Invisible watermarking was supposed to solve the provenance problem: embed an imperceptible signal in AI-generated images, then detect it later to determine origin. The watermark survives casual manipulation — cropping, compression, mild filtering — because it's distributed across the image's frequency content in a way that survives these operations.
The paper (arXiv:2603.12949) demonstrates that diffusion-based image editing — the same technology used to generate images — can remove invisible watermarks while preserving image quality. The editing process works by adding noise to the image and then denoising it with a diffusion model, guided by a text prompt that describes the desired output. This noise-denoise cycle effectively regenerates the image content while stripping the watermark, because the watermark exists in precisely the mid-frequency range that the diffusion model overwrites during regeneration.
The failure is structural, not incidental. Watermarks must be imperceptible (low energy relative to image content) and distributed across frequencies to survive compression. Diffusion models must overwrite mid-to-high frequency content to perform meaningful edits. The watermark lives in the exact signal space that the editor needs to modify. Any watermark robust enough to survive diffusion editing would be perceptible — visible — because it would need energy comparable to the image content itself.
This doesn't just break specific watermarking schemes; it challenges the watermarking-as-provenance approach entirely. If the same generative technology that creates images can erase watermarks from images, then the absence of a watermark carries no evidential weight. An unwatermarked image might never have been watermarked, or might have been watermarked and then diffusion-edited. The two cases are indistinguishable.