CISPA Researcher Tests Whether AI Image Watermarks Survive Training of New Models

Until now, AI image watermarks have mostly been tested for robustness against edits: JPEG compression, cropping, noise, filters. CISPA researcher Michel Meintz of SprintML Lab asked a different question. What happens if watermarked images end up in the training set of a new generative model, and will we see a trace of the watermark in its output? Judging by the title of the work, the answer is that a watermark can survive training, but how robust it is depends on its design. The source material contains no quantitative results, so what follows lays out what is known and how to read it.

What question is being asked?

Watermarks exist so that an image can be identified as generated and its origin traced. The classic threat model looks like this: someone takes a finished image and tries to erase the watermark. They recompress the file, crop the frame, add noise. There is plenty of work on this topic.

Meintz looks at a different scenario. Generated images have long been sitting on the open web, and the web remains the main source of training data. If such watermarked images land in a dataset, a new model may inherit their statistical features. Its output would then also carry the watermark, even though it has nothing to do with the original generator. The opposite outcome is also possible: the watermark does not transfer, and the original source cannot be traced through the new model.

Why everything comes down to watermark design

Watermarking schemes are built in different ways, which likely explains the spread in results. Metadata such as C2PA does not live in the pixels at all and disappears when a file is re-saved, so it never reaches training. Post-processing adds a signal to the pixel or frequency domain of a finished image.

Other methods are built into the generator itself. For example, Meta's Stable Signature fine-tunes the decoder of a latent diffusion model, while Tree-Ring sets a pattern in the initial noise. The assumption that the deeper a signal is embedded in an image's statistics, the more likely it is to transfer to a new model looks logical.

But it is a hypothesis, not a stated finding of the study.

For the industry, the question is a practical one. If a watermark is inherited, detectors get false positives on content from other models. If it is not inherited, the provenance chain cannot be trusted wherever content has passed through retraining.

What is known so far

• Author: Michel Meintz, SprintML Lab, CISPA.
• Subject of study: watermarks on AI images.
• Setup: robustness to training of a new generative model, not to edits of an individual image.
• Main result: watermarks can persist, but robustness depends on the scheme's design.
• Not disclosed in the announcement: the list of schemes, the models and datasets, detection success rates.

What to check in practice

Platforms and newsrooms should treat a watermark as one signal among several, not as final proof of provenance. It should sit alongside metadata, behavioral signals, and manual review of disputed cases.

Teams that fine-tune models on web data need to account for the possibility that other people's watermarks may leak into their output. For detector developers, this means a separate test: not only "does the watermark get erased by edits," but also "does it appear where it should not."

It is better to draw final conclusions after the full paper is out: it will need to specify the schemes, the training conditions, and the detection metrics. For now, one thing is clear: the question of whether a watermark survives retraining has now been posed in its own right, and the answer is "yes, but not for all of them."