Research map / Image generation / Autoregressive and latent generation
PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PGID, a training-free, plug-and-play noise-extraction framework that projects imprint-attacked latents back to their original watermarked/unwatermarked regions via progressive asymmetric inversion-denoising cycles, defending semantic watermarks against removal and forgery.
Problem
Semantic watermarks rely on diffusion inversion for detection, making them vulnerable to imprint removal and forgery attacks that displace latents across the watermarked/unwatermarked boundary.
Approach
Formalizes watermarked and unwatermarked latent regions for a fixed initial watermark noise, and uses asymmetric inversion-denoising cycles (denoise more than invert) with trajectory guidance away from the attacked trajectory to project attacked latents back to their original region, without any training.
Key results
- PGID-R raises Gaussian Shading detection under removal attack from 0.00 to 1.00 and bit accuracy from ~0.26 to ~0.998 (SD 2.1 attacker, 50 steps).
- PGID-F reduces forged-image detection for Tree Ring from 1.00 to 0.02-0.07 on MS-COCO with SD 2.1 attacker.
- PGID-F keeps authentic watermark detection at 0.96 for Tree Ring, 1.00 for Gaussian Shading and 1.00 for T2SMark.
Surprising findings
- Standard inversion-based detection can be defeated by denoising more steps than inverted, which restores removed watermarks; denoising beyond the optimal skip count degrades PRC detection.
- Forgery defense is less sensitive to guidance strength, relying mainly on the diffusion model's manifold projection.
Limitations
- Hyperparameters (k, s, gamma) must be tuned per scheme and architecture; no single default transfers.
- Added computational overhead over standard one-stage DDIM inversion.
- PRC is highly sensitive; a single gamma setting cannot cover all attack strengths, requiring multiple parallel PGID instances.
Experimental setup
Datasets: Stable Diffusion Prompts (SDP) MS-COCO ImageNet
Benchmarks: MS-COCO forgery ImageNet forgery imprint removal (SDP prompts)
Metrics: AUC TPR at fixed FPR (Det.) bit accuracy
Baselines: Tree Ring Gaussian Shading PRC T2SMark
Builds on: DDIM Tree Ring Gaussian Shading PRC T2SMark
Closest papers by meaning
- CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework (AAAI 2025 · similarity 0.89)
- Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.87)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.87)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.87)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.87)
- RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.