A new robustness benchmark shows today's local image watermarks - invisible tags meant to prove which part of an image is AI-generated or edited - crumble under basic photo manipulation.
Researchers built what they call the first systematic robustness benchmark for local watermarking, testing five methods (MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal) against 55 separate image transformations covering signal distortions, coordinate shifts, indirect edits, and direct attacks on the watermark itself. Local watermarks hide a signal in just one region of an image rather than the whole frame, so a specific object can be traced back to its source without visibly altering the picture. Every method tested failed against at least one transformation. MaskWM came out ahead on both recovering the hidden payload and locating it, though its watermark hurts image quality more than any rival's even before anyone tampers with the file.
The type of edit matters more than whether a watermark exists at all. Compression and noise are tolerated by the strongest methods, but geometric shifts and generative edits like inpainting and outpainting can wipe out payload recovery completely. That gap lines up almost exactly with how someone would actually try to disguise a doctored image, not with the synthetic stress tests vendors tend to publish.
Watermarking keeps getting pitched as the fix for provenance in the generative-AI era. This benchmark is a reminder that the fix still doesn't survive contact with a basic photo editor.