Understanding Semantic Perturbations on In-Processing Generative Image Watermarks

TL;DR

This paper systematically evaluates the robustness of in-processing generative image watermarks against semantic content changes, revealing significant vulnerabilities not captured by traditional robustness tests.

Contribution

It introduces a multi-stage framework for stress-testing watermark robustness under semantic drift, highlighting the need for improved evaluation methods.

Findings

Watermark detectability often drops to near zero under semantic edits.

Robustness varies significantly with the degree of semantic entanglement.

Current benchmarks do not adequately assess robustness against semantic manipulations.

Abstract

The widespread deployment of high-fidelity generative models has intensified the need for reliable mechanisms for provenance and content authentication. In-processing watermarking, embedding a signature into the generative model's synthesis procedure, has been advocated as a solution and is often reported to be robust to standard post-processing (such as geometric transforms and filtering). Yet robustness to semantic manipulations that alter high-level scene content while maintaining reasonable visual quality is not well studied or understood. We introduce a simple, multi-stage framework for systematically stress-testing in-processing generative watermarks under semantic drift. The framework utilizes off-the-shelf models for object detection, mask generation, and semantically guided inpainting or regeneration to produce controlled, meaning-altering edits with minimal perceptual degradation. Based on extensive experiments on representative schemes, we find that robustness varies significantly with the degree of semantic entanglement: methods by which watermarks remain detectable under a broad suite of conventional perturbations can fail under semantic edits, with watermark detectability in many cases dropping to near zero while image quality remains high. Overall, our results reveal a critical gap in current watermarking evaluations and suggest that watermark designs and benchmarking must explicitly account for robustness against semantic manipulation.