

They are, if you scroll to the bottom of the github repo that OP posted there are some examples of what works and doesn’t work to break it.
Watermark data like this is stored in the least significant bits of the pixels themselves, or in the case of OPs example, they do a frequency decomposition on the image then store the watermark data in the coefficients. Basically you have to trash the pixel data at least a little bit to defeat it. So cropping or flipping the image won’t do it, but resizing or rotating with some kind of filtering will.
I have no idea how the machine-learning technique listed there is working, and their documentation link is broken :(




It’s from here:
https://commons.wikimedia.org/wiki/File:British-Library-Arundel-127_Le_trois_morts_et_les_trois_vifs.jpg#/media/File:British-Library-Arundel-127_Le_trois_morts_et_les_trois_vifs.jpg
https://en.wikipedia.org/wiki/The_Three_Dead_and_the_Three_Living