Can an Invisible Watermark Survive a Repaint? What BrushOff Means for Watermark Benchmarks
Not always. A preprint posted on arXiv on October 19, 2026 shows that redrawing a watermarked painting with brush strokes removed the most robust watermark its authors tested, while the painting kept its look. The lesson is narrower than "watermarks don't work": a robustness claim only covers the attacks that were tested, and passing compression and blur says little about repainting.
This guide is for the person at a studio, publisher or platform who has to judge a vendor's watermark robustness claim before relying on it.
What did the BrushOff paper test?
The authors tested four watermarks on 500 paintings from five styles. Their attack, which they call BrushOff, redraws a watermarked painting with brush strokes using a pretrained stroke-based renderer. According to the abstract, it "needs no training, no knowledge of the watermark, and no generative model."
The strongest watermark in the test was VINE, a recent method built to survive image editing. VINE survived all 14 conventional distortions the authors tried, with at least 97.8% detection. After repainting, its detection fell to 1.8%. The repainted paintings kept a no-reference quality score (MUSIQ 58.2) close to the clean paintings (59.2).
The paper is a preprint and has not been peer reviewed.
Why is repainting different from diffusion regeneration?
Diffusion regeneration, which runs an image through a generative model, can also remove VINE. At the same removal level, though, the authors report that it moved images about twice as far from the original in DreamSim distance (0.559 vs. 0.265) and changed what the painting shows. Repainting, by contrast, kept the composition and subject of each painting, according to the authors.
The paper also found the reverse pattern. A simple probe that stores bits in the relative brightness of neighboring regions survived repainting with 83% detection, but failed under diffusion regeneration. In the authors' words: "Robustness to these two attacks is therefore a separate property, and benchmarks should test both."
Our reading: one "robust" label can hide which attacks were tried. Two watermarks can fail in opposite places.
How does this fit with earlier watermark benchmarks?
The VINE paper introduced W-Bench, described as "the first comprehensive benchmark designed to evaluate the robustness of watermarking methods against a wide range of image editing techniques, including image regeneration, global editing, local editing, and image-to-video generation." Across eleven methods, it reported that "most methods fail to detect watermarks after such edits."
BrushOff adds a category that list does not name: re-rendering an image stroke by stroke.
What should you ask about a watermark robustness claim?
The table below is our own checklist built from the two papers. It is a starting point for vendor conversations, not an industry standard.
Question to ask | Why it matters |
|---|---|
Which attacks were tested: conventional distortions, diffusion regeneration, and re-rendering? | In BrushOff, a watermark that survived 14 conventional distortions dropped to 1.8% detection under repainting |
Is robustness reported per attack, or as one average? | The authors found robustness to repainting and to regeneration to be separate properties |
Which metric is reported: detection rate, bit error rate, or something else? | Detection rate is not accuracy, and it does not tell you the false-positive rate |
Was image quality checked after the attack? | If quality stays close to the original, the attack is practical for someone copying the work (our view) |
What content type was tested? | BrushOff used paintings in five styles; photos, comics or webtoon panels may behave differently |
Is there a second signal, such as signed provenance metadata? | A watermark and metadata fail in different ways, so one can cover a gap in the other (our view) |
Where does C2PA provenance fit?
Watermarks and C2PA Content Credentials do different jobs. A C2PA manifest is signed metadata that records where a file came from and can be verified when it is present. Metadata can be lost when a file is shared or screenshotted, which is one reason pixel-level watermarks exist. As BrushOff shows, a pixel-level watermark has its own failure modes.
We think it is safer to plan for both, and to know which one you are relying on at each step of a workflow. MuseBlossom's Image Defence combines an invisible watermark with C2PA issuance and verification, and Contents Defence is on the C2PA Conforming Products List for image, audio and video. A listing confirms conformance to the specification; it does not prove watermark robustness.
What can't this paper tell you?
It is one preprint that tested four watermarks on paintings only, so it does not tell you how any other watermark performs, or how these results carry over to photos or comics. It reports detection rates under the authors' settings, not false-positive rates in a production system. We have not tested Image Defence against BrushOff, so we make no claim about it either way.
FAQ
Does BrushOff mean invisible watermarks are useless?
No. In the same test, VINE survived all 14 conventional distortions. The finding is that repainting is a separate risk that should be tested on its own.
Do these results apply to photos or comics?
The paper tested paintings in five styles. It did not test photos or comics, so results there are unknown.
Is detection rate the same as accuracy?
No. Detection rate here means how often the watermark was found in watermarked images. It does not tell you how often an unmarked image is wrongly flagged, which is the false-positive rate.
Evaluating image watermarking for your catalog? Ask us about Image Defence: go.museblossom.com/image