Erasing Invisible Image Watermarks
Erasing Invisible Image Watermarks | DSC261: Responsible Data Science, UCSD | Sept 2025 -- Dec 2025 |
- Implemented beige-box and black-box pipelines for removing StegaStamp and TreeRing invisible watermarks, combining SDXL VAE reconstruction, CIELAB luminance restoration, and cluster-specific SDXL image-to-image diffusion; achieved fidelity and semantic metrics (PSNR/SSIM, LPIPS, FID, CLIP-FID) closely tracking the NeurIPS 2024 first-place solution.
- For StegaStamp, improved image quality over a plain VAE-finetune baseline from 21.9 dB to 26.4 dB PSNR and from 0.65 to 0.78 SSIM via test-time optimization and CIELAB color transfer, while increasing average decoded-message Hamming distance from near-perfect recovery (0.08/100 bits) to ∼45/100 bits, effectively destroying the embedded payload; for TreeRing, used phase-space perturbations to remove watermarks at 45.8 dB PSNR and 0.997 SSIM.