Survival of Watermarks Under Semantics-Preserving Resynthesis

Determine whether a payload embedded in a spatial-block-grid image watermark can survive semantics-preserving image resynthesis that regenerates image content rather than merely degrading the original signal.

Background

The paper distinguishes AI-based attacks that regenerate image content from conventional attacks that attenuate or geometrically displace an embedded watermark. In a semantics-preserving resynthesis, the carrier image is replaced while its visual meaning is retained, so robustness mechanisms designed for signal-level distortions may not transfer.

The authors exclude content-regeneration attacks from their measurements and explicitly identify the survival of a payload under such resynthesis as unresolved. This problem concerns whether a watermark can remain recoverable when the image is regenerated by a generative model rather than subjected to ordinary compression, filtering, cropping, or geometric transformation.

References

Attacks that regenerate content rather than degrade it were excluded for the reason given in Section II-D, and the question of whether a payload of this kind can survive a semantics-preserving resynthesis remains open.

— What Limits Robustness in Deep Image Watermarking: An Analysis of Mechanisms and Their Scaling Across Capacities  (2609.01050 - Bistroń et al., 1 Sep 2026) in Section VI-C, “Limitations”

In the realistic InstructPix2Pix attack regime, reconstruction cosine remains in the $\sim$0.72--0.82 range (\cref{tab:bit_flip_5way}, $k=5$--$30$); more powerful editing models (e.g., Google Gemini) are expected to produce higher BER, and a thorough quantification across stronger editors is left for future work.

— Semantic Watermarking for Malicious Image Manipulation Detection  (2609.39623 - Kim et al., 30 Sep 2026) in Section 5, Limitations, paragraph “Channel and Modality Limits”