Research map / Adversarial robustness and security / Attacks on text and graphs
WMCopier: Forging Invisible Watermarks on Arbitrary Images
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes WMCopier, a no-box watermark forgery attack that trains an unconditional DDIM on watermarked images, then shallow-inverts clean images and refines them to embed the target watermark.
Problem
Forgery attacks on invisible image watermarks: forging a provider's watermark onto clean (possibly illicit) images without knowledge of the watermarking algorithm or paired data, causing false attribution.
Approach
Treat a diffusion model trained on watermarked images as a copier of the watermark distribution; apply shallow DDIM inversion of a clean image and denoise so the watermark bias is injected, then refine with score-based optimization balancing watermark likelihood and fidelity to the clean image.
Key results
- Average FPR@1e-6 of 83.71% and forged bit accuracy of 94.58% with PSNR 32.94 dB across four open-source schemes, versus 0.08% FPR for Yang et al.
- On Amazon's deployed watermark, the attack achieves a success rate close to 100% with PSNR above 30 dB, while Yang et al. yields SR of 28%-42% and PSNR below 25 dB.
- Multi-message defense with K=50 or K=100 drops forged FPR to 0% in the authors' tests.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use WMCopier instead of Yang et al. in the no-box setting | Watermark forgery on open-source schemes · Open-source schemes, average | Forged bit accuracy: 54.52% -> 94.58% | Helped |
| use WMCopier instead of Wang et al. in the black-box setting | Watermark forgery on open-source schemes · Open-source schemes, average | Forged bit accuracy: 84.32% -> 94.58% | Helped |
| add refinement (ablation) | WMCopier · DWT-DCT | Forged bit accuracy: 63.03% -> 89.62% | Helped |
| add refinement (ablation) | WMCopier · HiDDeN | Forged bit accuracy: 80.60% -> 99.40% | Helped |
| add refinement (ablation) | WMCopier · RivaGAN | Forged bit accuracy: 89.90% -> 95.90% | Helped |
| add refinement (ablation) | WMCopier · Stable Signature | Forged bit accuracy: 97.58% -> 98.19% | Helped |
| increase refinement iterations L (ablation) | WMCopier refinement · Forgery attacks | PSNR | Helped |
| increase trade-off coefficient lambda (ablation) | WMCopier refinement · Forgery attacks | Forged bit accuracy | Hurt |
| use multi-message watermarking with K=50 instead of K=10 (ablation) | Watermark defense · MS-COCO | FPR@10^-6: 34.00% -> 0.00% | Hurt |
| increase auxiliary data from 1,000 to 5,000 watermarked images (ablation) | WMCopier · RivaGAN on MS-COCO | Forged bit accuracy: 81.82% -> 95.74% | Helped |
| increase auxiliary data from 5,000 to 10,000 watermarked images (ablation) | WMCopier · RivaGAN on MS-COCO | Forged bit accuracy: 95.74% -> 97.81% | Helped |
| increase multi-message pool size from K=50 to K=100 (ablation) | Watermark defense · MS-COCO | FPR@10^-6: 0.00% -> 0.00% | No clear effect |
Surprising findings
- Forged watermarks from the attack achieve higher bit accuracy than the original DWT-DCT embedding process when the auxiliary data is filtered to 100% bit accuracy images.
- Müller et al.'s semantic-watermark forgery method fails on the non-semantic Stable Signature scheme, while WMCopier succeeds.
Limitations
- Requires a substantial amount of watermarked data (5,000 images) and training cost (about 40 A100 GPU hours).
- Standard diffusion architecture without specialized training; why different watermark types are learned differently remains open.
- Forged watermarks are somewhat less robust to distortions than genuine ones, and robustness gap is insufficient for reliable forgery detection.
Experimental setup
Datasets: DiffusionDB MS-COCO ImageNet CelebA-HQ Amazon Titan generated images
Benchmarks: DWT-DCT HiDDeN RivaGAN Stable Signature Amazon watermark detection API
Metrics: PSNR forged bit accuracy FPR@1e-6 success rate confidence level
Baselines: Yang et al. no-box forgery Wang et al. black-box forgery Müller et al. semantic watermark forgery
Builds on: DDIM DDIM inversion Stable Signature
Closest papers by meaning
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.90)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.90)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.89)
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.88)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.88)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.