One Prompt Is Enough: Watermark Laundering Through Foundation Image Models
Jidong Yang, Qi Li, Wei Zong, Yang-Wai Chow, Willy Susilo, Huaike Yu, Chunpeng Wang, Suo Gao
cs.CV · cs.AI · cs.CR
Quick verdict
Shows a single prompt to commercial image editors can launder invisible watermarks; sound and honest, but limited to three classic watermark schemes; no CIs.
Summary
The paper formalizes "watermark laundering": an attacker submits a watermarked image plus a single reconstruction prompt to a public foundation image editor and receives a visually faithful output from which the victim's invisible watermark no longer decodes reliably. Under a strict black-box threat model (no decoder, key, gradient, or feedback access), laundering is defined as simultaneous payload disruption and content preservation, supported by an information-theoretic reconstruction-bottleneck argument (data processing inequality plus a Fano-style BER bound). Empirically the authors run a full factorial grid: six commercial editing models (GPT Image 1/1.5/2; Nano Banana/Pro/2) × three watermarking schemes (DwtDct, DwtDctSvd, RivaGAN) × 100 stratified MS-COCO images = 1,800 outputs. GPT models yield the strongest disruption (GPT Image 1 mean BER 0.4808, nearest the random value 0.5) at low fidelity (PSNR 14.0); Nano Banana 2 reaches high fidelity (PSNR 30.27, SSIM 0.879) while DwtDct stays at BER 0.4110 — a high-fidelity laundering regime. Prompt ablations show BER is insensitive to wording, including removal of explicit hidden-information language, so lexical filtering would not block the effect. Conventional attacks (blur, noise, contrast, rotation, cropping, BM3D) are compared, and high-frequency residual correlates only weakly with BER (r = 0.316). Main limitations: only three classic watermark schemes, one prompt family, 100 images, no statistical uncertainty quantification, and a conventional baseline suite lacking diffusion-based regeneration.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A single natural-language reconstruction prompt submitted to a public black-box foundation image editor can render a victim's invisible watermark unreliable while the output remains visually and semantically faithful (Definition 1).
- OpenAI GPT Image models produce the strongest payload disruption (GPT Image 1 mean BER 0.4808, closest to random 0.5), while Nano Banana 2 achieves high-fidelity laundering of DwtDct (BER 0.4110 at PSNR 30.27, SSIM 0.879).
- Payload disruption does not require removal-oriented wording — any reconstruction framing suffices (minimal-prompt BER 0.4167 on Nano Banana 2) — so lexical prompt filtering cannot mitigate the threat.
- Prompt-conditioned reconstruction is a distinct operational attack interface, motivating foundation-model reconstruction as a missing robustness condition in standard invisible-watermark evaluation.
Strengths
Rigorous laundering definition separating it from destructive removal
Definition 1 and Equation (2) require payload disruption AND content preservation; Sec. 2 explicitly states decoder failure from severe image destruction is not laundering, and the paper refuses to collapse BER and fidelity into one aggregate score (Table 1a/1b report them jointly).
Novel operational threat interface versus prior regeneration attacks
Unlike cited local-pipeline attacks (Zhao et al. NeurIPS 2024; Liu et al. ICLR 2025, refs [15,16]), the attacker uses deployed public editing APIs with one prompt, no decoder knowledge, and no feedback — Table 2 shows conventional operators either destroy fidelity (rotation PSNR 9.71) or fail on payload (Gaussian blur BER 0.0000 for DwtDctSvd/RivaGAN), supporting the distinct-interface claim.
Clean experimental hygiene in the protocol
Policy-relevant prompt-insensitivity finding
Unusually candid limitations section
Weaknesses
No statistical uncertainty quantification anywhere
Victim watermark set is dated and weak
Title overgeneralizes relative to the paper's own Table 1
Theory largely restates standard inequalities
Provenance-substitution analysis is incomplete
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Preliminary Review — One Prompt Is Enough: Watermark Laundering Through Foundation Image Models (arXiv 2609.01249)
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is 'watermark laundering' as defined in this paper?
A failure mode where an attacker sends a watermarked image plus a single natural-language reconstruction prompt (e.g., asking an AI editor to restore or clean the image) to a public image-editing model. The returned image still looks faithful to the original, but an invisible watermark embedded in it can no longer be decoded reliably — visible content is preserved while the hidden forensic payload is destroyed.
Which AI image models and watermarking schemes were tested?
Six commercial editors — GPT Image 1, 1.5, and 2 (OpenAI) and Nano Banana, Nano Banana Pro, and Nano Banana 2 (Google) — against three classic invisible watermarking schemes (DwtDct, DwtDctSvd, RivaGAN), over 1,800 reconstructed 1024×1024 outputs from 100 stratified MS-COCO images.
Does this attack strip C2PA Content Credentials or SynthID?
No. The authors found C2PA/Content Credentials binary markers present in all 100 sampled outputs per provider but could not cryptographically verify signatures, and SynthID was not tested at all. They explicitly do not claim provider provenance is removed or substituted; the paper concerns post-hoc invisible watermark payloads only.
Which watermark survived the attack best?
In the tested grid, RivaGAN held up best under high-fidelity editing: under Nano Banana 2 its bit error rate was 0.1233 (well below the 0.5 random-recovery limit) and DwtDctSvd scored 0.2658, whereas DwtDct stayed near 0.41 for every editing model, meaning that scheme was reliably disrupted even by the gentlest editor.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure interiors (visual examples in Figs. 1, 3, 4a and the Pstruct module layout in Fig. 2) appear only as captions in the extraction; their pictorial content could not be assessed.
- The supplementary material containing the verbatim full and minimal prompt text is referenced (Sec. 3) but not included in the provided text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.