Listen to this Post
Introduction:
The foundation of digital trust in the age of generative AI is cracking. Security researcher and former CISO Mike Raggo’s recent Deepfake Risk Report highlights a critical and rapidly escalating threat: the emergence of model-agnostic techniques capable of stripping AI-image watermarks—both visible and invisible—across platforms. This capability directly undermines provenance and authenticity workflows, rendering current watermarking strategies ineffective and creating a dangerous environment where synthetic media can be falsely presented as authentic. As open-source tools and sophisticated attacks like MarkNull and UnMarker demonstrate the ability to remove watermarks from systems like Google’s SynthID with high fidelity and minimal visual degradation, the very mechanisms designed to combat deepfakes and misinformation are being systematically dismantled.
Learning Objectives:
- Understand the technical underpinnings of model-agnostic watermark removal attacks and why they represent a paradigm shift in the fight against deepfakes.
- Identify the specific tools, techniques, and vulnerabilities (including C2PA stripping and latent space manipulation) that adversaries are using to bypass provenance systems.
- Learn practical defensive measures, forensic detection methods, and command-line techniques to identify and mitigate watermark removal attempts.
You Should Know:
- The Rise of Model-Agnostic Attacks: From UnMarker to MarkNull
Traditional watermark removal attacks were often model-specific, requiring knowledge of the generative model’s architecture. However, recent academic research has produced “universal” attacks that operate without this knowledge. The UnMarker attack, presented at the 2025 IEEE Symposium on Security and Privacy, was the first practical universal attack on defensive image watermarking. It works by disrupting the spectral amplitudes where robust watermarks reside, attacking both high- and low-frequency components.
Building on this, researchers from Queen’s University and the University of Waterloo recently introduced MarkNull (arXiv:2608.10166), a more advanced model-agnostic watermark removal attack. MarkNull exploits a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. By introducing a Noise-Latent Alignment Score (NLAS) and optimizing to decorrelate the latent representation from the watermark, MarkNull reduces average bit accuracy to 53.14%—approaching random guessing (50%)—without perceptible image degradation. Notably, it successfully compromises Google’s SynthID-Image system while preserving high visual quality.
Step‑by‑step guide: Understanding the MarkNull Attack Vector
While MarkNull is an academic attack, understanding its methodology reveals the vulnerability of current watermarking:
– Step 1: The attacker obtains a watermarked AI-generated image (e.g., from Gemini with SynthID).
– Step 2: The attack analyzes the latent representation of the image, identifying the statistical dependency between the noise and the watermark.
– Step 3: An optimization objective is formulated to selectively decorrelate the latent representation from the embedded watermark.
– Step 4: The image is regenerated or manipulated in the latent space, effectively removing the watermark while preserving semantic fidelity.
– Step 5: The resulting image is forensically indistinguishable from a non-watermarked image to many detectors, passing as authentic content.
This attack vector demonstrates that relying solely on invisible watermarks is no longer a viable defense against determined adversaries.
- The Tool Ecosystem: Open-Source Watermark Removal Goes Mainstream
The gap between academic research and practical exploitation has closed rapidly. A market for removing AI watermarks has sprung up, with tools flooding the web following Anthropic’s announcement of invisible text watermarks. Key projects include:
- watermarks-remover: An MIT-licensed tool from developer Guillaume Meyer that began as a Claude-only agent skill and now advertises coverage of Claude, Gemini, SynthID-Text, OpenAI provenance surfaces, and open-weight models. The project gained over 2 million views and thousands of GitHub stars within days.
- remove-ai-watermarks: A comprehensive CLI and Python library that strips visible labels (Gemini sparkle), invisible pixel watermarks through diffusion regeneration, and metadata including C2PA, EXIF, XMP, and IPTC. It also supports video provenance cleaning for models like Sora, Veo, and Kling.
- Anthropies: Released by Cardano founder Charles Hoskinson, this tool targets Claude’s keyed text watermark, C2PA image credentials, and Git commit trailers that attribute content to Claude.
- C2PARemover: A dedicated CLI tool to detect and remove Content Authenticity Initiative (CAI) metadata, also known as C2PA metadata, from image files.
Practical Commands for Watermark and Metadata Removal
Security professionals and researchers should be aware of how these tools operate. Below are verified commands from the remove-ai-watermarks toolkit:
Installation (metadata-focused default):
uv tool install remove-ai-watermarks
Inspect an image for provenance signals and watermarks:
remove-ai-watermarks identify image.png
Remove a known visible mark and AI metadata:
remove-ai-watermarks visible image.png -o clean.png
Strip metadata without running visible inpainting or diffusion:
remove-ai-watermarks metadata image.png --remove -o clean.png
Note: Without -o, this command overwrites the source in place.
Process a directory of images:
remove-ai-watermarks batch ./input_images/ -o ./clean_images/
Video provenance identification and removal:
remove-ai-watermarks video identify input.mp4 --check remove-ai-watermarks video all input.mp4 -o clean.mp4
Installation for invisible watermark removal (requires CUDA):
uv tool install --force "remove-ai-watermarks[qwen-zimage]"
These commands highlight how trivial it has become for adversaries to strip provenance data from AI-generated content.
- The Forensic Stealth Problem: Removal Is Not Enough
A critical finding from recent research (arXiv:2605.09203) is that current watermark removal attacks fail to achieve true forensic stealth. While they may cause the watermark test to fail, they often replace the watermark with a different detectable signal. Across six state-of-the-art removers spanning four attack families, independent forensic detectors distinguished removal-processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget.
Using UnMarker as a case study, researchers demonstrated that this forensic signal persists under common post-processing, exhibits a characteristic two-regime spectral deformation, and creates a three-way tension among removal success, image quality, and forensic stealth. This means a workable watermark remover must satisfy all three conditions simultaneously: watermark evasion, utility preservation, and forensic indistinguishability from clean content.
Forensic Detection Commands (Defensive)
To detect whether an image has been processed by a watermark remover, security teams can use forensic analysis tools. While no single command guarantees detection, the following approaches are recommended:
Using ExifTool to inspect metadata:
exiftool -All image.png
Using the identify command from remove-ai-watermarks to check for residual signals:
remove-ai-watermarks identify image.png
Python script for basic spectral analysis (forensic indicator):
import numpy as np
from PIL import Image
import matplotlib.pyplot as plt
Load image and convert to grayscale
img = np.array(Image.open('image.png').convert('L'))
Perform 2D FFT
f_transform = np.fft.fft2(img)
f_shift = np.fft.fftshift(f_transform)
magnitude_spectrum = np.log(np.abs(f_shift) + 1)
Check for anomalies in frequency distribution
(Two-regime spectral deformation is a known indicator of UnMarker processing)
- Google’s Complicated Stance: Removing Visible Watermarks While Keeping SynthID
Adding to the complexity, Google announced in August 2026 that it will allow users to remove visible watermarks from AI-generated images while keeping the invisible SynthID provenance signal intact. Users can toggle this setting in “Settings” → “Media Watermark”. While Google maintains that disabling the visible watermark does not affect the invisible SynthID watermark or C2PA metadata, this decision has been met with criticism. Critics argue that it normalizes the removal of provenance indicators and could facilitate the distribution of fake videos. Furthermore, given that tools like MarkNull and remove-ai-watermarks can already strip SynthID, Google’s policy shift appears to be a concession to user preference rather than a security enhancement.
5. Defensive Strategies and the Future of Provenance
Given the current landscape, what can defenders do? The research community is actively working on countermeasures. The authors of MarkNull have also presented an attack detection mechanism as a defensive counterpart to their attack, highlighting the necessity of developing watermark designs resilient to model-agnostic latent-space attacks. Additionally, the concept of forensic stealth is gaining traction as a critical evaluation metric for watermarking systems.
Practical Defensive Recommendations:
- Multi-Layered Provenance: Do not rely solely on invisible watermarks. Combine them with cryptographic signatures, blockchain-based verification, and robust metadata (C2PA).
- Forensic Monitoring: Implement forensic detectors that can identify the spectral deformations characteristic of watermark removal attacks.
- Regular Auditing: Use tools like `remove-ai-watermarks identify` to audit your own AI-generated content for watermark integrity.
- Policy and Training: Educate users and investigators that the absence of a watermark does not guarantee authenticity. Deepfake detection must go deeper than surface-level markers.
What Undercode Say:
- Key Takeaway 1: Model-agnostic watermark removal is no longer theoretical—it is a practical, accessible threat. Tools like MarkNull and open-source projects like remove-ai-watermarks have democratized the ability to strip provenance data from AI-generated content with minimal effort and high fidelity.
- Key Takeaway 2: The forensic community is in an arms race. While current removers leave detectable forensic traces, the gap between removal and forensic stealth is narrowing. Defenders must adopt multi-layered provenance strategies and invest in advanced forensic detection capabilities.
Analysis: The situation described in Mike Raggo’s report represents a critical juncture in the fight against deepfakes. The very tools designed to establish trust in digital media are being systematically undermined by adversaries who are leveraging academic research and open-source development. The rapid proliferation of watermark removal tools—spawning within days of Anthropic’s watermark announcement—demonstrates the agility of the threat landscape. Furthermore, Google’s decision to allow users to remove visible watermarks, while technically preserving SynthID, sends a confusing message about the importance of provenance. The core challenge is no longer whether watermarks can be removed—they can—but whether we can develop forensic methods to detect that removal and build resilient systems that do not rely on a single point of failure. As the lines between authentic and synthetic media continue to blur, the security community must prioritize research into attack-resilient provenance and forensic stealth.
Prediction:
- -1 The widespread availability of model-agnostic watermark removal tools will lead to a significant increase in undetected deepfake dissemination, particularly in political disinformation and financial fraud campaigns, as adversaries can now easily strip provenance markers.
- -1 Current regulatory frameworks, such as the EU AI Act, that rely on watermarking as a compliance mechanism will face enforcement challenges, as the technical basis for compliance is being systematically undermined.
- +1 The forensic detection community will rise to the challenge, developing new techniques that go beyond watermark detection to identify the subtle artifacts of removal attacks, potentially leading to a new generation of more robust provenance systems.
- -1 Organizations that rely on AI-generated content for marketing, journalism, or internal communications will face increased reputational risk as the provenance of their assets becomes questionable, necessitating new verification workflows.
- +1 The crisis will accelerate research into alternative provenance mechanisms, such as cryptographic signing at the point of capture (e.g., chip-based signatures in cameras) and decentralized identity verification.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/e9srG5ub – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
