MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation

This paper proposes MARK NULL, a model-agnostic watermark removal attack against AI-generated images via on-manifold latent manipulation, along with its amortized variant MARK NULL-A. The work addresses three critical research gaps in watermark removal: (1) the fidelity-removal trade-off where strong attacks degrade image quality, (2) limited model-agnosticism where existing attacks fail to generalize across watermarking paradigms, and (3) heavy computational overhead from iterative DDIM inversions.

The paper's core observation is that watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. To quantify this, the authors introduce the Noise-Latent Alignment Score (NLAS), which measures the angular correlation between the latent representation z0 and the initial noise z T. The attack formulates an optimization objective that selectively decorrelates the latent representation from the embedded watermark while preserving semantic fidelity.

MARK NULL operates in a no-box setting, using only a public proxy model (Stable Diffusion 1.5) with no access to the target watermarking system. It iteratively optimizes an adversarial latent representation z0(adv) to enforce orthogonality with the watermarked initial noise z T(A,w), combined with perceptual quality losses (LPIPS, MSE, SSIM). The optimization objective is:

L MARK NULL = L img(I A, I w) + λ4·NLAS(z0(adv), z T(A,w))

MARK NULL-A distills this iterative optimization into a Watermark Removal Network (WRN) built on Restormer, enabling single forward-pass inference at 0.50 seconds per image with 6,282 MB VRAM.

The paper provides theoretical analysis from flow matching and ODE theory perspectives, establishing: (1) bijectivity of the noise-data mapping ensures unique preimages for latent perturbations; (2) proxy-target compatibility guarantees attack transferability when vector field discrepancies are bounded; (3) NLAS minimization suppresses correlation-based detection statistics to random-guessing baselines; and (4) manifold projection via VAE filtering removes high-frequency watermark signals from fine-tuning and post-hoc schemes.

Across nine representative watermarking schemes covering post-hoc (DwtDct, RivaGan, HiDDeN), fine-tuning-based (Stable Signature, VINE, SleeperMark), and initial-noise-based (Gaussian Shading, PRC, TreeRing) paradigms, MARK NULL reduces average bit accuracy to 53.14%, approaching the 50% random-guessing baseline. MARK NULL-A achieves 57.10% average BA. For the zero-bit TreeRing scheme, MARK NULL reduces TPR@1%FPR from 100% to 43%.

MARK NULL achieves the highest CQS (Composite Quality Score) across all nine tested watermarking schemes, with scores up to 4.24 for SleeperMark and 4.06 for TreeRing, outperforming all seven baseline attacks including VA, DA, CtrlRegen+, NFPA, Imprint, UnMarker, and NPA.

Both attacks achieve 100% ASR against Google's SynthID-Image system while maintaining superior perceptual quality (MARK NULL achieves the highest CQS of 3.87 among methods with 100% ASR).

MARK NULL suppresses BA to approximately 50% against VideoShield and VideoMark, while MARK NULL-A achieves excellent video quality (MUSIQ > 0.6) among successful attack baselines.

MARK NULL-A requires only 0.50 seconds per image, orders of magnitude faster than optimization-based baselines (UnMarker requires >700 seconds, NPA takes 33.8 seconds), with comparable or lower VRAM usage (6,282 MB vs. 14,378 MB for UnMarker).

The paper presents an attack detection mechanism using DDIM inversion-regeneration with LPIPS reconstruction error as a detection statistic. The detector achieves TPR above 90% for schemes like SleeperMark and GS under MARK NULL, though partial distribution overlap persists under stealthy attacks like MARK NULL-A.

1. MARK NULL breaks the fidelity-removal trade-off by explicitly minimizing NLAS to decorrelate watermark signals while maintaining SOTA perceptual quality.

2. MARK NULL-A addresses computational bottlenecks by replacing iterative DDIM inversions with a single feed-forward pass.

3. The attacks demonstrate unprecedented scalability across the broadest range of watermarking paradigms, achieving 100% ASR against SynthID-Image and generalizing to video watermarking without modality-specific adaptation.

The paper concludes that these findings highlight the necessity of developing watermark designs resilient to model-agnostic latent-space attacks and serve as a rigorous red-teaming benchmark for the community.

Improved AI System: Adaptive Watermark-Aware Generative Model with Self-Verifying Integrity

Improvements:

1. Latent-Space Watermark Immunization: Integrate a trainable watermark-orthogonal projection layer into the generative model's latent decoder, which dynamically adjusts the latent-to-noise mapping to minimize NLAS (Noise-Latent Alignment Score) during training. This forces the model to produce images whose latent representations are inherently decorrelated from any embedded initial noise, making MARK NULL-style attacks ineffective by construction.

2. Dual-Channel Semantic Fidelity Preservation: Add a parallel semantic consistency network that reconstructs the original image content from both the watermarked and attacked latent representations, using contrastive learning to ensure that any latent manipulation (e.g., decorrelation) does not alter high-level semantic features. This prevents the fidelity-removal trade-off from being exploited in reverse—attacks that reduce watermark detectability will also reduce semantic coherence, making them detectable.

3. Real-Time Attack Detection via Latent Trajectory Monitoring: Implement a lightweight monitoring module that tracks the latent trajectory during generation and compares it against expected manifold statistics. Any deviation consistent with MARK NULL's optimization (e.g., sudden orthogonality enforcement) triggers an immediate regeneration with a fresh, non-correlated noise seed, rendering the attack's output useless.

4. Cross-Paradigm Watermark Redundancy: Enhance watermarking schemes to embed signals across multiple latent subspaces (e.g., both initial noise and intermediate features) with independent NLAS constraints, so that even if one subspace is decorrelated, the others retain detectable correlations. This makes single-objective attacks like MARK NULL insufficient.

5. Computational Overhead Reduction for Defenders: Replace DDIM inversion-regeneration detection with a single-pass VAE-based anomaly score that approximates LPIPS reconstruction error, reducing detection latency from seconds to milliseconds while maintaining >90% TPR for most watermarking schemes.

What the Improved AI System Can Do:

• Generate images that are inherently resistant to latent-manipulation watermark removal, even when the attacker uses a no-box proxy model.

• Detect and automatically reject adversarial latent edits in real time, preserving both watermark integrity and image quality.

• Maintain watermark detectability across multiple latent subspaces, making it robust to attacks targeting any single correlation metric.

• Provide fast, scalable watermark verification for video streams (e.g., real-time content authentication) without the computational burden of iterative inversion.

• Serve as a hardened foundation for content provenance systems, ensuring that AI-generated media remains traceable even under sophisticated red-team attacks.