{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2601-16473","title":"DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defenses","arxiv_id":"2601.16473","date":"2026-01-23","proceeding":null,"authors":["Wei Song","Zhenchang Xing","Liming Zhu","Yulei Sui","Jingling Xue"],"abstract":"The rapid proliferation of realistic deepfakes has raised urgent concerns over their misuse, motivating the use of defensive watermarks in synthetic images for reliable detection and provenance tracking. However, this defense paradigm assumes such watermarks are inherently resistant to removal. We challenge this assumption with DeMark, a query-free black-box attack framework that targets defensive image watermarking schemes for deepfakes. DeMark exploits latent-space vulnerabilities in encoder-decoder watermarking models through a compressive sensing based sparsification process, suppressing watermark signals while preserving perceptual and structural realism appropriate for deepfakes. Across eight state-of-the-art watermarking schemes, DeMark reduces watermark detection accuracy from 100% to 32.9% on average while maintaining natural visual quality, outperforming existing attacks. We further evaluate three defense strategies, including image super resolution, sparse watermarking, and adversarial training, and find them largely ineffective. These results demonstrate that current encoder decoder watermarking schemes remain vulnerable to latent-space manipulations, underscoring the need for more robust watermarking methods to safeguard against deepfakes.","url_abs":"https://arxiv.org/abs/2601.16473","url_pdf":"https://arxiv.org/pdf/2601.16473","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2601.16473","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2601.16473"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/adobe/trustmark","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/jzyustc/MBRS","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/rmpku/CIN","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/FangHanNUS/PIMoG","reach":{"status":"gone","observed_at":"2026-09-16","how":"tree_404+repo_404"}},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/Shilin-LU/VINE-B","reach":{"status":"gone","observed_at":"2026-09-16","how":"tree_404+repo_404"}},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/Shilin-LU/VINE-R","reach":{"status":"gone","observed_at":"2026-09-16","how":"tree_404+repo_404"}}],"summary":{"ran":3,"ran_draft_wrong":3,"unverified":4},"by_repo_kind":{"found_in_text":{"samples":10,"ran":6,"repositories":3}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":10,"samples":[{"code_sha256_prefix":"a1e1fd2e80482a75","entry":"ConvTBNRelu","repo":"rmpku/CIN","repo_kind":"found_in_text","path":"codes/models/DEM.py","file_url":"https://github.com/rmpku/CIN/blob/HEAD/codes/models/DEM.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a1e1fd2e80482a75"}},{"code_sha256_prefix":"2bc80170964dc1a5","entry":"UpConvt","repo":"rmpku/CIN","repo_kind":"found_in_text","path":"codes/models/DEM.py","file_url":"https://github.com/rmpku/CIN/blob/HEAD/codes/models/DEM.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2bc80170964dc1a5"}},{"code_sha256_prefix":"ef9faf68f492a375","entry":"flow_warp","repo":"adobe/trustmark","repo_kind":"found_in_text","path":"python/trustmark/KBNet/arch_util.py","file_url":"https://github.com/adobe/trustmark/blob/HEAD/python/trustmark/KBNet/arch_util.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ef9faf68f492a375"}},{"code_sha256_prefix":"221b2d116fdf1032","entry":"get_obj_from_str","repo":"adobe/trustmark","repo_kind":"found_in_text","path":"python/trustmark/model.py","file_url":"https://github.com/adobe/trustmark/blob/HEAD/python/trustmark/model.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"221b2d116fdf1032"}},{"code_sha256_prefix":"96ad5dc9ca239aec","entry":"make_layer","repo":"adobe/trustmark","repo_kind":"found_in_text","path":"python/trustmark/KBNet/arch_util.py","file_url":"https://github.com/adobe/trustmark/blob/HEAD/python/trustmark/KBNet/arch_util.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"96ad5dc9ca239aec"}},{"code_sha256_prefix":"5a1d8458dc7077a6","entry":"resize_flow","repo":"adobe/trustmark","repo_kind":"found_in_text","path":"python/trustmark/KBNet/arch_util.py","file_url":"https://github.com/adobe/trustmark/blob/HEAD/python/trustmark/KBNet/arch_util.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5a1d8458dc7077a6"}},{"code_sha256_prefix":"f62ebdee96e71da5","entry":"DEM","repo":"rmpku/CIN","repo_kind":"found_in_text","path":"codes/models/DEM.py","file_url":"https://github.com/rmpku/CIN/blob/HEAD/codes/models/DEM.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f62ebdee96e71da5"}},{"code_sha256_prefix":"f578dbc12c74e595","entry":"get_random_rectangle_inside","repo":"jzyustc/MBRS","repo_kind":"found_in_text","path":"network/noise_layers/crop.py","file_url":"https://github.com/jzyustc/MBRS/blob/HEAD/network/noise_layers/crop.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f578dbc12c74e595"}},{"code_sha256_prefix":"ef52d142b2c30ac2","entry":"instantiate_from_config","repo":"adobe/trustmark","repo_kind":"found_in_text","path":"python/trustmark/model.py","file_url":"https://github.com/adobe/trustmark/blob/HEAD/python/trustmark/model.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ef52d142b2c30ac2"}},{"code_sha256_prefix":"7ca3d41ede0e46bd","entry":"random_string","repo":"adobe/trustmark","repo_kind":"found_in_text","path":"python/trustmark/datalayer.py","file_url":"https://github.com/adobe/trustmark/blob/HEAD/python/trustmark/datalayer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"7ca3d41ede0e46bd"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CV","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}