How AI Can Take away Imperceptible Watermarks


Exploring the Vulnerabilities in Detecting AI-Generated Media

Excessive-level illustration of how invisible watermarking works. Picture by writer.

Why can we Want Watermarks?

Watermarks are all around the web — and for apparent causes. How else might you shield your artwork or images from ending up in somebody's PowerPoint presentation with out crediting the creator? The only manner of addressing this drawback is to create seen watermarks just like the one beneath.

Instance of a visual watermark. Picture by writer based mostly on DALL-E 3.

The first draw back of this methodology is that it may compromise the artwork itself. Nobody would buy and use the cat picture like this. Due to this fact, whereas mitigating unauthorized copies, perceptible watermarks may discourage the audience from utilizing the artwork.

Within the music area, perceptible watermarks are additionally widespread in free Hip-Hop beats. Beat producers typically insert a voice pattern with their model identify proper earlier than the primary verse begins. This will serve both as a safeguard towards unlawful downloads or as a advertising device when the beat is free-to-use.

For inventory photographs and Hip-Hop beats alike, a standard follow is to position watermarks on the net previews and ship the unique product to purchasers after fee. Nonetheless, that is additionally liable to misuse. As quickly because the watermark-free product is bought, it may be copied and reuploaded to the web.

The Case for Imperceptible Watermarks

Safety of Mental Property

Imperceptible watermarks include a definite benefit: You possibly can show possession over any digital copy of your product with out negatively affecting product high quality. It’s like a chunk of paper with invisible ink on it. The paper is absolutely useful, however it carries a secret message that may be revealed at any time.

Instance of an imperceptible watermark. Lemon juice can be utilized as invisible ink. It may be made seen via warmth. Watch this video for an indication. Picture by writer.

With this expertise, creators can encode any sort of message inside their works. Extra importantly, as they’ve entry to the decoder, they’ll at all times assert possession over any digital copy of their authentic work. One other rising alternative for rights-holders is to make use of net crawlers to look the net and report any detected misuse.

Detection of AI-Generated Content material

One other beneficial software for imperceptible watermarks is for detecting AI-generated content material. The arrival of ChatGPT and comparable AI instruments has raised considerations in regards to the potential overflow of harmful AI-generated content material on the web. Tech firms like Meta or Google are bringing ahead imperceptible watermarking methods as technological breakthroughs to mitigate this drawback. Their instruments can add watermarks to photographs or music with none noticeable change in high quality.

In precept, it is a noteworthy growth. With imperceptible watermarks, solely the proprietor of the expertise can decode and detect the presence of such watermarks. Utilizing our instance from above, Meta & Google personal each the invisible ink and the means to disclose it. This permits them to precisely detect and filter content material generated with their very own instruments on their platforms (e.g. Instagram, YouTube). By collaborations, even impartial platforms like X (former Twitter) might use this tech to restrict AI-generated misinformation or different dangerous content material.

1*Yb40n ea0BX3OwURmBZg g
AI suppliers like Meta or Google are constructing their very own watermarking methods to detect their very own generated content material — or promote others the power to take action. Picture by writer.

How can AI Take away Imperceptible Watermarks?

Though imperceptible watermarks sound promising and are being promoted by huge tech firms, they’re removed from excellent. In reality, many of those watermarks could be reliably eliminated utilizing sensible AI algorithms. However how can AI take away one thing that’s imperceptible?

Eradicating Perceptible Watermarks

Let’s begin by understanding how perceptible watermarks could be eliminated with AI. Let me suggest a easy strategy: Begin by gathering tons of of 1000’s of photos from the net. Then, robotically add synthetic watermarks to those photos. Make certain they resemble actual watermarks and canopy all kinds of fonts, sizes, and types. Then, practice an AI to take away watermarks by repeatedly displaying it pairs of the identical picture — as soon as with and as soon as with out the watermark.

Whereas there are actually extra subtle approaches, this illustrates the benefit with which watermarks could be eliminated if the AI is skilled to acknowledge their look or sound. There are quite a few instruments on-line that permit me to simply take away the watermark from my cat picture above:

1*oU8eBy Pzdp1gfKPPr8BjA
Watermark eliminated utilizing On this instance, each the picture and the watermark are synthetic. Please don’t use such instruments to undermine the mental property of others.

Eradicating Imperceptible Watermarks

To make use of this easy strategy from above, it’s essential to present the AI with the “earlier than and after” examples. Nonetheless, if the watermarks are imperceptible, how can discover these examples? Even worse, we will’t even inform if a watermark is current or not simply by a picture or listening to a tune.

To unravel this drawback, researchers needed to get artistic. Zhao et al., 2023 got here up with a two-stage process.

  1. Destroy the watermark by including random noise to the picture
  2. Reconstruct the actual picture by utilizing a denoising algorithm
1*8hESJy3YV9YT1DiVM e8mA
Two-stage process for eradicating imperceptible watermarks on photos. Tailored from Zhao et al., 2023.

That is sensible, as a result of it challenges the instinct that, to be able to take away a watermark, you could be capable of detect it. This strategy can’t find the watermark. Nonetheless, if the one objective is to take away the watermark, merely destroying it by including sufficient white noise to the picture is fast and efficient.

After all, after including noise, you might need damaged the watermark, however you find yourself with a loud image. Essentially the most fascinating half is how the authors then reconstructed the unique picture from the noise. For that, they used AI diffusion fashions, corresponding to those utilized in DALL-E 3 or Midjourney. These fashions generate photos by iteratively turning random noise into real looking photos.

How diffusion fashions generate photos from noise. Taken from David Briand.

As a facet impact, diffusion fashions are additionally extremely efficient denoising methods, each for photos and for audio. By leveraging this expertise, anybody can take away imperceptible watermarks utilizing this actual two-step process.

Does this Imply Imperceptible Watermarks are Ineffective?

Picture by Anthony Tori on Unsplash

Sure and no. On the one hand, it appears doubtless that any imperceptible watermarking system invented thus far could be damaged by unhealthy actors via one methodology or the opposite. Once I posted about this drawback on Linkedin for the primary time, one individual commented: “It’s the adblocker blocker blocker recreation another time”, and I couldn’t agree extra.

The apparent defence towards the assault strategy proposed by Zhao et al. (2023) is to develop an invisible watermarking system that’s sturdy to it. As an example, we might practice our watermarking system in a manner that present SOTA diffusion fashions can’t reconstruct the picture nicely after eradicating the watermark with random noise. Or we might attempt to construct a watermark that’s sturdy to random noise assaults. In both case, new vulnerabilities would rapidly be discovered and exploited.

So are imperceptible watermarks merely ineffective? In a latest article, Sharon Goldman argues that whereas watermarks may not cease unhealthy actors, they might nonetheless be helpful for good actors. They’re a bit like metadata, however encoded immediately into the article of curiosity. In contrast to MP3 metadata, which can be misplaced when the audio is transformed to a unique format, imperceptible watermarks would at all times be traceable, as they’re embedded immediately within the music itself.

Nonetheless, if I’m sincere with myself, I used to be hopeful that imperceptible watermarks might be a viable resolution to flagging and detecting AI-generated content material. Apparently, I used to be improper. These watermarks is not going to forestall unhealthy actors from flooding the web with dangerous AI-generated content material, by and giant.

How Else Can We Show Possession within the AI Period?

Picture generated by the writer utilizing DALL-E 3.

Growth of Countermeasures

As highlighted above, growing countermeasures to identified assault algorithms is at all times an possibility. In lots of circumstances, nevertheless, it’s simpler for the attackers to iterate on their assault algorithms than for the defenders to develop safeguards. Nonetheless, we will’t neglect the chance that we’d uncover a brand new strategy to watermarking that isn’t as simply breakable. It’s due to this fact positively value investing time and sources into additional analysis on this matter.

Authorized Penalties In opposition to Watermark Attackers

Whereas producing photos with AI and importing them to a social media platform is mostly not thought-about unlawful, purposefully eradicating watermarks from AI-generated photos might very nicely be. Having no authorized experience myself, I can solely argue that it will make sense to threaten authorized penalties towards such malicious actions.

After all, the traditional customers resharing photos they discovered on-line ought to be excluded from this. Nonetheless, purposefully eradicating watermarks to unfold misinformation is clearly immoral. And even when authorized strain is not going to eradicate misuse (it by no means has), it may be one mitigating issue.

Rethinking Proofs of Possession

Many approaches exist round how blockchain expertise and/or sensible contracts might assist show possession within the digital age. A blockchain, in easy phrases, is a data storage that tracks interactions between members of a community. Every transaction could be uniquely recognized and may’t be manipulated at any later time limit. Including sensible contracts to this community permits us to attach transactions to binding duties which can be robotically fulfilled as soon as the transaction is executed.

In much less summary phrases, blockchains and sensible contracts might be used sooner or later to automate possession checks or royalty funds for mental property in any form or kind. To this point, no such system has discovered widespread adoption. Nonetheless, we is likely to be only some technical breakthroughs away from these applied sciences changing into invaluable property in our economies.


Digital watermarks have been used because the the early days of the web to forestall misuse of mental property corresponding to photos or music. Not too long ago, it has been mentioned as a technique for flagging and detecting AI generated content material. Nonetheless, it seems that AI will not be solely nice at producing pretend photos. It’s simply pretty much as good at eradicating any sort of watermark on these photos, rendering most detection methods ineffective.

It’s clear that we will’t let this discourage us in trying to find alternative routes of proving possession within the age of AI. By growing concrete technical and authorized countermeasures and, on the identical time, exploring how blockchains and/or sensible contracts might be leveraged sooner or later, we’d simply work out methods to clear up this essential drawback.


Zhao et al., 2023. Invisible Picture Watermarks Are Provably Detachable Utilizing Generative AI.

About Me

I’m a musicologist and a knowledge scientist, sharing my ideas on present subjects in AI & music. Right here is a few of my earlier work associated to this article:

Discover me on Medium and Linkedin!


How AI Can Take away Imperceptible Watermarks was initially revealed in In direction of Knowledge Science on Medium, the place individuals are persevering with the dialog by highlighting and responding to this story.

Supply hyperlink


Please enter your comment!
Please enter your name here