ML Security PapersHide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction
Huajie Chen 1, Tianqing Zhu 1, Hailin Yang 1, Yuchen Zhong 1, Yang Zhang 2, Hui Sun 1, Heng Xu 1, Zuobin Ying 1, Lihua Yin 3, Wanlei Zhou 1
Published on arXiv
2603.01067
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
HIDE&SEEK consistently defeats state-of-the-art proactive watermarking defenses with stronger erasure and higher visual fidelity than existing removal attacks, while being query-free and knowledge-free.
HIDE&SEEK
Novel technique introduced
Watermarking has emerged as a key defense against the misuse of machine-generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost-effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.
Key Contributions
- HIDE stage: identifies and masks pixels most critical to the watermark's structure using a targeted localization strategy
- SEEK stage: pixel-wise reconstructs only the masked critical pixels with a generative model, leaving the rest of the image untouched
- Query-free and knowledge-free attack requiring no access to the watermark detector or knowledge of the underlying watermarking scheme, outperforming existing removal attacks in both erasure strength and image quality
🛡️ Threat Analysis
HIDE&SEEK attacks content watermarks embedded in AI-generated image outputs — identifying and reconstructing only watermark-critical pixels to erase embedded signals while preserving visual fidelity. Per the guidelines, attacks that remove or defeat image watermarks/protections are ML09 (output integrity/content provenance attacks), not ML01.