Source-linked AI summary
Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking
Kirill Aistov, Khaled Abud, Irina Serzhenko, Egor Kovalev, Aleksey Yakushev, Aleksandr Akimenkov, Dmitry Obydenkov, Yury Markin, Sergey Lavrushkin, Dmitriy Vatolin, Anastasia Antsiferova
TL;DR
Adaptive removal remains an open security question, particularly for frequency-based watermarking. This paper introduces Latent Frequency Masking, which replaces selected Fourier coefficients in a VAE latent; experiments find several schemes vulnerable, while Gaussian Shading is harder to remove with partial masking.
Problem
Adaptive removal remains an open security question, and frequency-based watermarking schemes have received comparatively little scrutiny for vulnerability.
Source: §I · p. 1Method
Latent Frequency Masking suppresses watermark evidence by replacing selected coefficients in a diffusion model’s VAE latent, using Gaussian sampling or diffusion-regeneration replacements.
Source: §I · p. 2Results
Tree-Ring, RingID, Stable Signature, MaXsive, and METR are vulnerable under suitable settings, while Gaussian Shading is significantly harder to remove with partial masking.
Source: §VI · pp. 8–9Takeaways & Limitations
Distributed embedding can improve resistance to this class of attack, and latent-frequency manipulation exposes weaknesses not captured by conventional robustness tests.
Source: §VI · p. 9, §VII · p. 9The attack assumes access to a compatible latent diffusion autoencoder, which may not hold for proprietary systems.
Source: §VI · p. 9
Abstract
from arXiv · showhide
Invisible watermarking has become a central tool for tracing AI-generated images, but its robustness against adaptive removal attacks remains an open security question. We introduce Latent Frequency Masking, an attack that erases watermark evidence by replacing selected Fourier coefficients in the latent representation of a watermarked image. The replacement can be sampled from Gaussian noise for efficiency or derived from diffusion regeneration for improved image preservation. We provide a theoretical distortion bound relating the change between the reconstructed adversarial image and the masked latent-frequency perturbation. We evaluate the proposed attack against six diffusion watermarking methods on images generated from DiffusionDB and MS-COCO prompts. Latent Frequency Masking removes or substantially weakens several watermarks while preserving perceptual quality and achieving favorable runtime compared with existing attacks. These results identify latent-frequency manipulation as a practical attack surface and highlight the need to include such attacks in robustness evaluations of generative image watermarking.
I. INTRODUCTION
The introduction frames watermarking as a way to track AI-generated images, while noting that frequency-based watermarking has received comparatively little scrutiny against removal attacks. It introduces Latent Frequency Masking as a latent-frequency attack and outlines its theoretical and empirical contributions.
I. INTRODUCTION
- Frequency-based watermarking encodes information in an image’s spectral representation, a class the introduction says has received comparatively little scrutiny for vulnerability.The paper identifies the Fourier-transformed VAE latent as an attack surface.Source: §I · pp. 1–2
- LFM replaces selected Fourier coefficients in a diffusion model’s VAE latent, with Gaussian sampling or image-adaptive diffusion regeneration as replacement strategies.The paper also derives a distortion bound relating pixel-space change to VAE reconstruction error and the masked latent-frequency perturbation.Source: §I · p. 2
- Experiments against six diffusion watermarking schemes on DiffusionDB and MS-COCO show that LFM weakens or removes most while preserving perceptual quality and achieving favorable runtime.The paper also analyzes why distributed embedding, as in Gaussian Shading, resists the attack.Source: §I · p. 2
A. Invisible Watermarking Methods
- Post-generation watermarking includes frequency-domain methods and neural encoder–noise layer–decoder methods, while in-generation approaches modify latent representations before or during diffusion.Examples include Tree-Ring, MaXsive, Gaussian Shading, and Stable Signature, which use different embedding strategies.Source: A. Invisible Watermarking Methods · p. 2
- In-generation watermarking is motivated by minimal perceptual degradation and stronger robustness to conventional distortions, leaving its security against adaptive watermark-aware removal an open question.The passage gives Gaussian Shading and Tree-Ring as examples of these properties.Source: A. Invisible Watermarking Methods · p. 2
B. Attacks on Invisible Watermarks
Prior watermark-removal work spans analytical, regeneration-based, adaptive, optimization-based, model-level, and forgery-oriented attacks. The section argues that conventional distortion tests alone do not establish security against adaptive removal or forgery.
B. Attacks on Invisible Watermarks
- Robustness to JPEG compression, blur, noise, cropping, and geometric transforms does not imply security against adaptive removal or forgery.The section treats conventional perturbations as necessary sanity checks, not a sufficient robustness evaluation.Source: B. Attacks on Invisible Watermarks · p. 2
- Analytical attacks can estimate content-agnostic watermark patterns from multiple watermarked images, while regeneration attacks use a generative prior to remove signals not preserved during reconstruction.The section also discusses diffusion purification, model substitution, and saliency-aware diffusion reconstruction.Source: B. Attacks on Invisible Watermarks · p. 2
- Optimization-based removal can outperform fixed perturbation baselines, and UnMarker presents a detector-feedback-free universal spectral attack relevant to frequency-based watermarks.Decoder-rooted watermarks such as Stable Signature can also be neutralized by fine-tuning the generator.Source: B. Attacks on Invisible Watermarks · pp. 2–3
- Prior work also demonstrates black-box forgery and removal, motivating robustness assessment against steganalytic, regenerative, adaptive, and forgery-oriented attacks.The section names WMForger among the discussed methods.Source: B. Attacks on Invisible Watermarks · p. 3
A. Problem Statement
The paper defines an adversary’s objective and access in a watermark-removal setting, then describes LFM’s Fourier-domain replacement pipeline. It compares Gaussian and diffusion-regeneration sources for the replacement frequencies.
A. Problem Statement
- The adversary seeks an attacked image that falls below the verifier’s watermark threshold while retaining perceptual quality relative to the watermarked image.The assumed access includes the watermarked image, a compatible public latent diffusion model, and verifier queries, but not the clean image, key, prompt, or verifier internals.Source: A. Problem Statement · p. 3
B. Algorithm description
- LFM encodes the watermarked image with a VAE, transforms its latent with FFT, masks selected frequencies using replacement values, applies inverse FFT, and decodes an image.Figure 2 is identified as an overview of the attack.Source: B. Algorithm description · p. 3
1) Masking vector generation:
- Gaussian replacement samples standard-normal noise and transforms it to a spectrum, motivated by keeping the replacement latent in-distribution for the decoder.Diffusion regeneration instead supplies an image-adaptive replacement spectrum; using it only in masked regions preserves unmasked coefficients from the original latent.Source: 1) Masking vector generation · p. 3
- Gaussian replacement is simpler and more efficient but discards latent information, whereas regeneration retains more image semantics at the cost of greater algorithmic complexity.The paper notes that regeneration may introduce visible changes or alter fine details.Source: 1) Masking vector generation · p. 3
2) Mask selection:
LFM selects a centered Fourier-space mask over chosen latent channels and searches a small set of mask configurations. Its algorithm partially replaces masked coefficients while leaving coefficients outside the mask unchanged.
2) Mask selection:
- The mask-selection rationale places candidate watermark regions in Fourier space and aims to discard watermark information while leaving much of the latent intact for image quality.The rationale for low-frequency locations is attributed to a hypothesis in prior work.Source: 2) Mask selection · p. 3
- The search tests 20 configurations: radii 10 or 15 paired with every single latent channel and every pair of channels, selecting by TPR@1%FPR.The mask is defined by its radius and selected channels.Source: 2) Mask selection · p. 4
3) Algorithm:
- The replacement-strength parameter β ranges from retaining original masked coefficients at β = 1 to fully replacing them at β = 0; coefficients outside the mask remain unchanged.The algorithm encodes the image, transforms channel-wise with Fourier transforms, partially masks the latent, applies the inverse transform, and decodes it; Gaussian replacement needs no gradient computation or optimization.Source: 3) Algorithm · p. 4
C. Theoretical analysis
The analysis bounds the image distortion caused by latent frequency masking and explains how the mask and replacement choice affect that distortion. The bound assumes a Lipschitz-continuous decoder, an assumption described as natural for the Stable Diffusion decoder used in the experiments.
C. Theoretical analysis
- Pixel-space distortion is bounded by the VAE reconstruction error plus the decoder’s Lipschitz constant times the distance between masked latent-frequency coefficients.The theorem relates the attacked image to the watermarked image through reconstruction error and the latent-frequency differences in the masked region.Source: C. Theoretical analysis · pp. 4–5
- A smaller masked frequency region introduces less distortion, motivating selection of the smallest radius that erases watermark information.The mask radius therefore trades off distortion against watermark removal.Source: C. Theoretical analysis · p. 5
- The replacement vector’s proximity to the original latent frequencies affects distortion; diffusion regeneration is motivated by its similar regenerated image and latents.Closer replacement frequencies yield lower distortion, according to the analysis.Source: C. Theoretical analysis · p. 5
- The bound assumes a Lipschitz-continuous decoder, described as natural for the Stable Diffusion decoder used in the experiments.The Lipschitz constant depends on decoder weights and architecture, and the worst-case bound may be loose for a deep decoder.Source: C. Theoretical analysis · p. 5
IV. EXPERIMENTS
The evaluation uses prompts from DiffusionDB and MS-COCO, with a separate DiffusionDB set for parameter search.
IV. EXPERIMENTS
- The main evaluation selects 1,000 prompts each from DiffusionDB and MS-COCO.Watermarked images are generated using each method and its underlying diffusion model; all methods use Stable Diffusion v2.1 as the base model.Source: §IV · p. 6
- Watermarked images for evaluation are generated from the prompts using the respective watermarking methods and their underlying diffusion models.All evaluated methods use Stable Diffusion v2.1 as their base model.Source: §IV · p. 6
- LFM parameter search uses 100 DiffusionDB-generated watermarked images separate from the main evaluation set.Source: §IV · p. 6
A. Compared methods
The experiments compare LFM with six diffusion watermarking methods, common image distortions, and existing attacks.
A. Compared methods
- LFM is evaluated against Stable Signature, Tree-Ring, RingID, Gaussian Shading, Maxsive, and METR.Source: A. Compared methods · p. 6
- Comparisons include Gaussian blur and noise, JPEG compression, rotation, random cropout, and eight existing attack methods.The listed attacks are Adversarial Embedding, Diffusion Regeneration, Diffusion Rinsing, DIP, SADRE, WMForger, WMRemovalAttack, and Unmarker.Source: A. Compared methods · p. 6
- FLUX is used for Diffusion Regeneration, Diffusion Rinsing, and LFM’s diffusion-replacement strategy.Source: A. Compared methods · p. 6
B. Evaluation metrics
Evaluation measures both watermark-removal reliability and resulting image quality, using metrics suited to detection, payload recovery, and perceptual fidelity.
B. Evaluation metrics
- Watermark-erasing attacks are evaluated for both removal reliability and image quality.Source: B. Evaluation metrics · p. 6
- Zero-bit watermark detection is summarized by TPR@1%FPR, reflecting a strict false-alarm operating point.For multi-bit methods, payload similarity is measured and agreement between embedded and decoded messages can also serve as a detection score for shared operating-point comparisons.Source: B. Evaluation metrics · p. 6
- Image quality is assessed with PSNR, SSIM, and LPIPS when a reference image is available, and CLIP-IQA when it is not.Source: B. Evaluation metrics · p. 6
V. RESULTS
Across the tested methods, LFM often achieves strong watermark removal while retaining image quality, and its average performance–quality trade-off compares favorably with existing attacks. Gaussian Shading is the main exception, while diffusion-based replacement improves quality but can fail on MaxSive.
A. Attack Performance
- LFM achieves TPR@1%FPR close to 0 for Stable Signature, Tree-Ring, RingID, Maxsive, and METR at selected β values.It is the only tested method reported to reliably erase Tree-Ring within reasonable quality constraints.Source: A. Attack Performance · p. 6
- Diffusion replacement improves image quality by several dB PSNR over Gaussian replacement, but fails to erase MaxSive.The authors suggest regenerated values reintroduce watermark information because MaxSive resists Diffusion Regeneration.Source: A. Attack Performance · p. 6
- For Gaussian Shading, almost all attacks fail to bypass the watermark; the few exceptions, Rotation and Unmarker, perform poorly in quality.Its watermark is embedded throughout the latent, making partial masking ineffective.Source: A. Attack Performance · p. 6
- On LPIPS, LFM outperforms all other attacks for Stable Signature, achieving almost perfect removal across quality levels.Diffusion replacement still improves quality over Gaussian replacement, though less than on PSNR.Source: A. Attack Performance · p. 6
- On DiffusionDB, Figure 3 plots watermark removal efficiency (TPR@1%FPR, lower is better) against PSNR (higher is better) across attacks; LFM variants sit on the Pareto front except Gaussian Shading.Source: Figure 3 · p. 7
- Averaged across tested watermarks and datasets, LFM variants show a strong overall performance–quality trade-off, with LFM Gaussian and Unmarker achieving the lowest TPR@1%FPR.LFM Diffusion has slightly worse TPR@1%FPR because of its poor MaxSive performance, but both LFM variants rank near the top on all four quality metrics.Source: Table I · p. 7, A. Attack Performance · p. 7
B. Attack Speed Comparison
Gaussian-replacement LFM is the fastest compared attack, while diffusion replacement offers a quality and performance advantage over Diffusion Regeneration. The visual comparison and ablation show that the full pipeline matters, though LFM can still disturb image color.
B. Attack Speed Comparison
- Gaussian-replacement LFM achieves the highest attack speed among compared algorithms with comparable or better attack performance.Diffusion-replacement LFM runs at a speed comparable to Diffusion Regeneration and performs slightly better in quality and performance; LFM parameter search is excluded from timing because selected parameters are reused per watermarking algorithm.Source: B. Attack Speed Comparison · p. 7, Figure 5 · p. 8
C. Visual Comparison
- LFM mostly avoids visible artifacts and detail changes seen with some attacks, but can still disturb image color.For the presented image, only LFM erases the watermark information.Source: C. Visual Comparison · pp. 7–8
D. Ablation Study
- Every ablation variant with one or more pipeline steps removed fails to erase Tree-Ring watermark information, even when some variants have higher PSNR.The compared steps are VAE encoding/decoding, FFT, and masking; the full algorithm uses all three.Source: D. Ablation Study · p. 8, Table II · p. 8
VI. DISCUSSION AND LIMITATIONS
Latent Frequency Masking weakens several diffusion watermark schemes, while distributed watermark information makes Gaussian Shading harder to remove with partial masking. The discussion identifies scope limits and defensive implications, and the conclusion reports a favorable trade-off among removal, image quality, and computational cost.
VI. DISCUSSION AND LIMITATIONS
- LFM replaces selected Fourier coefficients in the VAE latent and offers Gaussian or diffusion-regeneration replacement strategies.The Gaussian variant is particularly efficient; diffusion regeneration improves image quality in several settings, but its effectiveness depends on whether regeneration suppresses the target watermark.Source: §VI · p. 8
- Tree-Ring, RingID, Stable Signature, MaXsive, and METR are vulnerable to LFM, while Gaussian Shading is significantly harder to remove with partial masking because its watermark is distributed throughout the latent.The discussion links this resistance to distributed rather than spectrally localized watermark information.Source: §VI · pp. 8–9
- The attack assumes access to a compatible latent diffusion autoencoder, which may not hold for proprietary systems.Mask selection also searches a small parameter space and may be suboptimal under a very strict query budget; the theoretical distortion bound alone does not guarantee watermark removal.Source: §VI · p. 9
- The findings point to evaluating latent- and frequency-space attacks and avoiding watermark evidence concentrated in compact, predictable latent-frequency regions.Proposed directions include detectors that remain sensitive after partial latent replacement and training that includes LFM as an adversarial transformation.Source: §VI · p. 9
VII. CONCLUSION
- LFM achieves a favorable trade-off among watermark removal, perceptual quality, and computational cost across multiple watermarking schemes.The conclusion contrasts this with conventional robustness tests, which do not capture the weaknesses exposed by LFM.Source: §VII · p. 9