PaperlayerView exact revision on arXiv

Source-linked AI summary

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Saibo Ye, Huajie Chen, Xin Guo, Le Yang, Chi Liu, Xiangyu Hu, Jingjing Guo, Tianqing Zhu

arXiv:2610.03166v1cs.CRcs.AI

TL;DR

Two-sided watermark detection can still identify inverted marks, while continuing to push bits away from the key may waste image quality. LiBRA uses bounded latent optimization and a bidirectional mean-confidence target; across four systems, it reports two-sided detection rates of 0 to 0.05 versus detection on every inversion-baseline image.

  • Problem

    Watermark removal must evade two-sided detection because pushing decoded bits away from the key can yield an inverted but still detectable watermark.

    Source: §I · p. 1

  • Method

    LiBRA uses bounded latent optimization with a symmetric loss that moves mean confidence toward a near-chance target from either direction while fidelity constraints shape the changes.

    Source: §I · p. 2, 2) The Adversary’s Goal · p. 4

  • Results

    Across four watermarking systems, LiBRA’s two-sided detection rates are 0 to 0.05, while the inversion baseline is detected on every image; its SSIM is higher and LPIPS lower than the baseline.

    Source: B. Main Results · p. 8

  • Takeaways & Limitations

    Across four released watermarking systems, experiments report improved evasion and image quality over the inversion baseline, but reaching the soft target does not guarantee removal.

    Source: §VII · p. 15

    The attack assumes detector gradients and access to the key or an estimate, and evaluation covers four released checkpoints rather than broad training-run sweeps.

    Source: D. Limitations and Threats to Validity · p. 14

Abstract

from arXiv · show

Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.

I. INTRODUCTION

Watermark removal must evade a two-sided detector without sacrificing image fidelity: pushing decoded bits toward inversion can leave a watermark detectable, while further changes may damage the image. LiBRA uses bounded latent optimization and a symmetric mean-confidence objective, with fidelity constraints shaping how it approaches a near-chance target.

I. INTRODUCTION

  • Two-sided detection can flag both correct and nearly inverted watermarks, so low bit accuracy alone does not establish removal.Confidence-based optimization can also disagree with the discrete bit matches used for image-level detection.Source: §I · pp. 1–2
  • LiBRA optimizes a bounded perturbation in a clean public autoencoder’s latent space, using decoder access and key knowledge or an estimate.Latent and image-level fidelity penalties constrain changes; an optional frequency-guided mask restricts perturbations to image-content-selected regions.Source: §I · p. 2
  • A symmetric loss moves mean per-bit confidence toward a near-chance target from above or below, counteracting excessive inversion while leaving individual bit configurations unspecified.Joint fidelity terms let image preservation influence how the target is approached; LiBRA uses one optimization procedure without an outer perturbation-budget search.Source: §I · p. 2
  • The paper analyzes why confidence-minimizing objectives and per-bit thresholds can admit fully inverted watermarks, distinguishing soft-confidence optimization from hard-bit detection.It evaluates four watermarking systems against WEvade-W-II and examines ablations, surrogate gaps, and adaptive evaluation under the stated threat model.Source: §I · p. 2

A. Notation

  • The notation distinguishes key-aligned per-bit margins and confidences from hard bit accuracy, which measures the fraction of decoded bits matching the key.The mean confidence is the average of per-bit confidences.Source: A. Notation · p. 2

B. Latent Autoencoding

  • A variational autoencoder encodes an image into a lower-dimensional representation and decodes that representation back into an image.For C = 4 and f = 8, a 512×512 RGB image maps to a 4 × 64 × 64 latent representation, reducing optimization variables by a factor of 48; reconstruction is lossy, so small latent changes do not guarantee small perceptual changes.Source: B. Latent Autoencoding · p. 2

C. Discrete Wavelet Decomposition

The paper situates LiBRA among watermarking and removal approaches, and explains why image-level detection must account for both unusually high and unusually low key agreement. LiBRA’s closest comparison is WEvade-W-II, but it targets average confidence rather than prescribing each bit’s target.

C. Discrete Wavelet Decomposition

  • A one-level 2D wavelet transform separates coarse approximation structure from three finer directional detail subbands, whose magnitudes can inform a spatial prior but do not locate watermark energy.For an orthonormal transform with compatible boundary handling, summed squared errors across subbands equal image-domain squared error.Source: C. Discrete Wavelet Decomposition · pp. 2–3

D. Watermark Detection as a Hypothesis Test

  • A two-sided exact binomial test detects both unusually high and unusually low key agreement; its discrete acceptance set marks outcomes the test does not detect, not proof that watermark information is erased.Under the unwatermarked null, matching bits are modeled as independent with probability 1/2.Source: D. Watermark Detection as a Hypothesis… · p. 3

A. Watermarking for AI-Generated Content

  • Watermarking schemes differ in where marks enter the pipeline: endogenous approaches couple them to generation, while exogenous approaches embed them through post-hoc image processing.The evaluated systems span generation-integrated and post-hoc schemes and share a soft per-bit decoding interface.Source: A. Watermarking for AI-Generated Content · p. 3

B. Watermark Removal Attacks

  • WEvade-W-II addresses detectable inversion, while LiBRA symmetrically steers average decoding confidence toward a near-chance target and leaves bit configurations flexible for fidelity constraints.The matched latent-space comparison reports reduced runtime with similar evasion and image fidelity under the tested setting; LiBRA’s main setting assumes key knowledge or a reliable estimate, unlike WEvade-W-II.Source: B. Watermark Removal Attacks · p. 3

C. Adaptive Attacks and Evaluation Practice

Watermark removal must be assessed against the provider’s actual image-level detection rule, not inferred from low bit accuracy alone. The threat model pairs a two-sided exact test with an adversary seeking both detection evasion and perceptual fidelity.

C. Adaptive Attacks and Evaluation Practice

  • Robustness evaluation should use the provider’s actual detection rule, because low bit accuracy alone can leave an inverted watermark detectable.The paper also examines a detector using confidence dispersion and an adaptive attack that accounts for that statistic.Source: C. Adaptive Attacks and Evaluation… · pp. 3–4

A. Threat Model

  • The threat model frames watermark removal as modifying a provider-watermarked image to evade its detector while preserving image quality.The paper specifies the provider’s detection rule and adversary capabilities to define that setting.Source: A. Threat Model · p. 4

1) The Victim’s Goal:

  • The provider flags an image when the exact two-sided binomial test finds statistically significant deviation from chance in either direction, so near-complete inversion remains detectable.The test’s accepted matching counts form a finite set; the provider also requires image quality and keeps the key and watermarked decoder confidential.Source: 1) The Victim’s Goal · p. 4

2) The Adversary’s Goal:

  • The adversary seeks a perceptually close image that evades detection while preserving fidelity under SSIM and LPIPS, landing inside the test’s exact acceptance set rather than merely flipping the watermark.The stated attacker is a legitimate or semi-legitimate service user seeking to redistribute or misuse content without tracing.Source: 2) The Adversary’s Goal · p. 4

3) The Adversary’s Capabilities:

LiBRA assumes a white-box, key-aware but resource-limited adversary and performs bounded latent optimization with fidelity penalties. Its optional content-derived spatial prior restricts perturbation locations, though the paper notes limits to that heuristic.

3) The Adversary’s Capabilities:

  • The adversary can query and back-propagate through the detector, use a public clean VAE, and access or estimate the key, but cannot modify the detector or access provider watermarking components.Compact latent-space optimization is motivated by limited compute and memory; the attacker also cannot observe the decision threshold directly.Source: 3) The Adversary’s Capabilities · p. 4

B. Overview

  • LiBRA combines bounded latent optimization and a symmetric mean-confidence objective with latent and image-level fidelity penalties and an optional spatial prior.Main objective comparisons use a common latent platform; separate experiments examine optimization space, prior, key knowledge, and other components.Source: B. Overview · p. 5

1) Bounded latent perturbation:

  • The attack encodes the watermarked image with a clean public autoencoder and optimizes a perturbation while enforcing latent bounds through tanh reparameterization.The cited passage describes the bounded representation and reparameterization, not a separate projection step.Source: 1) Bounded latent perturbation · p. 5

2) Fidelity:

  • Fidelity is constrained in both latent and decoded-image space; the implementation’s image term is pixel-domain squared error, equivalent to summed subband errors for the stated orthonormal transform.Decoded images are clipped to [−1, 1] before watermark decoding and fidelity evaluation, and the final output uses the same clipping.Source: 2) Fidelity · p. 5

D. Heuristic Spatial Prior

  • The optional mask selects textured or structured image regions as a heuristic visibility prior, not as a localization of watermark energy.Its low-frequency branch can select an entire flat bright image, and masking reduces free coordinates but not per-iteration decoding and detector costs.Source: D. Heuristic Spatial Prior · p. 5

E. Watermark Objective

The section contrasts one-sided confidence minimization, which can drive decoding into detectable inversion, with a symmetric objective that corrects overshoot. It also explains why per-bit alternatives fail and how the attack uses soft confidences and an optional spatial prior.

E. Watermark Objective

  • The attack scores soft confidences even though the detector tests piecewise-constant hard bit accuracy, so the two measures can disagree.The objective trajectories therefore need to be assessed against image-level detection outcomes.Source: E. Watermark Objective · p. 5

1) Baseline:

  • Minimizing mean confidence without a target naturally drives decoding toward full inversion, which remains detectable under a two-sided test.The detector evaluates hard bit accuracy, while the objectives operate on soft per-bit confidences.Source: 1) Baseline · p. 5, E. Watermark Objective · p. 5

2) Two-sided objective:

  • The symmetric objective pushes mean confidence toward a near-chance target from either direction, correcting overshoot while leaving individual bits flexible for fidelity preservation.It is optimized jointly with fidelity terms so image preservation can influence how the target is approached.Source: 2) Two-sided objective · p. 5

3) Per-bit alternatives:

  • For τ ≤ 0.5, per-bit threshold alternatives still permit fully inverted decodings and provide no incentive to restore bits after they fall below threshold.The alternatives slow descent but remain ablations rather than components of LiBRA.Source: 3) Per-bit alternatives · pp. 5–6

E. Watermark Objective

  • The overview shows an optional DWT-energy spatial prior, latent perturbation and decoding, then detector queries; the prior describes image content rather than watermark location.Fidelity penalties constrain latent and reconstructed-image changes.Source: Figure 2 · p. 6, Figure 3 · p. 6

F. What the Objectives Control

The objectives differ in what they reward: the baseline keeps pushing confidences downward, per-bit hinges can stop at fully inverted decodings, and LiBRA reverses direction after overshooting its mean-confidence target. But mean confidence does not determine hard-bit accuracy or guarantee detector acceptance.

F. What the Objectives Control

  • A positive baseline-loss derivative at every finite margin drives its infimum toward all margins approaching negative infinity and hard bit accuracy of zero.The analysis describes what the objective rewards, not how the optimizer converges.Source: F. What the Objectives Control · p. 6
  • Per-bit hinge minimizers remain fully inverted even when the adaptive threshold changes where the hinge stops.Because hard accuracy takes discrete values, the controller also need not reach its target exactly.Source: F. What the Objectives Control · p. 7
  • LiBRA’s two-sided loss reverses its gradient sign when mean confidence overshoots the target, unlike a hinge that stops pushing.The loss is zero at the target mean, but this does not establish that an image lies in the detector’s acceptance set.Source: F. What the Objectives Control · p. 7
  • Mean confidence can hide high hard-bit accuracy: 80 bits at 0.55 and 20 at 0.05 yield mean confidence 0.45 but accuracy 0.80.The shared latent couples margins, which may make such cases rare on victim detectors, but that is not guaranteed by the objective.Source: F. What the Objectives Control · pp. 6–7

G. Overall Objective and Algorithm

  • At 512 × 512, latent optimization reduces free variables by 48×, but not per-iteration cost, which is dominated by the decoder.The overall procedure uses Adam; each iteration requires one decoder and one detector forward–backward pass.Source: G. Overall Objective and Algorithm · p. 7

V. EXPERIMENTS

The experiments cover four watermarking systems with system-specific image sets, use a shared attack configuration unless stated otherwise, and assess watermark detection alongside image fidelity.

1) Watermarking systems and datasets:

  • Four systems are evaluated with 5,000 watermarked images each, totaling 20,000 per configuration across the main experiment.Stable Signature and HiDDeN/MBRS use MS-COCO images; YU1 uses fingerprinted CelebA test images.Source: 1) Watermarking systems and datasets · p. 7

2) Implementation:

  • Per-image runtime is 12.4 s at 512×512 and 1.3 s at 128 × 128 using the public Stable Diffusion 2.1-base VAE without training.Experiments used eight NVIDIA A100 GPUs, processing each image on one GPU.Source: 2) Implementation · p. 7

3) Attack configuration:

  • Unless stated otherwise, variants share optimizer, spatial restriction, and fidelity terms; the target is 0.45 with a fixed seed and no per-image tuning.Each configuration includes all 5,000 images for its system.Source: 3) Attack configuration · p. 7

4) Detectors and metrics:

  • Detection is measured with a naive one-sided rule and an exact two-sided binomial test at α = 0.01, alongside hard bit accuracy and PSNR, SSIM, and LPIPS.Lower detection rates indicate better evasion; higher PSNR and SSIM and lower LPIPS indicate better fidelity.Source: 4) Detectors and metrics · pp. 7–8

B. Main Results

LiBRA reduces two-sided watermark detection across the evaluated systems while preserving image fidelity, but mean-confidence targets do not guarantee that every image passes the hard-bit test. Comparisons with existing attacks show similar evasion at higher fidelity and lower runtime in the tested settings.

B. Main Results

  • Two-sided detection falls to 0–0.05 with LiBRA across four watermarking systems; YU1, Stable Signature, HiDDeN, and MBRS also show higher SSIM and lower LPIPS than inversion baselines.On YU1, LiBRA has mean Bit ACC 0.433 with no observed two-sided detections; on Stable Signature, its detection rate is 0.03, down from 1.00.Source: B. Main Results · p. 8

C. Distribution of the Achieved Operating Point

  • Across N = 48 images, Figure 5’s accepted-count region is k = 15:33, so evaluation sums image-level mass outside that region rather than relying on mean accuracy.Mean bit accuracy alone does not determine the fraction of images detected.Source: C. Distribution of the Achieved… · p. 8, Figure 5 · p. 9

D. The Surrogate Gap

  • Hard-test evasion ranges from 0.95 to 1.00, while 0.00–0.03 of images on three systems meet the soft target yet remain detectable.Figure 6 contrasts mean confidence with hard bit accuracy; soft-target attainment and successful removal are not identical.Source: D. The Surrogate Gap · pp. 8–9, Figure 6 · p. 9

E. Comparison with Existing Removal Attacks

  • On 5,000 Stable Signature images, LiBRA’s two-sided detection rate is 0.03 versus 0.02 for WEvade-W-II, with SSIM 0.970 versus 0.951 and LPIPS 0.046 versus 0.061.The matched comparison also reports runtime decreasing from 24.8 to 12.4 s per image.Source: E. Comparison with Existing Removal… · p. 9

F. Head-to-Head with WEvade-W-II

  • Under a common latent-space and random-reference setting, LiBRA takes 12.5 s per image versus WEvade-W-II’s 118.6 s, with comparable evasion and slightly better fidelity.The reported speedup is approximately 9.5×; detection rates are 0.04 and 0.03, respectively.Source: F. Head-to-Head with WEvade-W-II · p. 9

G. Is Each Component Necessary?

A spatial prior is not necessary for evasion, but the frequency-guided mask improves fidelity; neither early stopping nor added sign-consistency pressure reproduces LiBRA’s results. Blind spectral disruption adds distortion and computation without improving evasion, while the target-confidence sweep exposes a fidelity–detection trade-off.

G. Is Each Component Necessary?

  • The frequency prior matches full-latent LiBRA’s two-sided detection rate of 0.03 while raising SSIM from 0.962 to 0.970 and lowering LPIPS from 0.053 to 0.046.Among the four mask configurations, the frequency-guided mask has the highest SSIM and lowest LPIPS.Source: G. Is Each Component Necessary? · pp. 9–10
  • Early stopping leaves 11% of images detectable versus 3% for LiBRA, and adding Lbit does not help, slightly worsening fidelity and detection rate.The early-stopped baseline reaches Bit ACC 0.412; its SSIM is 0.963 versus 0.970 for LiBRA.Source: G. Is Each Component Necessary? · p. 10

1) Negative result: blind spectral destruction:

  • Adding the auxiliary spectral term leaves the two-sided detection rate at 0.03, while lowering SSIM from 0.970 to 0.958, raising LPIPS from 0.046 to 0.058, and increasing runtime from 12.4 to 13.6 s per image.The term disrupts Fourier amplitudes over high-frequency subbands and is not part of LiBRA.Source: 1) Negative result: blind spectral… · p. 10

H. Sensitivity to the Target Operating Point

  • Increasing the target mean confidence from 0.40 to 0.50 lowers detection from 0.05 to 0.02, raises SSIM from 0.967 to 0.973, and lowers LPIPS from 0.049 to 0.043.The default target 0.45 gives the lowest MAE; 0.50 gives the highest SSIM and lowest LPIPS in the sweep.Source: H. Sensitivity to the Target Operating… · pp. 10–11

I. Point Target versus Band Penalty

The point-target objective is retained as a conservative operating point because band penalties trade a small fidelity gain for weaker evasion. The results also show that detector significance and key-estimation error affect the tested detection outcomes, with low detection maintained under the tested key errors.

I. Point Target versus Band Penalty

  • With h = 0.10, the band penalty improves SSIM from 0.970 to 0.972 and LPIPS from 0.046 to 0.044, but raises clean detection from 0.03 to 0.05; wider bands raise it to 0.12 and 0.26.The authors retain the point target as the more conservative operating point; after JPEG, rates are 0.05 and 0.06 for the point and h = 0.10 band objectives.Source: §I · p. 11, Table X · p. 12

J. Sensitivity to the Defender’s Significance Level

  • At α = 0.01 and 0.001, LiBRA has zero observed detections; increasing α to 0.05 and 0.1 raises detection to 0.06 and 0.21, respectively.Increasing α narrows the acceptance set and raises the false-positive bound under the stated null model.Source: J. Sensitivity to the Defender’s… · p. 12, Table XI · p. 12

K. Relaxing Knowledge of the Key

  • As key error rises from 0 to 20%, LiBRA’s two-sided detection rate increases from 0.03 to 0.05, while SSIM and LPIPS change from 0.970/0.046 to 0.968/0.048.Across tested errors up to 20%, detection remains low and image fidelity similar.Source: K. Relaxing Knowledge of the Key · p. 12, Table XII · p. 12

L. Effect of the Iteration Budget

Across tested iteration budgets, LiBRA maintains stable evasion and fidelity, and its evasion remains similar across three resolutions. Post-processing preserves low detection in the tested cases, while a dispersion-aware detector reveals additional detections that an adaptive variance-matching term reduces.

L. Effect of the Iteration Budget

  • From T = 25 to T = 100, LiBRA’s detection rate stays at 0.03, SSIM remains between 0.970 and 0.971, and mean Bit ACC changes from 0.466 to 0.455.Over the same budget increase, the baseline’s SSIM falls from 0.968 to 0.921 and its two-sided detection rate reaches 1.00 at T = 25.Source: L. Effect of the Iteration Budget · p. 12

M. Effect of Image Resolution

  • Across tested resolutions, mean Bit ACC stays between 0.457 and 0.461 and two-sided detection between 0.03 and 0.04; runtime rises from 3.6 to 25.9 s per image from 256 × 256 to 768 × 768.Peak memory increases from 5.1 to 29.6 GB over that resolution increase.Source: M. Effect of Image Resolution · p. 12, Table XIV · p. 13

N. Robustness of the Attacked Image

  • After JPEG, resizing, Gaussian noise, and center cropping, two-sided detection remains between 0.03 and 0.05, but cropping lowers SSIM to 0.611; the dispersion-aware detector’s combined rate is 0.64.The combined rate is 1.00 for the no-attack, baseline, and B+ settings.Source: N. Robustness of the Attacked Image · p. 13, Table XV · p. 13

O. An Adaptive Round Against the Dispersion-Aware Detector

  • Adding the variance-matching penalty reduces combined detection from 0.64 to 0.09 and dispersion-only detection from 0.62 to 0.06, while SSIM changes from 0.970 to 0.966.The original two-sided rate changes from 0.03 to 0.04, and LPIPS from 0.046 to 0.050.Source: O. An Adaptive Round Against the… · p. 13, Table XVI · p. 13

P. Qualitative Results

LiBRA's conclusion reports improved watermark evasion and image quality over an inversion baseline across four released systems, while emphasizing that a soft-confidence target does not ensure removal. The section also stresses decision-rule-aware evaluation and bounds the findings to stated assumptions and evaluation scope.

P. Qualitative Results

  • Figure 8 compares watermarked inputs with baseline, B+, and LiBRA outputs, using residual maps beneath attacked images to show differences from inputs.The figure presents three Stable Signature examples; the passage does not state which output is visually superior.Source: P. Qualitative Results · p. 13, Figure 8 · p. 14

A. Evaluation Must Match the Decision Rule

  • Low bit accuracy can conceal an inverted watermark that remains detectable; evaluation should report the detection rule, null model, significance level, and image-level detection rate.The naive one-sided comparison is not calibrated against the two-sided test at matched false-positive rates.Source: A. Evaluation Must Match the Decision… · p. 13

B. Implications for Watermark Design

  • Controlling mean confidence leaves dispersion, joint bit patterns, and agreement across disjoint key subsets unconstrained, so these may still reveal watermark information.The text identifies redundant keys and joint-pattern tests as future directions and notes that multiple rejection rules need combined false-positive-rate calibration.Source: B. Implications for Watermark Design · p. 14

C. Bidirectional Control and Detection Outcomes

  • LiBRA reverses its gradient direction when mean confidence crosses the target, but reaching that target does not guarantee acceptance by the hard detection test.The section says final detection outcomes should be evaluated alongside image fidelity.Source: C. Bidirectional Control and Detection… · p. 14

D. Limitations and Threats to Validity

  • The attack characterizes a white-box setting requiring detector gradients and key access or an estimate; relaxing key knowledge does not remove the gradient assumption.The target also depends on an assumed significance level and may need adjustment for different null distributions, statistics, or thresholds.Source: D. Limitations and Threats to Validity · p. 14
  • Evaluation covers four released checkpoints and associated data, not broad training-run sweeps or transfer to Tree-Ring and Gaussian Shading; the spatial prior uses one configuration.The reproduced baseline also retains a sign-consistency term absent from LiBRA, and reaching a mean-confidence target neither guarantees hard-count evasion nor minimizes distortion.Source: D. Limitations and Threats to Validity · p. 14

E. Ethical Considerations

  • The study is scoped to publicly released research implementations and controlled evaluation images under explicit capability assumptions, not commercial services, private APIs, or deployed infrastructure.The defensive analysis includes an adaptive failure of a stronger detector and does not claim dispersion alone resolves the vulnerability.Source: E. Ethical Considerations · pp. 14–15

VII. CONCLUSION

  • Across four released watermarking systems, LiBRA improves evasion and image quality over the inversion baseline; Stable Signature results remain stable from 25 to 100 iterations.The conclusion also states that reaching the soft target does not guarantee successful removal.Source: §VII · p. 15
Loading 2610.03166v1…