{"id":"https://openalex.org/W7154381095","doi":"https://doi.org/10.48550/arxiv.2604.11720","title":"On the Robustness of Watermarking for Autoregressive Image Generation","display_name":"On the Robustness of Watermarking for Autoregressive Image Generation","publication_year":2026,"publication_date":"2026-04-13","ids":{"openalex":"https://openalex.org/W7154381095","doi":"https://doi.org/10.48550/arxiv.2604.11720"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.11720","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.11720","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.11720","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133602224","display_name":"Andreas M\u00fcller","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"M\u00fcller, Andreas","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112537052","display_name":"Denis Lukovnikov","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lukovnikov, Denis","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126675368","display_name":"Shingo Kodama","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kodama, Shingo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133564210","display_name":"Minh Pham","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pham, Minh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133605190","display_name":"Anubhav Jain","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jain, Anubhav","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133610368","display_name":"Jonathan Petit","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Petit, Jonathan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133617405","display_name":"Niv Cohen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cohen, Niv","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5133568340","display_name":"Asja Fischer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fischer, Asja","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6428999900817871,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6428999900817871,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.16279999911785126,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.07249999791383743,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/digital-watermarking","display_name":"Digital watermarking","score":0.923799991607666},{"id":"https://openalex.org/keywords/watermark","display_name":"Watermark","score":0.8561999797821045},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.7110000252723694},{"id":"https://openalex.org/keywords/autoregressive-model","display_name":"Autoregressive model","score":0.703000009059906},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.499099999666214},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.4162999987602234},{"id":"https://openalex.org/keywords/copy-protection","display_name":"Copy protection","score":0.41429999470710754},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4075999855995178}],"concepts":[{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.923799991607666},{"id":"https://openalex.org/C164112704","wikidata":"https://www.wikidata.org/wiki/Q7974348","display_name":"Watermark","level":3,"score":0.8561999797821045},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.7110000252723694},{"id":"https://openalex.org/C159877910","wikidata":"https://www.wikidata.org/wiki/Q2202883","display_name":"Autoregressive model","level":2,"score":0.703000009059906},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6518999934196472},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.631600022315979},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.5906000137329102},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.499099999666214},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.4162999987602234},{"id":"https://openalex.org/C2780581891","wikidata":"https://www.wikidata.org/wiki/Q15738686","display_name":"Copy protection","level":4,"score":0.41429999470710754},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4075999855995178},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.4009000062942505},{"id":"https://openalex.org/C106430172","wikidata":"https://www.wikidata.org/wiki/Q6002272","display_name":"Image restoration","level":4,"score":0.3578999936580658},{"id":"https://openalex.org/C9417928","wikidata":"https://www.wikidata.org/wiki/Q1070689","display_name":"Image processing","level":3,"score":0.35760000348091125},{"id":"https://openalex.org/C2776674983","wikidata":"https://www.wikidata.org/wiki/Q545981","display_name":"Image editing","level":3,"score":0.32269999384880066},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3222000002861023},{"id":"https://openalex.org/C104267543","wikidata":"https://www.wikidata.org/wiki/Q208163","display_name":"Signal processing","level":3,"score":0.29989999532699585},{"id":"https://openalex.org/C2779803651","wikidata":"https://www.wikidata.org/wiki/Q5282088","display_name":"Discriminator","level":3,"score":0.2903999984264374},{"id":"https://openalex.org/C2779696439","wikidata":"https://www.wikidata.org/wiki/Q7512811","display_name":"Signature (topology)","level":2,"score":0.2754000127315521},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.2736999988555908},{"id":"https://openalex.org/C2779843651","wikidata":"https://www.wikidata.org/wiki/Q7390335","display_name":"SIGNAL (programming language)","level":2,"score":0.2531999945640564},{"id":"https://openalex.org/C55352655","wikidata":"https://www.wikidata.org/wiki/Q304247","display_name":"Median filter","level":4,"score":0.25209999084472656}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.11720","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.11720","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.11720","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.11720","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities","score":0.5835817456245422}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"proliferation":[1],"of":[2,12],"autoregressive":[3],"(AR)":[4],"image":[5,118,138],"generators":[6],"demands":[7],"reliable":[8],"detection":[9,146,169],"and":[10,18,63,71,78,94,105,119,166],"attribution":[11],"their":[13,65,172],"outputs":[14],"to":[15,19,26,67,113,122,161,170],"mitigate":[16],"misinformation,":[17],"filter":[20],"synthetic":[21,144],"images":[22,157],"from":[23],"training":[24],"data":[25],"prevent":[27,171],"model":[28,124,176],"collapse.":[29],"To":[30],"address":[31],"this":[32,57],"need,":[33],"watermarking":[34,127,134],"techniques,":[35],"specifically":[36],"designed":[37],"for":[38,136,147],"AR":[39,137],"models,":[40],"embed":[41],"a":[42,52,85,96,114,163],"subtle":[43],"signal":[44],"at":[45],"generation":[46,139],"time,":[47],"enabling":[48],"downstream":[49],"verification":[50],"through":[51],"corresponding":[53],"watermark":[54,69,165],"detector.":[55],"In":[56],"work,":[58],"we":[59],"study":[60],"these":[61],"schemes":[62,135],"demonstrate":[64],"vulnerability":[66],"both":[68],"removal":[70,88,104],"forgery":[72,106],"attacks.":[73],"We":[74],"assess":[75],"existing":[76,133],"attacks":[77,107],"further":[79],"introduce":[80],"three":[81],"new":[82],"attacks:":[83],"(i)":[84],"vector-quantized":[86],"regeneration":[87],"attack,":[89,93],"(ii)":[90],"adversarial":[91],"optimization-based":[92],"(iii)":[95],"frequency":[97],"injection":[98],"attack.":[99],"Our":[100,129],"evaluation":[101],"reveals":[102],"that":[103,132],"can":[108,158],"be":[109,159],"effective":[110],"with":[111],"access":[112,121],"single":[115],"watermarked":[116],"reference":[117],"without":[120],"original":[123],"parameters":[125],"or":[126],"secrets.":[128],"findings":[130],"indicate":[131],"do":[140],"not":[141],"reliably":[142],"support":[143],"content":[145],"dataset":[148],"filtering.":[149],"Moreover,":[150],"they":[151],"enable":[152],"Watermark":[153],"Mimicry,":[154],"whereby":[155],"authentic":[156],"manipulated":[160],"imitate":[162],"generator's":[164],"trigger":[167],"false":[168],"inclusion":[173],"in":[174],"future":[175],"training.":[177]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-15T00:00:00"}