What invisible watermarks can and cannot survive

Three distinct attack threats on invisible watermarks

Invisible watermarks embedded in AI-generated images are often presented as a straightforward answer to labelling synthetic content. But the research literature on attacking these marks reveals a more complicated picture. The threats fall into three categories, each with different implications for misuse.

First is removal: an attacker deletes a watermark that is already present. Second is forgery: an attacker adds a watermark to content that was never watermarked, falsely claiming it as authentic or synthetic. Third is detection degradation: standard image processing, compression or distortion makes the watermark harder or impossible to verify, even though it has not been deliberately attacked. These are separate problems with separate defences, and conflating them muddles the actual stakes.

Removal attacks and model-agnostic manipulation

Early watermark removal attacks worked only against specific generative models, or succeeded only by severely degrading image quality. MarkNull, a 2024 study on arXiv, challenges this constraint. The authors present a model-agnostic removal attack that works by manipulating the latent representation of an image; [1] they argue that the robustness of digital watermarking against realistic, model-agnostic removal attacks remains poorly explored, and that existing attacks either succeed only against specific models or cause severe visual degradation. Their approach does not require customisation to a particular generative model, suggesting removal is more portable than prior work suggested.

The mechanics matter for policy. If removal requires specialist knowledge of one model's architecture, the barrier is higher. If it is model-agnostic, the barrier is lower. MarkNull indicates the latter, though it does not settle how widespread the technique is in practice or how quickly it can be deployed against new watermarking schemes.

Forgery: adding marks to unmarked content

Forgery is a distinct threat. WMCopier, published on arXiv in March 2025, demonstrates that an attacker can forge a watermark onto arbitrary unmarked images without knowing the watermarking scheme in advance. [3] The attack requires only access to watermarked content, and the authors report success against both open-source and proprietary watermarking systems. This is different from removal because instead of erasing evidence of synthesis, forgery fabricates false evidence of authenticity or provenance.

A related study, published in April 2025, shows that both removal and forgery are possible with only a single watermarked example and no knowledge of the watermarking algorithm or model weights. [2] The attack exploits the many-to-one mapping between images and the initial noise used in diffusion-based generation, allowing an attacker to perturb an image in or out of watermarked regions. This black-box constraint is important: it means an attacker does not need insider access or reverse engineering.

Detection degradation under ordinary processing

A third vulnerability, sometimes overlooked, is that watermarks can become undetectable through ordinary image operations. WAVES, a watermark benchmark published at ICML 2024, was built because the authors judged existing watermark evaluation insufficient. [4] The benchmark evaluates watermark detection jointly with image quality, and its stress tests span traditional image distortions alongside adversarial attacks. The authors report that their benchmark reveals previously undetected vulnerabilities in modern watermarking algorithms, suggesting that watermarks fail to detect reliably under conditions watermarking advocates may not have tested.

This matters because JPEG compression, cropping, colour adjustment and other standard image editing are not attacks in the adversarial sense; they are routine. If a watermark degrades under routine processing, it fails its basic function as a label for synthetic content.

The defence: certified watermarking with provable bounds

The attack literature should not be read as a verdict that watermarking is useless. The counterweight is certified watermarking, a method presented at ECCV 2024 that adapts randomised smoothing to provide provable robustness guarantees. [5] Unlike empirical claims about robustness, certified watermarking gives a mathematical bound: the method states that its guarantees cover both removal attacks and forgery attacks. The existence of such methods shifts the conversation from whether watermarking works to under what conditions and at what computational cost it can work reliably.

The certified approach is not universal. It requires acceptance of the specific watermarking scheme and its computational overhead. But it represents a principled alternative to asking watermarking to do everything without proof.

What watermark robustness means for policy and practice

The research record suggests that watermarks are a tool for raising the cost of misrepresentation, not a guarantee against it. Removal, forgery and detection degradation are real, documented threats with differing difficulty and detectability. Watermarks that are certified against specific attack classes offer more assurance than claims of robustness made without formal proof. Watermarks that have not been tested against removal, forgery and ordinary processing should not be trusted without independent evaluation.

For organisations deploying watermarks, the honest position is calibration: understand what your watermark actually protects against, what it does not, and under what conditions detection can fail. For policymakers proposing watermarks as a solution to synthetic media, the gap between marketing claims and verified robustness is the gap where harm can occur.

---

• What Content Credentials establish, and what they do not , the other approach to the same problem: signing at creation rather than marking the pixels
• Why deepfake detectors fail on new generators , why the detection route this post is an alternative to keeps failing
• What the US AI Safety Institute says still needs research , where the US AI Safety Institute puts watermarking on its list of unsolved problems

---

Sources

1. [1]
   MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation. arXiv:2608.10166.arxiv.org
2. [2]
   Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image. arXiv:2504.20111.arxiv.org
3. [3]
   WMCopier: Forging Invisible Image Watermarks on Arbitrary Images. arXiv:2503.22330.arxiv.org
4. [4]
   WAVES: Benchmarking the Robustness of Image Watermarks. ICML 2024. arXiv:2401.08573.arxiv.org
5. [5]
   Certifiably Robust Image Watermark. ECCV 2024. arXiv:2407.04086.arxiv.org