RAVEN: Erasing Invisible Watermarks via Novel View Synthesis

2026-01-13

AI Summary

Existing invisible watermarks are highly vulnerable to semantic-preserving viewpoint transformations, struggling to balance robustness and visual fidelity. This work is the first to expose the sensitivity of watermarks to such geometric transformations and introduces a zero-shot watermark removal method that reframes watermark erasure as a novel view synthesis task—requiring neither prior knowledge of the watermark nor access to a detector. Leveraging a frozen pre-trained diffusion model, the approach applies controlled geometric transformations in latent space and incorporates a view-guided correspondence attention mechanism to preserve structural consistency. It achieves state-of-the-art removal performance across 15 mainstream watermarking methods, significantly outperforming 14 baseline attacks while maintaining excellent perceptual quality on multiple datasets.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Multi-instance/Multi-view Learning
• Natural Language Processing: Language Grounding & Multi-modal NLP

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Invisible watermarking has become a critical mechanism for authenticating AI-generated image content, with major platforms deploying watermarking schemes at scale. However, evaluating the vulnerability of these schemes against sophisticated removal attacks remains essential to assess their reliability and guide robust design. In this work, we expose a fundamental vulnerability in invisible watermarks by reformulating watermark removal as a view synthesis problem. Our key insight is that generating a perceptually consistent alternative view of the same semantic content, akin to re-observing a scene from a shifted perspective, naturally removes the embedded watermark while preserving visual fidelity. This reveals a critical gap: watermarks robust to pixel-space and frequency-domain attacks remain vulnerable to semantic-preserving viewpoint transformations. We introduce a zero-shot diffusion-based framework that applies controlled geometric transformations in latent space, augmented with view-guided correspondence attention to maintain structural consistency during reconstruction. Operating on frozen pre-trained models without detector access or watermark knowledge, our method achieves state-of-the-art watermark suppression across 15 watermarking methods--outperforming 14 baseline attacks while maintaining superior perceptual quality across multiple datasets.

Problem

• invisible watermarking
• watermark removal
• view synthesis
• semantic-preserving transformation
• AI-generated images

Innovation

• novel view synthesis
• invisible watermark removal
• diffusion models
• latent space transformation
• zero-shot attack