Google created an AI that can easily remove the digital watermarks photographers put on their images to prevent unauthorized use.
In a paper published online Thursday, research scientists at the firm describe how a computer algorithm can get past this protection and remove watermarks automatically when working with collections instead of single images.
This gives users unobstructed access to the clean images the watermarks are intended to protect, and Google said the purpose of the research was to disclose the issue and find solutions.
Google created an AI that can easily and automatically remove the types of digital watermarks photographers put on their images to prevent unauthorized use working with collections instead of single images. The before and after images can be seen above
‘As often done with vulnerabilities discovered in operating systems, applications or protocols, we want to disclose this vulnerability and propose solutions in order to help the photography and stock image communities adapt and better protect its copyrighted content and creations,’ a post on Google’s research blogs announcing the research paper reads.
‘From our experiments much of the world’s stock imagery is currently susceptible to this circumvention.’
Watermarks are standard practice for professional photographers, marketers, and regular internet users who want to share photos or advertise them for sale without the risk they’ll be used without permission.
They usually consist of slightly transparent words or logos overlaid on images, making it so the photo can still be seen by potential buyers who want to license them.
Typically, watermarks are designed to contain complex structures such as thin lines and shadows that make them harder to remove, and while this works for protection on an individual image, the researchers found it can be decoded on a larger scale.
A figure illustrating the before, removal and after of watermarked stock images, as performed by Google’s new AI
‘While removing a watermark from a single image automatically is extremely challenging, watermarks are typically added in a consistent manner to many images,’ reads the paper, which was presented at the 2017 Computer Vision and Pattern Recognition Conference.
‘We show that this consistency can be exploited to automatically infer the watermark pattern and to obtain the original, watermark-free content with high accuracy.’
The new AI created by the researchers can estimate the watermark image and its opacity and recover the original, watermark-free image underneath.
Doing this for a single image with state-of-the-art editing tools would even be very tedious even for a Photoshop expert, who would need several minutes to remove just one watermark
By observing only watermarked image collections publicly available online (such as those depicting popular photo subjects such as food, sports, and nature), the AI showed this can be all be done automatically without any user intervention when approached en masse.
Watermark estimated automatically from watermarked images online and rendered on a gray background (left column). Input watermarked image (middle column) Automatically removed watermark (right column)
The first step of this process is identifying which image structures are repeating in the collection.
‘If a similar watermark is embedded in many images, the watermark becomes the signal in the collection and the images become the noise, and simple image operations can be used to pull out a rough estimation of the watermark pattern,’ the post reads.
After identifying the watermark, the program needs to know its decomposition into its image and alpha matte components in order to actually recover the image underneath.
This step involves a multi-image optimization problem called ‘multi-image matting,’ in which the watermark (the foreground) is separated into its image and opacity components while reconstructing a subset of the clean photo (the background).
The AI attack applied to a regular watermark (left) versus an attack applied to a randomly-warped watermark (right)
The researchers referred to their results as ‘very accurate’ and said the AI can deal with most watermarks used in practice, including ones containing thin structures, shadows, or color gradients.
‘We revealed a loophole in the way visible watermarks are used, which allows to automatically remove them and recover the original images with high accuracy,’ the paper reads.
To counter the vulnerability, the researchers recommend users introduce inconsistencies when embedding watermarks.
However, this can be quite challenging.
They discovered variation in the watermark’s location on photos or slightly changing the opacity from one to the next wasn’t enough.
The solution lies in introducing random geometric perturbations to the watermark, or warping it when embedding it in each image.
This technique produces a watermarked image that is very similar to the original photo and will leave very visible traces if removed.
Watermarked image, using subtle, random warping of the watermark (left column) and watermark removal result (right column)
‘In a nutshell, the reason this works is because that removing the randomly-warped watermark from any single image requires to additionally estimate the warp field that was applied to the watermark for that image — a task that is inherently more difficult,’ the post reads.
‘Therefore, even if the watermark pattern can be estimated in the presence of these random perturbations (which by itself is nontrivial), accurately removing it without any visible artifact is far more challenging.’
The researchers not that this is just one technique for creating robust watermarks and that it’s a good option because it’s relatively easy to implement.
However, more visible changes to the watermark across the images -such as introducing larger shifts in the watermark or incorporating other random elements – would lead to even better protection.
‘While we cannot guarantee that there will not be a way to break such randomized watermarking schemes in the future, we believe (and our experiments show) that randomization will make watermarked collection attacks fundamentally more difficult,’ the post reads.
‘We hope that these findings will be helpful for the photography and stock image communities.’
‘We revealed a loophole in the way visible watermarks are used, which allows to automatically remove them and recover the original images with high accuracy,’ the paper reads