Imagine you want to prove a signed document is yours, so you embed invisible ink in the paper. Now someone photocopies it — not with a scanner, but by hiring a calligrapher to trace every word by hand. The invisible ink is gone, but the document reads the same. That is BrushOff. The committed claim: a pretrained stroke-based renderer, given zero knowledge of the watermark and zero training, can redraw a watermarked painting stroke by stroke and destroy the watermark while preserving visual quality. The authors test this on VINE, a recent watermark explicitly designed to survive image editing. VINE survives all 14 conventional distortions they throw at it — crops, JPEG, blur, noise — with at least 97.8% detection. Repainting drops detection to 1.8%. That is not degradation; that is annihilation. The architecture is deliberately simple. The attack uses a pretrained neural stroke renderer (the kind built for neural style transfer and painterly rendering) that decomposes an image into a finite set of parameterized brush strokes and re-renders them on a blank canvas. No diffusion model, no GAN, no adversarial optimization against the watermark. The method is model-agnostic and watermark-agnostic — it treats the painting as a visual target and reconstructs it from scratch. Because strokes are countable, attack strength is a simple dial: more strokes means higher fidelity, fewer strokes means more aggressive removal. The ladder comparison is the paper's strongest move. They pit BrushOff against diffusion regeneration, which can also remove VINE. At equivalent removal levels, diffusion regeneration shifts the image twice as far from the original in DreamSim perceptual distance and visibly changes what the painting depicts. BrushOff maintains a no-reference quality score close to the clean originals. The dataset is 500 paintings across five styles — not cherry-picked showcase examples. The integrity story is decent but not airtight. The authors test four watermarking methods and 14 conventional distortions, providing a reasonably broad evaluation. The 500-painting dataset across five styles is a fair sample. But there is no code release mentioned, no pre-registration, and the quality metrics lean on no-reference scores (which can be gamed) rather than human perceptual studies. The comparison to diffusion regeneration is honest and informative, but the paper does not test against adversarial watermarks that specifically anticipate re-rendering attacks. The most intellectually interesting finding is the signal-survival probe. The authors show that a simple watermark storing bits in the relative brightness of neighboring regions survives repainting, while one using absolute brightness does not. Meanwhile, the relative-brightness probe fails under diffusion regeneration, and VINE fails under repainting. This means robustness to stroke-based re-rendering and robustness to diffusion regeneration are orthogonal properties — a watermark that survives one may fall to the other. Current benchmarks test neither systematically. The practical upshot is uncomfortable for anyone deploying invisible watermarks on visual art. The attack requires no special access, no training data, no knowledge of the watermarking scheme, and uses publicly available stroke renderers. The defense surface is narrow: you would need a watermark whose signal survives complete re-synthesis from parameterized primitives. The probe experiments suggest such watermarks are possible in principle — relational signals survive — but no deployed system currently achieves this against both attack families. Benchmark suites that omit re-rendering attacks are measuring the wrong thing.
