Efforts to trace AI-generated images via embedded watermarks—from giants such as Google’s SynthID and academic ventures—now face a serious challenge. A groundbreaking paper presented at the 2025 IEEE Symposium on Security and Privacy introduces UnMarker, a universal, attacker-agnostic tool capable of defeating leading watermarking systems, tells IEEE Spectrum.
Watermarking systems typically hide signals in the spectral domain—subtle patterns imperceptible to human eyes but detectable by machines. UnMarker disrupts these signals through a three-stage process: cropping, high-frequency disruption, and low-frequency filtering. The result? Watermarks are effectively erased. In tests, UnMarker removed nearly 79% of SynthID watermarks, and about 60% of newer variants such as StegaStamp and Tree-Ring Watermarks.
The implications are sobering: even the most advanced watermarking schemes, once considered future-proof, are now vulnerable. UnMarker constitutes the first practical universal attack—it operates in a black-box setting without any knowledge of the watermarking scheme or the need for detector feedback.
For tech enthusiasts, here’s the takeaway:
- Watermarking is brittle: Techniques once considered secure can be dismantled with a few well-crafted perturbations.
- UnMarker raises the bar for attackers: It shows malicious actors don’t need insider knowledge or complex tools to remove traces of image provenance.
- Time to rethink detection strategies: Watermarking alone won’t suffice—robustness must combine watermarking with complementary methods such as metadata tracing or AI-based forensic analysis.
UnMarker reveals a critical vulnerability in current defenses against AI-generated image misuse. It’s a wake-up call for the community to reexamine and fortify how digital authenticity is protected.