University of Waterloo researchers expose watermark removal vulnerability in AI deepfake defenses
Canadian researchers at the University of Waterloo demonstrated that a tool called UnMarker can remove watermarks from AI-generated images more than 50 per cent of the time without knowing the watermarking algorithm, exposing a systemic flaw in using watermarks as a defense against deepfakes. The researchers argued that this vulnerability undermines the premise of watermarking as a reliable way to identify AI-generated content and could enable harmful uses such as political manipulation and non-consensual synthetic media.
What happened
Researchers at the University of Waterloo's Cybersecurity and Privacy Institute developed a tool called UnMarker that can remove watermarks from AI-generated images without knowing the watermark design or whether an image is watermarked.
The tool exploits a systemic vulnerability in watermarking defenses by using statistical attacks to identify and distort pixel frequencies in the spectral domain, making images unrecognizable to watermark detectors while remaining visually unchanged to human observers.
When tested, UnMarker worked more than 50 per cent of the time on different AI models, including Google's SynthID and Meta's Stable Signature, without prior knowledge of the images' origins or watermarking methods.
Reported impact
Researchers stated that the vulnerability demonstrates that watermarking is likely not a viable shield against deepfakes and that global efforts to combat deepfakes may be on the wrong track.
The team warned that deepfakes created using AI systems without detection markers could be used for political smear campaigns, non-consensual pornography, and other harmful purposes with widespread consequences.
Index analysis
The vulnerability stems from inherent design constraints in watermarking schemes: watermarks must remain invisible to preserve image quality while being robust enough to survive image manipulation such as cropping or resolution reduction.
These requirements force watermarks to operate in the spectral domain, where subtle pixel manipulations can be consistently disrupted using statistical techniques that do not require knowledge of the specific watermarking algorithm.
Governance controls
In 2023, leading AI companies including OpenAI, Meta, Google and Amazon pledged at a White House event to implement mechanisms such as watermarking to clearly identify AI-generated content.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.