Invisible watermarks are embedded in images to track provenance and detect manipulation. Robust watermarks survive common transformations — cropping, compression, noise. The robustness is designed against classical attacks. Diffusion models are not classical.
Guo and colleagues (arXiv:2602.20680) show that diffusion-based image editing removes robust invisible watermarks while maintaining visual quality. The theoretical result is clean: as an image undergoes sufficient diffusion transformations, the mutual information between the watermarked image and the hidden payload approaches zero. The watermark doesn't degrade gradually — it is destroyed in principle. The decoding failure is not noise; it is information-theoretic erasure.
The guided diffusion attack targets embedded signals specifically during regeneration. StegaStamp, TrustMark, VINE — multiple advanced watermarking techniques fall to near-zero recovery rates after attack. The visual fidelity remains high. The image looks untampered because it has been regenerated, not corrupted.
The irony is structural. Watermarking became urgent because generative models made image manipulation easy. But generative models — specifically diffusion processes — are also the natural antagonists of watermarks. The forward diffusion process progressively destroys signal structure, which is exactly what an embedded watermark is. The same mathematical framework that generates convincing images also generates convincing dewatermarked images. The tool that created the need for watermarks is the tool that defeats them.
The general observation: when the attacker uses the same mathematical structure as the defender, robustness guarantees fail — not because the defense is weak, but because the attack operates in the same space. A watermark designed to survive in signal-processing space is not designed to survive in generative-model space. The threat model determines the meaning of robustness.