Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal

Computer Science > Cryptography and Security [Submitted on 9 May 2026] Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal Yevin Nikhel Goonatilake, Giuseppe Ateniese Watermarks for AI-generated images are meant to support downstream decisions about provenance, manipulation, and trust. In the settings that motivate watermark removal, therefore, success means more than causing the watermark test to fail. A successful remover must also preserve the utility of the image and make the output forensically indistinguishable from clean content, so that defeating the verifier restores deniability rather than merely replacing one detection signal with another. We show that current watermark removal attacks fail this stronger objective. Across six state-of-the-art removers spanning four attack families, independent forensic detectors distinguish removal-processed outputs from clean images at over 98% true-positive rate under a 1% false-positive budget. Thus, current removers often replace the watermark with a different detectable signal. Using UnMarker (IEEE S&P 2025) as a detailed case study, we show that this signal persists under common post-processing, exhibits a characteristic two-regime spectral deformation, and yields a three-way tension among removal success, image quality, and forensic stealth. These results show that existing removal benchmarks are incomplete: they reward verifier evasion and utility preservation while omitting forensic stealth. A workable watermark remover must satisfy all three conditions at once: watermark evasion, utility preservation, and forensic indistinguishability from clean content. Comments: 17 pages, 12 pages main text plus 5 pages appendix, includes figures and tables; under submission Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2605.09203 [cs.CR]   (or arXiv:2605.09203v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.09203 Focus to learn more Submission history From: Yevin Goonatilake [view email] [v1] Sat, 9 May 2026 22:45:48 UTC (14,122 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)