This is the question that decides whether watermarking is worth doing at all, so it deserves numbers rather than adjectives. The short version: our watermark survives generative inpainting up to roughly half the frame being repainted, survives AI upscaling comfortably, and — the genuinely surprising result — sometimes comes back stronger after an AI cleanup pass than before it. It does not survive everything, and we publish the failures too.
Two different signals, two different numbers
Before any figures: we run two independent detectors, and mixing up their scores is the easiest way to misread everything below.
- Bit accuracy — how much of the embedded 256-bit signature we recover. This is the watermark. An unmarked file sits near 0.5, the coin-flip floor.
- Content similarity — a separate perceptual match between two files, which works even on content that was never watermarked at all. Nothing to do with the embedded bits.
They fail in different places, which is the point of having both. Every number below is labelled with which one it is.
Why AI editing is the interesting attack
Older watermarking survived the old threats: cropping, compression, resizing, screenshots. Generative editing is different in kind. An inpainting model does not degrade pixels, it replaces them with newly synthesized content. Anything encoded in the replaced region is not damaged, it is simply gone. The question is whether enough of the signal lives in the surviving region to still decode.
Inpainting: measured, not asserted
We ran a mask sweep — repaint a centred rectangle covering an increasing fraction of the image, then attempt recovery. Bit accuracy is the share of the embedded signature recovered correctly; an unwatermarked file sits near 0.5, which is the coin-flip floor.
mask area bit accuracy detected 0% (clean) 0.99 100% 10% 0.99 100% 20% 0.97 100% 30% 0.95 100% 40% 0.91 98% 50% 0.83 96% unwatermarked 0.55 0%
Two things matter here. First, the curve degrades smoothly rather than falling off a cliff — there is no mask fraction where the watermark abruptly stops working. Second, the gap to the 0.55 unwatermarked floor stays wide even at 50% repainting, which is what makes the distinction trustworthy rather than marginal.
The honest caveat on those numbers
That sweep (n=50 images) used a classical inpainting algorithm, not a diffusion model. We have separately tested a real commercial AI upscaler — a video through Topaz Video AI still matched its original at 0.979, but that is a content similarity score, not watermark recovery, and it was a single video. We have not published an end-to-end mask sweep against a modern generative inpainter. Treating the table above as an exact prediction for a 2026 diffusion tool would be overclaiming, and we would rather say so than let you find out later.
AI upscaling makes the watermark easier to read
The counterintuitive result, and the one we are least certain about. We photographed a screen showing a watermarked image, then ran a consumer AI enhancer over the capture. Bit-accuracy recovery went up, from 0.65 to 0.75, crossing our recovery threshold in the process. This was a single sample — one photo, one enhancer — so treat it as a lead worth knowing about, not a measured rate. Our benchmark page labels it the same way.
The likely mechanism: the enhancer aggressively suppresses high-frequency capture noise — sensor grain, compression artifacts — while leaving the mid-frequency band where the watermark lives largely intact. It improves the signal-to-noise ratio on our side. The practical implication is worth sitting with: an infringer running "AI cleanup" on stolen content to make it look better may be making it more attributable, not less.
One caveat we insist on: that was tested against generic consumer enhancers, not tools purpose-built to strip watermarks. We would not bet on the effect holding against an adversarial denoiser, and we have not claimed it does.
Where it genuinely struggles
- Filming a screen, for video. Our hardest measured case. Still images photographed off a screen hold up well (content similarity 0.78-0.85), but video collapses — five of six real recordings scored between 0.24 and 0.54, mostly below our production threshold. These are content-similarity numbers, not watermark recovery. Phone orientation alone moved one clip by more than a factor of two.
- Heavy regeneration past ~50% of the frame. At some point you are not editing the image, you are generating a new one that resembles it. Nothing survives that, and any vendor claiming otherwise is describing marketing rather than physics.
- Very small crops. The signature is embedded globally across the frame. Crop tightly enough and there is not enough of it left to decode.
Why publishing the failures is the point
Every competitor in this space publishes a robustness claim and no robustness data. That is a choice, and it is the wrong one — a watermark you cannot characterize is a watermark you cannot rely on in a dispute. If you are going to point at a detection result as evidence, you need to know its error behaviour, and so does whoever you are pointing it at. Our full benchmark, including the transforms where we do worse, is public.