AI watermarking embeds invisible signals within images to provide provenance information and identify content as AI-generated. In this paper, we introduce MarkSweep, a novel watermark removal attack that effectively erases the embedded watermarks from AI-generated images without degrading visual quality. MarkSweep first amplifies watermark noise in high-frequency regions via edge-aware Gaussian perturbations and injects it into clean images for training a denoising network. This network then integrates two modules, the learnable frequency decomposition module and the frequency-aware fusion module, to suppress amplified noise and eliminate watermark traces. Theoretical analysis and extensive experiments demonstrate that invisible watermarks are highly vulnerable to MarkSweep, which effectively removes embedded watermarks, reducing the bit accuracy of HiDDeN and Stable Signature watermarking schemes to below 67%, while preserving perceptual quality of AI-generated images.

翻译：AI水印技术通过在图像中嵌入不可见信号，以提供来源信息并识别内容为AI生成。本文提出MarkSweep，一种新颖的水印去除攻击方法，可在不降低视觉质量的前提下，有效擦除AI生成图像中嵌入的水印。MarkSweep首先通过边缘感知的高斯扰动增强高频区域的水印噪声，并将其注入干净图像以训练去噪网络。该网络随后集成两个模块——可学习频率分解模块与频率感知融合模块，以抑制增强的噪声并消除水印痕迹。理论分析与大量实验表明，不可见水印对MarkSweep高度脆弱，该方法能有效去除嵌入水印，将HiDDeN和Stable Signature水印方案的比特准确率降至67%以下，同时保持AI生成图像的感知质量。