The paper introduces the first systematic robustness benchmark for local invisible image watermarking, evaluating five methods across 55 image transformations that include signal distortions, coordinate misalignments, indirect local edits, and direct watermark edits. Results show that all methods are vulnerable to some transformation, with MaskWM achieving the best payload recovery and localization but at the cost of image quality. The study highlights that robustness varies strongly with transformation type, especially noting that geometric misalignment and generative local edits can completely disrupt payload recovery.
By Kai Yao, Bence Szil\'agyi, Sebesty\'en Kamp, M\'at\'e Po\'or, M\'at\'e Szilveszter, Matyas K. Zsoldos, Marc Juarez
arXiv:2608. 10166v1 Announce Type: cross Abstract: Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored.
By Jie Cao, Qi Li, Zelin Zhang, Xiaodong Wu, Lingshuang Liu, Xiangman Li, Jianbing Ni
arXiv:2609.40031v1 Announce Type: cross
Abstract: Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated co...
By Khaled Abud, Aleksey Yakushev, Aleksandr Akimenkov, Irina Serzhenko, Kirill Aistov, Egor Kovalev, Dmitry Obydenkov, Sergey Lavrushkin, Anastasia Antsiferova, Dmitriy Vatolin, Yury Markin, Kirill Lukianov
Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated content and ensuring traceable sources to prevent man...
FeatMark is a watermarking framework that protects images from text‑to‑image diffusion model mimicry attacks by embedding small, scene‑consistent micro‑features instead of pixel‑level perturbations. It constructs domain‑specific feature banks, selects executable features, and injects them via mask‑guided concept editing to create highly localized, natural edits. Experiments on VGGFace2, CelebA‑HQ, and WikiArt show FeatMark remains robust against ten strong watermark removal attacks and several adaptive attacks, with minimal impact on perceptual quality and extending to video mimicry scenarios.
By Haoyang Li, Ruoxi Sun, Qingqing Ye, Benjamin Zi Hao Zhao, Yaxin Xiao, Jason Xue, Haibo Hu
Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual....
FoCLIP is a framework that creates adversarial examples to manipulate CLIP-based image quality metrics by reducing the alignment between image and text features. It uses stochastic gradient descent to combine feature alignment, score distribution balancing, and pixel‑guard regularization, enabling high CLIPscore predictions while maintaining visual fidelity. Experiments on artistic prompts and ImageNet show significant CLIPscore gains, and the authors also propose a color‑channel sensitivity detection method that achieves 91% accuracy.
By Yulin Chen, Zeyuan Wang, Tianyuan Yu, Yingmei Wei, Liang Bai
COVER is a new video watermarking method that targets codec compression as its primary design goal. It embeds the watermark payload in the latent space of a frozen generative video autoencoder and recovers it by re‑encoding the received video into the same latent space. Using a differentiable codec surrogate bank, COVER achieves high bit accuracy across multiple codecs while keeping marked videos visually close to the originals.
By Yuxin Cao, Hao Yang, Ziqi Ding, Jie Hao, Wei Song
Existing watermark attacks typically rely on predefined signal-processing operations or locally constrained restoration networks, making it difficult to capture the long-range dependencies of globally distributed watermark signals and resulting in an unfavorable trade-off between removal effectiveness and visual fidelity. In this paper, we propose SPFM-Net, a semantic-prior-guided and frequency-constrained Mamba framework for invisible watermark attack.
arXiv:2606. 16799v1 Announce Type: cross Abstract: Existing vision-language model (VLM)-based AI-generated image quality assessment (AIGIQA) methods suffer from a fundamental semantic-distortion dimensional conflict: monolithic representations optimized for semantic discrimination inherently entangle compositional understanding with low-level perceptual sensitivity, rendering them blind to fine-grained quality degradations.
By Zijie Meng
The paper introduces VeriFi, a watermarking framework that protects face images from AI‑generated manipulation. It embeds a compact semantic latent watermark to preserve content, localizes pixel‑level edits without explicit payloads, and simulates realistic deepfake attacks to improve robustness. Experiments on CelebA‑HQ and FFHQ show that VeriFi outperforms existing methods in robustness, localization accuracy, and recovery quality.
By Peipeng Yu, Jinfeng Xie, Chengfu Ou, Xiaoyu Zhou, Jianwei Fei, Yunshu Dai, Zhihua Xia, Chip Hong Chang
arXiv:2603. 17531v2 Announce Type: replace-cross Abstract: Recent advancements in diffusion-based image editing pose a significant threat to the authenticity of digital visual content.
By Pengzhen Chen, Yanwei Liu, Xiaoyan Gu, Xiaojun Chen, Wu Liu, Weiping Wang