFPA consistently reduces watermark detectability while maintaining high image quality measured by FID and CLIP scores.\n\nSTRENGTHS AND WEAKNESSES:\n$\\textbf{Strengths}$\n\n1 -- The paper proposes a novel method for removing semantic-level watermarks by treating the problem as a next-frame prediction task. This approach goes beyond traditional pixel-level attacks and introduces a new perspective for attacking advanced watermarking techniques.\n\n2 -- The paper presents a well-designed methodology by adapting a pre-trained text-to-image diffusion model for next-frame prediction. The authors combine DDIM inversion with an optimized optical flow transformation in the latent space to generate an unwatermarked image that remains visually and semantically similar to the original.\n\n3 -- The proposed attack works in a black-box setting without requiring any information about the watermark or the detector, and it does not rely on additional data or queries. This makes the attack practical and realistic for situations where the attacker has limited knowledge or resources.\n\n$\\textbf{Weaknesses}$\n\n1 -- The paper does not compare NFPA with recent work [1] showing that controllable regeneration from clean noise can remove even semantic-level watermarks, despite claiming that existing semantic watermarking techniques are robust against such attacks; this omission weakens the comparative analysis.\n\n2 -- A relatively simpler approach would be to use off-the-shelf image-to-video generation modules, such as Stable Diffusion-based video models, which can directly generate temporally coherent next frames without requiring the complex inversion and optical flow steps proposed by the authors. However, the paper does not explore or compare these simpler alternatives, leaving it unclear whether NFPA’s complexity is necessary.\n\n3 -- The next-frame images produced by NFPA appear primarily as translated versions of the originals, suggesting that simple image translation alone might remove much of the watermark. The paper should compare NFPA with basic translation attacks, potentially combined with diffusion-based inpainting to reconstruct missing regions created by the translation.\n\n4 --  The attack design is limited to translation-based motion and does not consider other common camera transformations, such as zoom or rotation around the subject, which could lead to more effective or diverse watermark removal strategies.\n\n5 -- While quantitative metrics and qualitative examples are provided, the paper lacks a user study or detailed perceptual evaluation to confirm whether the subtle semantic changes introduced by NFPA degrade the recognizability or utility of attacked images.\n\n[1] - IMAGE WATERMARKS ARE REMOVABLE USING CONTROLLABLE REGENERATION FROM CLEAN NOISE (ICLR, 2025)\n\nQUESTIONS:\nPlease see the weakness section for detailed concerns that require clarification.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies removing watermarks from the generated images and proposes a semantic-level removal attack named NFPA. NFPA treated the watermark removal task as a next-frame prediction task and modified the semantic structure of the watermarked image. Experiments validated its removal attack effectiveness and showed it can preserve high image quality after removal.\n\nSTRENGTHS AND WEAKNESSES:\nStrength: \n\n1) This paper presents a relatively novel view to remove image watermarks, ie. conducting a next frame prediction attack, by introducing temporal consistency, the proposed method is able to ensure semantic consistency. This poses a relatively new perspective to image watermark removal area.\n\n2) This work proposed flow-based transformation strategies to simulate camera-induced motions by noise swarping, which were evaluated with different motion conditions. The module was experimentally showed effective in experiments.\n\n3) With the TPR@1%FPR metric, the method showed competitive watermark removal performances with some existing attacks (though more evaluation metrics are suggested to be reported, see weakness).\n\nWeakness:  \n\n1) Though some baselines, such as distortion attacks, DA and VAE-Attack were compared, to be more compelling, I suggest the authors consider more recent baselines, e.g. [1], and I will raise my score if the proposed method could still achieve competitive performance( e.g. sota).\n\n2) Besides, for image quality measurement, it is suggested to use LPIPS [2], which can better reflect the visual fidelity wrt human visual systems. \n\n3) In addition, it is suggested to discuss the applicability of the proposed method, whether it is able to remove some other types of watermarks (rather than T2I generative models), such as conventional image watermarks. \n\n[1] Müller, Andreas, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. \"Black-box forgery attacks on semantic watermarks for diffusion models.\" arXiv 2025, https://arxiv.org/abs/2412.03283\n\n[2] Richard Zhang, et al. The Unreasonable Effectiveness of Deep Features as a Perceptual Metric. CVPR 2018\n\nQUESTIONS:\nSee weakness.\n\nLIMITATIONS:\nSee weakness.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-06"}