AI Watermark Remover Defeats Top Techniques

As AI image generators advance, telling real images from AI-generated images has proven close to impossible. A recent study from Microsoft with 12,500 global participants found that people can detect AI images with an average success rate of 62 percent—not much better than a coin flip.

Watermarking is one proposed solution. The European Union’s AI Act mandates watermarking for most AI image generators, and many companies with AI image generators have implemented a watermark or plan to soon do so.

Yet this approach might be a dead end, at least according to a paper presented at the 2025 IEEE Symposium on Security and Privacy. It reveals a new universal attack, UnMarker, which defeats leading watermarking techniques.

“All the leaders in the field are promoting and investing in [watermarking], with whole teams dedicated to that,” said Andre Kassis, creator of UnMarker and a Ph.D. candidate at the University of Waterloo, in Canada. “Naturally, we want to know, do these systems deliver on the promise they’re marketed for?”

How AI image watermarking works

To understand how UnMarker removes AI image watermarks, it’s first necessary to understand how they work.

A robust AI image watermark must be detectable by computers, effective across the trillions of possible images an AI image generator might create, and resistant to simple editing techniques like cropping or blurring. To meet these requirements, watermarks hide in a portion of the image most people don’t think about: the spectral domain.

“Spectral characterization is about how, relative to each other, the pixels in the image change their values,” explained Kassis.

Consider a portrait or illustration of a person, such as the one shown below. Busy portions of the image, like the person’s hair, have high spectral frequencies as pixels rapidly change in value. Smoother portions of the image, like the person’s cheek or forehead, have low spectral frequencies.

The UnMarker researchers generated unwatermarked and watermarked images, then used the UnMarker tool to remove the watermark by changing the image’s spectral frequencies. Counterclockwise from top: Google Imagen; Google SynthID; Google SynthID and UnMarker

Importantly, these spectral frequencies describe pixel values across the image, not the value of a single pixel or neighboring pixels. That makes the watermark invisible to human eyesight which, though great at finding patterns in pixels, isn’t equipped for spectral analysis.

The image triplet above, which demonstrates Google’s SynthID, shows a notable difference between the watermarked and non-watermarked images. While Google hasn’t shared details of how SynthID works, it’s likely a semantic watermark. This type of watermark is embedded in low spectral frequencies which, as explained earlier, describe smoother portions of the image—and this may influence how an image is generated and its output. The differences may also be due to the probabilistic nature of…