AI Watermark Remover Defeats Top Techniques

With Amnesty International’s photo generators, it has proven to inform real photos from the images created by artificial intelligence that they are close to the impossible. A recent study of Microsoft with 12,500 global participants found that people can discover artificial intelligence images with an average success rate of 62 percent – and not much better than the coin’s coercion.

Water signs are one proposed solution. The European Union’s artificial intelligence law imposes the water mark for most Amnesty International Fire generators, and many companies with Amnesty International photo generators have implemented a water mark or plan to do so soon.

However, this approach may be a blocked path, at least according to the IEEE 2025 seminar on security and privacy. It reveals a new global attack, Unmarker, which defeats leading watermark techniques.

“All leaders in this field are promoting and investing in [watermarking]”Of course, we want to know, do these systems fulfill the promise for which it was marketed?” Said André Casais, the creator of UNMARKER and a doctoral candidate at Waterloo University in Canada.

How AI Image works

To understand how Unmarker removes the signs of artificial intelligence image, it is necessary first to understand how it works.

A strong watermark of artificial intelligence should be discovered by computers, effective via trillion images that may be created by AI’s image generator, and resistance to simple editing technologies such as crops or lack of clarity. To meet these requirements, water marks are hidden in part of the image that most people do not think: the spectrum field.

“The spectral description revolves around how, for each other, the pixels in the image change their values,” Casis explained.

Consider a picture or clarification of a person, such as shown below. The crowded parts of the image, like a person’s hair, have high spectral frequencies where pixels change quickly in value. More smooth parts of the image, such as a person’s cheek or forehead, contain low spectral frequencies.

The UnMarker researchers created unique images and a watermark, then used the UNMARKER tool to remove the watermark by changing the spectral frequency of the image. Reverse the clockwise direction from the top: Google Imagen; Google Synthid; Google Synthid and Unmarker

More importantly, these spectral frequencies describe the pixel values across the image, not one pixel value or neighboring pixels. This makes the watermark invisible for human sight, which, although it is large in finding pixels, not equipped with spectral analysis.

The triple image, which shows Google, shows a remarkable difference between water and unique images. Although Google did not share details about how Synthid works, it is likely to be a semantic watermark. This type of watermark is included in low spectrum frequencies which, as shown previously, describes smoother parts of the image – this may affect how the image generates and removes it. The differences may also be caused by the possibility of artificial intelligence generation or the exact differences in the image generation model that Google uses pictures with or without a sended.

But this does not mean that the watermark is visible to humans. Why? In the realistic world, the user will not receive a picture with the aqueous artificial intelligence generator to compare two images – one with a watermark, one without – for comparison. The viewers will also have no basis for comparison.

The watermark detection devices discover the watermark by analyzing the spectral frequency of the image, where the watermark is expressed as a spectral pattern. However, watermark detection devices are not usually universal tools, (although some researchers have investigated this possibility). Each specific watermark is intended for use with its own detector, which is looking for the hidden spectral pattern of this watermark.

How to defeat the watermark Unmarker

Knowing that the strong and invisible watermark should be found in the spectral field, specifically targeted by Unmarker. It ignores the pixel values of the image and instead it makes changes to spectral information across the entire image, which effectively collapses the watermark.

“Unmarker does not try to search for the place where the watermark is hidden. It is not completely looking for the spectral tapes in which the watermark is coded. The image can be disrupted to remove it,” Casais explained.

It is effective. Unmarker is removed anywhere from 57 percent to 100 percent of detected watermarks from watermarks, depending on the watermark method used.

Hidden watermarks and Yu2 were completely defeated. When tested on the distinctive pictures of Google, the technology used in the example of the above images, Unmarker has succeeded in removing 79 percent of watermarks. The latest watermarks, such as Stegastamp and the water signs that revolve around the trees, were somewhat more powerful, as Unmarker removed about 60 percent.

While these modern watermarks that sometimes hold on Unmarker, removing even a portion of aquatic signs is enough to make aquatic signs technology doubtful. A person is looking to pass an artificial water intelligence image as real that can generate many images, and try to attack over and over again until the watermark is successfully removed.

This does not mean that Unmarker is not flawed. Although changes are usually not noticeable, Casais said that some images can have “slightly clear changes” that cause the image to look more artificial and may start from humans when carefully inspection. The attack also works better with minor image transplantation, although it is against most watermark techniques that are still effective without it.

Are the watermarks Amnesty International are already governed by?

Unmarker source code is available on GitHub. Using Unmarker is not completely trivial, because it requires some basic knowledge about how to use the command line interface to download and install the tool. However, this is hardly an obstacle to anyone who motivates him to pass the images created from artificial intelligence as original.

The attack does not require strange devices either. The paper was conducted for the paper using the NVIDIA A100 graphics unit with 40 GB of memory. Although GPU is sold for thousands of dollars, it is widely available for rent through cloud services such as Amazon Aws and Microsoft Azure, with clock rental prices often at $ 30. He was able to remove a watermark in about 5 minutes.

Kasis also pointed out that the GitHub project includes the complete Unmarker attack and water detectors to verify whether the attack is working. Using Unmarker without checking is “much lower mathematical”. Although he has not yet tried to use UNMARKER on consumer graphics processing unit devices, such as NVIDIA RTX 5090, it is expected that these devices are “able to run” with some effort.

If this looks like Death Knell for Ai Image Waterks, this is justified. UNMARKER explains that the properties that make the leading aquatic marks are strong and invisible – the image of the image spectral field – also creates a predictable way to attack. Organizations looking for images created in the watermark may need to rethink their approach. Or perhaps, they may need to stay away from watermarks and tactics that can positively prove the authenticity of the image, such as content adopting data.