Newest papers

BrushOff: Stroke-Based Re-rendering as a Watermark Removal Attack on Painting

Hao Chen, Junnan Xu · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26682 · cited by 0 works (OpenAlex) · open-access PDF

German

Unsichtbare Wasserzeichen werden verwendet, um zu markieren, wer ein Gemälde besitzt. Wir zeigen, dass ein einfacher Angriff die robusteste Eigenschaft entfernt. Die Attacksonde zeichnet die Wasserzeichenmalerei mit Pinselstreifen um, indem sie einen vorgefertigten Stroke-basierten Renderer verwendet. Wir nennen diesen Angriff BrushOff. Es braucht keine Ausbildung, kein Wissen über das Wasserzeichen und kein generatives Modell. Wir testen vier Wasserzeichen auf 500 Gemälden aus fünf Stilen. VINE, ein kürzlich gebautes Wasserzeichen, um Bildbearbeitung zu überleben, überlebt alle 14 herkömmlichen Verzerrungen, die wir testen, mit mindestens 97,8% Erkennung. Benpainting senkt seine Erkennung auf 1,8%, während die Ausgabe einen No-Referenz-Qualitätsscore

Machine translation (Meta M2M100); the English original follows.

Abstract

Invisible watermarks are used to mark who owns a painting. We show that a simple attack removes the most robust one we test. The attack redraws the watermarked painting with brush strokes, using a pretrained stroke-based renderer. We call this attack BrushOff. It needs no training, no knowledge of the watermark, and no generative model. We test four watermarks on 500 paintings from five styles. VINE, a recent watermark built to survive image editing, survives all 14 conventional distortions we test, with at least 97.8% detection. Repainting lowers its detection to 1.8%, while the output keeps a no-reference quality score close to that of the clean paintings. Diffusion regeneration can also remove VINE, but at the same removal level it moves the image twice as far from the painting in DreamSim distance, and it changes what the painting shows. Because the renderer draws a countable number of strokes, we can control the attack strength step by step. Finally, we test what kind of signal survives. A simple probe that stores bits in the relative brightness of neighboring regions survives repainting, while a probe that uses absolute brightness does not. The same probe fails under diffusion regeneration, while VINE fails under repainting. Robustness to these two attacks is therefore a separate property, and benchmarks should test both.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Robustness (evolution), Artificial intelligence, Painting, Watermark, Computer vision

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange