Invisible Image Watermarks Are Provably Removable Using Generative AI

Authors: xuandong  zhao
kexun  zhang
zihao  su
yu-xiang  wang
lei  li
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 03:54:38

Abstract: Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. They also prevent people from misusing images, especially those generated by AI models.
We propose a family of regeneration attacks to remove these invisible watermarks. 
The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image. 
This approach is flexible and can be instantiated with many existing image-denoising algorithms and pre-trained generative models such as diffusion models. Through formal proofs and extensive empirical evaluations, we demonstrate that pixel-level invisible watermarks are vulnerable to this regeneration attack.
Our results reveal that, across four different pixel-level watermarking schemes, the proposed method consistently achieves superior performance compared to existing attack techniques, with lower detection rates and higher image quality.
However, watermarks that keep the image semantically similar can be an alternative defense against our attacks.
Our finding underscores the need for a shift in research/industry emphasis from invisible watermarks to semantic-preserving watermarks. Code is available at https://github.com/XuandongZhao/WatermarkAttacker

Main paper: 
 introduction: 
 Generative models like DALL-E [45] , Imagen [50] , and Stable Diffusion [47] can produce images that are often visually indistinguishable from those created by human photographers and artists, potentially leading to misunderstandings and false beliefs due to their visual similarity. To address this, government leaders [30, 26, 29] advocate for the responsible use of AI, emphasizing the importance of identifying AI-generated content. In response, leading AI companies such as Google [20] , Microsoft [61] , and OpenAI [4] have pledged to incorporate watermarks into their AI-generated images. Invisible watermarks [62, 17, 9] are preferred as they preserve image quality and are less likely to be removed by laypersons. However, abusers are aware of these watermarks and may attempt to remove them, making it crucial for invisible watermarks to be robust against evasion attacks.Existing attacks can be categorized into two types. The first is destructive, where the watermark is removed by corrupting the image. Typical destructive attacks include modifying the brightness, JPEG compression, and adding Gaussian noise. These approaches are effective at removing watermarks, but The proposed attack first maps the watermarked image to its embedding, which is another representation of the image. Then the embedding is noised to destruct the watermark. After that, a regeneration algorithm reconstructs the image from the noisy embedding.they result in significant quality loss. The second type of attack is constructive, where the watermark is treated as some noise on the original image and removed by purifying the image. Constructive attacks include image-denoising techniques like Gaussian blur [25] , BM3D [11] , and learning-based approaches [65] . However, they cannot remove resilient watermarks easily. To counter these attacks, learning-based watermarking methods [67, 66, 15] were proposed to explicitly train against the known attacks to be robust. But how about other attacks? What is the end of this cat-and-mouse game? In this paper, we ask a more fundamental question:Is an invisible watermark necessarily non-robust?To be more precise, is there a fundamental trade-off between the invisibility of a watermark and its resilience to any attack that preserves the image quality to a certain-level?To address this question, we propose a regeneration attack that leverages the strengths of both destructive and constructive approaches. The pipeline of the attack is given in Figure 1 . Our attack first corrupts the image by adding Gaussian noise to its latent representation. Then, we reconstruct the image from the noisy embedding using a generative model. The proposed regeneration attack is flexible in that it can be instantiated with various regeneration algorithms, including traditional denoisers and deep generative models such as diffusion models [23] . Ironically, the recent advances in generative models that created the desperate need for invisible watermarks are also making watermark removal easier when integrated into the proposed regeneration attack.Surprisingly, we prove that the proposed attack guarantees the removal of certain invisible watermarks such that no detection algorithm could work. In other words, our attack is provably effective in removing any watermarks that perturb the image within a limited range of ℓ 2 -distance, regardless of whether they have been proposed or have not yet been invented. We also show that our attack maintains image quality comparable to the unwatermarked original.To validate our theory, we conduct extensive experiments on four widely used invisible watermarks [41, 67, 53, 15] . Our proposed attack method significantly outperforms five baseline methods in terms of both image quality and watermark removal. For the resilient watermark scheme RivaGAN, our regeneration attacks successfully remove 98% of the invisible watermarks while maintaining a PSNR above 30 compared to the original images. With the empirical results and the theoretical guarantee, we claim that pixel-level invisible image watermarks are vulnerable to our regeneration attacks.Given the vulnerability of invisible watermarks, we explore another option: semantic watermarks. Semantic watermarks do not limit the perturbation to be within an ℓ 2 -distance. As long as the watermarked image looks similar and contains similar content, it is considered suitable for use. One instance of such semantic watermarks is Tree-Ring [60] , which has shown resilience against our attacks. While not a perfect solution, as the watermark becomes somewhat "visible", semantic watermarking offers a potential path forward for protecting the proper use of AI-generated images when invisible watermarks are provably ineffective.Our contributions can be summarized as follows:• We propose a family of regeneration attacks for image watermark removal that can be instantiated with many existing denoising algorithms and generative models. • We prove that the proposed attack is guaranteed to remove certain pixel-based invisible watermarks and that the regenerated images are close to the original unwatermarked image. • We evaluate the proposed attack on various invisible watermarks to demonstrate their vulnerability and its effectiveness compared with strong baselines. • We explore other possibilities to embed watermarks in a visible yet semantically similar way.Empirical results indicate that this approach works better under our attack and is worth investigating as an alternative.2 Related Work and Background 
related work: 
 Image watermarking and steganography. Steganography and invisible watermarking are key techniques in information hiding, serving diverse purposes such as copyright protection, privacypreserved communication, and content provenance. Early works in this area employ hand-crafted methods, such as Least Significant Bit (LSB) embedding [62] , which subtly hides data in the lowest order bits of each pixel in an image. Over time, numerous techniques have been developed to imperceptibly embed secrets in the spatial [17] and frequency [24, 44] domains of an image. Additionally, the emergence of deep learning has contributed significantly to this field. Deep learning methods offer improved robustness against noise while maintaining the quality of the generated image.SteganoGAN [66] uses generative adversarial networks (GAN) for steganography and perceptual image optimization. RivaGAN [67] , further improves GAN-based watermarking by leveraging attention mechanisms. SSL watermarking [15] , trained with self-supervision, enhances watermark features through data augmentation. Stable Signature [14] fine-tunes the decoder of Latent Diffusion Models to add the watermark. Tree-Ring [60] proposes a semantic watermark, which watermarks generative diffusion models using minimal shifts of their output distribution. This work focuses on the removal of invisible watermarks, as opposed to visible watermarks, for several reasons. Visible watermarks are straightforward for potential adversaries to visually identify and locate within an image. Additionally, removal techniques for visible watermarks are already extensively studied in prior work such as [35, 21, 10] . In contrast, invisible watermarks do not have explicit visual cues that reveal their presence or location. Developing removal techniques for imperceptible embedded watermarks presents unique challenges.Deep generative models. The high-dimensional nature of images poses unique challenges to generative modeling. In response to these challenges, several types of deep generative models have been developed, including Variational Auto-Encoders (VAEs) [56, 55] , Generative Adversarial Networks (GANs) [18] , flow-based generative models [46] , and diffusion models [23, 47] . These models leverage deep latent representations to generate high-quality synthetic images and approximate the true data distribution. One particularly interesting use of generative models is for data purification, i.e., removing the adversarial noise from a data sample. The purification is similar to watermark removal except that purification is a defense strategy while watermark removal is an attack. The diffusion-based approach in [43] is similar to an instance of our regeneration attack, but the usage is different in our paper and our theoretical guarantee of watermark removal is stronger. In this paper, we aim to demonstrate the capability of these deep generative models in removing invisible watermarks from images by utilizing the latent representations obtained through the encoding and decoding processes.This section defines invisible watermarks and the properties of an algorithm for their detection. It then discusses the threat model for the removal of invisible watermarks. Definition 2.1 (Invisible watermark). Let x ∈ X be the original image and x w = Watermark(x, aux) be the watermarked image for a watermarking scheme that is a function of x and any auxiliary information aux, e.g., a secret key. We say that the watermark is ∆-invisible on a clean image x w.r.t. a "distance" function dist :X × X → R + if dist(x, x w ) ≤ ∆.Definition 2.2 (Watermark detection). A watermark detection algorithm Detect : X × aux → {0, 1} determines whether an image x ∈ X is watermarked with the auxiliary information (secret key) being aux. Detect may make two types of mistakes, false positives (classifying an unwatermarked image as watermarked) and false negatives (classifying a watermarked image as unwatermarked).x could be drawn from either the null distribution P 0 or watermarked distribution P 1 . We define Type I error (or false positive rate) ϵ 1 := Pr x∼P0 [Detect(x) = 1] and Type II error (or false negative rate)ϵ 2 := Pr x∼P1 [Detect(x) = 0].A watermarking scheme is typically designed such that P 1 is different from P 0 so the corresponding (carefully designed) detection algorithm can distinguish them almost perfectly, that is, to ensure ϵ 1 and ϵ 2 are nearly 0. An attack on a watermarking scheme aims at post-processing a possibly watermarked image which changes both P 0 and P 1 with the hope of increasing Type I and Type II error at the same time, hence evading the detection.We consider the following threat model for removing invisible watermarks from images:Adversary's capabilities. We assume that an adversary only has access to the watermarked images. The watermarking scheme Watermark, the auxiliary information aux, and the detection algorithm Detect are unknown to the adversary. The adversary can make modifications to these already watermarked images it has access to using arbitrary side information and computational resources, but it cannot rely on any specific property of the watermarking process and it cannot query Detect.Adversary's objective. The primary objective of an adversary is to render the watermark detection algorithm ineffective. Specifically, the adversary aims to produce an image x from the watermarked image x w which causes the Detect algorithm to always have a high Type I error (false positive rate) or a high Type II error (false negative rate). Simultaneously, the output image x should maintain comparable quality to the original, non-watermarked image. The adversary's objective will be formally defined later.Watermarking methods implant k-bit secret information into images. The detection algorithm Detect uses an extractor for this hidden data, applying a statistical test to ascertain if the extracted message matches the secret. This test evaluates the number of matching bits M (m, m ′ ) between the extracted m ′ and original m ∈ {0, 1} k messages. A watermark is detected if M (m, m ′ ) ≥ τ for a predefined threshold τ [63, 38] . Formally, we distinguish whether an image x was watermarked (H 1 ) or not (H 0 ). Assuming under null hypothesis H 0 that the extracted bits behave like independent Bernoulli variables with a 0.5 probability, M (m, m ′ ) follows a binomial distribution B(k, 0.5). The false positive rate (ϵ 1 ) corresponds to the probability that M (m, m ′ ) exceeds τ . This has a closed form using the regularized incomplete beta function I x (a; b):ϵ 1 (τ ) = P (M (m, m ′ ) > τ | H 0 ) = 1 2 k k i=τ +1 k i = I 1/2 (τ + 1, k -τ ).Decision threshold. We consider a watermark to be detected, if we can reject the null hypothesis H 0 with a p-value less than 0.01. In practice, for a k = 32-bit watermark, we require at least 23 bits to be extracted correctly in order to confirm the presence of a watermark. This provides a reasonable balance between detecting real watermarks and avoiding false positives. 
the proposed regeneration attack: 
 Our attack method first destructs a watermarked image by adding noise to its representation, and then reconstructs it from the noised representation.Specifically, given an embedding function ϕ : R n → R d , a regeneration function A : R d → R n , and a noise level σ, the attack algorithm takes a watermarked image x w ∈ R n and returns There are various different choices for ϕ and A that can instantiate our attack. ϕ can be as simple as identity map, or as complicated as deep generative models including variational autoencoders [31] .EQUATIONA can be traditional denoising algorithms from image processing and recent AI models such as diffusion [23] . The choice of ϕ and A may change the empirical results, but it does not affect the theoretical guarantee. In the following sections, we introduce three combinations of ϕ and A to instantiate the attack. Among the three, the diffusion instantiation is the most complicated and we describe it with pseudocode in Algorithm 1.Set ϕ to be identity map, then A can be any image denoising algorithm, e.g., BM3D [11] , TVdenoising [48] , bilateral filtering [54] , DnCNNs [65] , or a learned natural image manifold [6, 11, 65, 64] . A particular example of interest is a "denoising autoencoder" [57] , which takes ϕ to be identity, adds noise to the image deliberately, and then denoises by attempting to reconstruct the image. Observe that for "denoising autoencoder" we do not need to add additional noise.The regeneration attack in Equation 1 can be instantiated with a variational autoencoder (VAE). A VAE [31] consists of an encoder q ϕ (z|x) that maps a sample x to the latent space z and a decoder p θ (x|z) that maps a latent z back to the data space x. Both the encoder and decoder are parameterized with neural networks. VAEs are trained with a reconstruction loss that measures the distance from the reconstructed sample to the original sample and a prior matching loss that restricts the latent to follow a pre-defined prior distribution.Instead of mapping x directly to z, the encoder maps it to the mean µ(x) and variance σ(x) of a Gaussian distribution and samples from it. Therefore, VAE already adds noise during the encoding stage (though its variance depends on the sample x, which is not exactly the same as defined in Equation 1), so there is no need to add extra noise. Note that this is similar to the situation of denoising autoencoders described in Section 3.1, as the denoising autoencoder is a trivial case of VAE where µ(x) is identity.The regeneration attack can also be instantiated with diffusion models. Diffusion models [23] define a generative process that learns to sample from an unknown true distribution p(z 0 ). This process is learned by estimating original samples from randomly noised ones. In other words, diffusion models are trained to denoise, which makes them candidates for the regeneration function A in the proposed attack. The embedding function ϕ can either be identity [23] or a latent embedding [47] , depending on the space where diffusion is trained.For diffusion models, the process of adding noise to a clean sample is known as the forward process. Likewise, the process of denoising a noisy sample is known as the backward process.The forward process is defined by the following stochastic differential equation (SDE): dz = f (z, t)dt + g(t)dw (2), where t ∈ [0, 1], z ∈ R d , w(t) ∈ R d is a standard Wiener process, and f, g are real-valued functions. The backward process can then be described with its reverse SDE: dẑ = f (ẑ, t) -g(t) 2 ∇ ẑ log p t (ẑ) dt + g(t)d w (3), where ŵ is a reverse Wiener process. Diffusion models parameterize ∇ ẑ log p t (ẑ) with a neural network s(z, t). By substituting s(z, t) into Equation 3, the backward SDE becomes known and solvable using numerical solvers [34, 36] , ẑ0 = solve(z t , t, s, f, g).Among many ways to define f and g in Equation 2, variance preserving SDE (VP-SDE) is commonly used [23, 47] . Under this setting, the conditional distribution of the noised sample is the following Gaussian [51] : p(z t |z 0 ) = N ( α(t)z 0 , 1 -α(t)) (4), where α(t) a pre-defined noise schedule. The variance of the original distribution p(z 0 ) is preserved at any step.As defined in Algorithm 1, our algorithm removes the watermark from the watermarked image x w using diffusion models. x w is first mapped to the latent representation z 0 , which is then noised to the time step t * . A latent diffusion model is then used to reconstruct the latent ẑ0 , which is mapped back to an image x.Similar to denoising autoencoders, in either diffusion or VAEs, the noise-injection is integral to the algorithms themselves, and no additional noise-injection is needed.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? 
theoretical analysis: 
 We show in this section that the broad family of regeneration attacks as defined in Equation 1 enjoy provable guarantees on their ability to remove invisible watermarks while retaining the high quality of the original image. Our proofs are deferred to Appendix D. More discussion on the implications and interpretation of our theoretical analysis can be found in Appendix C.How do we quantify the ability of an attack algorithm to remove watermarks? We argue that if after the attack, no algorithm is able to distinguish whether the result is coming from a watermarked image or the corresponding original image without the watermark, then we consider the watermark certifiably removed. More formally: Definition 4.1 (f -Certified-Watermark-Free). We say that a watermark removal attack is f -Certified-Watermark-Free (or f -CWF) against a watermark scheme for a non-increasing function f : [0, 1] → [0, 1], if for any detection algorithm Detect : X × aux → {0, 1}, the Type II error (false negative rate) ϵ 2 of Detect obeys that ϵ 2 ≥ f (ϵ 1 ) for all Type I error 0 ≤ ϵ 1 ≤ 1.Let us also define a parameter to quantify the effect of the embedding function ϕ. Definition 4.2 (Local Watermark-Specific Lipschitz property). We say that an embedding function ϕ : X → R d satisfies L x,w -Local Watermark-Specific Lipschitz property if for a watermark scheme w that generates x w with x,∥ϕ(x w ) -ϕ(x)∥ ≤ L x,w ∥x w -x∥.The parameter L x,w measures how much the embedding compresses the watermark added on a particular clean image x. If ϕ is identity, then L x,w ≡ 1. If ϕ is a projection matrix to a linear subspace then 0 ≤ L x,w ≤ 1 depending on the magnitude of the component of x w -x in this subspace. For a neural image embedding ϕ, the exact value of L x,w is unknown but given each x w and x it can be computed and estimated efficiently. We defer more discussion to the Appendix A. Theorem 4.3. For a ∆-invisible watermarking scheme with respect to ℓ 2 -distance. Assume the embedding function ϕ of the diffusion model is L x,w -Locally Lipschitz. The randomized algorithmA(ϕ(•) + N (0, σ 2 I d )) produces a reconstructed image x which satisfies f -CWF with f (ϵ 1 ) = Φ Φ -1 (1 -ϵ 1 ) - L x,w ∆ σ ,where Φ is the Cumulative Density Function function of the standard normal distribution. Theoretically, after the attack, no detection algorithm can fall in the Impossibility Region and have both Type I error and Type II error at a low level. Empirically, the watermark detector performs even worse than the theory, indicating the success of our attack and the validity of the theoretical bound. We use 500 watermarked MS-COCO images with an empirically valid upper bound of L = 1 and noise level σ = 1.16∆. An additional example for the RivaGAN watermark is provided in Figure 12 .Figure 2 illustrates what the tradeoff function looks like. The result says that after the regeneration attack, it is impossible for any detection algorithm to correctly detect the watermark with high confidence. In addition, it shows that such detection is as hard as telling the origin of a single sample Y from either of the two Gaussian distributions N (0, 1) and N (L x,w ∆/σ, 1). Specifically, when there is a uniform upper bound L ≥ L x,w , we can calibrate σ such that the attack is provably effective for a prescribed Φ(Φ -1 (1 -•) -L∆/σ)-CWF guarantee for all input images and all ∆-invisible watermarks (see specific constructions in Appendix A).The proof, deferred to Appendix D, leverages an interesting connection to a modern treatment of differential privacy [13] known as the Gaussian differential privacy [12] . The work of [12] itself is a refinement and generalization of the pioneering work of [59] and [28] which established a tradeoff-function view.In this section, we prove that the regenerated image x is close to the original (unwatermarked) image x 0 . This is challenging because the denoising algorithm only gets access to the noisy version of the watermarked image. Interestingly, we can obtain a general extension lemma showing that for any black-box generative model that can successfully denoise a noisy yet unwatermarked image with high probability, the same result also applies to the watermarked counterpart, except that the failure probability is slightly larger. Theorem 4.4. Let x 0 be an image with n pixels and ϕ : R n → R d be an embedding function. Let A be an image generation / denoising algorithm such that with probability at least 1 -δ, ∥A(ϕ(x 0 ) + N (0, σ 2 I d )) -x 0 ∥ ≤ ξ x0,σ,δ . Then for any ∆-invisible watermarking scheme that produces x w from a clean image x 0 , then x = A(ϕ(x w ) + N (0,σ 2 I d )) satisfies that ∥x -x 0 ∥ ≤ ξ x0,σ,δwith a probability at least 1 -δ,where δ = min v∈R δ • e v + Φ ∆ 2σ -vσ ∆ -e v Φ -∆ 2σ -vσ ∆ in which Φ denotes the standard normal CDF and ∆ := L x0,w ∆.The theorem says that if a generative model is able to denoise a noisy version of the original image, then the corresponding watermark-removal attack using this generative model provably produces an image with similar quality.Corollary 4.5. The expression for δ above can be (conservatively) simplified to δ ≤ e L 2 x,w ∆ 2 σ 2 • δ 1/2 .For example if σ ≍ L x,w ∆, then this is saying that if ξ x0,σ,δ depends logarithmically on 1/δ, the same exponential tail holds for denoising the watermarked image.The above result is powerful in that it makes no assumption about what perturbation the watermarking schemes could inject and which image generation algorithm we use. We give a few examples below.For denoising algorithms with theoretical guarantees, e.g., TV-denoising [27, Theorem 2], our results imply provable guarantees on the utility for the watermark removal attack of the form, "w.h.p.,1 n ∥x -x 0 ∥ 2 = Õ σTV 2d (x0)n ", i.e., vanishing mean square error (MSE) as n gets bigger. For modern deep learning-based image denoising and generation algorithms where worst-case guarantees are usually intractable, Theorem 4.4 is still applicable for each image separately. That is to say, as long as their empirical denoising quality is good on an unwatermarked image, the quality should also be good on its watermarked counterpart. 
evaluation: 
 Datasets. We evaluate our attack on two types of images: real photos and AI-generated images.For real photos, we use 500 randomly selected images from the MS-COCO dataset [33] . For AIgenerated images, we employ the Stable Diffusion-v2.1 model2 from Stable Diffusion [47] , a state-of-the-art generative model capable of producing high-fidelity images. Using prompts from the Stable Diffusion Prompt (SDP) dataset 3 , we generate 500 images encompassing both photorealistic and artistic styles. This diverse selection allows for a comprehensive evaluation of our attack on invisible watermarks. All experiments are conducted on Nvidia A6000 GPUs.Watermark settings. We evaluate four publicly available pixel-level watermarking methods: DwtDctSvd [41] , RivaGAN [67] , StegaStamp [53] , and SSL watermark [15] . These methods represent a variety of approaches, ranging from traditional signal processing to recent deep learning techniques, as introduced in Section 2.1. To account for watermarks of different lengths, we use k = 32 bits for DwtDctSvd, RivaGAN, and SSL watermark, and k = 96 bits for StegaStamp. For watermark detection, we set the decision threshold to reject the null hypothesis with p < 0.01, requiring the detection of 23 out of 32 bits or 59 out of 96 bits, respectively, for the corresponding methods, as described in Section 2.3. For watermark extraction, we use the publicly available code for each method with default inference and fine-tuning parameters specified in their papers.Attack baselines. To thoroughly evaluate the robustness of our proposed watermarking method, we test it against a diverse set of baseline attacks representing common image perturbations. We select both geometric/quality distortions and noise manipulations that could potentially interfere with embedded watermarks. Specifically, the baseline attack set includes: brightness adjustments with enhancement factors of [2, 4, 6, 8, 12] , contrast adjustments with enhancement factors of [2, 3, 4, 5, 6, 7] , JPEG compression at quality levels [10, 20, 30, 40, 50, 60] , Gaussian noise addition with a The strongest attacker should appear in the lower right corner of these plots. Regeneration attacks demonstrate superior performance compared to other attack methods, achieving both lower TPR and higher image quality. Quality-detectability tradeoff results for the SDP dataset are in Figure 7 .mean of 0 and standard deviations of [5, 10, 15, 20, 25, 30] , and Gaussian blur with radii of [2, 4, 6, 8, 10, 12] . Further details are provided in Appendix B.Proposed attacks. For regeneration attacks using variational autoencoders, we evaluate two pre-trained image compression models from the CompressAI library [5] : Bmshj2018 [3] and Cheng2020 [7] . Compression factors are set to [1, 2, 3, 4, 5, 6] , where lower factors correspond to more heavily degraded images. For diffusion model attacks, we use the Stable Diffusion-v2.1 model. The number of noise steps is set to [10, 30, 50, 100, 150, 200] (with σ =[0.10, 0.17, 0.23, 0.34, 0.46, 0.57]), and we employ pseudo numerical methods for diffusion models (PNDMs) [34] to generate samples. By adjusting the compression factors and noise steps, we achieve varying levels of perturbation for regeneration attacks.Evaluation metrics. We evaluate the quality of attacked and watermarked images compared to the original cover image using two common metrics: Peak Signal-to-Noise Ratio (PSNR) defined as PSNR (x, x ′ ) = -10•log 10 (MSE (x, x ′ )), for images x, x ′ ∈ [0, 1] c×h×w , and Structural Similarity Index (SSIM) [58] which measures perceptual similarity. To evaluate the diversity and quality of watermarked images, we use Fréchet Inception Distance (FID) [22] between the distributions of watermarked and unwatermarked images. To evaluate the robustness of the watermark, we compute the True Positive Rate (TPR) at a fixed False Positive Rate (FPR), specifically TPR@FPR=0.01. The detection threshold corresponding to FPR=0.01 is set according to each watermark's default configuration: correctly decoding 23/32, 59/96, and 32/48 bits for the respective watermarking methods, as described in the watermark settings.This section presents detailed results and analysis of the regeneration attack experiments on different watermarking methods. Some attacking examples are shown in Figure 3 . Watermark removal effectiveness and image quality reservation. Figure 4 and 7 present the quality-detectability tradeoff results from applying various regeneration attacks to remove watermarks. The VAE and diffusion model-based attacks (VAE-Bmshj2018, VAE-Cheng2020, Diffusion) consistently achieve over 99% removal rates for the DctDwtSvd, RivaGAN, and SSL watermarking methods, demonstrating their high effectiveness. In contrast, StegaStamp exhibits the highest robustness, with effective removal only achieved by the diffusion model with substantial noise. This resilience is partially attributed to StegaStamp's lower visual quality and higher perturbation levels (as indicated in Table 1 , Figure 6 and Figure 5 ). Yet, increasing the noise level in diffusion models reduces StegaStamp's resistance. As demonstrated in Figure 4 and 7, higher noise levels improve the removal rate on StegaStamp, aligning with the theory that larger perturbations necessitate more noise for effective removal. This also aligns with the trade-off of lower image quality at higher noise levels.Overall, the consistently high removal rates across various watermarking schemes demonstrate the effectiveness of regeneration attacks for watermark removal. In terms of image quality preservation, the regeneration attacks generally maintain high quality, as indicated by PSNR and SSIM metrics. VAE models yield higher PSNR and SSIM scores, suggesting superior perceptual quality from a GAN-based perspective. However, qualitative inspection of example images in Figure 3 reveals the VAE outputs exhibit some blurring compared to the diffusion outputs. Since PSNR and SSIM are known to be insensitive to blurring artifacts [42, 58] , we conclude that the choice of using regeneration with diffusion models should be guided by the specific requirements of each application.Potential defense. Although we show that the proposed attack is guaranteed to remove any pixelbased invisible watermarks, it is not impossible to detect AI-generated images. Semantic watermarks offer a viable detection method, with further details and results discussed in Appendix E.Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes] Justification: Our code is provided in the supplementary material. We use openly accessible data in our experiments.Guidelines:• The answer NA means that paper does not include experiments requiring code. • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
conclusion: 
 We proposed a regeneration attack on invisible watermarks that combines destructive and constructive attacks. Our theoretical analysis proved that the proposed regeneration attack is able to remove certain invisible watermarks from images and make the watermark undetectable by any detection algorithm. We showed with extensive experiments that the proposed attack performed well empirically. The proofs and experiments revealed the vulnerability of invisible watermarks. Given this vulnerability, we explored an alternative defense that uses visible but semantically similar watermarks. Our findings on the vulnerability of invisible watermarks underscore the need for shifting the research/industry emphasis from invisible watermarks to their alternatives.Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes]Justification: We have specified the details in Section 5 for readers to understand the results.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [No] Justification: Although we haven't reported error bars, the effectiveness of our proposed attack is much better than the existing baselines.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.• The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: We discussed the compute resources we used in Section 5.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes]Justification: We have discussed the societal impacts in our abstract, introduction, conclusion, and Appendix F.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: We do not release any models or data.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: We have properly cited the dataset we use, MS-COCO in our paper.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.• If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [Yes] Justification: The code provided in our supplementary material is well documented.Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA]Justification: The paper does not involve human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 
institutional review board (irb) approvals or equivalent for research with human subjects: 
 Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?Answer: [NA]Justification: The paper does not involve human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper. 
 
 Appendix: How do we control a certain degree of Certified Watermark Freeness apriori? We note that our guarantee in Theorem 4.3 depends on the specific watermark injected on specific image instance through the unknown local Lipschitz parameter L x,w . Specifying a fixed CWF level requires us to have a uniform upper bound of L x,w independent to x and w. To give two concrete examples, when the embedding ϕ is chosen trivial to be the identity map, then we can take L x,w ≤ 1. When ϕ is a lower pass filtering, e.g., Fourier transform than removing all high-frequency components except the top k dimension, then we can bound L x,w ≤ √ k/n where n is the number of pixels. More generally, any linear transformation with bounded operator norm works.Is there a uniform bound for neural embedding ϕ such as those from VAE and diffusion models? We believe there is, but these bounds might be too conservative to use in practice. In particular, they might be ≫ 1 due to the widely observed adversarial examples [52, 19] . If the injected watermarks are carefully designed such that the injected perturbation is aligned with an adversarial perturbation, then the resulting watermarked images will be more resilient to our attacks that leverage the neural embeddings. They will not be more resilient to our attacks that do not use neural embeddings though. In practice, we found that in all existing watermarks, neural embeddings result in substantially smaller distortions to the original images while suppressing L x,w substantially (Figure 5 ).Other ways of achieving CWF without adding Gaussian noise. Research from the golden age of digital watermarking [39, 9, 16, 8] has proposed methods such as quantization for removing watermarks that provide similar tradeoffs in practice to the watermarks that we experimented with in this paper. However, these methods, in general, do not come with provable CWF guarantees. It is critical that the watermark removal attack is randomized to enjoy similar properties to what we have in Theorem 4.3. That said, the classical removal attacks can be used in constructing better embedding function ϕ which may help reducing the local Lipschitz parameter and, thus, improving the tradeoff between certified removal and utility of the regenerated image. Besides Gaussian noise, we can also add Laplace noise and other well-known perturbation mechanisms from the differential privacy and cryptography research community. Thoroughly investigating the impact of the choice of noise (and randomized quantization approaches) is an interesting direction of future research.In this section, we review several well-established invisible watermarking schemes that are evaluated in our experiments (Section 5). These approaches cover a range of methods, including traditional signal processing techniques and more recent deep learning methods. They include the default watermarking schemes employed by the widely used Stable Diffusion models [47] . We show some invisible watermarking examples in Figure 6 .DwtDctSvd watermarking. The DwtDctSvd watermarking method [41] combines Discrete Wavelet Transform (DWT), Discrete Cosine Transform (DCT), and Singular Value Decomposition (SVD) to embed watermarks in color images. First, the RGB color space of the cover image is converted to YUV. DWT is then applied to the Y channel, and DCT divides it into blocks. SVD is performed on each block. Finally, the watermark is embedded into the blocks. DwtDctSvd is the default watermark used by Stable Diffusion.RivaGAN watermarking. RivaGAN [67] presents a robust image watermarking method using GANs. It employs two adversarial networks to assess watermarked image quality and remove watermarks. An encoder embeds the watermark, while a decoder extracts it. By combining these, RivaGAN offers superior performance and robustness. RivaGAN SSL watermarking. SSL watermarking [15] utilizes pre-trained neural networks' latent spaces to encode watermarks. Networks pretrained with self-supervised learning (SSL) extract effective features for watermarking. The method embeds watermarks through backpropagation and data augmentation, then detects and decodes them from the watermarked image or its features.In this section, we review common attacking methods that aim to degrade or remove invisible watermarks in images. These methods are widely used to measure the robustness of watermarking algorithms against removal or tampering [67, 53, 15, 14, 60] . The attacking methods can be categorized into destructive attacks, where the watermark is considered part of the image and actively removed by corrupting the image, and constructive attacks, where image processing techniques like denoising are used to obscure the watermark.Destructive attacks intentionally corrupt the image to degrade or remove the embedded watermark.Brightness/Contrast adjustment. This attack adjusts the brightness and contrast parameters of the image globally. Adjusting the brightness/contrast makes the watermark harder to detect.parameter that controls the amount of compression. A lower quality factor leads to more loss of fine details and a higher chance of degrading the watermark.Gaussian noise. This attack adds random Gaussian noise to each pixel of the watermarked image. The variance of the Gaussian noise distribution controls the strength of the noise. A higher variance leads to more degradation of the watermark signal. Gaussian blur. Blurring the image by convolving it with a Gaussian kernel smoothens the watermark signal and makes it less detectable. The kernel size and standard deviation parameter control the level of blurring.Other recent attacking methods [32, 49, 37, 1] aim to remove invisible image watermarks using generative models. Concurrent to our work, [32] use propose DiffWA, a conditional diffusion model with distance guidance for watermark removal. However, DiffWA only works for low-resolution images and lacks theoretical guarantees. [49] train a substitute classifier and conduct projected gradient descent (PGD) attacks on it to deceive black-box watermark detectors. However, their approach requires multiple queries to the target generator. [37] propose an adaptive attack that locally replicates secret watermarking keys by creating differentiable surrogate keys used to optimize the attack parameters. However, they assume the attacker knows the watermarking method, which is a stronger assumption than ours. Our method removes invisible watermarks from high-resolution images, provides theoretical justifications, and does not assume knowledge of the watermarking algorithm.In this section, we discuss more about the theoretical guarantees in Section 4. For the readers' convenience, we first restate the definitions and theorems and then discuss their implications and interpretation. The proofs can be found in Appendix D.How do we quantify the ability of an attack algorithm to remove watermarks? We argue that if after the attack, no algorithm is able to distinguish whether the result is coming from a watermarked image or the corresponding original image without the watermark, then we consider the watermark certifiably removed. More formally:Definition C.1 (f -Certified-Watermark-Free). We say that a watermark removal attack is f -Certified-Watermark-Free (or f -CWF) against a watermark scheme for a non-increasing function f : [0, 1] → [0, 1], if for any detection algorithm Detect : X × aux → {0, 1}, the Type II error (false negative rate) ϵ 2 of Detect obeys that ϵ 2 ≥ f (ϵ 1 ) for all Type I error 0 ≤ ϵ 1 ≤ 1. Let us also define a parameter to quantify the effect of the embedding function ϕ. Definition C.2 (Local Watermark-Specific Lipschitz property). We say that an embedding function ϕ : X → R d satisfies L x,w -Local Watermark-Specific Lipschitz property if for a watermark scheme w that generates x w with x, ∥ϕ(x w ) -ϕ(x)∥ ≤ L x,w ∥x w -x∥.The parameter L x,w measures how much the embedding compresses the watermark added on a particular clean image x. If ϕ is identity, then L x,w ≡ 1. If ϕ is a projection matrix to a linear subspace then 0 ≤ L x,w ≤ 1 depending on the magnitude of the component of x w -x in this subspace. For a neural image embedding ϕ, the exact value of L x,w is unknown but given each x w and x it can be computed efficiently.Theorem C.3. For a ∆-invisible watermarking scheme with respect to ℓ 2 -distance. Assume the embedding function ϕ of the diffusion model is L x,w -Locally Lipschitz. The randomized algorithm A(ϕ(•) + N (0, σ 2 I d )) produces a reconstructed image x which satisfies f -CWF withf (ϵ 1 ) = Φ Φ -1 (1 -ϵ 1 ) - L x,w ∆ σ ,where Φ is the Cumulative Density Function function of the standard normal distribution.Figure 2 illustrates what the tradeoff function looks like. The result says that after the regeneration attack, it is impossible for any detection algorithm to correctly detect the watermark with high confidence. In addition, it shows that such detection is as hard as telling the origin of a single sample Y from either of the two Gaussian distributions N (0, 1) and N (L x,w ∆/σ, 1). The proof in Section D leverages an interesting connection to a modern treatment of differential privacy [13] known as the Gaussian differential privacy [12] . The work of [12] itself is a refinement and generalization of the pioneering work of [59] and [28] which established a tradeoff-function view.(1 -α(t * ))/α(t * ) (see Algorithm 1) and discuss the parameter choices. Remark C.4 (Two trivial cases). Observe that when α(t * ) = 0, the result of the reconstruction does not depend on the input x w , thus there is no information about the watermark in x(0), i.e., the trade-off function is f (ϵ 1 ) = 1 -ϵ 2 -perfectly watermark-free, however, the information about x (through x w ) is also lost. When α(t * ) = 1, the attack trivially returns x(0) = x w , which does not change the performance of the original watermark detection algorithm at all (and it could be perfect, i.e., ϵ 1 = ϵ 2 = 0). Remark C.5 (Choice of t * ). In practice, the best choice t * is in between the two trivial cases, i.e., one should choose it such that L x,w ∆ α(t * )/(1 -α(t * )) is a small constant. The smaller the constant, the more thoroughly the watermark is removed. The larger the constant, the higher the fidelity of the regenerated image w.r.t. x w (thus x 0 too). Remark C.6 (VAE). Strictly speaking, Theorem 4.3 does not directly apply to VAE because the noise added on the latent embedding depends on the input data. So if it chooses σ(x 0 ) = 1 and σ(x w ) = 0, then it is easy to distinguish between the two distributions. We can still provide provable guarantees for VAE if either the input image is artificially perturbed (so VAE becomes a denoising algorithm) or the latent space is artificially perturbed after getting the embedding vector. When σ(x) itself could be stable, more advanced techniques from differential privacy such as Smooth Sensitivity or Propose-Test-Release can be used to provide certified removal guarantees for the VAE attack. In practice, we find that the VAE attack is very effective in removing watermarks as is without adding additional noise. Remark C.7 (The role of embedding function ϕ). Readers may wonder why having an embedding function ϕ is helpful for removing watermarks. We give three illustrative examples.Pixel quantization. This ϕ is effective against classical Least Significant Bit (LSB) watermarks. By removing the lower-significance bits ϕ(x) = ϕ(x w ) thus L x,w = 0.Low-pass filtering. By choosing ϕ to be a low-pass filter, one can effectively remove or attenuate watermarks injected in the high-frequency spectrum of the Fourier domain, hence resulting in a L x,w ≪ 1 for these watermarks.Deep-learning-based image embedding. Modern deep-learning-based image models effectively encode a "natural image manifold," which allows a natural image x to pass through while making the added artificial watermark ϵ smaller. To be more concrete, consider ϕ to be a linear projection to a d-dimensional "natural image subspace". For a natural image x and watermarked imagex w = x + ε, we have ϕ(x w ) = ϕ(x) + ϕ(ε) = x + ϕ(ε). If ε ∼ N (0, σ 2 w I n ) then E[∥ϕ(ε)∥ 2 ] = dσ 2 w ≪ nσ 2 w = E[∥ε∥ 2 ]. This projection compresses the magnitude of the watermark substantially while preserving the signal, thereby boosting the effect of the noise added in the embedding space in obfuscating the differences between watermarked and unwatermarked images.Finally, we note that while Theorem 4.3 and 4.4 are specific to ℓ 2 -distance, the general idea applies to other distance functions (e.g., ℓ 1 distance). ℓ 2 -distance is natural for the Gaussian noise natively introduced by diffusion and VAE-based regeneration attacks.In this section, we prove that the regenerated image x is close to the original (unwatermarked) image x 0 . This is challenging because the denoising algorithm only gets access to the noisy version of the watermarked image.Interestingly, we can obtain a general extension lemma showing that for any black-box generative model that can successfully denoise a noisy yet unwatermarked image with high probability, the same result also applies to the watermarked counterpart, except that the failure probability is slightly larger. Theorem C.8. Let x 0 be an image with n pixels and ϕ : R n → R d be an embedding function. Let A be an image generation / denoising algorithm such that with probability at least 1 -δ, ∥A(ϕ(x 0 ) + N (0, σ 2 I d )) -x 0 ∥ ≤ ξ x0,σ,δ . Then for any ∆-invisible watermarking scheme that produces x w from a clean image x 0 , then x = A(ϕ(x w ) + N (0,σ 2 I d )) satisfies that ∥x -x 0 ∥ ≤ ξ x0,σ,δwith a probability at least 1 -δ whereδ = min v∈R δ • e v + Φ ∆ 2σ - vσ ∆ -e v Φ - ∆ 2σ - vσ ∆in which Φ denotes the standard normal CDF and ∆ := L x0,w ∆.The theorem says that if a generative model is able to denoise a noisy version of the original image, then the corresponding watermark-removal attack using this generative model provably produces an image with similar quality.Corollary C.9. The expression for δ above can be (conservatively) simplified toδ ≤ e L 2 x,w ∆ 2 σ 2 • δ 1/2 .For example, if σ ≍ L x,w ∆, then this is saying that if ξ x0,σ,δ depends logarithmically on 1/δ, the same exponential tail holds for denoising the watermarked image.The above result is powerful in that it makes no assumption about what perturbation the watermarking schemes could inject and which image generation algorithm we use. We give a few examples below.For denoising algorithms with theoretical guarantees, e.g., TV-denoising [27, Theorem 2], our results imply provable guarantees on the utility for the watermark removal attack of the form, "w.h.p.,1 n ∥x -x 0 ∥ 2 = Õ σTV 2d (x0)n ", i.e., vanishing mean square error (MSE) as n gets bigger.For modern deep learning-based image denoising and generation algorithms where worst-case guarantees are usually intractable, Theorem 4.4 is still applicable for each image separately. That is to say, as long as their empirical denoising quality is good on an unwatermarked image, the quality should also be good on its watermarked counterpart.Proof of Theorem 4.3. By the conditions on the invisible watermark and the local Lipschitz assumption on ϕ, we get that ∥ϕ(x 0 ) -ϕ(x w )∥ 2 ≤ L x0,w ∆. This can be viewed as the ℓ 2 -local-sensitivity of ϕ at x 0 in the language of differential privacy literature.The two candidate distributions are N (ϕ(x 0 ), σ 2 I) and N (ϕ(x w ), σ 2 I). Let T (P, Q) : [0, 1] → [0, 1] be the tradeoff function for distinguishing between distributions P and Q as in Definition 2.1 of [12] . The tradeoff function outputs the Type II error of the likelihood ratio test of the two point hypotheses as a function of the Type I error. By the Neyman-Pearson lemma, the likelihood ratio test is uniform most powerful, thus the tradeoff function provides a lower bound of any test in distinguishing P and Q.First notice that translation and scaling by any non-zero constant (a non-zero linear transformation) does not change the tradeoff function, thusT N (ϕ(x 0 ), σ 2 I), N (ϕ(x w ), σ 2 I) = T N (0, I), N ( ϕ(x w ) -ϕ(x 0 ) σ 2 , I)Next, observe that the likelihood ratio of the two multivariate isotropic normal distributions remains the same when we collapse it to the 1-dimension along the vector ϕ(x 0 ) -ϕ(x w ), i.e.,EQUATIONLemma 2.9 of [12] states that for any post-processing function h,EQUATIONwhich is known to information theorists as the information processing inequality of the Hockey-Stick divergence.Consider a particular randomized post-processing function h that first addsEQUATIONTo see the last identity, observe that we can choose v > 0 such thatLx 0 ,w ∆ σ 2 ( √ 1+v) = ∥ϕ(xw)-ϕ(x0)∥ σ 2, thanks to the local Lipschitz assumption. To put things together, we getT N (0, 1), N ( L x0,w ∆ σ 2 , 1) ≤ T N (ϕ(x 0 ), σ 2 I), N (ϕ(x w ), σ 2 I)The left hand side is the tradeoff function of two univariate Gaussian with variance 1, by Equation ( 6) of [12] , the tradeoff function can be written asΦ Φ -1 (1 -α) - Lx 0 ,w ∆ σ 2where Φ is the cumulative density function of the standard Gaussian distribution.Finally, by applying the the postprocessing property (6) again by instantiating h to be the re-generation procedure, we get that the regenerated image x also satisfies the same tradeoff function as stated above.Proof of Theorem 4.4. The key idea is to use the definition of indistinguishability (differential privacy, but for a fixed pair of neighbors, rather than for all neighbors). So we say two input x, x ′ are (v, w)indistinguishable using the output of a mechanism M if for any event S,Pr[M(x) ∈ S] ≤ e v Pr[M(x ′ ) ∈ S] + w.and the same also true when x, x ′ are swapped. In our case, we have already shown that (from the proof of Theorem 4.3) for any post-processing algorithm A, x 0 and x w are indistinguishable using x in the trade-off function sense. [2] obtained a "dual" characterization which says that the same Gaussian mechanism satisfies (v, w)-indistinguishability withw = Φ ∆ 2σ - vσ ∆ -e v Φ - ∆ 2σ - vσ ∆for all v ∈ R. By instantiating the event S to be that ∥x -x 0 ∥ > ξ x0,σ,δ , then we getPr xw [∥x -x 0 ∥ > ξ x0,σ,δ ] ≤ e v Pr x0 [∥x -x 0 ∥ > ξ x0,σ,δ ] + w = e v • δ + w.This completes the proof.Proof of Corollary 4.5. The w, v "privacy profile" implies a Renyi-divergence bound (one can also get that directly from the Renyi-DP of gaussian mechanism) which implies (by Proposition 10 of [40] ) thatδ ≤ min u≥1 e u ∆2 2σ 2 • δ (u-1)/u.The stated result is obtained by setting u = 2.In this section, we discuss possible defenses that are resilient to the proposed attack, and although Theorem 4.3 has guaranteed that no detection algorithm will be able to detect the watermark after our attack, the guarantee is based on the invisibility with respect to ℓ 2 distance. Therefore, by relaxing that invisibility constraint and thus making the watermark more visible, we may be able to prevent the watermark from being removed. One less-harmful way to loosen the invisibility constraint is with semantic watermarks. As shown in Figure 13 , pixel-based watermarks such as DwtDctSvd keep the image almost intact, while semantic watermarks change the image significantly but retain its content.Tree-Ring Watermarking [60] is a new technique that robustly fingerprints diffusion model outputs in a way that is semantically hidden in the image space. An image with a Tree-Ring watermark does not look the same as the image, but it is semantically similar (in Figure 13 , both the original and the semantically watermarked image contain an astronaut riding a horse in Zion National Park). Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. [60] demonstrated that Tree-Ring Watermarking can be easily applied to arbitrary diffusion models, including textconditioned Stable Diffusion, as a plug-in with negligible loss in FID. To evaluate Tree-Ring as an alternative watermark, we use the same datasets from the previous experiments in Section 5 -MS-COCO and SDP. However, since Tree-Ring adds watermarks during the generation process of diffusion, it cannot directly operate on AI-generated images. Instead, it needs textual inputs that describe the content of the images. We use captions from MS-COCO and the user prompts of SDP datasets as the input prompts. The selected set of attacks (including our proposed attack) is applied to the Tree-Ring watermarked images.As shown in Table 2 , Tree-Ring watermarks show exceptional robustness against all the attacks tested. However, such robustness does not come for free. We depict the ℓ 2 -distances between original images and watermarked ones in Figure 14 . Images with Tree-Ring watermarks are significantly more different from the original images in both the pixel space and the latent space. These results indicate that Tree-Ring, as an instance of semantic watermarks, shows the potential to be an alternative solution to the image watermarking problem. However, as our theory predicts, the robustness comes at the price of more visible differences. NeurIPS Paper Checklist We have pointed out one class of watermarks that can resist our attackssemantic-preserving ones. We have evaluated our method on these watermarks and discussed them in detail in Appendix F. Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.Justification: Yes it does.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).https://huggingface.co/stabilityai/stable-diffusion-2-1-basehttps://huggingface.co/datasets/Gustavosta/Stable-Diffusion-Prompts 


Decision: After discussion, all the reviewers provided positive feedback on this submission, therefore we recommend accepting it.

Reviews: review: paper_summary: paper_summary: This paper proposes regeneration attacks, which adds destructive Gaussian noise to the latent representation of the watermarked image, and then reconstructs the corrupted latent to reconstruct the original clean image. The paper provides theoretical guarantee that shows the trade-off function between the Type I error and the Type II error after the attack, in addition to the theorem that shows the ability of the regeneration attack's capability to produce images with similar quality as the generative model that reconstructs the corrupted latent. The paper also introduces a potential defense mechanism that can survive the regeneration attack.
strength_weakness: strength_weakness: The proposed method relies on the upper bound $L \geq L_{x,w}$ to effectively calibrate $\sigma$, which is slightly unrealistic considering the embedding function $\phi$ and original image $x$ is unknown to the attacker, even though a uniform upper bound may exist, this could potentially affect the attack performance or image quality since the attacker normally has no access to the decoding scheme thus unable to verify the performance of the attack while maintaining the image quality.
questions: questions: Major concerns are already addressed in Appendix A, so here are some minor questions that may be slightly out of the scope. 
1. For in-processing watermarking, semantic watermarking is a great alternative for preserving visual quality as well as robustness to regeneration attacks. However, for post-hoc watermarking, changing the semantic content leads to unsatisfactory results. How do you envision balancing the robustness of semantic watermarks with their increased visibility in practical applications? Are there any strategies you are exploring to minimize the visual impact while maintaining robustness under regeneration attacks?
2. The Stegastamp method seems to be able to withstand the proposed attack due to a relatively high l2 distance in both pixel and latent space. Figure 5 shows that with greater noise levels, StegaStamp fails to withstand the regeneration attacks, but the reduced PSNR and SSIM indicate significant degradation in image quality. Since StegaStamp's image quality is already low, enforcing regeneration attacks that further degrade image quality seems unrealistic in real-world scenarios. Given that PSNR and SSIM are pixel-level metrics, such degradation is expected after multiple perturbations in the semantic space. I wonder if the semantically meaningful content is still preserved after regeneration attacks capable of breaking StegaStamp. Specifically, a visualization for Figure 5 or an LPIPS curve might be helpful for understanding the preservation of semantic content.

-------------------Post rebuttal Edit------------------------

I appreciate the author for the comments. My questions has been well addressed. I have increased my rating accordingly.
limitations: limitations: potential negative societal impact has not been addressed but the author does provide potential defense mechanisms for the proposed attack method.
paper_summary: paper_summary: The main idea proposed in this paper is that regenerating images using other (pretrained) generative AI (e.g., vae, diffusion models) can provably remove any invisible watermarks embedded in a given image. Accompanying this, the paper can be divided into the following parts: (1) intro of the proposed regeneration methods; (2) proof of the removal guarantee (by any regeneration methods falls into the definition of this paper, not limited to vae or diffusion; and (3) empirical experiments to support their claim "the regeneration methods is effective, especially using defussion models."
strength_weakness: strength_weakness: The weakness is listed below in order, from major to minor:

Weakness 1 (Major): Experiment settings and evaluation are not rigorous.

The key experiment and result to support the authors claim of the effectiveness of their method will be those that can show the “strength” of their proposed attacks, but the current evaluation experiment is poorly designed. Reporting the watermark detection acc. (as in Table 2) using a fixed attack point (e.g., JPEG 50, or the selected VAE’s, etc., where they all have tunable parameters) cannot faithfully show the strength. This make the PSNR value reported in Table 2 meaningless. Instead, if there is a tradeoff between the image quality and the watermark detectability expected, the authors should report the maximal PSNR (the best image quality) for each attack method when the same detection ability (e.g., fail the watermark detection) of the decoder is achieved (e.g., with the same bitwise acc.) by tuning the hyperparameters of the attack methods (e.g., the JPEG quality factor, the compression index of the selected VAE model used in this paper, the noise level of the diffusion regeneration as Fig. 5, etc.). In this regard, the attack method with the best image quality can be argued as the strongest reasonably. Alternatively, the authors may consider profiling the quality and detectability tradeoff as proposed in [1]. The current evaluation experiment is not sufficient to support the claim made in line 71-73.

Weakness 2 (Major): Conclusion with insufficient support.

In line 13-14 “Our findings underscores … to semantic-preserving watermarks” is not convincing. For example, let’s say we want to prevent misusing generated images. In Fig 6., the authors visualize the StegaStamp watermark, where there are obvious abnormal patterns embedded into the image (in another word, they are not `invisible’ and humans can tell these images are suspicious). I would suspect that the attacked images of StegaStamp after applying the methods proposed by the authors will still have visible artifacts that are enough to raise human caution and suspect they are not original images—so it may be reasonable to argue that StegaStamp can successfully prevent image misuse and do not need a shift as the authors claimed. My suspicions are raised by the following results presented by the authors: (i) The visualizations of the attack methods proposed by the authors (e.g., Diffusion Attack in Fig 3. And 7.) are on DwtDctSVD watermarks and they already contain visible artifacts; (ii) corresponding PSNR values in Table 2 for DwtDctSVD is higher than StegaStamp; whereas in Fig 5., the PSNR of diffusion regeneration on StegaStamp is low. So, I would imagine that the attacked images of StegaStamp will have more visible artifacts but the author did not include any visualization of this. Thus, I consider the current conclusion an overclaim without persuasive argument and suggest the authors provide more evidence to support their claim.

Weakness 3 (Minor) --- inaccurate statements.

In line 1-3 “Invisible watermark safeguards images’ copyrights … prevent people from misusing images … ”.  These are largely believed to be only possible applications that people are thinking of how to use invisible watermarks, but not affirmative conclusions.
Line 4 “ The proposed attack method first adds random noise to an image…”. According to Eq. 1, the proposed methods add noise to the latent feature of the image (attack instance 2 & 3), not the image itself.


[1] An, Bang, et al. "WAVES: Benchmarking the Robustness of Image Watermarks." Forty-first International Conference on Machine Learning.
questions: questions: 1. Similar to Fig. 2, can you also provide (1) watermarks other than DwtDctSVD and (2) curves that are achieved by other regeneration attacks (e.g., VAE, denoising autoencoder)? Current illustration is insufficient to support the claim in the caption “indicating the success of our attack and the validity of the theoretical bound”.

2. As the authors repeatedly claim the superior attack performance of their proposed method, the visualization w.r.t only DwtDctSVD is not sufficient, as DwtDctSVD appears to be the least robust watermark among all the selected watermarks in this paper (see Table 2). Can you provide complete set of attack visualization of all methods on different watermarks considered in this paper? This will also help to clarify "Weakness 2" stated above.

3. As the authors proposed denoising reconstruction (attack instance 1), I think it is necessary to include DiffPure as a baseline attack in the experiment and discuss its performance. This has been applied as a watermark attack method in a published paper [2].

[2] Saberi, Mehrdad, et al. "Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks." The Twelfth International Conference on Learning Representations. 2023.
limitations: limitations: N/A. The work does not have potential negative impact that needs to be explicitly discussed.
paper_summary: paper_summary: This paper investigates the resilience of invisible watermarks embedded in images against removal attacks. The authors propose a new class of attacks, called regeneration attacks, which combine adding random noise to the image and then reconstructing the image using generative models. The study demonstrates that these attacks can effectively remove invisible watermarks, including the resilient RivaGAN, while maintaining image quality.
strength_weakness: strength_weakness: While invisible watermarks are highly vulnerable, semantic watermarks are less affected by the proposed attacks.
questions: questions: N/A
limitations: limitations: N/A

Comments: title: Reply to the authors
Reply to the authors
comment: Thank you for your comments. I will keep my positive score.
Thank you for your active engagement and insightful contributions!
We will make sure to revise our manuscript according to our discussion.
Thank you for the prompt response.

All of my concerns are sufficiently addressed. Therefore, I have decided to change my rating to accept.
Thank you for your prompt and insightful feedback! It significantly contributes to the improvement of our paper. We have provided responses and clarifications to your comments below:

> "DiffPure also seems to have tuning parameters. Thus I believe it is more appropriate to compare with DiffPure by plotting the quality-detectability tradeoff just as what you did to other attacks. I would ask to put this comparison in the same quality-detectability plots."

We appreciate your suggestion. We have now obtained all the results for DiffPure. In summary, DiffPure performs comparably to Regen-Diff, albeit with a slightly worse quality-detectability tradeoff. Due to the inability to edit the rebuttal PDF, we will include this comparison in the revised paper. Additionally, we offer the following analysis:

- Mathematically, DiffPure and Regen-Diff employ the same method, adding noise to samples via the forward process with a small diffusion timestep, and then solving the reverse VP-SDE to recover clean samples.

- DiffPure, or [1]'s implementation, utilizes the 256x256 diffusion (unconditional) checkpoint from the guided-diffusion library [2] pretrained on ImageNet data. In contrast, we use the stable-diffusion-2-1 latent diffusion model from Stable Diffusion, pretrained on the LAION-5B dataset, which offers superior generation quality. Our implementation, as demonstrated in the Supplementary Material, supports many other latent diffusion models.

> "If I remember correctly, you have tried to emphasized two things in your original paper: (1) the proposed regeneration attack is very effective and (2) the regeneration attack powered by diffusion model outperforms the others. However, based on your updated quality-detectability tradeoff, I see that regeneration powered by VAE seems to be the best performing one. Is this understanding correct? If so, I would ask the authors to adjust their related comments/conclusions in the paper accordingly."

Thank you for your feedback! For DctDwtSvd, RivaGAN, and SSL watermarks, Regen-VAE achieves the best Pareto front of quality and attack detectability. Regen-Diff performs best against Stable Signature and shows strong results across all scenarios. It also offers ease of use and achieves good attacking results with different noise levels. We will adjust our related comments and conclusions in the revised paper accordingly.

> "I hope to see some discussion related on how the "removability" and "cost to remove" trade-off can potentially imply for practical scenarios. For example, how this result support/concerns the application of watermark (copyright protection, preventing image misuse, etc); possible directions to counteract your finding if watermark is not safe let's say; or any idea for the future design of practical watermarks that you can suggest."

We appreciate your suggestions and feedback! In the revised paper, we will discuss how the "removability" and "cost to remove" trade-off can potentially apply to practical scenarios. For example, from the watermark addition side, if they can increase the L2 distance without significantly altering image perception quality, it could be practical. Researchers can use regeneration as an attacking baseline; if all attacked images have lower quality than a set threshold, the watermark can be deemed sufficient. Overall, we advocate for using semantic watermarks. As stated in response to reviewer n9vc, we are exploring methods to enhance the robustness of post-hoc watermarking. One promising approach involves using powerful image editing techniques to add or remove unimportant subjects or alter textures. These modifications are visible but appear as normal image content without the watermark key.

----
Thank you again for your feedback and prompt response. We hope these additional results address your concerns.


----
[1] Saberi et al. "Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks." ICLR 2024.

[2] https://github.com/openai/guided-diffusion
I appreciate the effort that you have put into this rebuttal. Most of my questions and concerns are addressed and I'm inclined to increase my original rating.

Nevertheless, I have some further comments and questions regarding the rebuttal provided and hope to be clarified/addressed:

1. DiffPure also seems to have tuning parameters. Thus I believe it is more appropriate to compare with DiffPure by plotting the quality-detectability tradeoff just as what you did to other attacks. I would ask to put this comparison in the same quality-detectability plots.

2. If I remember correctly, you have tried to emphasized two things in your original paper: (1) the proposed regeneration attack is very effective and (2) the regeneration attack powered by diffusion model outperforms the others. However, based on your updated quality-detectability tradeoff, I see that regeneration powered by **VAE** seems to be the best performing one. Is this understanding correct? If so, I would ask the authors to adjust their related comments/conclusions in the paper accordingly.

3. I understand that the authors' emphasis of this paper is the "removability", and the cost of quality loss to remove the watermark is secondary consideration. However, based on the additional results provided in the rebuttal, the cost to remove some watermarks (e.g., StegaStamp) tends to be large (e.g., PSNR $\sim$ 23.33 by Regen-Diff; also the visible flaws shown in the visualization). I hope to see some discussion related on how the "removability" and "cost to remove" trade-off can potentially imply for practical scenarios. For example, how this result support/concerns the application of watermark (copyright protection, preventing image misuse, etc); possible directions to counteract your finding if watermark is not safe let's say; or any idea for the future design of practical watermarks that you can suggest.

Overall, if the above points can be further clarified/addressed, I tend to change the rating to accept.