Understanding Semantic Perturbations on In-Processing Generative Image Watermarks

Understanding Seman tic P erturbations on In-Pro cessing Generativ e Image W atermarks Anirudh Nakra and Min W u Univ ersity of Maryland, College P ark, MD, USA Abstract. The widespread deplo yment of high-fidelit y generative models has intensified the need for reliable mec hanisms for pro venance and con- ten t authen tication. In-processing w atermarking—embedding a signature in to the generative model’s syn thesis p rocedure—has b een advocated as a solution and is often rep orted to b e robust to standard post-pro cessing (suc h as geometric transforms and filtering). Y et robustness to seman- tic manipulations that alter high-level scene con tent while main taining reasonable visual quality is not well studied or understo od. W e intro- duce a simple, multi-stage framework for systematically stress-testing in-pro cessing generative watermarks under seman tic drift. The framew ork utilizes off-the-shelf mo dels for ob ject detection, mask generation, and seman tically guided inpain ting or regeneration to pro duce controlled, meaning-altering edits with minimal p erceptual degradation. Based on extensiv e experiments on representativ e schemes, w e find that robustness v aries significan tly with the degree of seman tic en tanglemen t: metho ds b y whic h w atermarks remain detectable under a broad suite of conv entional p erturbations can fail under semantic edits, with watermark detectabil- it y in many cases dropping to near zero while image quality remains high. Overall, our results reveal a critical gap in current watermarking ev aluations and suggest that watermark designs and benchmarking must explicitly account for robustness against semantic manipulation. Keyw ords: Generativ e Image W atermarking · Robust W atermarking · Seman tic P erturbations 1 In tro duction The rapid adv ancement and widespread accessibility of generative Artificial In telligence (AI) hav e ushered in a new era of digital conten t creation. Models suc h as Stable Diffusion [25] can pro duce photorealistic images from simple text prompts, facilitating creativity but also revealing new so cietal challenges. The ease with which synthetic media can b e generated and disseminated has prompted an urgen t need for reliable metho ds to establish data prov enance—that is, to determine the origin of a piece of digital conten t. This is not merely an academic concern but a critical so cietal imp erativ e for combating misinformation, protecting in tellectual prop ert y , and ensuring the resp onsible deploymen t of AI tec hnologies. This urgency is reflected in high-level p olicy initiatives, such as the U.S. Executive Order on Safe, Secure, and T rust worth y AI (Executive Order 2 Nakra and W u 32 W i th o u t W a te r mar k Sta b l e- S i gna t ure Tr e e - Ri ng G a us s i a n S ha di ng I m ag e - P r oc es s i ng E di t s G l obal S em ant i c S hi f t s Loc al S em ant i c S hi f t s F in e - t une dec ode r M odi f y g ener at i n g di s t r i but i on D i s t r i but i on pr es er v i ng s am pl i n g M e ssa g e M e ssa g e M e ssa g e D et ect ab i l i t y P ix e l q u a lit y S e m a n t ic s im ila r it y T P R , A U C , B i t A c c u r a c y , p - v al ues P S N R , S S I M , A r t i f ac t anal y s i s C ont ex t ual E nc oder s , LLM A gr eem ent S em a nt i c T r a de o f f A na l y s i s Fig. 1: Represen tative in-pro cessing generative image w atermarks suc h as Stable- Signature [7], T ree-Ring [35], and Gaussian Shading [36] aim to embed the watermarking signal during the LDM generation pro cess. W e stu dy the resilience of these w atermarks against a v ariety of seman tic p erturbations, aiming to quantify the level of seman tic en tanglement ac hieved b y these metho ds. 14110) [32], which explicitly calls for the developmen t of standards and to ols for con tent authentication and w atermarking to lab el AI-generated con tent. Digital watermarking for images has b een advocated as a promising solution to address this prov enance problem. A robust watermarking system is exp ected to p ossess several key prop erties: imp erceptibilit y , ensuring the watermark do es not degrade the visual quality of the conten t; capacit y , allowing for the em b edding of a sufficien t amount of information; robustness , enabling the w atermark’s surviv al against common image manipulations; and security , b eing resilien t against adv ersarial attac ks. Mo dern approaches ha ve mov ed b ey ond simple p ost-processing techniques and instead integrate the watermark directly in to the generative pro cess of deep learning mo dels, promising unprecedented lev els of robustness [7, 35]. Ho wev er, the ev aluation of this robustness has largely b een confined to a sp ecific class of pixel/sample-level p erturbations. Existing benchmarks, suc h as W A VES [2], pro vide a standardized and v aluable framework for stress-testing w atermarks against a diverse suite of attacks. Similarly , the original publications for representativ e metho ds such as Stable Signature and T ree-Ring demonstrate resilience against signal-level, or syntactic p erturbations such as JPEG compres- sion, noise addition, geometric transforms, and v arious filtering op erations [2, 7, 35]. While these tests are essential, they may present a false sense of securit y b ecause they do not account for a more p otent and insidious threat vector for images in the GenAI era: attac ks that target the semantic conten t of images. This pap er’s central thesis is that the very mechanism that mak es mo dern generativ e w atermarks robust—their deep integration in to the semantic and Understanding Semantic Perturbations on Generative Image W atermarks 3 laten t fabric of the generative mo del—ma y also b e their weakness. W e argue that p erturbations designed to manipulate sp ecific me aning of an image, rather than just its pixel v alues, may circumv en t the defenses of these sophisticated w atermarking schemes. T o inv estigate this conjecture, we introduce a mo dular framew ork for launching targeted semantic p erturbations as illustrated in Fig. 1. This framework systematically identifies salien t ob jects within an image and replaces them with new, semantically coherent conten t using state-of-the-art text-guided diffusion mo dels. Overall, our contributions are threefold: • W e present a multi- stage framew ork to study the entanglemen t of scene se- man tics with the watermarking pro cess, which combines ob ject detection with st ylization metho ds and generativ e inpainting to p erform conten t manipulation in a practical blac k-b o x setup. • W e conduct an extensiv e empirical study on representativ e in-pro cessing gener- ativ e image watermarks, demonstrating that robustness v aries sharply with the degree of seman tic entanglemen t: methods by which remain detectable under a broad suite of con ven tional p erturbations can fail under semantic edits. • W e pro vide a broader and stronger suite of image pro cessing baseline perturba- tions on represen tative in-pro cessing generative image watermarks. Our findings in this pap er c hallenge the prev ailing assumptions ab out water- mark robustness and highligh t a critical new direction for the developmen t and ev aluation of data prov enance technologies for generative AI. 2 Bac kground, Notation, and Related Prior Art 2.1 Laten t Diffusion Mo dels (LDM) Diffusion mo dels are probabilistic generative mo dels that learn to transform samples from a simple prior distribution (typically Gaussian noise) into data samples via a sequence of learned denoising steps. They hav e achiev ed strong p erformance across image synthesis [25], sup er-resolution [9], and related con- ditional generation tasks [6, 27]. As a result, latent diffusion mo dels [25] hav e b ecome a standard bac kb one for high-quality text-to-image generation. Unlike pixel-space diffusion, latent diffusion p erforms the forw ard noising and rev erse denoising processes in a low er-dimensional latent space obtained via a learned enco der/decoder (suc h as a v ariational auto encoder (V AE) [17]). Op erating in this compact represen tation improv es computational efficiency and guides the mo del to ward capturing higher-lev el seman tic structure, since the laten t space abstracts a wa y some low-lev el pixel v ariability while preserving the global comp osition. LDMs define a diffusion pro cess in a learned latent space. Let x ∈ R H × W × 3 denote an image. An encoder E maps x to a laten t representation z 0 = E ( x ) ∈ R h × w × d , and a deco der D maps latents back to pixel space, ˆ x = D ( z 0 ) . Using the denoising diffusion implicit models (DDIM) sampling strategy [26], the forward and in verse pro cesses are as follows. F orwar d (noising) pr o c ess. Giv en a v ariance sc hedule { β t } T t =1 , d efine α t = 1 − β t and ¯ α t = Q t s =1 α s . The forw ard pro cess corrupts z t as, z t +1 = √ α t +1 z t + p 1 − α t +1 ε t +1 , ε t +1 ∼ N (0 , I ) . (1) 4 Nakra and W u Backwar d (denoising) pr o c ess. Conditioned on c (suc h as a text embedding), the denoiser ε θ predicts the injected noise ε θ ( z t , t, c ) ≈ ε . This yields an estimate of the clean laten t, ˆ z 0 ( z t , t, c ) = 1 √ ¯ α t  z t − √ 1 − ¯ α t ε θ ( z t , t, c )  . (2) 2.2 In-Pro cessing Semantic Generativ e Image W atermarks Existing generativ e image watermarking approaches can b e broadly categorized in to: (i) p ost-ho c watermarking [8, 14, 30, 37], whic h embeds a watermark after generation via a separate pro cessing step, and (ii) in-pr o c essing watermarking , whic h mo difies the generation pro cedure [7, 35, 36] itself to pro duce watermark ed outputs. Prior work often inv estigates p ost-hoc approaches under adversarial transformations, whereas inv estigations on in-processing metho ds that induce a more robust structured c hange in the generative distribution, such that the water- mark can b e reco vered reliably from samples, often via higher-level statistical or seman tic regularities, are lacking. In this pap er, w e fo cus on in-pro cessing metho ds and analyze their vulnerabilities under structured seman tic p erturbations. A prominen t representativ e is StableSignature [7], which embeds a water- mark by fine-tuning the V AE decoder of a LDM. The deco der is conditioned on a binary signature, so that deco ding laten ts through the fine-tuned mo dule yields images that carry an imp erceptible signature that can later b e recov ered by the corresp onding detector. T ree-Ring watermarking [35] takes a conceptually differen t approach tailored to diffusion sampling. Rather than mo difying pixels, T ree-Ring embeds a predefined pattern into the F ourier-domain representation of the initial noise (e.g., z T in latent diffusion). Under DDIM sampling, which is deterministic for a fixed conditioning and initialization, a v erifier with access to the mo del can approximately inv ert the generation pro cess for a candidate image to recov er an estimate of the initial noise. W atermark presence is then tested b y applying an FFT to the reco vered noise and chec king for the target F ourier pattern. Finally , Gaussian Shading [36] is a message-conditioned seman tic w atermark that mo dulates laten t sampling using a cryptographically generated bitstring. An encrypted message determines a sequence of partitioning decisions o ver the latent space; each bit selects a region from which the corresp onding laten t component is sampled. This construction is designed to preserve the global Gaussian prior while inducing a recov erable dep endence b et ween the sampled laten t and the hidden message, which can subsequently b e deco ded from the generated image. 2.3 Seman tic Ev aluation of Generative Image W atermarks While several works recognize that generative watermarks may b e coupled to high-lev el image structure, none offer a comprehensiv e ev aluation of in-pro cessing w atermarks under semantic manipulation. Lu et al.’s W-Bench [21] studies p ost- ho c watermarks under image-editing op erations, but do es not explicitly model seman tic drift b eyond the edit areas, and its conclusions do not directly transfer to in-processing settings where watermarking alters the generative distribution Understanding Semantic Perturbations on Generative Image W atermarks 5 and pixel-level imp erceptibilit y is not the central ob jective. Arabi et al.’s SEAL [3] in tro duces a semantic “cat attack,” but ev aluates under a forgery threat mo del without systematically v arying semantic change. Closest in spirit to our work, T allam et al. [29] employ a detect-and-replace pip eline against T ree-Ring, yet their pro cedure regenerates most of the background while preserving scene semantics, effectiv ely appro ximating re-synthesis of the image, and without quantifying drift or semantic entanglemen t. Luk ovnik ov et al. [22] consider a sp ecific asp ect of seman tics, the lay out control, via ControlNet [38] and find limited/no impact on w atermarking, and their findings do not apply to other types of semantic shifts. T AG-WM [5] explicitly considers semantic manipulation as an adversarial strategy and includes suc h edits in their exp erimental suites. It primarily considers seman tics-preserving edits and do es not quantify robustness as a function of seman tic drift. Also, it studies sp ecific tamp ering threat mo dels and relies on con ven tional fidelit y metrics, which do not characterize the degree to which the w atermark is entangled with image semantics. In contrast, we directly manipulate seman tic con ten t as a function of seman tic drift and quan tify the resulting w atermark robustness, addressing a gap in prior ev aluation proto cols. 3 Problem F ormalization: Black-Bo x Threat Mo del Let G b e a generativ e mo del that pro duces a w atermark ed image x w ∈ X from a latent co de z and a signature s : x w = G ( z , s ) . Let D b e a watermark detector/deco der that, for an image input, outputs a detection statistic and/or a deco ded signature. Giv en x w , an adversary A applies a transformation f : X → X to obtain x ′ = f ( x w ) that reduces watermark detectability while maintaining p erceptual fidelity . Seman tic P erturbation Op erator. W e mo del semantic editing as mask ed regeneration with an inpainting operator. Let M ∈ { 0 , 1 } H × W b e a binary mask iden tifying a target region (such as an ob ject instance) and let c denote a target seman tic concept (such as a text prompt). W e define the semantic p erturbation op erator P : P sem ( x w , M , c ) = (1 − M ) ⊙ x w + M ⊙ Inpaint( x w , M , c ) , (3) where ⊙ denotes the pixel-wise dot pro duct and Inpain t ( · ) is an editing to ol (suc h as Stable Diffusion inpainting). In the black-box setting, the adversary do es not kno w the signature s and has no access to the parameters of G or D . The adv ersary is given only the w atermarked image x w and access to public seman tic editing to ols (e.g., off- the-shelf diffusion inpain ting mo dels). The adv ersary pro duces an edite d image x ′ = P sem ( x w , M , c ) , by selecting a mask M and concept c (e.g., via an ob ject detector/segmen ter and a prompt selection rule). This emulates the paradigm of Mo del-As-A-Service (MaaS), where users may only hav e query-lev el access to the mo del and can synthesize new generations using the service provider’s mo del, but do not interact with it directly and do not know which watermarking scheme w as used. 6 Nakra and W u ECCV 2026 Submission # 10380 25 (i) Original Im ag e (ii) Seam C ar ving (iii) Impulse Noise (iv) Strong In terlea v e (v) W eak In terlea v e (vi) Ro w o cclusions (vii) Morph. Ero s ion (viii) Do wns a m pling (ix) Blo c k Sh uffling Fig. 1 3 (a) Image-pro cessing-based p erturbations. Mi n W u (U MD ) -- Mi c ro - S i g nal s f or I nf o. F or ens i c s 33 G en e r a t i n g O b j e c t M as k s u s i ng Ma s k RCNN W at e r m ar k e d I m a ge O bj ec t r e p l a c e m e nt v i a o f f - t he - s he l f d i f f u s i on m o de l s & i np a i n t i ng A P I s I m a g e S t y l e T r a ns l at i o n v i a G A N s (I n t ra- Cl a s s) ( I n t e r - Cl a s s) Glob al Sem an t ic D rif t s L oc a l S e m a nt i c D r i f t s (b) Semantic p erturbations. Fig. 2: Overview of ev aluation: (a) Examples of different improv ed image-pro cessing- based p erturbations. (b) The mo dular pip eline used to generate global & lo cal semantic p erturbations. 4 Impro v ed Baselines: Image-Processing based P erturbations Curren t watermarking metho ds are typically ev aluated under generic channel degradations—suc h as additive Gaussian noise, JPEG compression, and global brigh tness/contrast adjustments—but largely omit more structured, seman tics- a ware perturbations. Mo ving b eyond this ev aluation regime, we stress-test repre- sen tative in-pro cessing watermarking sc hemes under a suite of stronger, more targeted p erturbations (illustrated in Fig. 2(a)) that op erate b ey ond simple lo w-level transformations. T raditional Conten t A w are Resizing. Seam carving [4] is a conten t-a ware image resizing tec hnique that changes the size of an image with p ossibly different asp ect ratios by iteratively removing low-energy seams (or inserting seams to enlarge the image). It is widely deploy ed in consumer editing to ols (suc h as A dob e Photoshop and GIMP [31]), and a post-pro cessing op eration that watermark ed images may undergo in practice. Accordingly , w e ev aluate the robustness of generativ e watermarking schemes under seam-carving-based resizing. Image Do wnsampling. Many GenAI watermarking metho ds [1, 15, 35] embed signals in the sp ectral domain. Naïve image do wnsampling without appropriate lo w-pass filtering can introduce aliasing artifacts that distort frequency-domain amplitude and phase, p oten tially corrupting embedded w atermark structure. Mo- tiv ated by this, we ev aluate watermark robustness under a downsample–upsample pip eline, measuring detectability after reducing resolution and subsequen tly restoring the image to its original size. Morphological Image Filtering. Prior work has primarily considered simple photometric edits (e.g., contrast adjustmen ts) and largely omits more struc- Understanding Semantic Perturbations on Generative Image W atermarks 7 tured image-pro cessing op erations. Morphological transformations [11]—including erosion and dilation—are routinely used for shap e-based analysis and as p ost- pro cessing steps in denoising and clean up pip elines. While not inherently ad- v ersarial, they are commonly applied in practice and can alter lo cal geometry and edge structure in w ays that may affect watermark statistics. Accordingly , we ev aluate the robustness of watermark ed images under standard morphological op erations. Impulse Noise/ Bit Flip and blo c k sh uffling. W e inv estigate the robustness of watermarks to p erturbations that reduce image fidelity without fundamentally altering the image’s semantic con tent. W e consider b oth sto c hastic and structured distortions. F or stochastic noise, w e test impulse corruption (pixel erasure), in which each pixel is indep enden tly lost/corrupted with probabilit y p . F or structured distortions that mimic sync hronization errors in transmission or storage, we ev aluate spatial desynchronization via pixel p ermutations and blo ck- wise p erm utations, whic h preserve global conten t statistics but disrupt lo cal spatial coherence and alignmen t. 5 Seman tically Corrupting GenAI W atermark ed Images T o prob e the robustness of seman tically embedded w atermarks, we present a mo dular, multi-stage p erturbation framework illustrated in Fig. 2(b). Rather than relying on additive noise or low-lev el image transformations, the framework p erforms targeted, semantically informed con tent replacement. Concretely , we instan tiate a detect-and-replace pip eline that comp oses off-the-shelf deep learning mo dels to (i) lo calize semantically meaningful regions and (ii) replace or regenerate their con tent in a controlled manner. W e illustrate qualitativ e results of our pip eline in Fig. 3. 5.1 Stage 1: Semantic T arget Iden tification The first stage identifies a semantically meaningful region within a watermark ed image that will b e manipulated. W e use Mask R-CNN for instance segmentation [12], whic h pro duces pixel-accurate masks for each detected ob ject instance rather than coarse bounding b o xes. This granularit y is critical for the subsequen t inpain ting step, as it cleanly remov es the target ob ject and yields a well-defined region to be regenerated. In each image, we enumerate all detected foreground instances and select the most salient ob ject, in terms of the instance with the largest mask area. W e then remov e (mask out) this region, pro ducing a binary mask that defines the target for seman tic replacement. 5.2 Stage 2: Conten t Corruption an d Regeneration Giv en the target mask, the second stage replaces the remo v ed region with seman tically plausible con tent. The ob jective is to synthesize pixels that are consisten t with the surrounding con text while b eing sufficiently different in structure and texture to in terfere with the watermark signal. W e instantiate this step using text-guided diffusion inpainting (such as Stable Diffusion), whic h conditions generation on the original image, the binary mask, and an edited text prompt. This form ulation provides direct control ov er the 8 Nakra and W u Fig. 3: An o verview of seman tic p erturbations across representativ e in-processing w atermarking methods. seman tics of the regenerated region and enables a contin uum of p erturbations, ranging from mild attribute edits (such as “a b ed with floral patterns”) to full ob ject substitution (such as replacing “a b ed” with “a sofa”). This controllabilit y is cen tral to our study , as it allows us to systematically v ary seman tic conten t while holding the global image context fixed, thereby isolating the sensitivity of generativ e watermarks to semantic manipulation. Lo cal Edits. T o quantify the watermark’s sensitivity to v arying degrees of seman tic change, w e categorize lo cal p erturbations into three tiers based on the “seman tic gap" introduced during regeneration: • In tra-Class T exture Shift: W e mo dify only the textural attributes of the iden tified ob ject (e.g., changing a “plain shirt" to a “flannel shirt"). This tests if the watermark is tied to sp ecific high-frequency textural features within the laten t embedding. • In tra-Class Replacemen t: W e replace the ob ject with a differen t instance of the same semantic class (e.g., replacing one “c hair” with another “c hair” via inpain ting). This preserv es the class-lev el seman tics but alters the lo cal geometry and fine-grained laten t structure. • In ter-Class Substitution: W e substitute the original ob ject with an entirely differen t seman tic category (e.g., “dog” to “fire hydran t”). This represents the maxim um semantic displacemen t p ossible within a lo cal region while main taining scene plausibilit y . Global Semantic Shifts. Beyond lo cal substitutions, we ev aluate the impact of global mo difications that alter the entire image manifold. W e implemen t this through neural style transfer (NST) [10], which redistributes the image’s low-lev el Understanding Semantic Perturbations on Generative Image W atermarks 9 statistics to matc h a target style (such as transforming a photorealistic image into an oil painting). Unlike lo cal edits, this shift affects every pixel simultaneously allo wing us to compare whether generative watermarks are more resilient to global textural shifts than to targeted, lo cal identit y changes. 6 Ev aluation In this section, we conduct a comprehensive exp erimen tal ev aluation to compare the resilience of representativ e in-pro cessing w atermarks against impro ved image- pro cessing baselines and under our prop osed semantic p erturbation framew ork. 6.1 Exp erimen tal Setup Datasets. W e use the MS-COCO 2017 [20] v alidation split, comprising 5,000 captioned images, and resize all images to 512 × 512 . F or the three represen tative in-pro cessing watermarking metho ds (namely , StableSignature, T ree-Ring, and Gaussian Shading), we use the corresp onding MS-COCO captions as prompts to generate images through an LDM. W atermark Generation. F or all three in-pro cessing watermarking metho ds, w e use Stable Diffusion v2-1 [25] as the base latent diffusion mo del. Giv en a prompt, we generate clean (unw atermarked) images by sampling the initial latent from the mo del’s standard prior. F or T ree-Ring, we inject the watermark by adding concentric circular patterns in the frequency-domain representation of the initial latents, using the default hyperparameters. F or Gaussian Shading, we sample laten ts conditioned on an encrypted p er-image message generated using a randomly sampled key and nonce; we adopt the default configuration with a 256-bit message capacit y and × 64 message replication. F or StableSignature, we use the official implemen tation with a 48-bit signature, and we deco de images using the Stable Diffusion v2 deco der. Image-Pro cessing-based Pixel Perturbation Setup. W e use bac kward energy-based seam carving [13] to iterativ ely remov e 10–50% of seams from the width of the watermark ed image. F or morphological op erations, we examine erosion and dilation kernels of v arious sizes from 3 × 3 to 11 × 11 . When analyzing erasure noise, we examine different probabilities of bit drop of 0–0.5. Finally , for understanding resilience to block sh uffling, we iteratively change the size of the blo c k being shuffled for 0–10% of the image and the num b er of blo c ks that are p erm uted from 0–50% of total blo c ks. ML-based Semantic Perturbation Setup. W e use a pretrained Mask R- CNN with a ResNet-101 bac kb one (trained on MS-COCO) to obtain instance masks, which serve as the segmentation backbone for all lo cal semantic edits. F or mask-conditional generation, w e employ Stable Diffusion v2-1 finetuned on LAMA-based inpainting mo de [25] across lo cal p erturbation settings. Sp ecifically , w e augment the region-sp ecific prompt with an inpainting instruction drawn from the Stable Diffusion Prompts dataset [34], conditioning the added text on the p erturbation mo de and the intra-mask conten t. T o induce global semantic shifts, w e apply neural style transfer using a VGG bac kb one. 10 Nakra and W u W atermark Detectability Metrics. W e ev aluate robustness to several pixel- and la yout-lev el p erturbations. T o ensure comparability with prior work, we follo w the ev aluation proto cols and metrics rep orted in the corresp onding original pap ers. F or T ree-Ring watermarks, w e rep ort the detector p-v alue (i.e., the probabilit y of observing the w atermark statistic under the null hypothesis of no w atermark) and, for StableSignature, the bit-recov ery accuracy . F or Gaussian Shading, we report the raw bit accuracy , defined as the fraction of bits in the reco vered message that match the target w atermark bit string. 6.2 Quan tifying Image Qualit y and Semantic Drift T o provide a standard quan tification of image fidelity , we rep ort p erceptual fidelit y using standard full-reference image quality metrics of PSNR [11] and SSIM [33]. W e must note, how ever, that these full-reference metrics can b e misleading in our setting for attack ed watermark ed images. In particular, global seman tic p erturbations inten tionally alter image style and, in some cases, con tent; consequen tly , PSNR and SSIM may p enalize b enign semantic changes rather than reflecting meaningful degradation. Prior work often uses CLIP-based scores [23] to assess semantic quality after syntactic p erturbations by comparing the generation prompt to the resulting image. In contrast, our goal is to measure the semantic distance b et ween the original watermark ed image and its seman tically p erturb ed coun terpart. W e therefore consider multiple caption-based approaches to b etter quan tify semantic drift. More sp ecifically , we adopt multimodal text-image measurements. First, we use BLIP [19] to generate captions for b oth the original and attack ed images, and compute the cosine similarity b et w een the resulting captions using sentence- transformer embeddings. While this provides a reasonable proxy for semantic preserv ation, BLIP captions o ccasionally include spurious or irrelev an t metadata, as illustrated in our supplemen tal material, reflecting biases in its training distribution. W e call this score BLIP agreement (BLIP A). Second, we replace BLIP with PaliGemma2 [28], a vision-language mo del that pro duces longer, more descriptiv e captions, and compute caption similarit y in the same manner. W e call this score VLM agreement (VLMA). Beyond simple captions, we also extract structured semantic information through a scene graph generation pro cess (SGG) [18] guided b y LLMs [16]. W e find that graph similarit y ov er suc h scene graphs largely aligns with cosine similarity on the captions, and thus we defer this metric and its results to the supplemental material. 6.3 Sensitivit y to Image-Pro cessing-based Perturbations T o establish a strong baseline, we first sub ject watermark ed images to a compre- hensiv e suite of more than ten conv entional, metho d-agnostic perturbations, as elab orated in Sec. 4. These p erturbations op erate at the signal level and include con tent-a ware resizing, do wnsampling/upsampling, additive and impulse noise, spatial filtering, morphological op erations, and blo c k-wise shuffling and hav e not b een previously studied. W e illustrate our findings in Fig. 4. W e observ e several consistent trends for StableSignature. StableSignature is robust to con tent-a ware resizing, remaining detectable even after removing nearly half the seams, consisten t with a watermark that is not lo calized to sp ecific Understanding Semantic Perturbations on Generative Image W atermarks 11 (a) Seam Carving (b) Downsampling (c) Impulse Noise (d) Interlea ving (e) Occlusion (f ) Morph. Erosion (g) Morph. Dilation (h) Partial Blo c k Shuffling (i) Complete Block Shuffling Fig. 4: Exp erimen tal results of w atermark detectabilit y vs visual fidelity in SSIM under enhanced image-pro cessing-based p erturbations, showing general robustness under these manipulations. Detection metrics are bit accuracy for StableSig/Gaussian shading and the normalized negative logarithm of p -v alue for tree-ring. Color indicates the p erturbation strength, and markers indicate the watermarking schemes. Note that we normalize the p -v alues for understanding the trend of the tree-ring detection metric with p erturbation strength. Extended results in tabular form are provided in the supplemen tal material. pixels (p oten tially aided by resizing augmen tations during training). In contrast, detectabilit y degrades rapidly under increasing row o cclusion and impulse (shot) noise, with bit accuracy often dropping to 50–60%. Do wnsampling–upsampling can eliminate the w atermark but at substantial fidelit y loss, and morphological op erations (erosion/dilation) also significantly reduce detectability with visible degradation. Surprisingly , blo c k shuffling has little effect, suggesting relativ e insensitivit y to blo c k-level spatial p ermutations. F or T ree-Ring and Gaussian shading, most conv en tional p erturbations reduce p -v alues for T ree-Ring and bit accuracy for Gaussian shading, but detectability t ypically remains acceptable. Both metho ds are sensitiv e to seam carving: aggres- siv e seam remov al can significantly reduce watermark detection metrics, often with noticeable fidelity loss. Lo calized corruption via black-pixel interlea ving has a limited effect ov erall; ro w o cclusion and impulse (shot) noise only mildly degrade Gaussian shading detectability but substantially hamp er T ree-Ring p - v alues and detectability . Morphological op erations do not affect Gaussian shading detectabilit y , whereas T ree-Ring detectabilit y reduces when large kernels are used. Unlike StableSignature, b oth metho ds are vulnerable to blo ck shuffling, 12 Nakra and W u Fig. 5: Exp erimen tal results of watermark detectability against visual fidelity in SSIM ( y -axis) and semantic drift ( x -axis) under semantic p erturbations. Color indicates de- tectabilit y (TPR@0.1%). Results show watermark detectability can collapse across metho ds under v arying levels of semantic drift, revealing a gap not captured b y conv en- tional robustness tests. T able 1: Robustness to semantic manipulation across in-pro cessing watermarking meth- o ds (a veraged o ver seeds). Detection metric is bit accuracy for stable signature/Gaussian shading, and the av erage p -v alue for tree ring. Extended results across multiple seeds for each v ariant are pro vided in the supplemental material. Perturbation V arian t Method PSNR ( ↑ ) SSIM ( ↑ ) Detection metric TPR@0.1% ( ↑ ) VLMA ( ↑ ) BLIP A ( ↑ ) Global Stylization Stable Signature [7] 12 . 7 ± 1 . 2 0 . 40 ± 0 . 05 57 . 8 ± 6 . 0 % 0 . 44 0 . 63 ± 0 . 22 0 . 56 ± 0 . 10 T ree Ring [35] 12 . 9 ± 1 . 5 0 . 41 ± 0 . 05 2 . 7 e − 02 0 . 67 0 . 56 ± 0 . 24 0 . 53 ± 0 . 11 Gaussian Shading [36] 12 . 3 ± 1 . 5 0 . 40 ± 0 . 05 98 . 9 ± 0 . 2 % 0 . 99 0 . 57 ± 0 . 24 0 . 55 ± 0 . 11 Local T exture Shift Stable Signature [7] 16 . 9 ± 4 . 1 0 . 71 ± 0 . 10 50 . 2 ± 7 . 9 % 0 . 10 0 . 77 ± 0 . 19 0 . 78 ± 0 . 11 T ree Ring [35] 16 . 6 ± 4 . 5 0 . 77 ± 0 . 11 1 . 4 e − 07 0 . 97 0 . 78 ± 0 . 19 0 . 76 ± 0 . 13 Gaussian Shading [36] 15 . 8 ± 4 . 5 0 . 75 ± 0 . 12 99 . 7 ± 0 . 1 % 1 . 00 0 . 74 ± 0 . 25 0 . 75 ± 0 . 11 Intra-Class Stable Signature [7] 16 . 5 ± 4 . 2 0 . 69 ± 0 . 10 49 . 5 ± 7 . 6 % 0 . 01 0 . 75 ± 0 . 22 0 . 80 ± 0 . 09 T ree Ring [35] 16 . 0 ± 4 . 4 0 . 75 ± 0 . 11 1 . 5 e − 06 0 . 98 0 . 77 ± 0 . 19 0 . 76 ± 0 . 14 Gaussian Shading [36] 15 . 5 ± 4 . 3 0 . 73 ± 0 . 12 99 . 6 ± 0 . 1 % 1 . 00 0 . 74 ± 0 . 25 0 . 77 ± 0 . 11 Inter-Class Stable Signature [7] 16 . 3 ± 4 . 5 0 . 69 ± 0 . 11 49 . 9 ± 7 . 9 % 0 . 03 0 . 62 ± 0 . 22 0 . 67 ± 0 . 16 T ree Ring [35] 16 . 0 ± 4 . 6 0 . 75 ± 0 . 12 8 . 8 e − 08 0 . 98 0 . 65 ± 0 . 24 0 . 65 ± 0 . 18 Gaussian Shading [36] 15 . 0 ± 4 . 3 0 . 73 ± 0 . 12 99 . 6 ± 0 . 1 % 1 . 00 0 . 63 ± 0 . 25 0 . 65 ± 0 . 16 b ecause such p erm utations violate the generator’s spatial statistics and were not accoun ted for under standard p ost-pro cessing. 6.4 Sensitivit y to Seman tic Shifts Ha ving established robustness under pixel-level p erturbations, we next ev aluate these sc hemes under our semantic p erturbation framework, which induces progres- siv ely larger semantic drift from the original synthesized image, and summarize our results in Fig. 5 and T able 1. Our results show that in-processing w ater- marking schemes that remain detectable under aggressive signal-lev el distortions can nev ertheless b e substantially degraded or rendered ineffective by semantic drift, underscoring the need for robustness ev aluations that explicitly mo del seman tically coherent edits rather than only pixel-level corruption. StableSignature degrades sharply under semantic edits. A cross all three lo cal p erturbation v arian ts (texture shift, intra-class, and inter-class replacement), bit-reco very accuracy collapses to near chance, remaining tightly concentrated around 49–51%. Under global semantic perturbations (st ylization), p erformance Understanding Semantic Perturbations on Generative Image W atermarks 13 (a) (b) (c) Fig. 6: Exp erimental results on watermark detectabilit y under local semantic p ertur- bations as a function of mask ed area. (a) p -v alue of the detected tree-ring w atermark when an increasing fraction of the image is mask ed. It is p ositiv ely correlated with the mask size, indicating reduced detectability as a larger fraction of the image is replaced. (b) Bit accuracy of the detected stable signature watermark remains near chance across all mask sizes, indicating failure even for small masks. (c) Bit accuracy of the Gaussian shading watermark remains consistently high, sho wing minimal sensitivity to mask size. remains p oor, with bit accuracy in the 53–65% range. Overall, semantic drift renders the deco der-conditioned signature largely non-recov erable. T ree-Ring exhibits a distinct failure mo de. Under lo cal p erturbations (im- plemen ted via inpainting within the same mo del family), T ree-Ring remains statistically detectable, but with substantially weak ened evidence: p -v alues in- crease to the 10 − 10 ∼ 10 − 6 regime across seeds, indicating non-trivial sensitivit y despite contin ued detection. This is even true when the lo cal p erturbations heavily c hange the seman tics of the scene, reflecting that although tree-ring watermarks c hange the underlying generating distribution of the LDMs, the semantics migh t not b e entangled with the watermarks in a meaningful wa y . In con trast, global seman tic p erturbations markedly undermine watermark detectability: p -v alues for detection increase further into the 10 − 3 ∼ 10 − 1 range, approac hing (and in some settings crossing) t ypical non-detection thresholds. W e find that Gaussian shading is the most robust against lo cal and global seman tic p erturbations among the three in-pro cessing w atermarks. It maintains near-p erfect message recov ery across b oth lo cal and global semantic p erturbations, with bit accuracy consisten tly high ( ≥ 98% for lo cal and global p erturbations). Effect of Mask Size. T o study how mask size affects in-pro cessing watermark robustness to semantic shifts, we analyze detection scores as a function of the fraction of pixels replaced by seman tic editing. F or StableSignature, as illustrated in Fig 6(b), watermark detectabilit y is consisten tly low across mask sizes, with reco very near c hance even for small edited regions. F or T ree-Ring, as illustrated in Fig. 6(a), w e observe a clear monotonic trend: larger edited regions lead to stronger degradation in detectability . Images dominated b y a small n umber of large foreground ob jects are particularly susceptible, sinc e editing these ob jects p erturbs a substan tial portion of the scene, whereas small, lo calized edits tend to ha ve a weak er effect in remo ving the watermark. Conv ersely , when most of the original image remains intact, and the ov erall semantics are largely preserved, T ree-Ring often remains detectable. Gaussian Shading Fig. 6(c) exhibits no straigh tforward dep endence on mask size, consistent with its ov erall robustness to lo cal semantic perturbations. Collectively , these results suggest that, for at least some schemes, the watermark ma y not hav e a stable, in terpretable entanglemen t with the seman tics of the scene, in con trast to common assumptions in prior work, 14 Nakra and W u T able 2: Lo cal semantic p erturbations using the same or different diffusion mo del family . Detection metric is bit accuracy for stable signature/Gaussian shading, and the a verage p -v alue for tree ring. Cross-family p erturbations may degrade detection metrics more than same-family perturbations. Attac k Category Same F amily Cross F amily PSNR ( ↑ ) SSIM ( ↑ ) Detection Metric PSNR ( ↑ ) SSIM ( ↑ ) Detection Metric Stable Signature [7]. 16 . 29 0 . 68 50 . 10% 15 . 43 0 . 64 53 . 49% T ree Ring [35]. 15 . 83 0 . 75 3 . 88 e − 07 15 . 18 0 . 63 9 . 08 e − 07 Gaussian Shading [36]. 14 . 87 0 . 72 99 . 60% 13 . 85 0 . 63 98 . 43% and robustness against seman tic manipulation v aries significan tly dep ending on the metho d. Cross-family Lo cal Seman tic Edits. T o disentangle robustness effects at- tributable to the diffusion family used for lo cal semantic p erturbations, w e ev aluate an inpainting mo del drawn from a different generator family from the w atermarked model: Kandinsky 2.1 [24]. This reflects a realistic deploymen t setting, since users ma y apply semantic edits using any commercially av ailable, off-the-shelf diffusion mo del, rather than from the original generator family . Moreo ver, out-of-family inpainting can constitute a stronger p erturbation, as distributional mismatch b et ween the watermarking mo del and the editing mo del ma y induce larger representation shifts and more effectively disrupt watermark reco very , particularly for schemes that rely on the generator’s learned data dis- tribution. As shown in T able 2, cross-family semantic edits degrade detection statistics more than same-family inpainting, but typically do not eliminate the w atermark completely . This suggests that as long as a substantial fraction of pixels in the scene remains drawn from the original generator’s distribution, w atermark detectability may remain high. 7 Discussion and Conclusion In this pap er, we identify an underexplored vulnerability in representativ e in- pro cessing generative image w atermarks. While these metho ds are robust to a broad suite of syntactic p erturbations, they can b e substantially degraded b y semantic manipulations that alter high-level scene conten t. This suggests that coupling watermark evidence to a generator’s semantic mac hinery is a double-edged sw ord: semantic entanglemen t can confer resilience to signal-level noise yet increase susceptibility to con tent-lev el edits. Our results challenge the prev ailing prov enance ev aluation protocols and motiv ate b enc hmarks that explicitly quan tify robustness as a function of semantic drift and the corresp onding effects on watermark detectability . Building on this first-step effort, we consider pro viding a complete mechanistic account of wh y semantic manipulation affects in- pro cessing methods unevenly as a key future direction. Enabled b y our b enchmark, researc hers may determine whic h higher-level image v ariations watermarks exploit in the generative setting. Answering this question may help bridge the gap b et w een traditional signal-pro cessing watermarking theory and mo dern GenAI w atermarking practice. Lo oking forw ard, more reliable authentication will lik ely require m ulti-lay ered defenses, including designs that remain detectable under b oth syntactic and semantic edits. Understanding Semantic Perturbations on Generative Image W atermarks 15 References 1. Alam, I., Islam, M.T., W o o, S.S., Muhammad, K.: Sp ecGuard: Sp ectral Pro jection- based Adv anced Invisible W atermarking. In: Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision (2025) 2. An, B., Ding, M., Rabbani, T., Agraw al, A., Xu, Y., Deng, C., Zh u, S., Mohamed, A., W en, Y., Goldstein, T., Huang, F.: W A VES: Benc hmarking the Robustness of Image W atermarks. In: Pro ceedings of the 41st International Conference on Mac hine Learning (2024) 3. Arabi, K., Witter, R.T., Hegde, C., Cohen, N.: SEAL: Seman tic aw are image w atermarking. In: Pro ceedings of the IEEE/CVF In ternational Conference on Computer Vision. pp. 16196–16205 (2025) 4. A vidan, S., Shamir, A.: Seam Carving for Conten t-A w are Image Resizing. In: ACM SIGGRAPH (2007) 5. Chen, Y., Ma, Z., F ang, H., Zhang, W., Y u, N.: T A G-WM: T amp er-A ware Generative Image W atermarking via Diffusion Inv ersion Sensitivity. In: Pro ceedings of the IEEE/CVF International Conference on Computer Vision. pp. 16723–16732 (2025) 6. Demirag, Y., Liu, D., Niehues, J.: Benchmarking Diffusion Mo dels for Machine T ranslation. In: Pro ceedings of the 18th Conference of the European Chapter of the Asso ciation for Computational Linguistics: Student Researc h W orkshop. pp. 313–324 (2024) 7. F ernandez, P ., Couairon, G., Jégou, H., Douze, M., F uron, T.: The Stable Signature: Ro oting W atermarks in Latent Diffusion Mo dels. In: Pro ceedings of the IEEE/CVF In ternational Conference on Computer Vision (ICCV). pp. 22466–22477 (2023) 8. F ernandez, P ., Sablayrolles, A., F uron, T., Jégou, H., Douze, M.: W atermarking Images in Self-Sup ervised Latent Spaces. In: IEEE International Conference on A coustics, Speech and Signal Pro cessing (ICASSP). pp. 3054–3058. IEEE (2022) 9. Gao, S., Liu, X., Zeng, B., Xu, S., Li, Y., Luo, X., Liu, J., Zhen, X., Zhang, B.: Implicit Diffusion Models for Contin uous Sup er-Resolution. In: Pro ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 10021–10030 (2023) 10. Gat ys, L.A., Eck er, A.S., Bethge, M.: Image St yle T ransfer using Con volutional Neural Netw orks. In: Pro ceedings of the IEEE conference on computer vision and pattern recognition. pp. 2414–2423 (2016) 11. Gonzalez, R.C., W oo ds, R.E.: Digital Image Pro cessing. Pearson Education (2018) 12. He, K., Gkio xari, G., Dollár, P ., Girshick, R.: Mask R-CNN. In: Pro ceedings of the IEEE International Conference on Computer Vision (ICCV) (2017) 13. Huang, H., F u, T., Rosin, P .L., Qi, C.: Real-time Con tent-A w are Image Resizing. Science in China Series F: Information Sciences 52 (2), 172–182 (2009) 14. Ingemar, C., Matthew, M., Jeffrey , B., Jessica, F., T on, K.: Digital W atermarking and Steganography. Morgan Kaufmann (2008) 15. Kassis, A., Hengartner, U.: UnMarker: A Universal Attac k on Defensive Image W atermarking. In: IEEE Symposium on Security and Priv acy (SP) (2025) 16. Kim, K., Y o on, K., Jeon, J., In, Y., Mo on, J., Kim, D., Park, C.: LLM4SGG: Large Language Mo dels for W eakly Sup ervised Scene Graph Generation. In: Pro ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 28306–28316 (2024) 17. Kingma, D.P ., W elling, M.: Auto-enco ding V ariational Bay es. arXiv preprint arXiv:1312.6114 (2013) 16 Nakra and W u 18. Li, H., Zhu, G., Zhang, L., Jiang, Y., Dang, Y., Hou, H., Shen, P ., Zhao, X., Shah, S.A.A., Bennamoun, M.: Scene Graph Generation: A Comprehensive Survey. Neuro computing (2024) 19. Li, J., Li, D., Sav arese, S., Hoi, S.: Blip-2: Bo otstrapping Language-Image Pre- training with F rozen Image Enco ders and Large Language Mo dels. In: International Conference on Machine Learning. pp. 19730–19742. PMLR (2023) 20. Lin, T.Y., Maire, M., Belongie, S., Hays, J., Perona, P ., Ramanan, D., Dollár, P ., Zitnick, C.L.: Microsoft COCO: Common Ob jects in Context. In: Europ ean Conference on Computer Vision. pp. 740–755. Springer (2014) 21. Lu, S., Zhou, Z., Lu, J., Zhu, Y., K ong, A.W.K.: Robust W atermarking Using Generativ e Priors Against Image Editing: F rom Benchmarking to Adv ances. arXiv preprin t arXiv:2410.18775 (2024) 22. Luk ovnik ov, D., Müller, A., Thietke, J., Quiring, E., Fischer, A.: Are Semantic W atermarks for Diffusion Mo dels Resilien t to Lay out Con trol? In: The 1st W orkshop on GenAI W atermarking, ICLR, 2025 23. Radford, A., Kim, J.W., Hallacy , C., Ramesh, A., Goh, G., Agarwal, S., Sastry , G., Ask ell, A., Mishkin, P ., Clark, J., et al.: Learning T ransferable Visual Models from Natural Language Sup ervision. In: International Conference on Mac hine Learning. pp. 8748–8763. PMLR (2021) 24. Razzhigaev, A., Shakhmatov, A., Maltsev a, A., Arkhipkin, V., Pa vlov, I., Ryabov, I., Kuts, A., Panc henko, A., Kuznetsov, A., Dimitrov, D.: Kandinsky: An Improv ed T ext-to-Image Synthesis with Image Prior and Laten t Diffusion. In: Proceedings of the 2023 Conference on Empirical Metho ds in Natural Language Pro cessing: System Demonstrations. pp. 286–295 (2023) 25. Rom bach, R., Blattmann, A., Lorenz, D., Esser, P ., Ommer, B.: High-resolution Image Synthesis with Laten t Diffusion Models. In: Pro ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 10684–10695 (2022) 26. Song, J., Meng, C., Ermon, S.: Denoising Diffusion Implicit Mo dels. In: In ternational Conference on Learning Represen tations, 2020 27. Song, Y., Liu, X., Shou, M.Z.: Diffsim: T aming Diffusion Mo dels for Ev aluating Visual Similarity. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 16904–16915 (2025) 28. Steiner, A., Pin to, A.S., T sc hannen, M., Keysers, D., W ang, X., Bitton, Y., Gritsenk o, A., Minderer, M., Sherb ondy , A., Long, S., et al.: PaliGemma 2: A family of versatile VLMs for transfer. arXiv preprint arXiv:2412.03555 (2024) 29. T allam, K., Cav a, J.K., Geniesse, C., Erichson, N.B., Mahoney , M.W.: Removing W atermarks with P artial Regeneration using Semantic Information. arXiv preprint arXiv:2505.08234 (2025) 30. T ancik, M., Mildenhall, B., Ng, R.: Stegastamp: In visible Hyp erlinks in Physical Photographs. In: Pro ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 2117–2126 (2020) 31. The GIMP Developmen t T eam: GNU Image Manipulation Program (GIMP) (2026) 32. The White House: Executive Order 14110 on the Safe, Secure, and T rust worth y Dev elopment and Use of Artificial Intelligence (2023) 33. W ang, Z., Bovik, A.C., Sheikh, H.R., Simoncelli, E.P .: Image Quality Assessment: F rom Error Visibility to Structural Similarity . IEEE T ransactions on Image Pro- cessing (2004) 34. W ang, Z.J., Monto ya, E., Munechik a, D., Y ang, H., Ho o ver, B., Chau, D.H.: Dif- fusionDB: A Large-Scale Prompt Gallery Dataset for T ext-to-Image Generative Mo dels. arXiv:2210.14896 [cs] (2022) Understanding Semantic Perturbations on Generative Image W atermarks 17 35. W en, Y., Kirchen bauer, J., Geiping, J., Goldstein, T.: T ree-Rings W atermarks: In visible Fingerprints for Diffusion Images. In: Adv ances in Neural Information Pro cessing Systems (2023) 36. Y ang, Z., Zeng, K., Chen, K., F ang, H., Zhang, W., Y u, N.: Gaussian shading: Pro v able Performance-Lossless Image W atermarking for Diffusion Mo dels. In: Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 12162–12171 (2024) 37. Zhang, K.A., Xu, L., Cuesta-Infante, A., V eeramachaneni, K.: Robust Invisible Video W atermarking with A ttention. arXiv preprint arXiv:1909.01285 (2019) 38. Zhang, L., Rao, A., Agraw ala, M.: Adding Conditional Control to T ext-to-Image Diffusion Mo dels. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 3836–3847 (2023) 18 Nakra and W u A App endix A.1 Comprehensiv e Image Pro cessing Perturbation Results This section pro vides the full results of stress-testing the w atermark against the complete suite of con ven tional attacks. T able 3: Robustness to impro ved baseline image-pro cessing-based p erturbations Attac k Category Strength Stable Signature T ree Ring Gaussian Shading PSNR ( ↑ ) SSIM ( ↑ ) Bit Acc ( ↑ ) PSNR ( ↑ ) SSIM ( ↑ ) p -val ( ↓ ) PSNR ( ↑ ) SSIM ( ↑ ) Bit Acc ( ↑ ) Seam Carving 2% 21 . 24 ± 3 . 17 0 . 69 ± 0 . 11 0 . 99 ± 0 . 02 20 . 65 ± 3 . 97 0 . 69 ± 0 . 13 1 . 10 e - 21 19 . 46 ± 2 . 77 0 . 65 ± 0 . 11 0 . 99 ± 0 . 01 10% 16 . 06 ± 2 . 63 0 . 51 ± 0 . 13 0 . 99 ± 0 . 02 15 . 83 ± 2 . 92 0 . 50 ± 0 . 13 1 . 80 e - 05 14 . 63 ± 2 . 70 0 . 47 ± 0 . 13 0 . 83 ± 0 . 11 20% 14 . 76 ± 2 . 46 0 . 46 ± 0 . 13 0 . 98 ± 0 . 02 14 . 56 ± 2 . 66 0 . 45 ± 0 . 13 2 . 00 e - 03 13 . 53 ± 2 . 54 0 . 42 ± 0 . 13 0 . 76 ± 0 . 10 40% 14 . 02 ± 2 . 34 0 . 43 ± 0 . 13 0 . 98 ± 0 . 03 13 . 81 ± 2 . 60 0 . 42 ± 0 . 13 5 . 20 e - 03 12 . 94 ± 2 . 51 0 . 39 ± 0 . 13 0 . 71 ± 0 . 10 50% 13 . 42 ± 2 . 23 0 . 41 ± 0 . 13 0 . 96 ± 0 . 04 13 . 26 ± 2 . 57 0 . 39 ± 0 . 12 1 . 80 e - 02 12 . 52 ± 2 . 43 0 . 37 ± 0 . 13 0 . 68 ± 0 . 10 Downsampling 5 × 23 . 76 ± 3 . 00 0 . 67 ± 0 . 10 0 . 51 ± 0 . 06 22 . 98 ± 2 . 67 0 . 65 ± 0 . 10 2 . 10 e - 10 22 . 86 ± 2 . 73 0 . 65 ± 0 . 11 0 . 99 ± 0 . 01 10 × 20 . 70 ± 2 . 79 0 . 55 ± 0 . 13 0 . 36 ± 0 . 04 20 . 06 ± 2 . 56 0 . 52 ± 0 . 12 6 . 80 e - 07 19 . 91 ± 2 . 74 0 . 52 ± 0 . 13 0 . 85 ± 0 . 05 20 × 18 . 23 ± 2 . 40 0 . 48 ± 0 . 13 0 . 39 ± 0 . 02 17 . 76 ± 2 . 52 0 . 46 ± 0 . 13 3 . 00 e - 04 17 . 51 ± 2 . 60 0 . 45 ± 0 . 13 0 . 64 ± 0 . 04 Impulse noise 0.1 15 . 75 ± 0 . 77 0 . 38 ± 0 . 08 0 . 70 ± 0 . 12 15 . 19 ± 0 . 99 0 . 35 ± 0 . 09 3 . 24 e - 03 15 . 21 ± 1 . 08 0 . 38 ± 0 . 10 0 . 92 ± 0 . 09 0.2 12 . 74 ± 0 . 77 0 . 27 ± 0 . 07 0 . 68 ± 0 . 12 12 . 19 ± 0 . 98 0 . 25 ± 0 . 08 1 . 79 e - 03 12 . 19 ± 1 . 08 0 . 28 ± 0 . 09 0 . 90 ± 0 . 09 0.3 10 . 98 ± 0 . 77 0 . 21 ± 0 . 06 0 . 66 ± 0 . 10 10 . 42 ± 0 . 98 0 . 20 ± 0 . 06 6 . 04 e - 03 10 . 43 ± 1 . 07 0 . 22 ± 0 . 08 0 . 88 ± 0 . 10 0.4 9 . 73 ± 0 . 77 0 . 17 ± 0 . 05 0 . 61 ± 0 . 10 9 . 17 ± 0 . 98 0 . 16 ± 0 . 05 1 . 64 e - 02 9 . 18 ± 1 . 07 0 . 18 ± 0 . 07 0 . 87 ± 0 . 10 0.5 8 . 76 ± 0 . 77 0 . 14 ± 0 . 04 0 . 55 ± 0 . 08 8 . 20 ± 0 . 98 0 . 13 ± 0 . 05 1 . 63 e - 02 8 . 21 ± 1 . 07 0 . 15 ± 0 . 06 0 . 85 ± 0 . 11 Occlusion 0.1 15 . 79 ± 0 . 99 0 . 60 ± 0 . 05 0 . 96 ± 0 . 06 15 . 34 ± 1 . 03 0 . 59 ± 0 . 05 1 . 52 e - 09 15 . 31 ± 1 . 10 0 . 61 ± 0 . 06 0 . 99 ± 0 . 01 0.2 12 . 78 ± 0 . 85 0 . 39 ± 0 . 06 0 . 86 ± 0 . 10 12 . 26 ± 0 . 99 0 . 38 ± 0 . 07 5 . 18 e - 04 12 . 24 ± 1 . 11 0 . 40 ± 0 . 08 0 . 96 ± 0 . 04 0.3 11 . 02 ± 0 . 85 0 . 27 ± 0 . 06 0 . 70 ± 0 . 10 10 . 46 ± 0 . 98 0 . 26 ± 0 . 07 5 . 99 e - 04 10 . 46 ± 1 . 13 0 . 28 ± 0 . 08 0 . 94 ± 0 . 05 0.4 9 . 77 ± 0 . 80 0 . 20 ± 0 . 05 0 . 58 ± 0 . 08 9 . 21 ± 0 . 98 0 . 19 ± 0 . 06 4 . 83 e - 03 9 . 21 ± 1 . 14 0 . 21 ± 0 . 07 0 . 92 ± 0 . 06 0.5 8 . 81 ± 0 . 80 0 . 15 ± 0 . 04 0 . 52 ± 0 . 07 8 . 26 ± 0 . 98 0 . 14 ± 0 . 05 1 . 11 e - 03 8 . 25 ± 1 . 13 0 . 16 ± 0 . 06 0 . 90 ± 0 . 07 Interlea ving 100 25 . 83 ± 0 . 79 0 . 93 ± 0 . 01 0 . 99 ± 0 . 02 25 . 20 ± 0 . 99 0 . 92 ± 0 . 01 7 . 05 e - 25 25 . 23 ± 1 . 10 0 . 93 ± 0 . 01 1 . 00 ± 0 . 00 50 22 . 76 ± 0 . 78 0 . 86 ± 0 . 02 0 . 98 ± 0 . 04 22 . 18 ± 0 . 98 0 . 85 ± 0 . 02 7 . 13 e - 18 22 . 19 ± 1 . 07 0 . 86 ± 0 . 02 0 . 99 ± 0 . 00 20 18 . 78 ± 0 . 77 0 . 65 ± 0 . 05 0 . 84 ± 0 . 11 18 . 21 ± 0 . 98 0 . 63 ± 0 . 06 3 . 40 e - 07 18 . 22 ± 1 . 07 0 . 65 ± 0 . 06 0 . 98 ± 0 . 02 10 15 . 75 ± 0 . 76 0 . 38 ± 0 . 08 0 . 63 ± 0 . 10 15 . 20 ± 0 . 98 0 . 36 ± 0 . 09 6 . 79 e - 06 15 . 20 ± 1 . 07 0 . 38 ± 0 . 10 0 . 95 ± 0 . 05 5 12 . 73 ± 0 . 76 0 . 26 ± 0 . 07 0 . 59 ± 0 . 07 12 . 18 ± 0 . 98 0 . 24 ± 0 . 08 2 . 12 e - 04 12 . 19 ± 1 . 07 0 . 27 ± 0 . 09 0 . 96 ± 0 . 04 2 8 . 76 ± 0 . 77 0 . 14 ± 0 . 04 0 . 58 ± 0 . 14 8 . 20 ± 0 . 98 0 . 13 ± 0 . 05 1 . 44 e - 04 8 . 21 ± 1 . 07 0 . 15 ± 0 . 06 0 . 99 ± 0 . 01 Morph. Erosion 3 × 3 20 . 69 ± 2 . 76 0 . 71 ± 0 . 08 0 . 85 ± 0 . 07 20 . 10 ± 2 . 55 0 . 73 ± 0 . 07 4 . 92 e - 14 20 . 04 ± 2 . 56 0 . 72 ± 0 . 09 0 . 99 ± 0 . 00 5 × 5 16 . 91 ± 2 . 59 0 . 53 ± 0 . 12 0 . 68 ± 0 . 06 16 . 33 ± 2 . 48 0 . 53 ± 0 . 12 1 . 63 e - 06 16 . 26 ± 2 . 49 0 . 53 ± 0 . 13 0 . 99 ± 0 . 01 7 × 7 15 . 03 ± 2 . 42 0 . 45 ± 0 . 13 0 . 64 ± 0 . 06 14 . 49 ± 2 . 41 0 . 45 ± 0 . 13 4 . 52 e - 04 14 . 41 ± 2 . 42 0 . 45 ± 0 . 14 0 . 95 ± 0 . 04 11 × 11 12 . 99 ± 2 . 17 0 . 39 ± 0 . 14 0 . 62 ± 0 . 06 12 . 44 ± 2 . 28 0 . 39 ± 0 . 14 1 . 24 e - 02 12 . 37 ± 2 . 29 0 . 38 ± 0 . 14 0 . 69 ± 0 . 05 Morph. Dilation 3 × 3 20 . 67 ± 2 . 84 0 . 73 ± 0 . 07 0 . 82 ± 0 . 07 20 . 06 ± 2 . 60 0 . 73 ± 0 . 07 1 . 10 e - 14 19 . 96 ± 2 . 63 0 . 73 ± 0 . 08 0 . 99 ± 0 . 00 5 × 5 16 . 89 ± 2 . 76 0 . 56 ± 0 . 11 0 . 67 ± 0 . 07 16 . 29 ± 2 . 58 0 . 55 ± 0 . 11 8 . 17 e - 10 16 . 13 ± 2 . 66 0 . 55 ± 0 . 12 0 . 99 ± 0 . 01 7 × 7 14 . 97 ± 2 . 66 0 . 48 ± 0 . 13 0 . 62 ± 0 . 07 14 . 47 ± 2 . 56 0 . 47 ± 0 . 13 2 . 77 e - 05 14 . 26 ± 2 . 64 0 . 47 ± 0 . 14 0 . 96 ± 0 . 03 11 × 11 12 . 82 ± 2 . 50 0 . 42 ± 0 . 13 0 . 56 ± 0 . 06 12 . 44 ± 2 . 49 0 . 42 ± 0 . 14 4 . 55 e - 03 12 . 18 ± 2 . 58 0 . 41 ± 0 . 14 0 . 76 ± 0 . 06 Partial Blo c k Shuffling 50 22 . 29 ± 1 . 73 0 . 93 ± 0 . 00 0 . 99 ± 0 . 02 22 . 22 ± 2 . 07 0 . 93 ± 0 . 00 9 . 15 e - 22 21 . 67 ± 2 . 04 0 . 93 ± 0 . 00 1 . 00 ± 0 . 00 100 19 . 20 ± 1 . 71 0 . 88 ± 0 . 00 0 . 98 ± 0 . 03 19 . 24 ± 1 . 92 0 . 88 ± 0 . 00 2 . 15 e - 19 18 . 64 ± 2 . 15 0 . 87 ± 0 . 01 1 . 00 ± 0 . 00 250 15 . 13 ± 1 . 61 0 . 71 ± 0 . 01 0 . 96 ± 0 . 05 15 . 28 ± 1 . 87 0 . 71 ± 0 . 01 1 . 45 e - 09 14 . 60 ± 2 . 10 0 . 71 ± 0 . 02 0 . 99 ± 0 . 00 500 12 . 06 ± 1 . 59 0 . 48 ± 0 . 02 0 . 90 ± 0 . 09 12 . 23 ± 1 . 82 0 . 48 ± 0 . 03 4 . 35 e - 03 11 . 58 ± 2 . 10 0 . 47 ± 0 . 03 0 . 90 ± 0 . 05 1000 9 . 09 ± 1 . 58 0 . 14 ± 0 . 05 0 . 84 ± 0 . 10 9 . 20 ± 1 . 84 0 . 13 ± 0 . 05 4 . 61 e - 01 8 . 57 ± 2 . 10 0 . 12 ± 0 . 06 0 . 51 ± 0 . 03 Complete Block Shuffling 32 9 . 05 ± 1 . 61 0 . 17 ± 0 . 08 0 . 96 ± 0 . 05 9 . 18 ± 1 . 85 0 . 17 ± 0 . 08 4 . 04 e - 01 8 . 52 ± 2 . 10 0 . 15 ± 0 . 08 0 . 50 ± 0 . 02 16 9 . 00 ± 1 . 59 0 . 12 ± 0 . 05 0 . 84 ± 0 . 10 9 . 12 ± 1 . 84 0 . 12 ± 0 . 06 4 . 80 e - 01 8 . 46 ± 2 . 08 0 . 11 ± 0 . 06 0 . 49 ± 0 . 02 8 8 . 98 ± 1 . 60 0 . 06 ± 0 . 03 0 . 58 ± 0 . 06 9 . 11 ± 1 . 85 0 . 06 ± 0 . 03 5 . 20 e - 01 8 . 47 ± 2 . 10 0 . 06 ± 0 . 03 0 . 50 ± 0 . 02 4 8 . 98 ± 1 . 60 0 . 03 ± 0 . 01 0 . 47 ± 0 . 04 9 . 11 ± 1 . 85 0 . 03 ± 0 . 01 4 . 75 e - 01 8 . 47 ± 2 . 08 0 . 02 ± 0 . 02 0 . 49 ± 0 . 02 A.2 Comprehensiv e Semantic P erturbation Results This section pro vides the full results of stress-testing the w atermark against the complete suite of semantic p erturbations on a diverse set of images from the MS COCO dataset. Understanding Semantic Perturbations on Generative Image W atermarks 19 T able 4: Robustness to seman tic manipulation across in-pro cessing watermarking metho ds Attac k Category V ariant Seed Stable Signature T ree Ring Gaussian Shading PSNR SSIM Bit Acc TPR VLMA BLIPA PSNR SSIM p -val TPR VLMA BLIP A PSNR SSIM Bit Acc TPR VLMA BLIP A ( ↑ ) ( ↑ ) ( ↑ ) @0.1% ( ↑ ) ( ↑ ) ( ↑ ) ( ↑ ) ( ↑ ) ( ↓ ) @0.1% ( ↑ ) ( ↑ ) ( ↑ ) ( ↑ ) ( ↑ ) ( ↑ ) @0.1% ( ↑ ) ( ↑ ) ( ↑ ) Global Stylization 1 12 . 49 ± 1 . 18 0 . 31 ± 0 . 06 0 . 57 ± 0 . 05 0 . 41 0 . 60 ± 0 . 21 0 . 52 ± 0 . 10 12 . 41 ± 1 . 41 0 . 32 ± 0 . 06 1 . 54 e - 03 0 . 80 0 . 52 ± 0 . 23 0 . 49 ± 0 . 14 11 . 82 ± 1 . 34 0 . 32 ± 0 . 06 0 . 99 ± 0 . 01 1 . 00 0 . 53 ± 0 . 24 0 . 52 ± 0 . 12 2 12 . 24 ± 1 . 17 0 . 46 ± 0 . 04 0 . 58 ± 0 . 05 0 . 45 0 . 58 ± 0 . 22 0 . 55 ± 0 . 11 12 . 71 ± 1 . 37 0 . 47 ± 0 . 05 1 . 06 e - 01 0 . 35 0 . 53 ± 0 . 24 0 . 53 ± 0 . 11 12 . 10 ± 1 . 48 0 . 46 ± 0 . 05 0 . 98 ± 0 . 01 0 . 98 0 . 52 ± 0 . 25 0 . 53 ± 0 . 12 3 13 . 41 ± 1 . 43 0 . 53 ± 0 . 05 0 . 65 ± 0 . 07 0 . 80 0 . 69 ± 0 . 21 0 . 62 ± 0 . 10 13 . 94 ± 1 . 66 0 . 55 ± 0 . 05 1 . 51 e - 03 0 . 75 0 . 62 ± 0 . 25 0 . 60 ± 0 . 10 13 . 17 ± 1 . 70 0 . 54 ± 0 . 06 0 . 99 ± 0 . 01 1 . 00 0 . 61 ± 0 . 26 0 . 61 ± 0 . 10 4 12 . 47 ± 1 . 11 0 . 32 ± 0 . 04 0 . 53 ± 0 . 05 0 . 24 0 . 62 ± 0 . 21 0 . 52 ± 0 . 10 12 . 65 ± 1 . 41 0 . 33 ± 0 . 04 2 . 48 e - 02 0 . 71 0 . 55 ± 0 . 24 0 . 50 ± 0 . 11 12 . 14 ± 1 . 44 0 . 33 ± 0 . 04 0 . 98 ± 0 . 02 1 . 00 0 . 54 ± 0 . 24 0 . 51 ± 0 . 11 5 13 . 04 ± 1 . 39 0 . 36 ± 0 . 06 0 . 54 ± 0 . 05 0 . 30 0 . 65 ± 0 . 22 0 . 60 ± 0 . 10 12 . 82 ± 1 . 64 0 . 37 ± 0 . 06 1 . 13 e - 03 0 . 76 0 . 58 ± 0 . 24 0 . 56 ± 0 . 11 12 . 40 ± 1 . 61 0 . 37 ± 0 . 05 0 . 99 ± 0 . 01 1 . 00 0 . 63 ± 0 . 22 0 . 57 ± 0 . 09 Local T exture Shift 1 16 . 99 ± 4 . 14 0 . 70 ± 0 . 10 0 . 48 ± 0 . 07 0 . 12 0 . 76 ± 0 . 20 0 . 78 ± 0 . 11 16 . 47 ± 4 . 54 0 . 77 ± 0 . 12 6 . 54 e - 07 0 . 90 0 . 79 ± 0 . 20 0 . 76 ± 0 . 14 16 . 04 ± 4 . 42 0 . 74 ± 0 . 12 0 . 99 ± 0 . 00 1 . 00 0 . 73 ± 0 . 26 0 . 73 ± 0 . 10 2 17 . 21 ± 4 . 37 0 . 71 ± 0 . 11 0 . 49 ± 0 . 07 0 . 03 0 . 77 ± 0 . 22 0 . 80 ± 0 . 11 17 . 18 ± 4 . 42 0 . 77 ± 0 . 12 1 . 28 e - 08 0 . 99 0 . 77 ± 0 . 20 0 . 77 ± 0 . 13 16 . 33 ± 4 . 42 0 . 75 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 80 ± 0 . 22 0 . 75 ± 0 . 12 3 16 . 45 ± 4 . 22 0 . 70 ± 0 . 10 0 . 51 ± 0 . 07 0 . 06 0 . 74 ± 0 . 22 0 . 74 ± 0 . 13 16 . 29 ± 4 . 73 0 . 76 ± 0 . 11 4 . 82 e - 09 1 . 00 0 . 78 ± 0 . 16 0 . 73 ± 0 . 13 15 . 29 ± 4 . 72 0 . 74 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 70 ± 0 . 27 0 . 72 ± 0 . 11 4 17 . 18 ± 4 . 15 0 . 71 ± 0 . 10 0 . 51 ± 0 . 08 0 . 16 0 . 79 ± 0 . 18 0 . 80 ± 0 . 09 16 . 53 ± 4 . 71 0 . 77 ± 0 . 11 1 . 76 e - 08 0 . 98 0 . 78 ± 0 . 21 0 . 79 ± 0 . 14 15 . 80 ± 4 . 70 0 . 75 ± 0 . 11 0 . 99 ± 0 . 00 1 . 00 0 . 67 ± 0 . 30 0 . 79 ± 0 . 10 5 17 . 01 ± 4 . 06 0 . 71 ± 0 . 10 0 . 51 ± 0 . 08 0 . 16 0 . 79 ± 0 . 15 0 . 79 ± 0 . 12 16 . 56 ± 4 . 56 0 . 77 ± 0 . 11 1 . 12 e - 08 0 . 98 0 . 80 ± 0 . 16 0 . 76 ± 0 . 13 16 . 01 ± 4 . 49 0 . 75 ± 0 . 12 0 . 99 ± 0 . 00 1 . 00 0 . 80 ± 0 . 21 0 . 77 ± 0 . 12 Intra-Class 1 16 . 21 ± 4 . 33 0 . 68 ± 0 . 11 0 . 49 ± 0 . 08 0 . 03 0 . 76 ± 0 . 20 0 . 79 ± 0 . 09 15 . 68 ± 4 . 37 0 . 75 ± 0 . 12 5 . 77 e - 08 0 . 98 0 . 80 ± 0 . 17 0 . 76 ± 0 . 15 15 . 37 ± 4 . 40 0 . 73 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 75 ± 0 . 24 0 . 79 ± 0 . 10 2 16 . 58 ± 4 . 28 0 . 69 ± 0 . 10 0 . 48 ± 0 . 07 0 . 00 0 . 75 ± 0 . 22 0 . 79 ± 0 . 11 16 . 23 ± 4 . 35 0 . 75 ± 0 . 11 1 . 51 e - 07 0 . 99 0 . 74 ± 0 . 21 0 . 77 ± 0 . 13 15 . 66 ± 4 . 32 0 . 73 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 73 ± 0 . 26 0 . 78 ± 0 . 12 3 16 . 37 ± 4 . 34 0 . 69 ± 0 . 11 0 . 49 ± 0 . 07 0 . 00 0 . 75 ± 0 . 22 0 . 78 ± 0 . 09 15 . 99 ± 4 . 44 0 . 75 ± 0 . 12 1 . 04 e - 06 0 . 98 0 . 75 ± 0 . 21 0 . 75 ± 0 . 15 15 . 54 ± 4 . 35 0 . 72 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 74 ± 0 . 26 0 . 74 ± 0 . 14 4 16 . 80 ± 4 . 16 0 . 70 ± 0 . 10 0 . 50 ± 0 . 07 0 . 00 0 . 73 ± 0 . 25 0 . 81 ± 0 . 10 16 . 19 ± 4 . 46 0 . 76 ± 0 . 11 8 . 99 e - 09 1 . 00 0 . 75 ± 0 . 22 0 . 76 ± 0 . 15 15 . 39 ± 4 . 45 0 . 73 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 75 ± 0 . 25 0 . 78 ± 0 . 10 5 16 . 86 ± 4 . 17 0 . 70 ± 0 . 10 0 . 50 ± 0 . 07 0 . 03 0 . 75 ± 0 . 23 0 . 80 ± 0 . 08 16 . 02 ± 4 . 46 0 . 76 ± 0 . 12 6 . 64 e - 06 0 . 97 0 . 80 ± 0 . 16 0 . 76 ± 0 . 14 15 . 64 ± 4 . 21 0 . 74 ± 0 . 12 0 . 99 ± 0 . 00 1 . 00 0 . 74 ± 0 . 26 0 . 79 ± 0 . 12 Inter-Class 1 16 . 29 ± 4 . 62 0 . 68 ± 0 . 11 0 . 50 ± 0 . 07 0 . 03 0 . 58 ± 0 . 23 0 . 67 ± 0 . 15 16 . 15 ± 4 . 62 0 . 75 ± 0 . 12 1 . 45 e - 08 0 . 99 0 . 69 ± 0 . 23 0 . 66 ± 0 . 17 14 . 87 ± 4 . 63 0 . 72 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 59 ± 0 . 26 0 . 65 ± 0 . 17 2 16 . 42 ± 4 . 46 0 . 69 ± 0 . 11 0 . 50 ± 0 . 08 0 . 00 0 . 65 ± 0 . 20 0 . 67 ± 0 . 15 16 . 15 ± 4 . 81 0 . 75 ± 0 . 11 2 . 85 e - 10 1 . 00 0 . 61 ± 0 . 26 0 . 66 ± 0 . 17 15 . 16 ± 4 . 23 0 . 73 ± 0 . 11 0 . 99 ± 0 . 01 1 . 00 0 . 64 ± 0 . 27 0 . 65 ± 0 . 14 3 16 . 26 ± 4 . 56 0 . 69 ± 0 . 11 0 . 50 ± 0 . 08 0 . 06 0 . 61 ± 0 . 24 0 . 65 ± 0 . 18 15 . 83 ± 4 . 70 0 . 75 ± 0 . 12 3 . 88 e - 07 0 . 94 0 . 62 ± 0 . 26 0 . 66 ± 0 . 20 15 . 14 ± 4 . 33 0 . 73 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 67 ± 0 . 25 0 . 68 ± 0 . 17 4 16 . 26 ± 4 . 52 0 . 69 ± 0 . 11 0 . 49 ± 0 . 08 0 . 03 0 . 65 ± 0 . 18 0 . 70 ± 0 . 15 16 . 41 ± 4 . 52 0 . 76 ± 0 . 11 8 . 00 e - 09 0 . 98 0 . 67 ± 0 . 24 0 . 66 ± 0 . 18 15 . 22 ± 4 . 25 0 . 74 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 60 ± 0 . 26 0 . 66 ± 0 . 17 5 16 . 30 ± 4 . 60 0 . 69 ± 0 . 11 0 . 50 ± 0 . 06 0 . 03 0 . 60 ± 0 . 23 0 . 66 ± 0 . 17 15 . 87 ± 4 . 69 0 . 75 ± 0 . 12 3 . 06 e - 08 0 . 98 0 . 65 ± 0 . 21 0 . 64 ± 0 . 18 15 . 01 ± 4 . 41 0 . 73 ± 0 . 12 0 . 99 ± 0 . 01 1 . 00 0 . 62 ± 0 . 24 0 . 64 ± 0 . 17 20 Nakra and W u (a) Seam Carving (b) Downsampling (c) Impulse Noise (d) Interlea ving (e) Occlusion (f ) Morph. Erosion (g) Morph. Dilation (h) Partial Blo c k Shuffling (i) Complete Block Shuffling Fig. 7: Exp erimen tal results of watermark detectability vs visual fidelit y in PSNR under enhanced image-pro cessing-based p erturbations, sho wing general robustness under these manipulations. Detection metrics are bit accuracy for Stable Signature/Gaussian shading and the normalized negative logarithm of p -v alue for T ree-Ring. Color indicates the p erturbation strength, and markers indicate the watermarking sc hemes. Fig. 8: Exp erimen tal results of watermark detectability against visual fidelit y in PSNR ( y -axis) and semantic drift ( x -axis) under semantic perturbations. Color indicates detectabilit y (TPR@0.1%). Results show watermark detectability can collapse across metho ds under v arying levels of semantic drift, rev ealing a gap that has not b een captured by conv entional robustness tests. Understanding Semantic Perturbations on Generative Image W atermarks 21 A.3 Qualitativ e Examples of Seman tic Drift Captions (a) (b) (c) Fig. 9: (a) Image watermark ed using StableSignature [7], (b) Global semantic p ertur- bation on (a), (c) Lo cal inter-ob ject replacement p erturbation on (a). BLIP Caption for Fig. 9(a) there is a bed with a floral comforter in a bedroom, new england architecture, photo taken in 2018, shot on anamorphic lenses, real estate photography, full width, hdr photo, trending on textures. com, by Amelia Robertson Hill, small room VLM Caption for Fig. 9(a) A cozy bedroom featuring a comfortable bed draped in a pink floral bedspread, adorned with a floral comforter and two pillows. The room exudes a warm and inviting atmosphere, with a rug on the floor, a small throw rug, and a rug on the bed. The walls are adorned with pictures and a painting, while a shelf in the corner provides ample storage space. The ceiling is white, and the window is framed by white blinds. The bedspread and pillows are white with pink flowers, and the rug on the bed is striped. The room also includes a twin-sized bed, a full-size bed, and a daybed. 22 Nakra and W u BLIP Caption for Fig. 9(b) painting of a bedroom with a bed and a bookcase, deepdream, dreamy blurred lens, image dataset, prism lights, 5 0 0 px, calico cat, lacking in three-dimensionality, psychedelic interconnections, sunlight pouring through window, rendered VLM Caption for Fig. 9(b) A cozy room with a comfortable bed and a bookshelf. The bed is made with a multi-colored comforter and blankets. The bookshelf is filled with books and knick-knacks. The wall is yellow and the ceiling is grey. There is a picture hanging on the wall above the bed and a small picture hanging on the wall near the bookshelf. The room is lit by a warm glow from the fireplace. BLIP Caption for Fig. 9(c) there is a red chair in a living room with a book shelf, real estate photography, shot on anamorphic lenses, by Esther Blaikie MacKinnon, narrow hallway, realisitc photo, professional detailed photo, image artifacts, canon 20mm lens, a photorealistic rendering VLM Caption for Fig. 9(c) A red chair sits comfortably in the living room, bathed in the warm glow of the window. The rug beneath the chair is grey, while the armrest and the chair itself are adorned with a red cushion. Pictures hang on the wall, and a white shelf stands proudly in the corner. A green plant flourishes on the floor, and a white light switch provides ample illumination. The floor is made of wood, and the blinds on the window are white. A brown table sits next to the shelf, while a green house plant adds a touch of greenery to the space. The living room is filled with a sense of warmth and comfort. Understanding Semantic Perturbations on Generative Image W atermarks 23 A.4 Quan titative T rend Analysis of Semantic Drift Captions T o enable a fair comparison b et ween BLIP and VLM-based captions, we first p ost-process BLIP captions using GPT-5 to remov e hallucinated or extraneous con tent. As shown in Fig. 10, BLIP and VLM caption-similarity metrics ex- hibit consisten t qualitative trends. Intra-ob ject lo cal p erturbations yield higher similarit y than inter-ob ject local p erturbations. Although style transfer largely preserv es scene semantics, the induced domain shift (such as conv erting images to an artistic style) reduces caption similarity relativ e to b oth lo cal p erturbation regimes. Both metrics also correctly assign negligible similarity to unrelated image pairs, indicating strong separation b et ween distinct scenes. Finally , VLM captions pro vide b etter discrimination b et ween intra-class and inter-class lo cal p erturbations, exhibiting a larger gap in similarity scores than BLIP . T able 5: (a) Cosine similarity b et ween unp erturbed watermark ed image and p erturb ed w atermarked images using BLIP , (b) Cosine similarity b et ween unp erturbed water- mark ed image and p erturbed w atermarked images using VLM. (a) (b) Fig. 10: Cosine similarity betw een unp erturbed watermark ed image and p erturbed w atermarked images using BLIP and VLM, including global semantic p erturbations with 2 seed v ariants, intra-ob ject lo cal semantic p erturbation with 3 seed v ariants, in ter-ob ject local seman tic perturbation, and a distinct scene. 24 Nakra and W u A.5 Bey ond Captions: Using Scene-Graphs to Quantify Semantic Drift W e exactly follow the scene graph generation pip eline of LLM4SGG [16] illus- trated in Fig. 11 to construct scene graphs for b oth the original and p erturbed w atermarked images as sho wn in Fig. 12. T o quan tify similarity b etw een the resulting graphs, we compute a triplet-based alignment score by matc hing corre- sp onding 〈 sub ject, predicate, ob ject) relations b et ween the p erturbed and original scene graphs. As illustrated in Fig 13, the trends for triplet similarity align with BLIP and VLM captions. Fig. 11: Ov erview of the scene graph generation (SGG) pro cess. Fig. 12: Scene graph of Fig 9(a) Understanding Semantic Perturbations on Generative Image W atermarks 25 Fig. 13: T riplet similarity betw een unp erturbed watermark ed image and p erturbed w atermarked images using SGGs generated by VLM captions, including in tra-ob ject lo cal semantic p erturbation with 3 seed v ariants, inter-ob ject lo cal seman tic perturbation, and a distinct scene. A.6 Limitations and F uture W ork Our b enc hmark enables systematic study of which higher-level image v ariations differen t watermarks exploit in the generative setting; how ev er, several limitations remain. First, while we characterize semantic changes induced by our attacks, w e do not identify the sp ecific regularities that watermark embedders exploit to yield reliably reco verable signals, and the emb edding mechanisms remain largely black-box. Second, our semantic p erturbation framework is inherently foreground-cen tric: the detect-and-replace pip eline prioritizes salient ob jects and ma y underrepresen t other sources of semantic v ariation (such as bac kground comp osition, global geometry , or lighting). Consisten t with this, our scene-graph analysis primarily aligns with foreground-ob ject-based analysis. Third, as an initial pro of-of-concept work, this pap er do es not yet provide explanation for the uneven sensitivity of differen t in-pro cessing metho ds to syntactic versus seman tic p erturbations. F or instance, Gaussian Shading is highly robust to most seman tic edits, yet is more affected by adaptive seam carving than exp ected. Understanding ho w watermark schemes can sim ultaneously exhibit robustness and brittleness—and whether this b ehavior arises from ov erfitting to sp ecific laten t regularities—remains an op en question. Finally , our empirical study focuses on sev eral widely used, represen tative in-pro cessing metho ds. Sev eral recent sc hemes [3, 5] are tailored to sp ecific threat mo dels that explicitly incorp orate seman tic manipulation; assessing their robustness under controlled seman tic drift and clarifying their trade-offs is an imp ortan t direction for future w ork. 26 Nakra and W u Building on this initial effort, a key direction for future work is to develop explanations for these metho d-dep enden t vulnerabilities. Lo oking forward, more reliable authen tication will likely require multi-la y ered defenses, including designs that remain detectable under both syntactic and seman tic edits. An additional promising direction is w atermarking in structured laten t spaces to impro v e in terpretability; a central question is how to design suc h interpretable watermark represen tations while maintaining robustness to b oth syntactic and semantic manipulation. A.7 Computing Resources for the Exp erimen ts All exp eriments were conducted using three NVIDIA TIT AN V GPUs. F or Stable Diffusion and Kandinsky , we hav e used 50 inference steps for diffusion sampling.