MarkNull Framework Demonstrates Model-Agnostic Watermark Removal in AI-Generated Images
Researchers have introduced MarkNull, a model-agnostic attack framework that removes digital watermarks from generative images while preserving visual quality. The approach leverages on-manifold latent manipulation to reduce average bit detection accuracy to near-random levels.
Digital watermarking is widely used for copyright attribution and tracking AI-generated imagery, but its resilience to generalized removal attempts has been a significant vulnerability. Existing watermark removal methods often rely on specific generative architectures or degrade the visual quality of the target image to the point of rendering it unusable. The newly proposed MarkNull framework addresses these limitations by introducing a model-agnostic attack mechanism that maintains high image fidelity. The core of MarkNull relies on the observation of a strong statistical dependency between the generated latent representation of an image and its embedded watermark noise. By introducing the Noise-Latent Alignment Score (NLAS), the system optimizes the latent space to selectively decorrelate these elements. This process effectively strips out the watermarking signal without altering the underlying semantic features of the image. Testing across multiple watermarking paradigms, including post-hoc, fine-tuning, and initial-noise methods, shows that MarkNull successfully lowers bit verification accuracy to approximately 53.14 percent, which is close to random guessing. Furthermore, the researchers developed MarkNull-A, an amortized version that eliminates the optimization bottleneck to perform the attack in a single forward pass lasting just half a second per image. Notably, the attack proved effective against commercial-grade systems such as Google SynthID-Image, highlighting the need for more robust defense mechanisms in generative media.
Primary source
Open arXiv ↗This article summarizes the source. Check the original for full details and conditions.
Comparison
| Aspect | Before / Alternative | After / This |
|---|---|---|
| Compatibility | Model-specific (only targets specific generator architectures) | Model-agnostic (applies across diverse generative pipelines) |
| Visual quality protection | Severe visual degradation or noticeable blurriness | High semantic fidelity preserved without perceptible artifacts |
| Attack processing speed | Slow iterative optimization required for each image | Single forward pass (0.50 seconds per image) using amortized variant |
| SynthID-Image susceptibility | Highly robust against post-hoc manipulation | Compromised under latent decorrelation optimization |
