RAVEN: Erasing Invisible Watermarks via Novel View Synthesis

TL;DR

This work exposes a fundamental vulnerability in invisible image watermarks by treating removal as novel view synthesis. They propose RAVEN, a zero-shot diffusion-based attack that applies latent-space viewpoint shifts and a view-guided attention mechanism to suppress watermarks while preserving semantic content and perceptual quality. The method operates without detector access or watermark knowledge and achieves state-of-the-art suppression across 15 attacks and 14 watermarking schemes, with strong results on MS-COCO, Stable-Diffusion-Prompts, and DiffusionDB. The findings highlight a need for watermarking schemes robust to semantic-preserving viewpoint transformations and demonstrate practical, efficient, black-box watermark removal.

Abstract

Invisible watermarking has become a critical mechanism for authenticating AI-generated image content, with major platforms deploying watermarking schemes at scale. However, evaluating the vulnerability of these schemes against sophisticated removal attacks remains essential to assess their reliability and guide robust design. In this work, we expose a fundamental vulnerability in invisible watermarks by reformulating watermark removal as a view synthesis problem. Our key insight is that generating a perceptually consistent alternative view of the same semantic content, akin to re-observing a scene from a shifted perspective, naturally removes the embedded watermark while preserving visual fidelity. This reveals a critical gap: watermarks robust to pixel-space and frequency-domain attacks remain vulnerable to semantic-preserving viewpoint transformations. We introduce a zero-shot diffusion-based framework that applies controlled geometric transformations in latent space, augmented with view-guided correspondence attention to maintain structural consistency during reconstruction. Operating on frozen pre-trained models without detector access or watermark knowledge, our method achieves state-of-the-art watermark suppression across 15 watermarking methods--outperforming 14 baseline attacks while maintaining superior perceptual quality across multiple datasets.

Figures (8)

• Figure 1: Overview of RAVEN. Given a watermarked image $x_w$, we encode it into latent space and perform partial diffusion inversion to obtain $z_\tau$. Latent viewpoint modulation applies a camera motion $\mathcal{C}_\theta$ to generate $\tilde{z}_\tau$. During denoising steps, view-guided correspondence attention computes queries $\tilde{Q}$ from the transformed latent while keys $K$ and values $V$ come from a reference latent denoised in parallel from $z_\tau$. This cross-view mechanism preserves scene semantics while suppressing watermark-related cues. The decoder $\mathcal{D}$ reconstructs the output, followed by color and contrast correction to produce the final watermark-free result $\tilde{x}$.
• Figure 2: Qualitative comparison of watermark removal methods. The top row shows full images, while the bottom row displays zoomed-in regions (red boxes) for detailed inspection. VAE-C cheng2020learned introduces excessive blurring that degrades fine details. Regen zhao2024invisible produces visible artifacts due to high noise injection required for watermark removal. Rinse exhibits unnatural color shifts and loss of photorealism, a consequence of performing multiple regeneration passes. UnMarker liu2024image leaves noisy residual artifacts that compromise visual quality. CtrlGen+ liu2024image produces overly stylized outputs that deviate from natural appearance. In contrast, RAVEN preserves fine-grained details, natural textures, and photorealistic appearance. Note that the zoomed regions for UnMarker liu2024image and RAVEN differ slightly from other methods due to cropping layers and camera translation transformations, respectively. More results are provided in suppl.
• Figure 3: Effect of strength parameter $s$ on watermark removal. Increasing $s$ enhances watermark suppression but degrades visual quality. Low values ($s = 0.05$) preserve quality but may retain watermarks, while high values introduce artifacts.
• Figure 4: Effect of view-guided correspondence attention. Without correspondence attention (middle), latent viewpoint modulation causes severe structural distortions. With view-guided attention (right), RAVEN preserves fine-grained details, textures, and structural consistency while effectively removing watermarks.
• Figure 5: Effect of color and contrast transfer. FID comparison across four watermarking methods before and after applying color and contrast transfer in CIELAB space. The post-processing step consistently improves FID.