DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defenses

TL;DR

Deepfake risks motivate defensive watermarking, but existing encoder–decoder watermarking schemes remain vulnerable to latent-space manipulations. DeMark is a query-free black-box attack that leverages image compressive sensing principles to enforce latent-space sparsity, dispersing watermark carriers while preserving perceptual and structural image quality. Across eight state-of-the-art watermarking schemes, DeMark substantially reduces watermark detectability with competitive image fidelity and superior computational efficiency, outperforming prior distortion, regeneration, and adversarial attacks. The work highlights a fundamental need for more robust watermark designs that distribute watermark information across multi-level latent features to resist latent-space perturbations in deepfake pipelines.

Abstract

The rapid proliferation of realistic deepfakes has raised urgent concerns over their misuse, motivating the use of defensive watermarks in synthetic images for reliable detection and provenance tracking. However, this defense paradigm assumes such watermarks are inherently resistant to removal. We challenge this assumption with DeMark, a query-free black-box attack framework that targets defensive image watermarking schemes for deepfakes. DeMark exploits latent-space vulnerabilities in encoder-decoder watermarking models through a compressive sensing based sparsification process, suppressing watermark signals while preserving perceptual and structural realism appropriate for deepfakes. Across eight state-of-the-art watermarking schemes, DeMark reduces watermark detection accuracy from 100% to 32.9% on average while maintaining natural visual quality, outperforming existing attacks. We further evaluate three defense strategies, including image super resolution, sparse watermarking, and adversarial training, and find them largely ineffective. These results demonstrate that current encoder decoder watermarking schemes remain vulnerable to latent-space manipulations, underscoring the need for more robust watermarking methods to safeguard against deepfakes.

Figures (13)

• Figure 1: Effects of ICS on SC, IR, and PR for a set of 2,000 images from the OpenImage dataset watermarked using each of the six post-processing schemes, MBRS MBRS, CIN CIN, TrustMark TrustMark, PIMoG PIMoG, VINE-B VINE, and VINE-R VINE, and 500 watermarked images generated from each of two in-processing schemes, PTW PTW and SS StableSignature.
• Figure 2: Illustration of DeMark, Distortion (brightness, contrast, blurring, Gaussian noise, and compression in that order), RegenVAE, and RegenDM on image integrity using two VINE-R-generated watermarked images (WMs) from OpenImage.
• Figure 3: Percentage distributions of watermarked images (y-axis: Frequency) across latent representation sparsity levels (x-axis: SLR) (\ref{['eq:sparsity_level']}) for DeMark under three $\alpha$ settings: $\alpha=0$ (no sparsity), $\alpha=10$ (moderate sparsity), and $\alpha=20$ (moderately high sparsity). Results include watermarked images from the eight watermarking schemes (\ref{['subsec:experiment_setup']}).
• Figure 4: Impact of latent representation sparsity levels on DeMark's attack effectiveness across the eight watermarking schemes under three $\alpha$ settings: $\alpha=0$ (no sparsity), $\alpha=10$ (moderate sparsity), and $\alpha=20$ (moderately high sparsity).
• Figure 6: Visual comparison of image integrity between DeMark and DeMark-ISR using an OpenImage sample watermarked by VINE-R. (a) Image ($256 \times 256$) attacked by DeMark. (b) The same image from (a) reconstructed to $1024 \times 1024$ using ISR (DeMark-ISR), allowing the reader to assess integrity differences visually.