So much for watermarks: UnMarker tool nukes AI provenance tags
- Reference: 1753379110
- News link: https://www.theregister.co.uk/2025/07/24/ai_watermarks_unmarker/
- Source link:
To support that claim, they've released a software tool called [1]UnMarker . It can run offline, and can remove an image watermark in only a few minutes using a 40 GB Nvidia A100 GPU.
Digital image watermarking, the process of altering data in an image file to declare image provenance, has been proposed as a way to help people spot "deepfakes" or AI-generated images and videos.
[2]
Back in mid-2023, before AI safety commitments had fallen out of fashion in the US, [3]Amazon , [4]Google , and [5]OpenAI all talked up watermarking as a way to safeguard against harmful AI-generated imagery. Google has devised a system called [6]SynthID for this purpose. Meta has its own system called [7]Stable Signature .
[8]
[9]
But according to Andre Kassis, a PhD candidate in computer science at the University of Waterloo, and Urs Hengartner, associate professor of computer science, digital watermarks of this sort can be erased, regardless of how they're encoded.
They describe their work in a paper titled " [10]UnMarker: A Universal Attack on Defensive Image Watermarking ," which appeared in the proceedings of the 46th IEEE Symposium on Security and Privacy in May.
[11]
Kassis in a phone interview with The Register cited the flood of AI content and its harmful impact in terms of scams, fraud, and non-consensual exploitative imagery for his interest in this research.
"It's no secret that we're surrounded by AI wherever we go," he said. "And although it has many benefits, it also has a dark side unfortunately."
Watermarking, he said, is a defense that has been proposed and supported with millions of dollars of investment. "So I think it is essential that we stop for a minute and ask ourselves, 'Is it worth the hype? Can it really protect us or are we still vulnerable?'" he said.
[12]
UnMarker, according to Kassis and Hengartner, is the first watermark removal attack that works against all watermarking schemes, whether semantic (content-altering) or non-semantic (content-preserving). It doesn't require access to the watermark mechanism's parameters or internal details, extra data, or feedback from a watermark detector.
Their key insight, the researchers explain in their paper, is that a universal carrier has to be used by any given marking scheme to embed a watermark in an image file and it has to operate on the spectral amplitudes of the pixels in the image.
Carrier, Kassis explained, is an abstract term that refers to the set of attributes a watermark can influence. He likened it to the space allotted to the address on a postal envelope.
"If you mess the address up, then the mailman won't be able to go and deliver the mail," he explained. "So this is the same idea. That's exactly how Unmarker does it. We don't need to know what the actual content of the watermark is. All we need to know is where it resides and then we basically distort that channel."
[13]UN World Court declares countries must curb emissions or be held responsible
[14]Nothing to see here: Brave browser blocks privacy-busting Microsoft Recall
[15]AI industry's size obsession is killing ROI, engineer argues
[16]Copilot Vision on Windows 11 sends data to Microsoft servers
The UnMarker code looks for spectral variations in images in order to alter the frequency without creating visual artifacts. The altered images look the same but no longer get recognized by watermark detection mechanisms most of the time. Consequently, systems set up to block or flag AI-generated content via watermark just won't work reliably.
Kassis and Hengartner tested various digital watermarking schemes, specifically [17]Yu1 , [18]Yu2 , [19]HiDDeN , [20]PTW , [21]Stable Signature , [22]StegaStamp , and [23]TRW . When images watermarked with these techniques were processed by UnMarker, the best watermark detection rate only reached 43 percent. And anything below 50 percent, they argue, is essentially worthless.
Kassis said that when these tests were conducted, Google's SynthID was not available through a public API and could not be evaluated. But he said he had the opportunity to test SynthID later and UnMarker managed to drop its watermark detection rate from 100 percent to around 21 percent.
"So the attack is also extremely effective against this commercial system as well," he told us.
Other researchers have come to similar conclusions about the fragility of digital watermarks. Back in 2023, academics affiliated with the University of Maryland argued that image watermarking techniques [24]would not work . More recently, in February this year, boffins affiliated with Google DeepMind and the University of Wisconsin-Madison [25]concluded that "no existing [image-provenance] scheme combines robustness, unforgeability, and public-detectability."
The DeepMind research also covers C2PA (Coalition for Content Provenance and Authenticity), a form of watermarking that involves adding digital signatures to image metadata rather than manipulating image pixel data; the Waterloo research does not specifically address C2PA, though the DeepMind paper deems it less robust than other watermarking methods.
Despite the doubts voiced by Waterloo researchers about the viability of digital watermarking to address AI image concerns, there's a thriving industry promoting the technology.
"It has become a huge industry," Kassis said. "And like once you let the genie out of the bottle, it's hard to put it back. The White House last year secured commitments from [26]seven major tech players to invest and develop these watermarking technologies. Then there's attention from legislators and stuff like that. So it's kind of hard to right now just stop everything and take a step back and start from scratch."
Kassis said the key message is that security should come first.
"We always rush to develop these tools and our excitement overshadows the security aspects," he said. "We only think about it in hindsight and that's why we're always surprised when we find out how malicious attackers can actually misuse these systems." ®
Get our [27]Tech Resources
[1] https://github.com/andrekassis/ai-watermark
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIZNNDSDfC_4SyVw9YTdfQAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.aboutamazon.com/news/company-news/amazon-responsible-ai
[4] https://blog.google/technology/ai/google-io-2023-keynote-sundar-pichai/#ai-responsibility
[5] https://openai.com/blog/moving-ai-governance-forward
[6] https://ai.google.dev/responsible/docs/safeguards/synthid
[7] https://ai.meta.com/blog/stable-signature-watermarking-generative-ai/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIZNNDSDfC_4SyVw9YTdfQAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIZNNDSDfC_4SyVw9YTdfQAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://arxiv.org/abs/2405.08363
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIZNNDSDfC_4SyVw9YTdfQAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIZNNDSDfC_4SyVw9YTdfQAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2025/07/23/un_world_court_curb_emissions/
[14] https://www.theregister.com/2025/07/23/brave_browse_block_microsoft_recall/
[15] https://www.theregister.com/2025/07/23/ai_size_obsession/
[16] https://www.theregister.com/2025/07/23/microsoft_copilot_vision/
[17] https://arxiv.org/abs/2012.08726
[18] https://arxiv.org/abs/2007.08457
[19] https://github.com/jirenz/HiDDeN
[20] https://www.usenix.org/conference/usenixsecurity23/presentation/lukas
[21] https://ai.meta.com/blog/stable-signature-watermarking-generative-ai/
[22] https://github.com/tancik/StegaStamp
[23] https://github.com/YuxinWenRick/tree-ring-watermark
[24] https://www.theregister.com/2023/10/02/watermarking_security_checks/
[25] https://arxiv.org/html/2502.04901v1
[26] https://bidenwhitehouse.archives.gov/briefing-room/statements-releases/2023/07/21/fact-sheet-biden-harris-administration-secures-voluntary-commitments-from-leading-artificial-intelligence-companies-to-manage-the-risks-posed-by-ai/
[27] https://whitepapers.theregister.com/
The Fourrier transform is not known to be particularly cheap in terms of computing power.
Please explain
From the standpoint of linear processors, presumably parallel processors too, an image is a collection of bytes processed individually and /or collectively, but not holistically. Operations applied to sequences of bytes can be understood only in terms of programmer intentions sewn into the software. Presumably, AI software, regardless of the underlying model, has a commonality of protocol that, intentionally or otherwise, permits some information encoded within a digital image to influence how closely an AI follows the instructions from a human operator, e.g. refuse to mess about with images registered as 'property'.
When a human examines a photograph, analogue or digital, the retinal optical image is converted into the equivalent of an organised digital encoding drawn from individual retinal cells: rods and cones. This information passes into biological neural networks, some properties of which are emulated by AI software. A human will be entirely unaware of hidden data within the image under examination.
Wouldn't this unawareness obtain for copies of the original taken by analogue or digital cameras? In the analogue instance, the image can be copied into the digital domain entirely independently of 'property protection' software digital camera makers could be legislatively obliged to bundle-in.
So, is it correct to assume that by the roundabout means mentioned above, an AI, or a Lora, can be trained on 'protected' images?
If so, can the work outlined in this article be considered equivalent, but more elegant than, the route suggested here?
Speculatively, can invisible watermarks be detected, and removed without detriment to the image, by applying technologies used for deblurring, etc?. Also, invisible watermarks, those deployed by any single source, e.g. a commercial photo repository, would require a base uniformity or pattern. Cannot analysis of many of these images by an AI refine means for ignoring distraction of this kind?
Re: Please explain
Why does that read like it was generated by a LLM
Because they're doing it backwards
Devices that create original photos like smartphones and cameras need to cryptographically sign those originals as a way to prove the photo is genuine. Yes once you send it in a text message, post on Instagram or publish it in a news article it will have been modified, but what's important is that if anyone questions it you could make the original unmodified photo available to prove it was real. News sites might post those originals in an area on their web site that is linked from the modified photos (i.e. they've cropped it, compressed down the size, etc.) so people could immediately verify it isn't AI, when and where it was taken (if that information isn't removed for privacy reasons) and so forth.
Yes that will take a lot of work and require some sort of open standard for Apple, Samsung, Sony and so forth. So people better get cracking on that if they haven't already been, because the idea of marking AI generated stuff is so laughably stupid I can't believe anyone seriously tried.
Re: Because they're doing it backwards
That is - precisely - what C2PA is, and I was going to make the same point. Rather than add something to a file which bad actors want to strip out (a watermark), require the addition of some sort of certification that is desirable (a signature).
Maliciously removing the first is easy to do, maliciously adding the second is, for all practical purposes, impossible.
Re: Because they're doing it backwards
maliciously adding the second is, for all practical purposes, impossible
I wouldn't say "impossible", since it is being done on device and even Secure Element / security co-processor type stuff is not immune to compromise from those with sufficient incentive given that they'd have unlimited access to the hardware containing the key.
You could beef it up by passing a checksum (just that, not the whole photo/video) out "to the cloud" where it is further encrypted along with the time/date that happened (with the determination of the time/date made by the cloud server, i.e. it doesn't use the time/date in the photo/video file's metadata) Then if there is a compromise like someone hacks a Sony camera and extracts their private key so they're able to falsely sign AI generated stuff you could figure out the approximate day when that happened and not trust stuff cloud signed after that date but all the stuff before that date would still be trusted absent some proof of earlier compromise.
To handle that sort of thing you'd need to have a way of revoking a key and providing a new one, and people who know more about this sort of stuff than me would probably have some ideas about multiple levels of key, device specific vs vendor specific and so forth.
Thanks for the info about C2PA, I'm glad this is already being considered. I'll have to read up on it and see if it is what I hope it is. From looking at the list of members I notice that Apple, Samsung, Sony, and Mediatek are conspicuous in their absence. They aren't necessary to help develop the spec but for it to have any chance of success they will have to implement it.
Re: Because they're doing it backwards
> smartphones and cameras need to cryptographically sign those originals
Then you'll need some sort of way of verifying that. How granular will we need to go? Do we have Sony, Canon, Apple, Google, et al publish public keys for the devices they sell? Or does each device have a public key, so I know that pic was taken by Alice's Pixel 7 Pro, or Bob's Nikon D850?
Then how do we balance privacy? People already complain that color printers have the semi-hidden yellow ink pattern that identifies their printouts.
What do you do when Eve grabs Bob's camera and takes an upskirt of Alice and Bob gets cuffed? (Jeez, now I'm thinking of kinky adult-only XKCDs....)
Re: Because they're doing it backwards
Then you'll need some sort of way of verifying that. How granular will we need to go? Do we have Sony, Canon, Apple, Google, et al publish public keys for the devices they sell? Or does each device have a public key, so I know that pic was taken by Alice's Pixel 7 Pro, or Bob's Nikon D850?
There would be multiple keys, so you'd have an Apple etc. key that could be trivially validated (presumably there would be a website where you could dump the metadata information and it would look up the appropriate keys and tell you pass/fail for each bit of signed info in that metadata) Presumably there would also be device level keys but those would likely only come into play in court cases - to prove that I was the one who took a particular picture if I was a witness for example. But that would normally be data that's in the metadata but ignored, for example if CNN publishes a picture of a war crime neither they nor whoever took the picture would want it to be linked back to the photographer especially if it is a dissident rather than foreign journalist.
Re: Because they're doing it backwards
The editing body could resign the image as they are the ones attesting to he fidelity of it. And if you trust, say the WSJ, then their signature would be good enough... But if I posted one, you'd want the camera's signature and mine on top of that. There are also ways to embed the full image and have the cropped one visible in the document... Would just be features to handle authenticated content. Just need to get it integrated so folks can understand it... Because right now, I'd say less than 5% would even understand how to interpret a signature in a picture... Need a lock icon or something...
Re: Because they're doing it backwards
And if you trust, say the WSJ, then their signature would be good enough
Well when you have half the political establishment trying to smear any media that doesn't parrot exactly what Dear Leader claims to be the truth as "fake news" I think that provenance data needs to extend beyond the publisher to prove it was an ORIGINAL photo or video to start with, with the capability (which could enabled/disabled for each individual photo) to also pass along the exact date and time and GPS coordinates where it was taken. As the recent lawsuit against the WSJ shows all it takes is one story for a publisher to be branded "fake news". It also raises the bar for the news sources Dear Leader does approve of to provide proof of photos attacking his enemies. Because MAGA might trust certain media but the rest of us take their claims with a grain of salt so if they want to do more than just feed red meat to their side they'll have to be able to prove the provenance of their photos/videos beyond merely "signed by Fox News".
That way if you have a photo for example showing a congressman meeting with a widely acknowledged to be Bad Guy and when published the congressman cries "fake news!" and tries to claim it was AI generated or photoshopped and that he wasn't in that location at that time or maybe he was but he didn't meet with the other person in the photo it can be proven that it was 1) an original photo from an iPhone, 2) it was taken at the claimed date/time, 3) it was taken at the claimed location and it becomes a lot harder to deny. You'd have to fall back on the pre-digital defense of "that's not me its just someone who looks a lot like me" I guess.
Everything
Need to watermark everything.
Especially human generated things. Anything that doesn't pass as human or pass as a trusted human, is AI SLOP or just trash. I would imagine bodies like the RIAA would want this...
"remove an image watermark in only a few minutes"
With over $3000 of hardware.
I'm pretty sure that the average PC user does not have a $3K+ hardware setup, and the number of individuals with an A100 graphics card in their rig can probably be counted on the fingers of one hand.
So this is a nice research paper, to be sure, and I salute the fact that it is proven that watermarking is basically obsolete.
Now come back to me when you have the figures on a GeForce RTX 50, which I figure is a bit more available to the common public.
Ho hum. Watermark systems have a long history of being discredited/bypassed/etc. shortly after being developed.
Benefits?
"It's no secret that we're surrounded by AI wherever we go," he said. "And although it has many benefits, it also has a dark side unfortunately."
I've yet to see anything that could be remotely described as a benefit.
Minutes on a 40GB A100?
I'm surprised it's so difficult, given the image itself could be generated in seconds on a much lesser GPU?