News and Updates

• November 13th, 2026 - Universal Invisible Watermark Removal announced

Motivation

Invisible watermarking is becoming an important tool for labeling AI-generated images, yet its robustness is often evaluated against a narrow range of distortions and removal attacks. A broader evaluation is needed to assess resilience across different watermarking schemes, the impact of attacks on image quality, and whether removal leaves traces detectable by forensic methods.

Task

The task is to develop universal methods for removing invisible watermarks from images. The challenge covers more than 20 watermarking schemes, with some schemes kept hidden during development to evaluate generalization. The challenge includes two tracks:

• Post-hoc Track: Covers watermarks applied to existing images as a separate processing step, including neural methods such as HiDDeN [1] and TrustMark [2].

• In-Generation Track: Covers watermarks embedded during image generation. Examples include Tree-Ring [3], which embeds a signal into the initial noise, and Stable Signature [4], which modifies the generator’s decoder to produce watermarked images.

Evaluation

Method performance is evaluated along three dimensions:

• Watermark removal effectiveness: Measured using TPR at a fixed FPR (TPR@FPR) or bit error rate (BER), depending on the watermarking scheme
• Image quailty preservation: Removal should introduce minimal visual distortion and preserve the content and appearance of the image. Evaluated using both pixel-wise and perceptual metrics to assess visual distortion and changes in image content and appearance.
• Resistance to forensic detection: The attack should also avoid leaving traces that a hidden forensic detector can identify, including artifacts that may not be noticeable to a human observer.

Challenge Timeline [TBD]

Dataset [TBD]

Participate

Participation details will be announced soon. Stay tuned!

Organizers

• Khaled Abud, khaled.abud@graphics.cs.msu.ru

• Mark Goverdovskii, mark.goverdovskii@graphics.cs.msu.ru

• Kirill Aistov

• Dmitry Vatolin

• Radu Timofte

References

1. [1] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “HiDDeN: Hiding data with deep networks,” in Proc. Eur. Conf. Comput. Vis. (ECCV), 2018, pp. 682–697, doi: 10.1007/978-3-030-01267-0_40.
2. [2] T. Bui, S. Agarwal, and J. Collomosse, “TrustMark: Robust watermarking and watermark removal for arbitrary resolution images,” in Proc. IEEE/CVF Int. Conf. Comput. Vis. (ICCV), 2025, pp. 18629–18639.
3. [3] Y. Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-Rings watermarks: Invisible fingerprints for diffusion images,” in Adv. Neural Inf. Process. Syst., vol. 36, 2023, pp. 58047–58063, doi: 10.52202/075280-2529.
4. [4] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, “The Stable Signature: Rooting watermarks in latent diffusion models,” in Proc. IEEE/CVF Int. Conf. Comput. Vis. (ICCV), 2023, pp. 22466–22477.