Removing a watermark from AI-generated images isn't enough if a forensic detector can still tell the image has been tampered with. The authors test six state-of-the-art watermark-removal attacks and show that independent forensic classifiers can distinguish removal-processed outputs from clean images at over 98% true-positive rate (1% FPR). Using UnMarker as a case study, they find removal leaves a characteristic spectral signature that persists under common post-processing and creates a three-way trade-off among watermark evasion, image quality, and forensic stealth. They argue removal benchmarks should measure all three, not just whether the watermark test fails.
Main takeaways:
- Current watermark removers evade the watermark detector but leave forensic traces: independent detectors achieve >98% TPR at 1% FPR distinguishing removal-processed from clean images.
- Removal introduces a detectable spectral deformation that survives common post-processing (JPEG compression, resizing, etc.).
- Three-way tension: removing the watermark, preserving image quality, and staying forensically indistinguishable from clean content are jointly hard to satisfy.
- Existing benchmarks are incomplete because they ignore forensic stealth — a successful remover must not just fool the verifier but also avoid leaving a different detectable signal.