\section{Related Works}
\label{sec:related}

\textbf{Copyright Protection.}
DGM-based AI tools have raised concerns about 
unauthorized use of copyrighted images, including style transfer~\citep{kim2022diffusionclip}, 
personalization~\citep{gal2022image,ruiz2023dreambooth}, and image editing~\citep{choi2023custom,shi2024dragdiffusion}. 
Recent studies framed data protection as a problem of \textit{adversarial attacks}.
By introducing imperceptible perturbations to protected images, these approaches aim to degrade AI performance on the affected data~\citep{salman2023raising,liang2021visible,van2023anti}. 
Particularly,
PhotoGuard~\citep{salman2023raising} attacked a text-to-image model by perturbing its latent code, aligning generations with an unrelated dummy image. 
Glaze~\citep{shan2023glaze} further employed a style-transfer model to minimize the similarity of generated images to the protected content. 
AdvDM~\citep{liang2023adversarial} targeted on diffusion-based models by minimizing the likelihood of perturbed images; and \cite{liang2023mist} added a texture-targeting loss for improved robustness. 
To defend against personalized DreamBooth~\citep{ruiz2023dreambooth}, 
\cite{van2023anti} learned perturbations to degrade its training performance using a bi-level optimization framework, 
with an approximate solution proposed by neglecting the trajectories in the lower-level optimization.
% and proposed an approximate solution by ignoring the trajectories in the lower-level optimization. 
\cite{liu2024metacloak} improved this process by using meta-learning to attack an ensemble of models. 
However, existing methods specifically targeted DGMs that cause the misuse, 
and their attack-based solutions are highly specialized, making generalization challenging~\citep{demontis2019adversarial}.
% and their attack-based solutions are specialized for the particular DGM and are challenging to generalize. 
In contrast, our {\name} identifies a hard-to-reconstruct region of the image and places a visible watermark, rendering the image unusable. In this way, {\name} provides protection agnostic to misuse scenarios.

% Reference: MetaCloak



\textbf{Visible Watermarking and Removal.}
Visible watermarks have been widely used to prevent piracy \citep{braudaway1996protecting,cox1997secure,mohanty1999dual,kankanhalli1999adaptive}. 
Early works resorted to signal processing technique to enhance the robustness of watermark \citep{podilchuk1998image,kankanhalli1999adaptive,hu2001wavelet}.
In response, watermark removal has also accumulated a vast literature~\citep{dekel2017effectiveness,cheng2018large,leng2024removing}. 
When the watermark location is known, inverse-problem-based solvers can provide strong reconstructions~\citep{khachaturov2021markpainting}, as also verified in our experiments. 
However, these methods are ineffective when location information is unavailable, and obtaining human 
labeling is often impractical~\citep{liu2022watermark}.
The advance of deep learning further stimulated the end-to-end blind watermark removal models. 
Early works used image translation methods to generate clean images from watermarked observations in a single step~\citep{cao2019generative,li2019towards}. 
Later, \cite{cun2021split,liang2021visible,liu2022watermark} separated the processes of locating and removing watermarks into two distinct steps, achieving more effective results.
These methods have posed remarkable performance on removing visible watermarking \citep{dekel2017effectiveness}. 
However, the primary focus of watermarking in the AI era has shifted to attack-based protection and invisible watermarking on AI-generated contents, leaving robust visible watermarking unsolved. 
In this work, we proposed a new learning-based visible watermarking and experimented with both inverse problem solver and two-stage blind watermark removal methods. 
Empirically, {\name} learns stronger watermarks to defeat all these methods. 



% Reference: https://arxiv.org/pdf/2207.08178



\textbf{Watermarking in AI Era.}
The advance of vision and language foundation models~\citep{radford2019language,dhariwal2021diffusion,wei2022chain,rombach2022high,bordes2024introduction,liu2024toward,zhu2024sora} have raised ethical concerns about the potential misuse of AI-generated content (AIGC), such as deepfake~\citep{westerlund2019emergence}, plagiarism~\citep{kirchenbauer2023watermark,lau2024protecting}, and others~\citep{guo2023aigc}. 
To address these challenges, 
invisible watermarking have been proposed for embedding in the output data \citep{zhao2023recipe,liu2024survey,karki2024deep}. 
These watermarks do not affect normal use of AIGC,
but in case of misuse such as fake news, they can be extracted to trace the source of the generated content. 
For example, in watermarking vision models, an encoder and decoder are trained to generate and extract watermarks, and the vision model is often fine-tuned jointly to avoid performance degradation~\citep{yu2020responsible,fernandez2023stable,mareen2024blind,an2024benchmarking}.
For language models, the generation process is altered by increasing the likelihood of certain words while decreasing that of others. This creates a traceable pattern in the generated texts~\citep{kirchenbauer2023watermark,liu2024survey}. 
Notably, these watermarking techniques have objectives orthogonal to ours. 
They aim to ensure the traceability of AIGC, while ours targets to protect copyrighted contents created by human artists.  
%\cite{} trained an encoder and decoder to generate and 


% The advance of vision and language DGMs have raised great attention on their generations. 