LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
LiBRA attack removes AI-image watermarks in an autoencoder's latent space while preserving quality, steering decoder confidence toward random guessing instead of inversion.
LiBRA (Latent In-band Bidirectional Removal Attack) targets watermarks used to attribute AI-generated images, assuming attacker access to the watermark key and decoder. It makes bounded image edits in a public autoencoder's latent space, guiding average decoding confidence toward random guessing from either direction, avoiding the inverted-but-still-detectable failure mode of inversion-driven attacks. An optional frequency-guided mask limits where changes occur to preserve image quality, and removal success is verified with an exact two-sided binomial test.
- White-box threat model requiring watermark key and decoder access
- Bidirectional objective avoids inverted but still-detectable watermarks
- Bounded latent-space edits with optional frequency mask preserve image quality
- Removal verified via exact two-sided binomial test
From the original article
1 min read at arxiv.orgDigital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original.
By Saibo Ye · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.