about
UnMarker: A Universal Attack on Defensive Image Watermarking (arxiv.org)
2 points by gnabgib on Jul 23, 2025 | hide | past | pdf | discuss on HN

In plain words: It scrambles the image frequency patterns where robust watermarks must live, erasing hidden AI fingerprints without knowing the scheme or asking a detector for hints. It broke even structure-based watermarks, cutting the best detection rate to 43% while keeping images cleaner than earlier attacks.

Abstract

Reports regarding the misuse of Generative AI (GenAI) to create deepfakes are frequent. Defensive watermarking enables GenAI providers to hide fingerprints in their images and use them later for deepfake detection. Yet, its potential has not been fully explored. We present UnMarker -- the first practical universal attack on defensive watermarking. Unlike existing attacks, UnMarker requires no detector feedback, no unrealistic knowledge of the watermarking scheme or similar models, and no advanced denoising pipelines that may not be available. Instead, being the product of an in-depth analysis of the watermarking paradigm revealing that robust schemes must construct their watermarks in the spectral amplitudes, UnMarker employs two novel adversarial optimizations to disrupt the spectra of watermarked images, erasing the watermarks. Evaluations against SOTA schemes prove UnMarker's effectiveness. It not only defeats traditional schemes while retaining superior quality compared to existing attacks but also breaks semantic watermarks that alter an image's structure, reducing the best detection rate to $43\%$ and rendering them useless. To our knowledge, UnMarker is the first practical attack on semantic watermarks, which have been deemed the future of defensive watermarking. Our findings show that defensive watermarking is not a viable defense against deepfakes, and we urge the community to explore alternatives.

Andre Kassis, Urs Hengartner
arXiv:2405.08363 · cs.CR, cs.CV, cs.LG · submitted May 14, 2024 · updated Nov 22, 2024
abstract · pdf · html · To appear at IEEE S&P 2025

add comment on HN