The rapid proliferation of realistic deepfakes has raised urgent concerns over their misuse, motivating the use of defensive watermarks in synthetic images for reliable detection and provenance tracking. However, this defense paradigm assumes such watermarks are inherently resistant to removal. We challenge this assumption with DeMark, a query-free black-box attack framework that targets defensive image watermarking schemes for deepfakes. DeMark exploits latent-space vulnerabilities in encoder-decoder watermarking models through a compressive sensing based sparsification process, suppressing watermark signals while preserving perceptual and structural realism appropriate for deepfakes. Across eight state-of-the-art watermarking schemes, DeMark reduces watermark detection accuracy from 100% to 32.9% on average while maintaining natural visual quality, outperforming existing attacks. We further evaluate three defense strategies, including image super resolution, sparse watermarking, and adversarial training, and find them largely ineffective. These results demonstrate that current encoder decoder watermarking schemes remain vulnerable to latent-space manipulations, underscoring the need for more robust watermarking methods to safeguard against deepfakes.

翻译：逼真深度伪造技术的迅速扩散引发了对其滥用的迫切担忧，这促使人们在合成图像中使用防御性水印以实现可靠的检测和溯源追踪。然而，这种防御范式假定此类水印本质上具有抗去除性。我们通过DeMark挑战了这一假设，这是一个针对深度伪造防御性图像水印方案的无查询黑盒攻击框架。DeMark通过一种基于压缩感知的稀疏化过程，利用编码器-解码器水印模型在潜在空间中的脆弱性，在保持适合深度伪造的感知和结构真实性的同时抑制水印信号。在八种最先进的水印方案上，DeMark将水印检测准确率从平均100%降低至32.9%，同时保持了自然的视觉质量，其性能优于现有攻击方法。我们进一步评估了三种防御策略，包括图像超分辨率、稀疏水印和对抗训练，发现它们在很大程度上是无效的。这些结果表明，当前的编码器-解码器水印方案仍然容易受到潜在空间操作的攻击，这凸显了需要更鲁棒的水印方法来防范深度伪造。