Interactive Demo

MEANING CHANGES.The mark remains.

An open framework for testing whether provenance survives coherent, targeted changes in meaning.

CSI AttackWWW 2026

Why CSI

Provenance should followmeaning, not merely pixels.

Semantic watermarks bind provenance to what an image depicts. CSI stands for Coherence-Preserving Semantic Injection. It tests whether that promise survives a coherent, targeted change in meaning.

A person happily greeting a golden dog in a sunny meadow

The same person happily greeting an orange cat in the same meadow

Semantic content

The image still looks natural.
Its subject has changed.
So has its meaning.

The edited meadow scene with a cat in place of the original dog

After Attack

Watermark detected

Detector signal

The watermark survives the edit.
The detector still finds it.
The watermark check passes.

Original content

Edited content: an orange cat greeting the same person

Edited contentContent changed

Watermark detected

The mismatch

The subject has changed.
The watermark is still accepted.
That is the mismatch CSI tests.

A valid mark can stilltell the wrong story.

If meaning changes while the detector still accepts the watermark, provenance has stopped describing the content it appears to protect.

Evidence

The scene was rewritten.

A coherent, targeted edit. No forced entry, nothing visibly
disturbed. The image still reads as evidence. It now
depicts something else.

Testimony

The mark still testifies.

The watermark survives the edit, and the detector
accepts it. The signal keeps vouching for an image
that no longer exists.

Finding

CSI cross-examines the signal.

CSI measures whether semantic change and detector
acceptance coexist. Where they do, the mark is not
provenance. It is an alibi.

Did provenance survive, or only its signal?

Method

Change the meaning,keep the scene coherent.

CSI searches for edits that change part of an image’s story while preserving its overall scene. It filters the candidates, regenerates them with recovered noise, and checks the result.

The original scene of a person greeting a golden dog in a meadow

Original image

A possible edit

A person greets a cat in a meadow.

Another possibility

A person meets a cat in the same meadow.

Propose an edit

A language model uses the original image and target change to propose edits that keep the subject and scene coherent.

Keep the person and setting

A cat alone in a meadow.

Person missing

A person greets a cat in a meadow.

Person and setting kept

A person greets a cat indoors.

Setting changed

Filter the prompts

Check the proposed descriptions before rendering. Keep only those that preserve the important parts of the scene.

A person greeting an orange cat in a meadow

Edited image

Recovered noise

Check the imagePerson and setting

Regenerate and verify

Generate each chosen edit with the recovered noise, then check the image for consistency and test for its watermark.

81%of images edited using the CSI attack still passed the SEAL watermark check.

Changed content.Accepted watermark.

CSI changes what an image depicts. The paper reports how often the edited images still passed the watermark check at the tested threshold.

View in Paper

Demo

Follow an image,from creation to attack.

Explore how images take shape, how semantic watermarks are added, and how detection works. Then follow CSI as it changes an image’s meaning and see how the watermark check responds.

Change the meaning.
Test the watermark.

Keep the scene coherent while changing part of its story. Follow CSI’s edits, then examine the image and the detector’s response together.

Explore CSI Attack