Technical Summary: Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy

Problem Statement

The rapid advancement of generative AI has necessitated the deployment of invisible watermarking schemes to assert provenance and protect intellectual property in synthetic media. While regulators (e.g., the EU AI Act) mandate these protections, their robustness is frequently challenged by sophisticated removal attacks. Existing literature has explored various removal strategies, including generative regeneration and adversarial perturbations. However, a critical gap remains in understanding the interaction between different watermarking schemes when superimposed. The authors posit that the fundamental optimization problem solved by watermark embedding (finding a minimal perturbation to trigger a detector) is nearly identical to that solved by watermark removal (finding a minimal perturbation to evade a detector). This analogy suggests that watermark encoders themselves could serve as effective, generic removal tools.

Methodology

The paper proposes a two-stage attack pipeline, termed "Watermarks Attack Watermarks" (WAW), which operates under a "beige-box" (method known) and "black-box" (method unknown) threat model.

1. Re-Watermarking as an Attack Vector

The core hypothesis is that applying a second watermark (the "attack watermark") on top of an existing one (the "victim watermark") disrupts the original signal. The authors evaluate this across 96 combinations of victim and attack pairs using eight representative watermarking schemes:

• In-processing: Tree-Ring, Stable Signature (embedded during generation).
• Post-processing: StegaStamp, RoSteALS, ZoDiac, Pixel Seal, WAM, Video Seal (applied to generated images).

The authors define a "policy" based on empirical interference matrices. They test two primary strategies:

• Same-method re-application: Applying the same watermarking algorithm twice.
• Cross-method interference: Applying a different algorithm (specifically ZoDiac) to disrupt in-processing watermarks.

2. Watermark Identification Classifier

To address the black-box scenario where the attacker does not know the victim's method, the authors train a lightweight classifier.

• Architecture: A fine-tuned ConvNeXt-V2 Large model pre-trained on ImageNet-22K.
• Task: A 9-class classification problem distinguishing between eight specific watermarking methods and unwatermarked images.
• Input: Visual inspection of the image alone, without access to detection models, keys, or gradients.
• Training Data: 500 images per class from the DiffusionDB dataset, split 80/10/10.

3. Evaluation Framework

The pipeline is evaluated on subsets of DiffusionDB and MS-COCO. Success is measured by:

• Detection Evasion: True Positive Rate (TPR) at 1% False Positive Rate (FPR).
• Payload Corruption: Bit Accuracy (BA) for multi-bit schemes.
• Perceptual Distortion: Normalized Quality Degradation (NQD), aggregating eight standard image quality metrics.
• Baselines: The attack is compared against state-of-the-art generic removal attacks from the WAVES benchmark, including prompted diffusion regeneration, VAE regeneration, and iterative diffusion "rinsing."

Key Contributions

1. Validation of the Re-Watermarking Hypothesis

The authors demonstrate that re-watermarking is a highly effective, generic removal strategy that requires no specialized knowledge of the victim's internal parameters.

• In-processing Victims: Applying ZoDiac on top of Tree-Ring or Stable Signature reduces TPR to near zero with minimal perceptual degradation.
• Post-processing Victims: Re-applying the same method (e.g., StegaStamp on StegaStamp) consistently overwrites the original signal, reducing TPR to near zero and bit accuracy to baseline levels.
• Efficiency: This approach causes significantly less visual degradation (over 2× less than the strongest diffusion-based baselines) while achieving equal or superior removal rates.

2. High-Accuracy Watermark Identification

The paper introduces the first classifier capable of identifying the specific watermarking method applied to an image based solely on visual features.

• Performance: The classifier achieves 87.8% to 95.3% overall accuracy across in-distribution (DiffusionDB) and out-of-distribution (MS-COCO) datasets.
• Significance: This capability transforms the attack from a black-box trial-and-error process into a targeted beige-box attack, allowing the automated selection of the optimal overwriting strategy.

3. The End-to-End Attack Pipeline

By combining the identification classifier with the derived re-watermarking policy, the authors construct a fully blind, automated attack pipeline.

• Results: The pipeline reduces bit accuracy by at least 25% and up to 48% across all victim methods.
• Ownership Forgery: Crucially, the attack does not merely erase the signal; it replaces it with a new, valid watermark. The attacker's message is recovered with high bit accuracy (often >99%), allowing the attacker to plausibly claim ownership or create ambiguity regarding the original provenance.

Results

• Signal Suppression: For half of the evaluated schemes, the attack reduces bit accuracy to the unwatermarked baseline and TPR to near zero. Even for robust methods like RoSteALS and WAM, bit accuracy drops below 75%, rendering payload recovery impossible.
• Quality Preservation: The re-watermarking attack introduces significantly less perceptual distortion than regeneration-based attacks (e.g., Regen-Diff, Rinse).
• Generalization: The attack policy holds across different datasets (DiffusionDB and MS-COCO) and different diffusion backbones (SD 2.1 and SD 3.5), though performance varies slightly for methods dependent on specific latent space statistics (e.g., ZoDiac on SD 3.5).

Significance and Claims

The paper argues that the robustness and imperceptibility properties that make image watermarks attractive are paradoxically what make them vulnerable to each other.

• Vulnerability of Current Schemes: The authors claim that current watermarking schemes fail to meet formal undetectability guarantees. The fact that a simple classifier can distinguish between different watermarking methods implies that these schemes leave scheme-specific "fingerprints" recoverable without keys.
• Cost of Attack: The attack is "cheap" and "generic." It requires only access to off-the-shelf watermarking encoders, which are freely available to content creators. It does not require gradients, surrogate models, or detection keys.
• Implications for Security: The ability to identify and overwrite watermarks challenges the reliability of current schemes for regulatory compliance and copyright protection. The authors suggest that the assumption of "method secrecy" as a defense is insufficient.
• Call to Action: The work serves as a stress-test for candidate schemes, urging the development of watermarking systems with stronger formal security guarantees and a primary focus on true undetectability rather than just robustness against common distortions.

The authors conclude that while their pipeline is a significant vulnerability, it also provides a diagnostic tool for defenders to audit whether their schemes leave recoverable fingerprints, thereby motivating the development of more secure watermarking technologies.