Research map / Image generation / Autoregressive and latent generation
Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that semantic watermarks (Tree-Ring, Gaussian Shading) can be forged or removed in a black-box setting using an unrelated proxy latent diffusion model and a single watermarked reference image.
Problem
Semantic watermarks for latent diffusion models, which embed patterns in the initial noise recoverable by DDIM inversion, are assumed secure because the generator is kept secret; the paper asks whether attackers can forge or remove these watermarks without access to the target model.
Approach
Use an attacker-owned proxy LDM to invert a single watermarked image into its initial latent, then either optimize a clean cover image's latent so its inversion matches the watermark (Imprint-Forgery, also used for removal by negating the target) or regenerate the inverted latent with a new prompt (Reprompting); the watermark transfers across unrelated models.
Key results
- Imprint-Forgery on Gaussian Shading reaches detection of 0.91-1.00 across SD2.1-Anime, SDXL, PixArt-Σ and FLUX.1 at 150 steps, with PSNR around 30 dB.
- Reprompt+ attack achieves 1.000 detection on Gaussian Shading for SD2.1-Anime, SDXL and PixArt-Σ, and 0.880 on FLUX.1.
- Imprint-Removal drives Gaussian Shading detection and attribution to 0.00 for all target models after 100-150 steps; adjusting detection thresholds cannot separate attack images from JPEG/noise-perturbed watermarked images.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Imprint a target watermark into cover images using a proxy model | Semantic watermarks · Gaussian Shading on FLUX.1 | detection TPR: 0.00 -> 0.95 | Helped |
| Imprint a target watermark into cover images using a proxy model | Semantic watermarks · Tree-Ring on FLUX.1 | detection TPR: 0.00 -> 0.23 | Helped |
| Use Imprint-Removal to suppress the original watermark | Semantic watermarks · Gaussian Shading on FLUX.1 | detection TPR: 1.00 -> 0.00 | Hurt |
| Use Imprint-Removal to suppress the original watermark | Semantic watermarks · Tree-Ring on FLUX.1 | detection TPR: 1.00 -> 0.00 | Hurt |
| Reprompt a watermarked latent to generate an image with a different prompt | Semantic watermarks · Gaussian Shading on FLUX.1 | detection TPR: 0.656 | Helped |
| Reprompt a watermarked latent to generate an image with a different prompt | Semantic watermarks · Tree-Ring on FLUX.1 | detection TPR: 0.128 | Helped |
| Try multiple prompts and bin resamplings during reprompting | Reprompting attack · Gaussian Shading on FLUX.1 | detection TPR: 0.656 -> 0.880 | Helped |
| Try multiple prompts during reprompting | Reprompting attack · Tree-Ring on FLUX.1 | detection TPR: 0.128 -> 0.350 | Helped |
| Tighten watermark detection thresholds | Semantic watermark defenses · Common perturbations and forgery attacks | detection threshold separation | No clear effect |
Surprising findings
- Attacks transfer across unrelated architectures and training, e.g. an SD2.1 proxy forges watermarks on DiT models PixArt-Σ and FLUX.1.
- Threshold tightening is not an effective defense because attack images overlap with robustly perturbed genuine watermarked images.
Limitations
- FLUX.1 is harder to attack, with Tree-Ring imprint detection at 0.12-0.23 at FPR=1%.
- Tree-Ring is only evaluated in the detection scenario, since it does not support attribution.
- Reprompt+ requires multiple prompts and bin resampling, increasing attack cost.
Experimental setup
Datasets: natural cover images prompt and image datasets (unspecified in main text)
Metrics: TPR@1%FPR TPR@FPR=10^-6 attribution success PSNR bit accuracy p-value
Baselines: Averaging attack (Yang et al.) Surrogate attack (Saberi et al.)
Builds on: Tree-Ring Gaussian Shading DDIM inversion averaging attack
Closest papers by meaning
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.90)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.90)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.89)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.89)
- Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models (CVPR 2024 · similarity 0.88)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.