Removing Watermarks with Partial Regeneration using Semantic Information

2025-05-13

AI Summary

This work exposes a critical robustness flaw in current semantic watermarking schemes (e.g., TreeRing) under adaptive attacks: their extreme vulnerability to content-aware regeneration attacks. To address this, we propose SemanticRegen—a label-free, three-stage attack method that leverages vision-language models for fine-grained semantic description generation, zero-shot segmentation for foreground mask extraction, and large language model-guided diffusion models for background inpainting. SemanticRegen introduces the novel “foreground-preserving local regeneration” paradigm and defines mask-structured similarity (mSSIM) to quantify foreground fidelity. Experiments demonstrate that SemanticRegen is the first attack to successfully break TreeRing (p > 0.05); watermark bit accuracy drops below 0.75 across four additional watermarking methods. With an mSSIM of 0.94 ± 0.01—up to 12% higher than state-of-the-art diffusion-based attacks—it achieves highly effective watermark removal while preserving semantic integrity and visual quality.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Generation

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Agentic search

Abstract

As AI-generated imagery becomes ubiquitous, invisible watermarks have emerged as a primary line of defense for copyright and provenance. The newest watermarking schemes embed semantic signals - content-aware patterns that are designed to survive common image manipulations - yet their true robustness against adaptive adversaries remains under-explored. We expose a previously unreported vulnerability and introduce SemanticRegen, a three-stage, label-free attack that erases state-of-the-art semantic and invisible watermarks while leaving an image's apparent meaning intact. Our pipeline (i) uses a vision-language model to obtain fine-grained captions, (ii) extracts foreground masks with zero-shot segmentation, and (iii) inpaints only the background via an LLM-guided diffusion model, thereby preserving salient objects and style cues. Evaluated on 1,000 prompts across four watermarking systems - TreeRing, StegaStamp, StableSig, and DWT/DCT - SemanticRegen is the only method to defeat the semantic TreeRing watermark (p = 0.10>0.05) and reduces bit-accuracy below 0.75 for the remaining schemes, all while maintaining high perceptual quality (masked SSIM = 0.94 +/- 0.01). We further introduce masked SSIM (mSSIM) to quantify fidelity within foreground regions, showing that our attack achieves up to 12 percent higher mSSIM than prior diffusion-based attackers. These results highlight an urgent gap between current watermark defenses and the capabilities of adaptive, semantics-aware adversaries, underscoring the need for watermarking algorithms that are resilient to content-preserving regenerative attacks.

Problem

• Exposing vulnerability in semantic watermark robustness
• Removing watermarks while preserving image content
• Evaluating attack effectiveness across multiple watermarking systems

Innovation

• Uses vision-language model for fine-grained captions
• Extracts foreground masks with zero-shot segmentation
• Inpaints background via LLM-guided diffusion model