Where Does the Watermark Hide? Push-Pull Disentanglement for Invisible Watermark Removal

arXiv:2609.31722v1 Announce Type: new Abstract: Fixed image distortions do not cover an attacker that learns from paired clean and watermarked images. We study this paired-training threat with single-image inference: deployment uses neither the clean reference nor the watermark key, payload, or decoder. An encoder maps each image to a structural latent g and an auxiliary residual latent u. Push supervision reconstructs the watermarked image from D(g_w,u_w). Pull supervision trains the zero-auxiliary output D(A_g(g_w;k),0) toward the paired clean image. At k=1.10,u=0, the four-method sweep gives an average BER of 0.3958, PSNR of 31.07 dB, and SSIM of 0.9554. Restoring u from 0 to 0.15 moves average BER from 0.3893 to 0.3357, while PSNR falls from 30.99 to 28.23 dB. The intervention supports decoder dependence on the auxiliary input in the evaluated setting. The accompanying theory is a conditional, post-hoc account of this behavior rather than an experimentally verified information-relocation result.

Source: arXiv cs.CV | 2026-09-29