The benchmark indicates that invisible image-watermark robustness depends on threat-model alignment and does not establish formal security guarantees. Across the evaluated methods and attacks, no approach was uniformly robust.
The failure modes differed by attack. Compared with the tested moderate manipulations JPEG compression, blur, brightness changes, and small crops attacks that broke spatial alignment or substantially rewrote content exposed additional weaknesses; the tested purification methods varied in effectiveness. Regeneration attacks, including FLUX-based regeneration and rinsing, were among the most damaging tests for post-hoc watermarks, while generative approaches retained greater resilience in those scenarios.
Re-embedding created another distinct risk; additional watermarking frequently overwrote post-hoc watermarks. Key-based methods could survive when a different key was used, and DCT CAISS showed strong self-overlay resistance in the tested configuration. Absolute results also depended on evaluation resolution, so benchmark scores should be reported with the dataset and resolution conditions.
The benchmark covers image watermarking and does not establish formal security guarantees or production performance. Its conclusions are limited by the evaluated methods, datasets, metrics, attacker capabilities, and threat models; video, audio, and text were outside its scope.