Abstract
The widespread deployment of high-fidelity generative models has intensified the need for reliable mechanisms for provenance and content authentication. In-processing watermarking, embedding a signature into the generative model's synthesis procedure, has been advocated as a solution and is often reported to be robust to standard post-processing (such as geometric transforms and filtering). Yet robustness to semantic manipulations that alter high-level scene content while maintaining reasonable visual quality is not well studied or understood. We introduce a simple, multi-stage framework for systematically stress-testing in-processing generative watermarks under semantic drift. The framework utilizes off-the-shelf models for object detection, mask generation, and semantically guided inpainting or regeneration to produce controlled, meaning-altering edits with minimal perceptual degradation. Based on extensive experiments on representative schemes, we find that robustness varies significantly with the degree of semantic entanglement: methods by which watermarks remain detectable under a broad suite of conventional perturbations can fail under semantic edits, with watermark detectability in many cases dropping to near zero while image quality remains high. Overall, our results reveal a critical gap in current watermarking evaluations and suggest that watermark designs and benchmarking must explicitly account for robustness against semantic manipulation.
Abstract (translated)
高保真生成模型的广泛部署加剧了对可靠溯源与内容认证机制的需求。在处理过程中嵌入水印——即在水印生成模型的合成流程中嵌入签名——已被提倡作为一种解决方案，且常被报道对标准后处理（如几何变换和滤波）具有鲁棒性。然而，对于在保持合理视觉质量的同时改变高层场景内容的语义操控，其鲁棒性尚未得到充分研究与理解。我们提出一个简单的多阶段框架，用于在语义漂移条件下系统性地压力测试处理中生成水印。该框架利用现成的目标检测、掩码生成以及语义引导修复或重生成模型，以产生受控的、意义改变的编辑操作，同时最小化感知降质。基于对代表性方案的广泛实验，我们发现鲁棒性随语义纠缠程度显著变化：在多种常规扰动下仍可检测水印的方法，可能在语义编辑下失效，许多情况下水印可检测性降至近零，而图像质量仍保持较高水平。总体而言，我们的结果揭示了当前水印评估中的关键缺口，并表明水印设计与基准测试必须明确考虑对语义操控的鲁棒性。
URL
https://arxiv.org/abs/2603.27513
