RAVEN: Erasing Invisible Watermarks via Novel View Synthesis

TL;DR

This paper reveals a vulnerability in invisible watermarks by reformulating removal as a view synthesis problem, using a diffusion-based method to effectively erase watermarks while preserving image quality.

Contribution

The authors introduce a novel view synthesis approach using diffusion models to remove watermarks without prior knowledge, exposing a fundamental flaw in current watermarking schemes.

Findings

Achieves state-of-the-art watermark removal across 15 methods

Outperforms 14 baseline attacks in effectiveness

Maintains high perceptual quality during removal

Abstract

Invisible watermarking has become a critical mechanism for authenticating AI-generated image content, with major platforms deploying watermarking schemes at scale. However, evaluating the vulnerability of these schemes against sophisticated removal attacks remains essential to assess their reliability and guide robust design. In this work, we expose a fundamental vulnerability in invisible watermarks by reformulating watermark removal as a view synthesis problem. Our key insight is that generating a perceptually consistent alternative view of the same semantic content, akin to re-observing a scene from a shifted perspective, naturally removes the embedded watermark while preserving visual fidelity. This reveals a critical gap: watermarks robust to pixel-space and frequency-domain attacks remain vulnerable to semantic-preserving viewpoint transformations. We introduce a zero-shot diffusion-based framework that applies controlled geometric transformations in latent space, augmented with view-guided correspondence attention to maintain structural consistency during reconstruction. Operating on frozen pre-trained models without detector access or watermark knowledge, our method achieves state-of-the-art watermark suppression across 15 watermarking methods--outperforming 14 baseline attacks while maintaining superior perceptual quality across multiple datasets.