ML Security PapersTokenPure: Watermark Removal through Tokenized Appearance and Structural Guidance
Pei Yang 1, Yepeng Liu 2, Kelly Peng 1, Yuan Gao 1, Yiren Song 1,3
Published on arXiv
2512.01314
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
TokenPure achieves state-of-the-art watermark removal and reconstruction fidelity, substantially outperforming existing baselines in both perceptual quality and content consistency.
TokenPure
Novel technique introduced
In the digital economy era, digital watermarking serves as a critical basis for ownership proof of massive replicable content, including AI-generated and other virtual assets. Designing robust watermarks capable of withstanding various attacks and processing operations is even more paramount. We introduce TokenPure, a novel Diffusion Transformer-based framework designed for effective and consistent watermark removal. TokenPure solves the trade-off between thorough watermark destruction and content consistency by leveraging token-based conditional reconstruction. It reframes the task as conditional generation, entirely bypassing the initial watermark-carrying noise. We achieve this by decomposing the watermarked image into two complementary token sets: visual tokens for texture and structural tokens for geometry. These tokens jointly condition the diffusion process, enabling the framework to synthesize watermark-free images with fine-grained consistency and structural integrity. Comprehensive experiments show that TokenPure achieves state-of-the-art watermark removal and reconstruction fidelity, substantially outperforming existing baselines in both perceptual quality and consistency.
Key Contributions
- Diffusion Transformer-based watermark removal framework (TokenPure) that reframes removal as conditional generation, bypassing the watermark-carrying noise space entirely
- Decomposition of watermarked images into complementary visual tokens (texture/appearance) and structural tokens (geometry) to jointly condition the diffusion process
- State-of-the-art watermark removal achieving superior perceptual quality and content consistency over existing baselines
🛡️ Threat Analysis
TokenPure is a watermark removal attack targeting content watermarks embedded in images — it defeats image-level protections designed to verify provenance and ownership. Per the ML09 definition, attacks that remove or defeat image watermarks/protections via purification or generative techniques fall under Output Integrity Attack, not ML01.