Low-Compute Watermark Removal via Dual-Domain Natural Projection

Effective removal of semantic watermarks requires balancing three competing objectives: \emph{high removal success}, \emph{low perceptual distortion}, and \emph{low computational cost}. However, existing single-image attacks typically optimize only for the first two, achieving strong watermark suppression but relying on expensive, multi-step optimization that limits practical deployment. In this work, we show that this trade-off is fundamental: no current approach achieves all three properties simultaneously. We introduce \textsc{DAWN}, a lightweight, training-free attack that explicitly targets the low-cost regime while maintaining competitive removal performance. \textsc{DAWN} works by projecting a watermarked image onto natural-image priors in complementary frequency and semantic spaces, suppressing watermark signals that deviate from natural statistics, and then applying a decoupled perceptual-alignment step to restore visual consistency with minimal artifact. Across diverse pixel-, frequency-, and latent-space watermarking schemes, \textsc{DAWN} consistently reduces detectability while preserving structural and semantic fidelity, demonstrating that efficient, low-resource watermark removal is feasible with only modest perceptual degradation. Our code is available at \url{https://anonymous.4open.science/r/DAWN-567A/}.

As AI tools make it increasingly easy to generate realistic images, a key question arises: how do we know where an image came from? Digital watermarks, invisible signatures embedded into AI-generated images, have emerged as a promising way to track image provenance and combat misinformation. However, the robustness of these watermarks depends on how hard they are to remove. We show that an attacker with a single image, no knowledge of the watermarking system, and a modest laptop can reliably erase these invisible signatures. Our method, DAWN, works by "cleaning" a watermarked image in two complementary ways: first by smoothing out subtle statistical irregularities in the image's frequency structure, then by using a pre-trained AI model to restore natural-looking content. Together, these two steps suppress the watermark signal without visibly degrading the image. Our findings reveal a fundamental limitation: no current approach can simultaneously achieve high watermark removal, good image quality, and low computational cost. This exposes critical vulnerabilities in today's watermarking systems and highlights the need for more resilient designs to protect AI-generated content.