ML Security PapersSimuFreeMark: A Noise-Simulation-Free Robust Watermarking Against Image Editing
Yichao Tang , Mingyang Li , Di Miao , Sheng Li , Zhenxing Qian , Xinpeng Zhang
Published on arXiv
2511.11295
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
SimuFreeMark outperforms state-of-the-art watermarking methods across a wide range of conventional and semantic editing attacks without requiring any noise simulation during training.
SimuFreeMark
Novel technique introduced
The advancement of artificial intelligence generated content (AIGC) has created a pressing need for robust image watermarking that can withstand both conventional signal processing and novel semantic editing attacks. Current deep learning-based methods rely on training with hand-crafted noise simulation layers, which inherently limit their generalization to unforeseen distortions. In this work, we propose $\textbf{SimuFreeMark}$, a noise-$\underline{\text{simu}}$lation-$\underline{\text{free}}$ water$\underline{\text{mark}}$ing framework that circumvents this limitation by exploiting the inherent stability of image low-frequency components. We first systematically establish that low-frequency components exhibit significant robustness against a wide range of attacks. Building on this foundation, SimuFreeMark embeds watermarks directly into the deep feature space of the low-frequency components, leveraging a pre-trained variational autoencoder (VAE) to bind the watermark with structurally stable image representations. This design completely eliminates the need for noise simulation during training. Extensive experiments demonstrate that SimuFreeMark outperforms state-of-the-art methods across a wide range of conventional and semantic attacks, while maintaining superior visual quality.
Key Contributions
- Demonstrates that image low-frequency components are inherently robust to both conventional signal processing and AIGC-based semantic edits, providing a stable foundation for watermarking without noise simulation
- Proposes SimuFreeMark, which embeds watermarks into the deep feature space of low-frequency components via a pre-trained VAE, eliminating the need for hand-crafted noise simulation layers during training
- Achieves state-of-the-art robustness against both conventional attacks (JPEG, Gaussian noise) and semantic editing attacks (object replacement, inpainting) while preserving superior visual quality
🛡️ Threat Analysis
SimuFreeMark is a content watermarking scheme — the watermark is embedded in image outputs (not model weights) to protect copyright and trace provenance of AI-generated images against removal via signal processing or AIGC-based semantic editing attacks.