MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbation

TL;DR

The paper identifies a fundamental geometric vulnerability in semantic watermarks: tiny, imperceptible spatial perturbations disrupt phase alignment in latent representations, breaking watermark detection while preserving perceptual content. It introduces MarkCleaner, a framework that jointly uses mask-guided encoding and a differentiable 2D Gaussian Splatting renderer to perform high-fidelity watermark removal under micro-geometric perturbations. During training, outputs are supervised against geometrically perturbed targets, and semantic content is preserved via self-supervised alignment with frozen DINOv2 features, yielding robust removal across diverse watermark schemes with real-time inference. The approach outperforms state-of-the-art attacks in erasure and visual fidelity, and its results motivate considering geometric robustness as a core constraint in watermark design and evaluation, with potential extensions to visible watermark removal and future geometry-aware defenses.

Abstract

Semantic watermarks exhibit strong robustness against conventional image-space attacks. In this work, we show that such robustness does not survive under micro-geometric perturbations: spatial displacements can remove watermarks by breaking the phase alignment. Motivated by this observation, we introduce MarkCleaner, a watermark removal framework that avoids semantic drift caused by regeneration-based watermark removal. Specifically, MarkCleaner is trained with micro-geometry-perturbed supervision, which encourages the model to separate semantic content from strict spatial alignment and enables robust reconstruction under subtle geometric displacements. The framework adopts a mask-guided encoder that learns explicit spatial representations and a 2D Gaussian Splatting-based decoder that explicitly parameterizes geometric perturbations while preserving semantic content. Extensive experiments demonstrate that MarkCleaner achieves superior performance in both watermark removal effectiveness and visual fidelity, while enabling efficient real-time inference. Our code will be made available upon acceptance.

Figures (11)

• Figure 1: MarkCleaner remove watermark without compromising visual fidelity. Existing paradigms face a fundamental dilemma: high fidelity or high erasure, but not both. (a) Trade-off between fidelity and erasure in existing methods: Reconstruction-based methods (Path A) have high fidelity but fail to remove the semantic watermark, while generative methods (Path B) successfully erase watermarks but introduce severe semantic drift, hallucinating content, or altering details. (b) Our MarkCleaner offers a unified solution for both visible and invisible watermarks by resolving this issue via mask-guided encoding and geometric perturbation, enabling clean removal without content distortion.
• Figure 2: Frequency-domain analysis of phase perturbation caused by geometry. Starting from the same initial latent, we show (a) standard generation, (b) generation with latent watermark, and (c) geometric transformation of (b). Each column displays the RGB image with latent amplitude and phase spectra. Geometric transformation disrupts watermark-induced phase ripples while preserving amplitude structure, indicating watermark invalidation arises from phase modulation rather than content alteration. TPR@1%FPR computed over 1000 images. (Zoom in for details.)
• Figure 3: Overview of MarkCleaner.Training Stage: Input image is first processed by dual-domain masking, including frequency band masking (FBM) and spatial random masking (SRM), then encoded and decoded into per-patch 2D Gaussian parameters (mean, covariance, color, opacity) for differentiable rasterization. The model is supervised using geometrically perturbed targets rather than the original input, with losses $\mathcal{L}_R$, $\mathcal{L}_P$, $\mathcal{L}_G$, and DINOv2-based alignment $\mathcal{L}_D$. Inference Stage: Watermarked images pass through the same pipeline, with optional user-provided masks for visible watermark regions, producing semantically consistent yet geometrically perturbed outputs.
• Figure 4: Qualitative comparison of watermark removal methods. Traditional pixel-space distortions severely degrade visual quality, while generation-based methods tend to remove watermarks at the cost of semantic drift. Our MarkCleaner achieves more effective watermark suppression with better visual fidelity. More results are provided in the Appendix \ref{['sec:sup_visual_results']}.
• Figure 5: Visualization of ablation studies. Red boxes highlight geometric subtle shifts, while Yellow boxes highlight structural preservation. Full Model introduces imperceptible micro-shifts to erase the watermark while maintaining visual coherence.