Invisible Image Watermark Attacks: A Survey

Abstract

Invisible image watermarking supports copyright protection, provenance tracing, and AI-generated content governance. However, deep encoder-decoder and generative watermarks, public image editors, and latent-space reconstruction have transformed watermark attacks into a rapidly evolving landscape beyond conventional distortion-centered taxonomies and evaluation protocols. To the best of our knowledge, this is the first survey dedicated to attacks on invisible image watermarks, covering foundational attacks and representative research from 2018 to 2026 across classical and diffusion-based image watermarks. We organize more than sixty target watermarks into five classes (W1--W5) and introduce a unified multilabel taxonomy of seven attack families: conventional signal-processing, geometric and synchronization, regeneration and purification, adversarial perturbation, semantic editing, latent-space inversion, and forgery and provenance attacks. Our threat model separates attack objectives, attacker knowledge and access capabilities, and fidelity constraints, while treating data conditions as an orthogonal dimension. We provide grading references for attack effectiveness and image fidelity and consider forensic detectability as an additional evaluation dimension. Three findings emerge: robustness does not imply security, apparently stronger watermark classes expose new attack surfaces, and forgery may be more practical than removal. Sequential attack chains remain an open evaluation concern. We conclude with open problems in unified evaluation, forensic detectability, and cryptographic attribution.