Research map / Adversarial robustness and security / Attacks on text and graphs
Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Trains a ConvNeXt V2-Tiny image preference model on procedurally generated Fourier artifacts with a ranking loss, then uses gradient ascent on a single watermarked image to remove or forge post-hoc image watermarks in a black-box setting.
Problem
Watermark forging for post-hoc image watermarks: an attacker with only a single watermarked image, no access to the watermarking model/decoder or paired data, wants to steal the watermark and apply it to new content (and also remove watermarks).
Approach
Train an image preference model (Bradley-Terry ranking loss) to prefer clean images over procedurally corrupted ones, add adversarially perturbed negatives to yield interpretable gradients, then extract the watermark as the difference between a watermarked image and its gradient-optimized clean version, and paste it onto new images.
Key results
- Single-image forging achieves bit accuracy 1.00 (CIN), 0.83 (MBRS), 0.61 (TrustMark), 0.83 (Video Seal) at PSNR 31.3, outperforming DiffPure and matching or beating Warfare and image averaging overall.
- Watermark removal with the method reaches bit accuracy 0.82 (CIN), 0.64 (MBRS), 0.60 (TrustMark), 0.49 (Video Seal) at PSNR 31.2, while the VAE baseline keeps near-1.00 bit accuracy.
- Ranking loss is crucial: binary cross-entropy yields near-random forging (0.60/0.53/0.52/0.47), and removing adversarial perturbation reduces performance.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use one-shot preference-model watermark extraction and transfer | Ours · Video Seal watermark forging | bit accuracy: 0.59 -> 0.83 | Helped |
| Use one-shot preference-model watermark extraction and transfer | Ours · TrustMark watermark forging | bit accuracy: 0.61 vs 0.61 | Mixed |
| Replace ranking loss with binary cross-entropy loss (ablation) | Preference model · Watermark forging | bit accuracy: 1.00 -> 0.60 (CIN); 0.83 -> 0.53 (MBRS); 0.61 -> 0.52 (TrustMark); 0.83 -> 0.47 (Video Seal) | Hurt |
| Replace ranking loss with hinge loss (ablation) | Preference model · Watermark forging | bit accuracy: 1.00 -> 0.62 (CIN); 0.83 -> 0.55 (MBRS); 0.61 -> 0.52 (TrustMark); 0.83 -> 0.47 (Video Seal) | Hurt |
| Add adversarial perturbation during training (ablation) | Preference model · Watermark forging | bit accuracy: 0.97 -> 1.00 (CIN); 0.65 -> 0.83 (MBRS); 0.52 -> 0.61 (TrustMark); 0.49 -> 0.83 (Video Seal) | Helped |
| Train with real watermarks instead of procedural artifacts (ablation) | Preference model · Watermark forging | bit accuracy: 1.00 -> 1.00 (CIN); 0.83 -> 0.67 (MBRS); 0.61 -> 0.58 (TrustMark); 0.83 -> 0.77 (Video Seal) | Hurt |
| Use only wave-style synthetic artifacts (ablation) | Preference model · Watermark removal | bit accuracy: 0.82 -> 0.98 (CIN); 0.64 -> 0.83 (MBRS); 0.60 -> 0.55 (TrustMark); 0.49 -> 0.45 (Video Seal) | Mixed |
| Use only noise synthetic artifacts (ablation) | Preference model · Watermark removal | bit accuracy: 0.82 -> 1.00 (CIN); 0.64 -> 0.97 (MBRS); 0.60 -> 0.99 (TrustMark); 0.49 -> 0.97 (Video Seal) | Hurt |
| Use only line-style synthetic artifacts (ablation) | Preference model · Watermark removal | bit accuracy: 0.82 -> 1.00 (CIN); 0.64 -> 0.95 (MBRS); 0.60 -> 0.99 (TrustMark); 0.49 -> 0.95 (Video Seal) | Hurt |
| Increase forging optimization steps from k=50 to k=500 (ablation) | Ours · MBRS watermark forging | bit accuracy: 0.75 -> 0.83 | Helped |
| Increase forging optimization steps from k=50 to k=500 (ablation) | Ours · Watermark forging | PSNR: 39.3 -> 31.3 | Hurt |
| Increase removal optimization steps from k=50 to k=500 (ablation) | Ours · CIN watermark removal | bit accuracy: 1.00 -> 0.82 | Helped |
Surprising findings
- Training on real watermarked outputs (gray-box) performed worse than training on procedural artifacts, due to overfitting from low diversity of real watermarks.
- Image averaging, a multi-image baseline, is competitive on CIN and MBRS but fails on content-aware Video Seal.
Limitations
- Blurs natural high-frequency textures such as water surfaces, trees, and grass.
- Does not apply to semantic watermarks such as Tree-Ring or RingID that alter generated content.
- Forging TrustMark remains difficult (bit accuracy 0.61).
Experimental setup
Datasets: SA-1B
Benchmarks: SA-1B validation (100 images)
Metrics: bit accuracy PSNR ROC curves for detection
Baselines: Warfare Image averaging Noise blending Gray image blending DiffPure CtrlRegen VAE compression
Builds on: Bradley-Terry model Deep Image Prior UnMarker Warfare
Closest papers by meaning
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.90)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.90)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.89)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.89)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.88)
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.