Invisible watermarking has become a critical mechanism for authenticating AI-generated image content, with major platforms deploying watermarking schemes at scale. However, evaluating the vulnerability of these schemes against sophisticated removal attacks remains essential to assess their reliability and guide robust design. In this work, we expose a fundamental vulnerability in invisible watermarks by reformulating watermark removal as a view synthesis problem. Our key insight is that generating a perceptually consistent alternative view of the same semantic content, akin to re-observing a scene from a shifted perspective, naturally removes the embedded watermark while preserving visual fidelity. This reveals a critical gap: watermarks robust to pixel-space and frequency-domain attacks remain vulnerable to semantic-preserving viewpoint transformations. We introduce a zero-shot diffusion-based framework that applies controlled geometric transformations in latent space, augmented with view-guided correspondence attention to maintain structural consistency during reconstruction. Operating on frozen pre-trained models without detector access or watermark knowledge, our method achieves state-of-the-art watermark suppression across 15 watermarking methods--outperforming 14 baseline attacks while maintaining superior perceptual quality across multiple datasets.

翻译：隐形水印已成为认证AI生成图像内容的关键机制，各大平台正大规模部署水印方案。然而，评估这些方案在面对复杂去除攻击时的脆弱性，对于评估其可靠性并指导鲁棒性设计至关重要。在本工作中，我们通过将水印去除重新表述为视角合成问题，揭示了隐形水印的一个根本性脆弱点。我们的核心洞见是：生成同一语义内容在感知上一致的替代视角——类似于从偏移的视角重新观察同一场景——能够自然地去除嵌入的水印，同时保持视觉保真度。这揭示了一个关键缺陷：对像素空间和频域攻击具有鲁棒性的水印，在保持语义的视角变换面前依然脆弱。我们提出了一种零样本、基于扩散的框架，该框架在隐空间施加受控的几何变换，并通过视角引导的对应注意力机制增强，以在重建过程中保持结构一致性。该方法在无需访问检测器或水印先验知识的情况下，仅使用冻结的预训练模型，便在15种水印方法上实现了最先进的水印抑制效果——在多个数据集上超越了14种基线攻击方法，同时保持了更优的感知质量。