i removed apple's AI watermark

[@evanzhoudev]

The point of this video was to revert the metadata of the Cleaned Up file back to what it was before the operation, not only to remove the watermark. Taking a screenshot (removes all metadata) or just removing Credit and Digital Source Type (keeping residual changes) work to remove the watermark, but are not what I am trying to achieve.

[@Noah_Kai2]

thanks mark rober

[@Noah_Kai2]

but actually, video is really good and youre underrated

[@NullHyp]

Then they could use steganography, hiding the metadata in the pixels themselves

[@undefinedchannel9916]

@@NullHyp Detecting steganography is its own beast but it's not impossible.

[@B00T987]

SHHHHHHHHHHHH🤫🤫🤫 we can't let them know!!!

[@badeed]

i generated so much misleading content and distributed it. Thank to my best friend and accomplice Evan Zhou

[@percy9228]

I turned off my add blocker and set a loop for this video so I can help awareness of this illegal activity and increase and allow Evan Zhou to afford his yacht so he doesn't go to jail for this misleading content.

[@young_oilyman7]

@@percy9228 lmaooooooo wtf

[@eyuelzero]

Username checks out. Thank you for your service Mr. Bad Deed!

[@charlesdoesmore5488]

​@@percy9228Because you like making people suffer from 9-to-5 jobs.

[@badeed]

@@eyuelzero i am badeed

[@HarrisonBorbarrison]

If they use the super-nerd method by hiding the metadata, I think lots of people would be screenshotting their images if they wanted to get rid of the watermark.

[@FranEnchufes]

Steganography technique could still be sufficient to show up in the screenshot. Even if you crop it a bit or tamper brightness, color etc ( as long as you make homogeneous edits )

[@yurab1834]

Yeah, this whole implementation doesn't seem like something that's designed to be bullet-proof. It's a simple solution that targets the lowest common denominator. This would be defeated by almost any web service that lets you upload images, because stripping metadata has been a standard practice for a while now. It's more of a nice-to-have user feature than a security system. Right now, there's no such thing as a watermark that's both unremovable and that preserves all of the original data at the same time - and Apple knows this.

[@khamigen]

Above that, apple could just watermark the screenshot based on the content on the screen, like how it is done with copyrighted media

[@SaHaRaSquad]

@@khamigen That would likely not work if the image is shown in a third-party app. With DRM it works because the film industry is powerful enough to force all parties to cooperate. And even then it's possible to circumvent protections like DHCP. But I think Apple's approach might be good enough for most cases. If you look at the average AI generated image that people proudly post on the web it's apparent that they don't like putting in effort, not even to hide their tracks.

[@khamigen]

​@@SaHaRaSquadyes, most likely, the average Joe does not even notice the watermark and won't bother. Only thing that defeats the purpose, unlike the visual watermark by Samsung's ai, it's not shown in the image and I don't believe, Instagram keeps metadata after posting, aside from not giving out the original image. So the purpose of showing a sign for manipulated content to others is probably defeated in this case as well

[@PythonPlusPlus]

I don’t think the watermark is there to prevent people from being misled. It’s more likely there to advertise the feature to others so they will be curious about it and upgrade.

[@cat47]

yeah definitely. apple isn't the kind of company to be sneaky with steganography anyways. and i think he could've been a bit more intelligent about what properties he removed

[@evanzhoudev]

@cat47 I removed all the properties which Apple Intelligence managed to add. The purpose was not to simply hide the visual watermark, but to restore metadata back to its original state.

[@siz1700]

"upgrade"

[@wota_pov]

i think somehow social media will tag the image as ai generated if it has the watermark

[@drilbo]

it's more about trying to comply with alignment standards being pushed by government and the industry

[@feffy380]

Watermarking with steganography generally isn't robust against simple transformations like scaling and cropping or adding a very light layer of noise. A determined user will always be able to remove the watermarks because they have full access to the file, so the effort of a high tech watermark is wasted when they know the vast majority of people simply won't bother

[@someguy9175]

Yes but half of the people who are taking screenshots won't be able to remove a stenographic watermark without ruining the picture anyhow.

[@dealloc]

@@someguy9175 That's not the point; anyone who has the _intent_ is to mislead will go for any avenue. People who don't know, won't care anyway.

[@dahahaka]

Marking ai images will never EVER be an option. Instead cameras have to cryptographically hash and sign a photo at the time of taking the picture, so you can tell that the photo is not manipulated. Imagine telling people to mark fake currency.... You'd get admitted to a mental hospital

[@dahahaka]

And no it wouldn't do shit using steganography, bad actors will always be able to get rid of the watermark

[@vytah]

I'm stealing your currency metaphor.

[@evanzhoudev]

Great point. Love the analogy.

[@drilbo]

interesting analogy, but considering we all have access to the "money printers" here, the workaround just becomes a more hilarious version of the screenshot one: just take a picture of the manipulated picture

[@3c3c3c]

They have been trying to sign photos like this to prove they were not tampered with for 15 years now, only for every attempt ending up cracked after less than a month

[@AntonioNoack]

*@5:15 no, not really possible. You'd just add some soft noise to the image (a new, different command line tool), and it will be gone again.

[@merscmersc]

@5:20 he says, "don't abuse this". What are you referring to?

[@AntonioNoack]

​@@merscmersc Oh, sorry, *5:15, he says that it's possible for Apple to implement tagging that cannot be removed. I highly doubt that.

[@Blaze6108]

Eh, there's already techniques that are somewhat hard to defeat unless you mulch the image so much that it becomes noticeably manipulated, and the field is in its infancy in terms of serious research interest. Also, the point is to cover the most common use cases so that there isn't just a deluge of falsified information online, obviously nothing can ever guarantee perfect security. But then deliberately falsifying steganography itself would probably be a bannable offense around the web, same as breaking any other ToS. It might even become illegal in the future for falsified material specifically.

[@Vin50000]

​@@Blaze6108 but also only useful assuming every single ai image generator and editor is doing it

[@Blaze6108]

@@Vin50000 Well, like I said, the point is to cover the most common use cases. Hosting non-safeguarded models could just be one of the various things you can already get taken offline for.

[@Bxu021]

I'm just happy the watermark wasnt a giant apple logo in the corner lol

[@klopsik_go]

me too bruv, me too.

[@larko2933]

Bro made a whole ass video about just blindly deleting some fields of an images metadata

[@mrowlsss]

Aww, did someone wake up on the wrong side of the bed today?

[@xyssxy]

​@@mrowlsss?

[@mrowlsss]

@@xyssxy ?

[@skyr3x]

Yeah i was kind of surprised when the video just ended without a definitie answer on what fields are actually responsible for adding the watermark

[@hassanhalfawy9243]

Literally. This video could’ve been 25 seconds and would’ve still been longer than it should’ve.

[@mr.w7803]

IDK if it’s lazy… it’s likely more scalable given that all platforms can read EXIF metadata

[@evanzhoudev]

Yes, but there can be more safety measures on top of EXIF. While all platforms can read EXIF, Apple can have it's own more robust system for their own detection algorithms.

[@jdurkin12]

bro got the mark rober playlist goin hard 🥵🔥‼️🔊

[@SaHaRaSquad]

Is steganography really more robust? I mean what if I just re-encode it as JPEG with a high quality setting? Sure the image quality would technically decrease but it's less effort than figuring out what exif data fields to remove and a better result than when you remove all exif data.

[@PercyPanleo]

I believe there are certain methods that continue working even with modifications to the image, but it's possible they didn't consider doing that because of them already using JPEG where the compression could just break it before considering re-encoding.

[@atom6_]

steganography doesnt work. If have a pure single color picture you can see the bits that have changed. If it gets converted, compressed, cropped or resized you will loose the information. It does not surpise me that exif/iptc is the method they have chosen. To embed it, it should be pure raw, but that is not possible after the fact.

[@feffy380]

Steganography is extremely brittle. The only way to make it more robust is to make larger changes to the image, but then it's no longer an invisible watermark

[@synkro_nyze]

The Mark Rober music has me rolling

[@Ezcte]

The clean up watermark became cleaned up

[@knit-]

i love seeing things in videos taken on my birthday

[@Limofeus]

2:10 I think it'd be more reasonable to store it in exif, otherwise only apple devises would be able to decrypt it and for all non apple devices (and apple devices that arent aware of such watermark existing, maybe for someone with older iOS or whatewer apple's OSs are called) the photo would look like a normal photo without the watermark basically getting rid of the sole purpose this watermark exists in the first place

[@SierraGolfNiner]

The reality is that it doesn't matter how they embed this information, it's a quick reverse-engineer away and completely removable. Someone could just reverse the photos app, figure out what apple is looking at, then build and app to fix it. You'd have an open source tool (probably written in python) available by the time iOS18 came out.

[@aecl4287]

I genuinely don’t understand why there are so many negative comments, he simply wanted to show a proof of concept and explained that very clearly. Love your videos, keep it going ❤👋

[@scriptifyy]

"please do not use this method to generate any misleading content"

[@sirflimflam]

They're not going to implement steganography . Mostly because there is no sane way to mark an image as AI generated and hope it will persist beyond even mild tweaking of the file. There is just too much freedom of control over the information itself. Perhaps if the images were locked down in the iOS ecosystem or something it would be a little bit easier box in, but as it stands now, the exif data is the most practical.

[@alexanderhorner]

Using anything beyond simply storing the watermark in the metadata would be unnecessary and excessive. In terms of security, it’s crucial to focus on the weakest link. If someone is determined to remove the watermark, they can easily take a screenshot of the image. Those who are more committed and care about preserving the original metadata would also find ways to remove more advanced techniques, such as steganographic watermarks. Therefore, embedding the watermark in the metadata is the simplest and most efficient solution.

[@proplayerplayz]

you know shit is going to get real when the mark rober music plays

[@Flutterwhat]

great job im sure your little disclaimer is going to work!

[@habelincoln1665]

you would have to compare the metadata you edited to the original, cuz if someone is checking whether a pic was cleaned up, they’ll see the missing values. very possible that the unedited has those values set to different things but still there.

[@dinoscheidt]

🤌 Well, note really: The AI generated patches still have a pixel noise finger print mask that are resilient against blur, compression artifacts, screenshots incl shifting perspective and morphing. Plenty of research papers how adobe, google incl apple do it. Removing the EXIF data is more like removing the sticker label. Not the watermark.

[@635574]

So he only changed the part which the dumbest software can see.

[@steve_1507]

Would make a good Part 2

[@KleptomaniacJames]

Yeah, and that stuff is arguably even easier to remove, once you get the process down.

[@Megasteel32]

source: I made it the fuck up

[@mike_diz]

> Noise > Resilient against blur How would that possibly be the case? The crowd demands a source

[@RandyLent]

good video, i've been to that shoreline before.

[@TheMarioMakerMaster]

Bro made a whole ahh video when you can just take a screenshot...

[@TheMarioMakerMaster]

Just take a screenshot and crop it...

[@Alice_Fumo]

Robust watermarks for modified images are impossible. You can only have a watermark for an original unedited image which stops working if any modifications at all are made to the image. (such as your device using a user-inaccessible cryptographic key to sign the image (including its metadata) upon taking a photo) That way, while someone still can just take out their camera to take a photo of a photo to give it authentic status, if you modified metadata, that original status gets lost, so if your location metadata shows that you were at home photographing something in a different country, which happened at a different point in time, that would be information which could be used to prove your image is merely a photo of a different photo. Much more sensible than trying to do the reverse where this video has shown precisely why it doesn't work well.

[@Typocat]

If they use the image route, modifying the image with markup or other image apps could easily remove the message, Most likely they wont

[@赤砂-z3u]

You can have a unmodified mark and a ai modified mark , just like web certificate, and when people remove it the app can just say it can't be verified. Although I don't think apple would bother to do it, and also since it's difficult to make it an industrial standard, probably all photos taken by say Samsung would be marked as unverified.

[@yurab1834]

@@赤砂-z3u this would probably have other issues. If this is done like web certificates, the images would need to be signed over the internet - a massive privacy and usability headache, because any on-device signer would be reverse-engineered to make it sign whatever you give it. This would be a pain to use in photo viewers too, since many or most images aren't photos - and having warnings pop up for each screenshot, purely digital files etc is an issue.

[@Typocat]

@@赤砂-z3u If you mean theres two marks next to eachother that say if its verified and not verified, could the user techincally accidentaly overwrite the non verified mark too?

[@l3xforever]

Steganographic watermarks were a thing for decades. You only need to embed it in the parts that were touched, and it’s not that easy to remove by simple operations. You will have to introduce significant noose/distortions that would be visible, which is the point.

[@Sierra410]

@user-lz5kh5zn3r web certificated work because there's a chain of trust. Each website with a certificate has that certificate signed by some organization: a certificate authority. The only way to get that certificate authority to sign your certificate, is to prove that you actually own the domain (which can be a bit of a lengthy process). Once that's done, any computer would be able to verify whether the certificate is legit or not by checking the signature (there's only a handful of CAs in the world, so each computer is aware of each and every one of those). How do you imagine implementing something like this for images? It's physically impossible to verify each and every snapped photo in real time, so the only way around it is to issue each device a unique certificate and trust _it_ fully. That is, assume that each device is tamper-proof and bad actors cannot extract the certificate out of it and signed any arbitrary data with it. But exactly that is going to happen, and the tool created to fight fakes would allow people creating them to sign them, and make them appear "real" which would only result in gullible people being tricked even _more_ easily. In addition to that, it'd also act as a device-unique fingerprint, which would be a privacy nightmare.

[@thestaticisreal]

what about copying and pasting the metadata from the unaltered photo?

[@sarjannarwan6896]

I think this is just for the average person, if you're capable of changing metadata you're probably capable of just running a model outside of IOS anyway.

[@isheamongus811]

0:35 GIMP it no EXIF

[@VelocityLP]

>location: monterey LETS GOOOOO

[@redplayerya]

The only solution to this issue is something like C2PA encryption and it being supported on social platforms as well

[@pawxed]

this is like the nft monkey image all over again

[@saladnoob]

apple taking notes

[@Casur1N]

Steganography for AI misled images must be implemented, even going as far as using MD5s or SHAsum to add "chaos" and complexity to removing those watermarks. Nevertheless Screenshots exist, either built in or external capture, so it will take more creativity to sollve the problem, let the community forums brainstorm ideas

[@s0kulite]

you still didnt find the exact metadata to erase after diffing

[@evanzhoudev]

All of these new fields were added by Apple Intelligence. The idea is to restore the metadata to exactly what it was before the operation, and thus I removed all of the new fields. If you want to know, the bare minimum you need to remove the watermark is Credit and DigitalSourceType.

[@s0kulite]

@@evanzhoudev great, thank you for clarifying

[@ZubairAhmed-bu1oo]

wouldn't it have been much easier to just copy the original exif data and just replace the new exif data with that

[@胡峻愷-x7m]

I think digital sign is required to resolve this issue. Use private key stored at app server or T2 chip to sign the original photo. Any modification will breaks the signature.

[@flamyf]

how tf did you squeeze an almost 6 minute video from simple exif metadata removal?

[@MarkoHR]

That's not as bad as being so suprised that metadata is stored in metadata

[@Ila_Aras]

it's the whole process of figuring it out. It's a learning video. Sorry that you have no attention span

[@Stone_624]

> Import image to Adobe Photostop > Export as a new rendered project photo Tada!

[@Lumina9306]

Evan I don't think you have to disclose that this is some terrible vulnerability on apple's part, I strongly doubt they even remotely see it that way. I also doubt anyone who wanted to misinform with images would use apple intelligence as their primary tool

[@No-mq5lw]

I would expect any half decent attempt at fingerprinting an image as AI generated by the AI itself to fully embed itself within the areas that are tampered with.

[@KTibow]

it would've been more interesting if you decompiled photos or at least removed the ones irrelevant to the badge showing up from the command

[@mehr5821]

Good video for a small channel but you have to speed through some of these ideas and steps faster

[@draken5379]

The pixels of themselves contain watermark embedded by whatever diffusion model they are using for inpainting.

[@Aeduo]

They probably have other means to identify the use of their AI tools, if even just an analysis of artifacts of the algorithm. Probably left for more forensic uses with law enforcement.

[@mbgmbgmbg]

wouldn't it be easier to simply exchange the metadata of the new picture with the old pictures?

[@germimonte]

your idea of stenography would NOT WORK, Apple can't control what every other device manufacturer and software developer put on an image, so any stenographic solution would produce a random result on pictures not created by apple. and even if it was an extremely rare chance of false positive, you'd still be one bit away from removing the mark. Don't fell bad thou, the problem is unsolvable

[@johnibambohni]

What about the C2PA specification? Apple seems not to have implemented that. It might come.

[@Blooodflow]

you could also just use the old metadata on the edited photo

[@aldenr593]

Guys this stuff is not new AT ALL! This has been in Photoshop since at least 2012.

[@ricosuaveyatusabe9179]

You should try this when all Apple intelligence has been released for at least 3 months

[@yehan_mov]

Apple seeing this video : 👁👄👁

[@Roadblocksmanfacesphere132]

Short and easy way: screenshot the AI Clean Up image and then crop it

[@7heMech]

You can narrow down properties by removing one by one

[@SeatiesTheGoat]

how could you this song is owned by mark rober

[@GonTiger]

why tho?...

[@lululemon0424]

i guess apple knows people will just screenshot it anyways. this is not their top priority.

[@CommentGuard717]

Bro, it doesn't even matter. If you were actually trying to deep fake something, you would use something better and something that doesn't watermark the image at all.

[@mrowlsss]

What's your problem?

[@aibi5532]

​@mrfoxesite4482and those phones r way better

[@HaydenBigler97]

Just do clean up, and then throw that image over the meta data image using an app or something. Now save it.

[@TheSuperiorCat]

I could not relate more to 1:57 trying to build an app using python and then looking at the debug file only to see this or when you open a random file from your mac library

[@Chickenbreadlp]

Hiding the watermark using stegonography inside the picture itself isn't very robust either, since any form of re-encoding the image (say by converting a jpg into a webp or vice versa) would mean you'd loose that watermark. Basically any form of lossy image compression would immediatly loose that watermark... Unless ofc they'd put a visible watermark inside the picture alá unpaid stock-photo. That would be the only, non-easily removable watermark. But ofc that would also annoy users a lot more...

[@ParodieHecker-mobile]

And there are AI models that are pretty good at deleting visual watermarks (like shutterstock etc.) from images.

[@Chickenbreadlp]

@@ParodieHecker-mobile Notice that I said "non-easily removable"? Never say never. I know there are systems that defeat these watermarks, but a little bit of randomness to the watermark often already defeats these systems... Not that this security will be proof forever ofc...

[@ParodieHecker-mobile]

@@Chickenbreadlp I didn't mean to contradict you at all, I just wanted to add that

[@lenoirx]

iSheep detected "the biggest company on the world" 🤣🤣

[@IDontModWTFz]

See, Samsung is a bit more confusing but with AI you can remove the AI watermark which is pretty funny

[@Shark-pj8in]

Actually, if u download and upload ur file to lets say Google Drive and view it, you can then take a full resolution screenshot. I'm not gonna share how to here but look it up.

[@toasteroven8341]

The vid could have been a 30 second tiktok 😂

[@Metrixx]

our generation is cooked

[@teasippingzombie]

not everyone has two humping monkeys for braincells

[@koctf3846]

Because harder imprint is unnecessary. This is not a top secret tool after all. If the uploader intended to avoid the label, he could just edit the phone using open source solutions instead.

[@Alccce]

That font you are using is FiraCode

[@moth.monster]

yeah, this is what i kind of expected. the average person is just gonna screenshot anyways cuz they lazy

[@moon_krendelsestate]

Nice video, but it’s not a proof of concept - it is a guide :)

[@georgeandmontyexplores8414]

sound owned by mark rober

[@dospistef]

just use the ai, to delete the ai. 🤯

[@jerrydaboss1]

Ok so some quick thoughts: 1. I mean u could just overwrite the edited image's metadata with the originals. That would give you exactly what you wanted. All the info, no "watermark." More straightforward than selective deletion 2. Have you tried finetuning the CLI command? Maybe only one of the fields created the watermark, so you don't need to remove them all. 3. If they hid the watermark in the image, it would be better, because it could be resistant to screenshotting. The original image is 5943 by 7924 (as shown in your video). Screenshotting would reduce that down to the iPhone 15's resolution, so 1179 by 1572, or roughly 25x smaller. If we assume Apple's steganographic CleanUp signature modifies 100 bits in the original image, they will only need 2421 bits of parity for it to survive the compression/data loss from the screenshot. The full image has 5943px*7924px*24bits/px = 1130215968 bits, so 2421 is 2 percent of a percent of a percent of the original file, so no noticeable change. Being Apple, they obviously will have some sort of algorithmic or mathematical trick to reduce that number. Or the photos app can simply remove that steganographic signature from the original, render the image at the iPhone's resolution, but add back the signature first, that way, no need for parity, as the screenshot will contain the original signature without the compression effect from what is essentially "super sampling"/"pixel binning" ruining it (assuming Apple is merging several image pixels into one display pixel, rather than stochastic sampling among the image pixels covered by each display pixel) thus only taking those 100 bits, essentially unharming the image quality.

[@Cole.ryan.mohler]

0:40 mark rober music

[@PlanetGamingChaos]

facts!!

[@Cole.ryan.mohler]

@@PlanetGamingChaos yes very facts

[@JourneyKennediKatelynu]

dopepics AI fixes this. Remove Apple's AI watermark journey.

[@arik2934]

this video could’ve been only 1 minute

[@Behindstage]

Let’s be clear ai photography is not photography.

[@mehreen-kt6zu]

Screenshot plus manually adding metadata will fool 90%

[@takennmc]

embedding the data in the image would only really work if you kept the info private and other services would not know how to read that

[@Kr3mowka]

did bro just make a whole ass video instead of taking a screenshot ?

[@TaiwaneseDude1]

It'd work if you just take a screenshot of the image you modified...I tried, it shows nothing lol, that's a really easy way to get around that.

[@nichijoufan]

so... is there anything... new to this?

[@lumatozer]

Mark Rober ahh video

[@BDgt_WorkerOfficial]

At least I don’t have to use apps to remove stuff in thepic

[@polocatfan]

Please don't do that.

[@superNova5837]

Could something like this be done to images that came from image playground granted you’d need to get the images out of image playground and into photos I’d assume Apple added a special field in the metadata specifically for this although it could also be using the field handling which app something came from (ie saved from Safari being applied to anything downloaded from safari)

[@Pilug404]

Sounds kinda easy just rewrite the image data with JS onto a canvas then put the old meta data back in I think it would work never tested

[@ベロラ]

cool video but i can smell your breath from your voice and i don't even know how that works

[@itslemonandrew]

Now just tell me its not pointless. There is an eraser button next to the watermark, it does the same job or whats its purpose?

[@evanzhoudev]

That’s the icon for Clean Up (not a button).

[@itslemonandrew]

@@evanzhoudev Oh I see my bad.

[@sir_arsen]

why do you need to get rid of it?

[@martontichi8611]

yeah right. what a pointless video.

[@vytah]

To show that you cannot assume that a photo wasn't edited even if it has no watermark. Which is never going to work, but many people are not aware

[@salocin74]

Is there any way to create a Shortcut in iOS to make this change automatically?

[@BobbandusReal]

hmm. mark + rober

[@Citrumoothy]

Apple just copied Google Magic editor. Great job apple!

[@evanzhoudev]

Nope, Magic Editor is sent to the Cloud, while Clean Up happens on-device. I believe the Magic "Eraser" for Google is handled on-device, but that has worse results than Clean Up. Besides, the idea of object erasing has been present before Google came up with it.

[@Citrumoothy]

@@evanzhoudev Ohhh i see. Both are the same ideas but different, That cleared things up.

[@smartestgirl]

At that point, just use photoshop or a free photo editor to do whatever lol

[@WiseNoodleOfficial]

Well done good sir, stuff like this is always fun to do :)

[@kektimus]

Why would you "expect something more robust" from yet another tech giant rushing to get into AI like everybody else?

[@evanzhoudev]

This exploit isn't hard to fix; it's a sanitization that can be literally done with a few lines of code. I do agree they are rushing, but I expect them to be slightly more careful with things like this.

[@AustinJckson]

Embedding the flag with steganography wouldn't be worth their time because people would reverse engineer it or just screenshot the image anyway. It would be a cat-and-mouse game that Apple isn't interested in taking on.