Removing Watermarks with Partial Regeneration using Semantic Information

TL;DR

This paper introduces SemanticRegen, a novel attack that effectively removes semantic watermarks from AI-generated images by selectively inpainting backgrounds, exposing vulnerabilities in current watermarking defenses.

Contribution

The paper presents SemanticRegen, a three-stage, label-free attack that erases state-of-the-art semantic watermarks while preserving image content, revealing a critical weakness in current watermarking schemes.

Findings

SemanticRegen defeats the TreeRing watermark (p=0.10)

Reduces bit-accuracy below 0.75 for other schemes

Maintains high perceptual quality with masked SSIM of 0.94

Abstract

As AI-generated imagery becomes ubiquitous, invisible watermarks have emerged as a primary line of defense for copyright and provenance. The newest watermarking schemes embed semantic signals - content-aware patterns that are designed to survive common image manipulations - yet their true robustness against adaptive adversaries remains under-explored. We expose a previously unreported vulnerability and introduce SemanticRegen, a three-stage, label-free attack that erases state-of-the-art semantic and invisible watermarks while leaving an image's apparent meaning intact. Our pipeline (i) uses a vision-language model to obtain fine-grained captions, (ii) extracts foreground masks with zero-shot segmentation, and (iii) inpaints only the background via an LLM-guided diffusion model, thereby preserving salient objects and style cues. Evaluated on 1,000 prompts across four watermarking systems - TreeRing, StegaStamp, StableSig, and DWT/DCT - SemanticRegen is the only method to defeat the semantic TreeRing watermark (p = 0.10 > 0.05) and reduces bit-accuracy below 0.75 for the remaining schemes, all while maintaining high perceptual quality (masked SSIM = 0.94 +/- 0.01). We further introduce masked SSIM (mSSIM) to quantify fidelity within foreground regions, showing that our attack achieves up to 12 percent higher mSSIM than prior diffusion-based attackers. These results highlight an urgent gap between current watermark defenses and the capabilities of adaptive, semantics-aware adversaries, underscoring the need for watermarking algorithms that are resilient to content-preserving regenerative attacks.