A new benchmark finds that some invisible AI-image watermarks fail when attackers simply reembed a new mark on top of the image.
Researchers built WARP, an open-source framework that tests 32 classical, deep-learning, and generative watermarking methods against 34 removal techniques, ranging from basic cropping and compression to adversarial, purification, and re-embedding attacks. The team says it is the largest robustness benchmark assembled for the field so far, scoring each method on image quality, watermark readability, and resistance to erasure. The results show a clear pattern: several watermarking schemes that survive everyday distortions like resizing or JPEG compression still fail once an attacker re-embeds a competing watermark over the original. The benchmark code is public on GitHub.
Watermarking is turning into a compliance requirement, not just a research exercise, as regulators push platforms to label AI-generated images. A standardized benchmark that separates watermarks which actually hold up under attack from ones that only look good on a lab slide gives platforms and policymakers a real basis for comparison.
One point worth remembering: a watermark that is tough against blur and compression but falls apart against re-embedding is not meaningfully robust once it meets a determined attacker.