Digital watermarking techniques are crucial for copyright protection and
source identification of images, especially in the era of generative AI models.
However, many existing watermarking methods, particularly content-agnostic
approaches that embed fixed patterns regardless of image content, are
vulnerable to steganalysis attacks that can extract and remove the watermark
with minimal perceptual distortion. In this work, we categorize watermarking
algorithms into content-adaptive and content-agnostic ones, and demonstrate how
averaging a collection of watermarked images could reveal the underlying
watermark pattern. We then leverage this extracted pattern for effective
watermark removal under both graybox and blackbox settings, even when the
collection contains multiple watermark patterns. For some algorithms like
Tree-Ring watermarks, the extracted pattern can also forge convincing
watermarks on clean images. Our quantitative and qualitative evaluations across
twelve watermarking methods highlight the threat posed by steganalysis to
content-agnostic watermarks and the importance of designing watermarking
techniques resilient to such analytical attacks. We propose security guidelines
calling for using content-adaptive watermarking strategies and performing
security evaluation against steganalysis. We also suggest multi-key assignments
as potential mitigations against steganalysis vulnerabilities.

数字水印技术在版权保护和图像源识别方面非常重要，特别是在生成式人工智能模型的时代。然而，许多现有的水印算法，尤其是不考虑内容的方法，即使在最小的感知畸变下，也容易受到隐写分析攻击的影响。本文将水印算法分类为内容自适应和内容不可知的，并演示了如何通过平均一系列水印图像来揭示潜在的水印模式。我们利用提取出的模式实现了在灰盒和黑盒设置下的高效水印去除，即使该系列包含多个水印模式。对于一些算法，如树环水印，提取出的模式还可以在原始图像上伪造出令人信服的水印。我们通过对十二种水印方法的定量和定性评估突出了隐写分析对内容不可知的水印的威胁，以及设计抗击这种分析攻击的水印技术的重要性。我们提出了安全指南，呼吁使用内容自适应的水印策略，并进行隐写分析的安全评估。我们还建议使用多密钥分配作为对隐写分析漏洞的潜在缓解措施。