PaperlayerView exact revision on arXiv

Source-linked AI summary

RemTraceNet: Few-Shot Forensic Detection of Invisible Watermark Attacks

Jidong Yang, Huaike Yu, Qi Li, Yuantian Miao, Wei Zong, Yang-Wai Chow, Willy Susilo, Chunpeng Wang, Suo Gao

arXiv:2609.31694v1cs.CVcs.CR

TL;DR

Watermark removal can leave forensic traces, but watermark-attack-specific processing-history detection is distinct from detecting watermark presence. RemTraceNet uses complementary evidence views and achieves high TPR@1%FPR across the evaluated pipelines and configurations.

  • Problem

    Watermark removal may disrupt recovery while leaving processing traces, but existing watermark detectors identify payload evidence rather than whether a specified removal pipeline processed an image.

    Source: §1 · p. 2

  • Method

    For each known removal pipeline, a binary specialist distinguishes attacked outputs from paired clean and unattacked-watermarked controls using RemTraceNet’s complementary forensic evidence views.

    Source: §1 · p. 2

  • Results

    At n = 100, three-seed mean TPR@1%FPR ranged from 82.75% to 88.17% across the two resolutions and control types.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Removal traces remain learnable, and removal-specific forensics may provide complementary provenance and ownership evidence when direct watermark verification fails.

    Source: §1 · p. 2

    The experiments do not test distinguishing malicious removal from all benign post-processing, and RemTraceNet cannot recover damaged payloads or infer key, owner, or signature information.

    Source: §5 · p. 9

Abstract

from arXiv · show

Removing an invisible watermark and concealing the forensic evidence are distinct objectives: successfully disrupting the embedded watermark does not imply that the removal process is forensically undetectable. When verification fails, removal traces can provide complementary evidence for provenance and ownership verification, whereas their absence leaves the cause of the failure ambiguous. Existing methods are typically evaluated by watermark suppression and perceptual quality, while forensic stealth is rarely considered. We therefore study watermark-attack-specific few-shot forensics: for each known pipeline, a specialist can separate its outputs from paired clean and unattacked watermarked controls. Separate Attack-vs-Clean and Attack-vs-Watermarked evaluations prevent watermark-presence shortcuts. Image-aligned and prompt-matched controls are used for post-hoc and generator-integrated schemes, respectively. In this work, we introduce RemTraceNet, which fuses constrained residuals, local relations, FFT/Haar statistics, and block-DCT evidence at native resolution. Across 23 removal pipelines and 10 watermark configurations, we evaluate native 256 x 256 and 512 x 512 inputs. With 100 attacked training images per pipeline, the three-seed TPR@1%FPR, macro-averaged over attacks and watermark configurations, ranges from 82.75% to 88.17% across resolutions and control types. Under the condition of same labels and protocol, RemTraceNet outperforms retrained SRNet, ZhuNet, and SiaStegNet baselines by 10.80--15.68 percentage points. Extensive experimental results show that erasing a watermark and erasing evidence of its removal are distinct challenges, and that removal traces remain learnable under limited supervision.

1 Introduction

Watermark removal can disrupt verification while leaving forensic traces, but typical evaluations focus on watermark detectability or payload recovery. The paper frames removal-specific forensics as a few-shot processing-history task and introduces RemTraceNet to detect traces across removal pipelines.

1 Introduction

  • Imperceptible removal does not imply forensic stealth: attacks can disrupt watermark recovery while leaving processing traces.Existing robustness protocols measure watermark detectability or payload recovery, not whether outputs remain distinguishable from clean or unattacked-watermarked controls.Source: §1 · p. 2
  • RemTraceNet combines global residual, relational, FFT/Haar, and block-DCT evidence with dense local multiple-instance decisions.Its architecture is designed to distinguish heterogeneous processing evidence from image content.Source: §1 · p. 2
  • At n = 100, TPR@1%FPR ranges from 82.75% to 88.17% across resolutions and negative controls, and RemTraceNet exceeds the strongest retrained steganalysis architecture by 10.80–15.68%.The evaluation covers 23 removal pipelines and ten watermark configurations; unseen-watermark TPR@1%FPR is lower than seen-watermark TPR in all four settings.Source: §1 · p. 2
  • The study evaluates native 256x256 and 512x512 inputs with three seeds and attacked training sizes from n = 10 to 200.Specialists are fitted on five watermark configurations and evaluated on ten, including five unseen during fitting.Source: §1 · p. 2
  • The task detects whether an image was processed by a specified removal pipeline, using paired clean and unattacked-watermarked controls as negatives.Post-hoc controls are image-aligned, while generator-integrated controls are prompt-matched; separate Attack-vs-Clean and Attack-vs-Watermarked evaluations address distinct comparisons.Source: §1 · p. 2

2 Problem Formulation

The formulation treats forensic detection as identifying a specified attack pipeline’s processing history, rather than watermark presence or payload removal. It pairs controls according to the watermarking regime and reports the specialist in two distinct binary comparisons.

2 Problem Formulation

  • The pairing unit q links clean and unattacked-watermarked controls; post-hoc pairs share a source image, while generator-integrated pairs share a prompt.Only the post-hoc regime assumes pixel correspondence.Source: §2 · p. 3
  • The processed watermarked member is the positive, while clean and unattacked-watermarked controls are both negative for the pipeline-specific specialist.The attacked class is balanced against the combined negatives, and no separate clean detector is trained.Source: §2 · p. 3
  • The same specialist is reported in two binary slices: against paired unprocessed content and against unattacked-watermarked controls.The second slice tests additional attack processing rather than watermark presence alone; the detector receives no key, encoder, decoder, target detector, or attack parameters.Source: §2 · p. 3
  • The task is attack-specific because the specified pipeline produces the positive and determines which specialist checkpoint is selected.The image input itself contains no attack or watermark identifier.Source: §2 · p. 3

3 Method

RemTraceNet combines four complementary forensic views to distinguish processing evidence from image content without relying on watermark presence alone. It combines global and spatial decisions and trains them with an objective that keeps clean and unattacked-watermarked controls distinct.

3.1 Multi-view forensic representation

  • Four views combine constrained residuals, local relations, FFT/Haar statistics, and block-DCT evidence for the paired forensic task.The residual stem uses a zero-sum Bayar filter, fixed SRM filters, and a learned high-pass path; the other views provide regional relations, global frequency summaries with directional Haar coefficients, and block-level DCT evidence.Source: §3.1 · p. 4

3.2 Global and local decisions

  • Global view gating forms a learned representation, while relation and DCT maps produce spatially indexed local logits retained until final pooling.Each global view is projected before gating; view dropout is used during training, and the sigmoid of the resulting score is the processed-image probability.Source: §3.2 · p. 5

3.3 Role-balanced low-FPR objective

  • The role-balanced objective weights attacked examples at 0.50 and each negative role at 0.25, then separately ranks positives against clean and watermarked negatives.It also includes paired-feature, branch, gate, and high-pass-prior terms; paired features use the available alignment level without assuming pixel correspondence for prompt-matched pairs.Source: §3.3 · p. 5

4 Experiments

The experiments evaluate attack-specific forensic detection across removal pipelines and watermark configurations using paired controls, native-resolution inputs, and task-adapted baselines. RemTraceNet outperforms the retrained baselines in the four aggregate settings, while generalization and ablation results qualify that performance.

4.1 Data and strict protocol; 4.2 Optimization and metrics

  • The study evaluates 23 pipelines across ten watermark configurations, with paired controls, complete training triplets, and five configurations withheld from fitting.Post-hoc pairs share a source image; generator-integrated pairs share a prompt. The operation label indicates processing, not necessarily successful watermark removal.Source: §4.1 · pp. 5–6
  • TPR@1%FPR is the primary metric, computed per attack, watermark, resolution, negative role, and seed using slice-specific empirical test-ROC thresholds.Each slice has 100 negatives, so one false positive corresponds to 1% empirical FPR; thresholds are descriptive, not a single validation-calibrated deployment threshold.Source: §4.2 · p. 6

4.3 Task-adapted steganalysis baselines

  • SRNet, ZhuNet, and SiaStegNet were retrained for the same labels and protocol, but the comparison retains RemTraceNet’s full objective and uses seed 42.This compares task-adapted systems, not loss-matched architecture ablations or multi-seed significance.Source: §4.3 · p. 6

4.4 Main results and generalization analysis

  • At n = 100, unseen-watermark TPR@1%FPR trails seen-watermark results by 0.43%–7.84% across the four resolution and negative-role settings.Performance at 512 is lower than at 256, so native-resolution evaluation does not establish resolution invariance.Source: §4.4 · p. 6
  • From n = 10 to n = 100, macro TPR@1%FPR rises by 16.10%–26.13%, while increasing n from 100 to 200 adds only 0.22%–4.31%.These data-efficiency results use a fixed 1,000-update budget, not matched per-example exposure.Source: §4.4 · p. 7
  • At 512, diffusion-regeneration AUROC is 75.69%/79.44% for built-in watermarks versus 98.06%/98.10% for post-hoc watermarks under clean/watermarked negatives.The subgroup comparison does not attribute the difference to generator integration because pairing regimes and group compositions differ.Source: §4.4 · p. 7

4.5 Comparison with retrained steganalysis systems

  • 10.80%–15.68%: RemTraceNet improves TPR@1%FPR over the strongest baseline, SiaStegNet, across the four overall settings.The seed-42 comparison uses models retrained from scratch on the same attack-specific forensic task.Source: §4.5 · p. 7, Table 3 · p. 8

4.6 Ablation study

  • On the eight-attack core suite, residual-only loses 18.58–20.47%; removing individual views or local scores also degrades results, and objective ablations lose 3.53–8.55%.Across all 23 attacks, removing branch auxiliary supervision loses 5.38–7.68%; clean-negative and global-DCT ablations lose 0.37–8.53% and 5.43–9.73% at seed 42.Source: §4.6 · pp. 8–9, Figure 4 · p. 9

5 Discussion and Limitations

Attack forensics can supplement payload-based verification by assessing whether an image contains traces consistent with a candidate removal pipeline. RemTraceNet’s current protocol omits systematic benign post-processing controls, limiting what its experiments establish about benign operations.

5 Discussion and Limitations

  • Attack-vs-Clean tests separation from paired clean controls, while Attack-vs-Watermarked tests additional processing beyond watermark presence.In copyright disputes, this can supplement direct watermark verification with evidence about processing history.Source: §5 · p. 9
  • A specialist’s output can be interpreted alongside original files, keys, signatures, and other investigative evidence, but cannot establish ownership, infringement, or attacker intent.It assesses traces consistent with a candidate removal process when independent information points to a particular tool or algorithm.Source: §5 · p. 9
  • Because benign operations such as transmission compression and platform re-encoding are not systematically included, the experiments do not test discrimination from all benign post-processing.RemTraceNet also cannot recover a damaged payload or infer key, owner identity, or signature information.Source: §5 · p. 9
  • Future work will investigate whether attack-type and affected-region estimates can guide restoration and watermark decoding, potentially preserving identifiable ownership information after an attack.The proposed direction combines attack detection with payload recovery when direct verification fails.Source: §5 · p. 9

Related papers

Loading 2609.31694v1…