The Forensic Cost of Watermark Removal

TL;DR

This paper introduces Watermark Removal Detection (WRD), a new axis for evaluating watermark removal methods by detecting statistical artifacts, revealing that current methods lack forensic stealthiness.

Contribution

It highlights the importance of forensic detectability in watermark removal, introduces WRD as a detection tool, and benchmarks existing methods showing none balance attack success, perceptual quality, and detectability.

Findings

State-of-the-art attacks leave detectable statistical artifacts.

A classifier trained on artifacts achieves high detection rates.

No current watermark removal method balances all three criteria.

Abstract

Current watermark removal methods are evaluated on two axes: attack success rate and perceptual quality. We show this is insufficient. While state-of-the-art attacks successfully degrade the watermark signal without visible distortion, they leave distinct statistical artifacts that betray the removal attempt. We name this overlooked axis Watermark Removal Detection (WRD) and demonstrate that a modern classifier trained on these artifacts achieves state-of-the-art detection rates at $10^{-3}$ FPR across every removal method tested. No existing attack accounts for this forensic leakage. We benchmark leading watermarking schemes against standard removal pipelines under the extended evaluation triple of attack success, perceptual quality, and forensic detectability, and find that no current method balances all three. Our results establish forensic stealthiness as a necessary requirement for watermark removal.