A Baseline Method for Removing Invisible Image Watermarks using Deep Image Prior

2025-02-19

AI Summary

This work addresses the black-box removal of imperceptible watermarks embedded in AI-generated content, proposing a single-image inversion method that requires neither training data nor prior knowledge of the watermarking system. The core innovation lies in the first application of Deep Image Prior (DIP) to imperceptible watermark removal: leveraging optimization-driven iterative reconstruction, the method recovers high-fidelity original images from a single watermarked input. It achieves efficient removal across multiple state-of-the-art invisible watermarking schemes, consistently attaining PSNR >30 dB—substantially outperforming existing black-box attacks. Furthermore, the study reveals DIP’s strong robustness against imperceptible watermarks while exposing its limitations on visible watermarks. To support systematic evaluation, the authors establish the first reproducible benchmark for assessing imperceptible watermark robustness, thereby introducing a novel paradigm for evaluating watermark system security.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Learning to Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Image watermarks have been considered a promising technique to help detect AI-generated content, which can be used to protect copyright or prevent fake image abuse. In this work, we present a black-box method for removing invisible image watermarks, without the need of any dataset of watermarked images or any knowledge about the watermark system. Our approach is simple to implement: given a single watermarked image, we regress it by deep image prior (DIP). We show that from the intermediate steps of DIP one can reliably find an evasion image that can remove invisible watermarks while preserving high image quality. Due to its unique working mechanism and practical effectiveness, we advocate including DIP as a baseline invasion method for benchmarking the robustness of watermarking systems. Finally, by showing the limited ability of DIP and other existing black-box methods in evading training-based visible watermarks, we discuss the positive implications on the practical use of training-based visible watermarks to prevent misinformation abuse.

Problem

• Removes invisible image watermarks
• Uses deep image prior
• Evaluates watermark system robustness

Innovation

• Uses Deep Image Prior
• Removes invisible watermarks
• No dataset required