On the Robustness of Watermarking for Autoregressive Image Generation

The proliferation of autoregressive realstic image generators necessitates robust methods for mitigating misinformation and filtering synthetic images content. To this end, watermarking schemes for image models embed a subtle signal at generation time, enabling downstream verification with a corresponding detector. In this work, we study the vulnerability of such watermarks to removal and forgery attacks. We evaluate existing attacks and, finding them limited, introduce three new ones: (i) a vector-quantized regeneration removal attack, (ii) an adversarial optimization–based attack, and (iii) a frequency injection attack. Our evaluation reveals that both removal and forgery can be effective with access to as little as a single watermarked reference image. Consequently, we find that most AR watermarking schemes do not reliably support content filtering. Finally, we show that even the most robust method, BitMark, admits watermark mimicry—a form of forgery in which authentic images are made to imitate a generator's watermark.