Pith. sign in

REVIEW 2 major objections 5 minor 2 cited by

Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image

T0 review · 2 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single watermarked image is enough to forge or erase latent-noise diffusion watermarks.

desk verdict A genuinely new attack setting—single-image, black-box watermark forgery without the U-Net—that mostly delivers, but the proxy-VAE transfer claim is under-tested and the removal results are weaker than the abstract implies. read the letter →

arxiv 2504.20111 v1 pith:ATUZ273T submitted 2025-04-27 cs.CV

Anubhav Jain , Yuya Kobayashi , Naoki Murata , Yuhta Takida , Takashi Shibuya , Yuki Mitsufuji , Niv Cohen , Nasir Memon
show 1 more author
Julian Togelius
This is my paper · ORCID
classification cs.CV
keywords diffusionmodelwatermarkinglatentnoisewatermarkforgeryremovalDDIMinversionadversarialattackblack-boxAIimageprovenance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Most diffusion-model watermarks hide a secret key in the initial noise, and detectors recover that key by inverting the image back to noise. This paper argues that the inversion map is many-to-one: many clean images share the same recovered initial noise, so each key corresponds to a whole region of image-latent space, not a single point. The authors show that with just one watermarked image and an off-the-shelf encoder, which need not be the model's own encoder, an attacker can nudge any unrelated image into that region and be falsely verified as watermarked, or nudge a watermarked image out of it to erase the mark. They demonstrate high forgery success against Tree-Ring, RingID, WIND, and Gaussian Shading on two Stable Diffusion versions, and effective removal for Tree-Ring. If correct, this means current initial-noise watermarking is forgeable from a single public example, which matters for attribution and misinformation defenses.

What carries the argument

The load-bearing object is the watermark region, defined as all clean latents whose DDIM inversion matches the secret key below the detector's threshold. The mechanism behind it is the many-to-one inversion map: the same initial noise can denoise into many images under different prompts, but detection inverts with an empty prompt, so a key's preimage in latent space is a region rather than a point. The attack operationalizes this region using a proxy VAE encoder $E_{\phi}$: for forgery it solves $\min_{\delta} \|E_{\phi}(x^{(c)}+\delta)-E_{\phi}(x^{(w)})\|_2 + \lambda\|\delta\|_2$, and for removal it targets the mean of the watermarked image $E_{\phi}(\mu_{x^{(w)}})$ instead. A linear separator experiment shows the region has a usable direction in latent space, and the optimization exploits the encoder's non-smoothness to keep perturbations small.

What would settle it

Repeat the forgery attack using a proxy VAE trained on a very different domain, such as medical or cartoon images; if the attack success rate falls to chance while the same-domain proxy stays high, the proxy-transfer premise is false and the attack is not black-box in the claimed sense. Alternatively, take a non-watermarked image whose proxy latent distance to a watermarked image is zero and check whether the detector still rejects it; if rejection persists, latent closeness does not imply watermark-region entry.

Watch

Extended reading notes

Core claim

The central claim is that latent-noise watermarking schemes, where a secret key is embedded in the initial noise used by a diffusion model, contain a geometric vulnerability: because DDIM inversion with an empty prompt maps many different clean latents to the same recovered key, the set of images that verify as watermarked forms a region in the clean latent space, not isolated examples. The paper defines this watermark region and shows it is linearly separable from non-watermarked latents. It then converts this into a black-box attack: minimize the distance between the target image's encoding and a single reference watermarked image's encoding in a proxy VAE latent space, and the resulting imperceptible perturbation moves the target inside the region, so DDIM inversion recovers the key and the detector accepts it. Reversing the objective, pulling a watermarked latent toward a plain mean image, removes the mark. The attack needs only one watermarked image and no access to the denoising network or the secret key. Experiments report near-perfect forgery on RingID, WIND, and Gaussian Shading, roughly 79 to 94 percent success on Tree-Ring, and strong removal on Tree-Ring while multi-pattern watermarks resist removal.

Load-bearing premise

The load-bearing premise is that minimizing distance in the proxy VAE's latent space transfers to the detector's DDIM-inversion geometry, so images that look close in the proxy space also invert to similar initial-noise patterns.

Editorial extensions

If this is right

  • Any latent-noise watermark that relies on empty-prompt DDIM inversion inherits a region-based forgery surface; a single watermarked sample can be used to falsely attribute unrelated images to the model owner.
  • The attack succeeds without access to model weights, the secret key, or the denoising U-Net; a proxy VAE trained on similar imagery is enough, making the practical threat broader than prior attacks that required key or model access.
  • Forgery and removal asymmetries follow from watermark content: single-pattern Tree-Ring is harder to forge but easy to remove, while multi-pattern RingID, WIND, and Gaussian Shading are easy to forge but resist removal, so the choice of key structure determines which attack is practical.
  • Reported image-quality metrics at high $\lambda$ show the successful perturbations are subtle, meaning detection cannot rely on visible distortion as a simple defense.
  • The results imply that distortion-free watermarking does not guarantee robustness against adversarial manipulation; robustness must be tested against region-based attacks, not just transformations or cropping.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is that content-dependent watermarks, where the embedded message is a function of the image itself, may close the region loophole because an attacker would need to know the message-generation rule, not just one example.
  • The region-entry view suggests a detector-side defense: reject images whose recovered key matches but whose latent sits suspiciously close to a known reference latent, or require multiple independent inversions with different prompts or encoders before accepting the key.
  • Although the paper evaluates generic non-watermarked images, the forgery mechanism does not depend on image semantics; if the transfer assumption holds, targeted forgery of a specific harmful image should work with the same objective, which would be a stronger real-world concern than the reported average success rate.
  • The proxy-encoder assumption could be stress-tested across encoder families; if the attack transfers across architectures that never saw the detector's inversion geometry, it would suggest the region is a property of the diffusion prior itself, not of a particular VAE.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes black-box forgery and removal attacks against latent-noise watermarking schemes for diffusion models. The attacker is assumed to have access to a single watermarked image and an off-the-shelf VAE (possibly not the exact VAE used by the diffusion model), but not the denoising U-Net or the secret key. The forgery attack (Eq. 3) optimizes an additive perturbation to a clean image so that its proxy-VAE latent representation moves close to the latent representation of the watermarked reference image; the removal attack (Eq. 4) similarly pushes a watermarked image's latent toward that of a plain mean-valued image. The method is evaluated on Tree-Ring, RingID, WIND, and Gaussian Shading across SDv1.4 and SDv2.0, using 200 image pairs per setting, with attack success rates defined by the schemes' p-value or bit-accuracy thresholds. The paper reports high forgery success for RingID, WIND, and Gaussian Shading, moderate-to-high success for Tree-Ring, and successful removal mainly for Tree-Ring, with an honest discussion of the difficulty of removal for multi-pattern watermarks.

Significance. If the results hold, this is a meaningful contribution to the security analysis of latent-noise watermarks. The paper demonstrates that a single watermarked image can suffice to forge a watermark in a black-box manner, without access to the denoising network, and it evaluates the attack across four watermarking schemes and two diffusion models. The public codebase is a strength for reproducibility, and the use of first-attempt success (rather than cherry-picked attempts) makes the evaluation protocol cleaner than in some prior work. The reported failure of removal for RingID and WIND is also a useful, honest data point. However, the significance depends on the transferability of proxy-VAE optimization to the DDIM-inversion detector geometry and on the representativeness of the reference-image selection; both assumptions are currently tested only under favorable conditions.

major comments (2)
  1. [Section 4.3, Eq. (3); Section 5, Experimental Setup] The claim that 'a VAE that was trained on a similar dataset suffices' is supported only by using the SDv1.4 VAE to attack watermarks embedded via SDv2.0. These are two Stable Diffusion VAEs from the same model family and effectively the same training distribution. No experiment varies the proxy VAE independently, e.g., using a VAE from a different architecture or a different training domain. Since Eq. (3) optimizes in the proxy encoder's latent geometry while detection relies on DDIM inversion with a U-Net, this transfer is the load-bearing assumption for the black-box, single-image attack. Please add experiments with a genuinely different proxy VAE (for example, a VAE from a different latent diffusion model or an autoencoder trained on a different image domain) or explicitly limit the claim to same-family proxies. Without such evidence, the Introduction's 'similar dataset suffices' assertion is not established.
  2. [Section 5, Experimental Setup] The reference watermarked images used for the forgery attack are generated from simple prompts because, as the paper states, 'the resultant images contain more visible watermark patterns/signal due to lower amounts of high-frequency information.' This selection directly biases the reported attack success rates upward relative to arbitrary watermarked images that an attacker would encounter in practice. The paper does not report forgery ASR when the reference image is generated from a complex prompt (e.g., the Gustavosta prompts used to create the main watermarked set). Please report this variant, or provide evidence that simple-prompt references are representative of real-world target images. This is important because the attack optimizes toward a single reference latent, and the size of the vulnerable region may depend on the reference image's content.
minor comments (5)
  1. [Tables 1, 2, 5, 6] All ASR values are point estimates from 200 pairs with no confidence intervals or standard errors. Given that the paper makes comparative statements (e.g., 'almost perfect' versus '≈85%'), please add standard errors or confidence intervals to support the strength of the conclusions.
  2. [Tables 1, 2, 5, 6] The FID metric is reported for what appears to be a single set of attacked images; please clarify how FID is computed in this paired setting (e.g., between the original and attacked distributions) and note that FID is a distributional metric rather than a per-image distortion measure.
  3. [Appendix 11.3] The optimization runs for 15,000 iterations with a learning rate of 0.02 per image; this computational cost should be stated in the main text so that readers can judge the practicality of the attack.
  4. [Section 4.3, Eq. (4)] The removal objective uses a plain image with all pixel values equal to the mean of the watermarked image. The justification is relegated to the appendix; the main text should at least summarize the comparison with real-image guidance, since the choice is non-obvious and affects the success of the removal attack.
  5. [Throughout] There are several typographical issues, including inconsistent spacing in 'V AE' and some misspellings. The manuscript should be proofread for these presentation issues.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the attack optimizes against a proxy VAE and is evaluated on held-out detectors; Eq. 3 does not reduce to the detector's matching function.

full rationale

The paper's central claim is an empirical transfer hypothesis: minimizing distance in a proxy VAE's latent space (Eq. 3) should move a non-watermarked image into the watermark region defined by DDIM inversion in Definition 1. These are distinct functions: Eq. 3 uses only E_phi and the reference watermarked image x(w), while success is measured by M_W(I^-(z0), k), the detector's key-matching test. No detector parameters, secret key, or inversion network enter the optimization; lambda is a swept hyperparameter, not a fitted value. The SVM motivation in Section 4.2 uses many same-key images, but it is presented as an existence check and is not used in the main single-image attack. The only self-citations are to prior watermarking schemes (WIND [2], RingID [5]) used as public, externally implemented benchmarks and as descriptions of threat-model scenarios; they are not invoked to justify the attack's validity. The proxy-VAE transfer assumption is a genuine empirical premise, not an identity or a renamed input, so no step reduces to its own inputs by construction.

Assumptions & free parameters 1 free parameters · 4 assumptions · 1 invented entities

The central claim rests on the existence of the watermark region, the transferability of the proxy VAE, and the non-smoothness of the latent space. These are domain assumptions rather than derived results. The only tuned number in the main attack is the regularization weight lambda.

free parameters (1)
  • lambda (regularization weight) = 5e4, 2e4, 1e4 (grid)
    Controls the trade-off between attack success and perturbation magnitude; ASR and image quality are reported across these values, and it is chosen by the authors rather than derived.
assumptions (4)
  • domain assumption Many-to-one mapping between clean latents and initial noise under DDIM inversion with empty prompt.
    The watermark region is defined by this mapping; the attack relies on it. Introduced in Section 4.2 Motivation.
  • domain assumption A proxy VAE trained on similar data has a latent space similar enough to the target model's VAE for the attack to transfer.
    The attack uses an off-the-shelf VAE, which may differ from the model's VAE; results suggest it works but there is no guarantee. Section 4.3.
  • domain assumption The VAE representation space is non-smooth, so small perturbations can move latent representations significantly.
    Cited from Cemgil et al. [3]; this justifies the imperceptibility of the attack. Section 4.3.
  • domain assumption The watermark detector inverts images using DDIM inversion with an empty prompt.
    This is how the targeted watermarking schemes operate, and it is the stated threat model in Section 3.1.
invented entities (1)
  • Watermark region
    purpose: A hypothesized region in the clean latent space that maps to a given watermark key upon inversion; the attack aims to move images into or out of it.
    The paper supports its existence with an SVM experiment and its own attack results, but these are internal to the paper and no external falsifiable prediction is made beyond the attack itself.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image." pith.science (2026). https://pith.science/paper/ATUZ273T

@misc{pith2026250420111,
  author       = {Pith},
  title        = {Pith review of: Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ATUZ273T}},
  note         = {Machine review of arXiv:2504.20111}
}
read the original abstract

Watermarking techniques are vital for protecting intellectual property and preventing fraudulent use of media. Most previous watermarking schemes designed for diffusion models embed a secret key in the initial noise. The resulting pattern is often considered hard to remove and forge into unrelated images. In this paper, we propose a black-box adversarial attack without presuming access to the diffusion model weights. Our attack uses only a single watermarked example and is based on a simple observation: there is a many-to-one mapping between images and initial noises. There are regions in the clean image latent space pertaining to each watermark that get mapped to the same initial noise when inverted. Based on this intuition, we propose an adversarial attack to forge the watermark by introducing perturbations to the images such that we can enter the region of watermarked images. We show that we can also apply a similar approach for watermark removal by learning perturbations to exit this region. We report results on multiple watermarking schemes (Tree-Ring, RingID, WIND, and Gaussian Shading) across two diffusion models (SDv1.4 and SDv2.0). Our results demonstrate the effectiveness of the attack and expose vulnerabilities in the watermarking methods, motivating future research on improving them.

Figures

Figures reproduced from arXiv: 2504.20111 by the authors.

Figure 1
Figure 1. Intuition behind the attack: A whole region exists in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Our forgery attack works by finding an adversarial perturbation [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Motivation for the attack. There exists a latent direction/region pertaining to watermarked latents from a specific secret key in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Two-dimensional visualization of the latent space show [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Examples showing successful watermark forgery attacks on the Tree-Ring watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Examples showing successful watermark removal attacks on the Tree-Ring watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Examples of images generated using RingID, where the [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Comparing trade-off between attack success rate (ASR) and imperceptibility of the attack for different optimization objectives [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Visualization of the mask we utilized to control the ad [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 10
Figure 10. Figure 10: Examples showcasing the idea that there exist latent [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Examples showing successful watermark forgery attacks on the Tree-Ring watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]
Figure 12
Figure 12. Figure 12: Examples showing successful watermark forgery attacks on the RingID watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]
Figure 13
Figure 13. Figure 13: Examples showing successful watermark forgery attacks on the WIND watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Examples showing successful watermark forgery attacks on the Gaussian Shading watermarking method with different hyper [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: Examples showing successful watermark removal attacks on the Tree-Ring watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p018_15.png]
Figure 16
Figure 16. Figure 16: Examples showing successful watermark removal attacks on the Tree-Ring watermarking method with different hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p018_16.png]
Figure 17
Figure 17. Figure 17: Examples showing successful watermark removal attacks on the Gaussian Shading watermarking method with hyperparameter [PITH_FULL_IMAGE:figures/full_fig_p019_17.png]
Figure 18
Figure 18. Figure 18: DCT domain representations of watermarked images from the same key (row 1) and non-watermarked images (row 2) generated [PITH_FULL_IMAGE:figures/full_fig_p019_18.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images

    cs.CV 2026-08 conditional novelty 7.0 of 10

    IRIS embeds a keyed ring derived from the generated image's CLIP-based semantic code back into late diffusion steps, making the watermark fail automatically when the image's semantics change.

  2. First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

    cs.CV 2025-08 conditional novelty 4.0 of 10

    A competition-winning pipeline removes 95.7% of StegaStamp and TreeRing watermarks on the NeurIPS 2024 benchmark by combining VAE fine-tuning, diffusion purification, and translation tricks.

Reference graph

Works this paper leans on

48 extracted references · 30 canonical work pages · cited by 2 Pith papers

  1. [1]

    Waves: Bench- marking the robustness of image watermarks

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Bench- marking the robustness of image watermarks. In Forty-first International Conference on Machine Learning. 1, 3

    work page

  2. [2]

    Hidden in the noise: Two- stage robust watermarking for images

    Kasra Arabi, Benjamin Feuer, R Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two- stage robust watermarking for images. arXiv preprint arXiv:2412.04653, 2024. 1, 3, 4, 5, 6, 7, 2

    arXiv 2024

  3. [3]

    Adversarially robust represen- tations with smooth encoders

    Taylan Cemgil, Sumedh Ghaisas, Krishnamurthy Dj Dvi- jotham, and Pushmeet Kohli. Adversarially robust represen- tations with smooth encoders. In International Conference on Learning Representations, 2020. 2

    work page 2020

  4. [4]

    Wmadapter: Adding watermark control to latent dif- fusion models

    Hai Ci, Yiren Song, Pei Yang, Jinheng Xie, and Mike Zheng Shou. Wmadapter: Adding watermark control to latent dif- fusion models. arXiv preprint arXiv:2406.08337, 2024. 3, 8

    arXiv 2024

  5. [5]

    Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification

    Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Com- puter Vision, pages 338–354. Springer, 2024. 1, 3, 4, 6, 7, 2

    work page 2024

  6. [6]

    On the use of automatically generated synthetic image datasets for benchmarking face recognition

    Laurent Colbois, Tiago de Freitas Pereira, and S ´ebastien Marcel. On the use of automatically generated synthetic image datasets for benchmarking face recognition. In 2021 IEEE International Joint Conference on Biometrics (IJCB) , pages 1–8. IEEE, 2021. 4

    work page 2021

  7. [7]

    Digital watermarking and steganography

    Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007. 3

    work page 2007

  8. [8]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural informa- tion processing systems, 34:8780–8794, 2021. 3

    2021

Show all 48 references
  1. [9]

    Watermarking images in self-supervised latent spaces

    Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Herv´e J´egou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054–3058. IEEE, 2022. 3

    2022

  2. [10]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv ´e J ´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceed- ings of the IEEE/CVF International Conference on Com- puter Vision, pages 22466–22477, 2023. 3, 8

    2023

  3. [11]

    An un- detectable watermark for generative image models

    Sam Gunn, Xuandong Zhao, and Dawn Song. An un- detectable watermark for generative image models. arXiv preprint arXiv:2410.07369, 2024. 3

    2024 arXiv

  4. [12]

    Multimedia watermark- ing techniques

    Frank Hartung and Martin Kutter. Multimedia watermark- ing techniques. Proceedings of the IEEE, 87(7):1079–1107,

  5. [13]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium. Advances in neural information processing systems , 30, 2017. 7, 8, 3, 4

    2017

  6. [14]

    A transfer attack to image watermarks

    Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Gong. A transfer attack to image watermarks. arXiv preprint arXiv:2403.15365, 2024. 1

    2024 arXiv

  7. [15]

    Exploring frequency adversar- ial attacks for face forgery detection

    Shuai Jia, Chao Ma, Taiping Yao, Bangjie Yin, Shouhong Ding, and Xiaokang Yang. Exploring frequency adversar- ial attacks for face forgery detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4103–4112, 2022. 1

    2022

  8. [16]

    Image forgery techniques: a review

    Gurpreet Kaur, Navdeep Singh, and Munish Kumar. Image forgery techniques: a review. Artificial Intelligence Review, 56(2):1577–1625, 2023. 1

    2023

  9. [17]

    Ad- versarial machine learning at scale

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Ad- versarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016. 5, 1

    2016 arXiv

  10. [18]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In Artificial in- telligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018. 5, 1

    2018

  11. [19]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceeding...

    2014

  12. [20]

    Image watermarks are removable using controllable regeneration from clean noise

    Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. arXiv preprint arXiv:2410.05470, 2024. 1, 3

    2024 arXiv

  13. [21]

    Leveraging optimization for adaptive attacks on image watermarks

    Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. arXiv preprint arXiv:2309.16952 ,

    arXiv

  14. [22]

    Frequency-driven imperceptible adversarial attack on semantic similarity

    Cheng Luo, Qinliang Lin, Weicheng Xie, Bizhu Wu, Jin- heng Xie, and Linlin Shen. Frequency-driven imperceptible adversarial attack on semantic similarity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15315–15324, 2022. 1

    2022

  15. [23]

    Null-text inversion for editing real im- ages using guided diffusion models

    Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real im- ages using guided diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6038–6047, 2023. 2, 3

    2023

  16. [24]

    Black-box forgery attacks on se- mantic watermarks for diffusion models

    Andreas M ¨uller, Denis Lukovnikov, Jonas Thietke, Asja Fis- cher, and Erwin Quiring. Black-box forgery attacks on se- mantic watermarks for diffusion models. arXiv preprint arXiv:2412.03283, 2024. 3

    2024 arXiv

  17. [25]

    Digital watermark- ing: algorithms and applications

    Christine I Podilchuk and Edward J Delp. Digital watermark- ing: algorithms and applications. IEEE signal processing Magazine, 18(4):33–46, 2001. 1, 3

    2001

  18. [26]

    A survey of digital image watermarking techniques

    Vidyasagar M Potdar, Song Han, and Elizabeth Chang. A survey of digital image watermarking techniques. In IN- DIN’05. 2005 3rd IEEE International Conference on Indus- trial Informatics, 2005., pages 709–716. IEEE, 2005. 1, 3

    2005

  19. [27]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 3

    2022

  20. [28]

    Robustness of ai-image detectors: Fundamental lim- its and practical attacks

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental lim- its and practical attacks. arXiv preprint arXiv:2310.00076,

    arXiv

  21. [29]

    Photorealistic text-to-image diffusion models with deep language understanding

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural information...

    2022

  22. [30]

    Communication in the presence of noise

    Claude Elwood Shannon. Communication in the presence of noise. Proceedings of the IRE, 37(1):10–21, 1949. 7

    1949

  23. [31]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020. 3

    2010 arXiv

  24. [32]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020. 3

    2020

  25. [33]

    Watermark faker: towards forgery of digital image water- marking

    Ruowei Wang, Chenguo Lin, Qijun Zhao, and Feiyu Zhu. Watermark faker: towards forgery of digital image water- marking. In 2021 IEEE International Conference on Multi- media and Expo (ICME), pages 1–6. IEEE, 2021. 1

    2021

  26. [34]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Si- moncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600–612, 2004. 7, 8, 3, 4

    2004

  27. [35]

    Tree-ring watermarks: Fingerprints for diffu- sion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffu- sion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023. 1, 3, 4, 6, 7, 8, 2

    2023 arXiv

  28. [36]

    Secret and public key image watermarking schemes for image authentication and ownership verification

    Ping Wah Wong and Nasir Memon. Secret and public key image watermarking schemes for image authentication and ownership verification. IEEE transactions on image process- ing, 10(10):1593–1601, 2001. 3

    2001

  29. [37]

    Flexible and secure watermarking for latent diffusion model

    Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proceedings of the 31st ACM International Conference on Multimedia, pages 1668–1676, 2023. 3

    2023

  30. [38]

    Ste- ganalysis on digital watermarking: Is your defense truly im- pervious? arXiv preprint arXiv:2406.09026, 2024

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Ste- ganalysis on digital watermarking: Is your defense truly im- pervious? arXiv preprint arXiv:2406.09026, 2024. 1, 3

    2024 arXiv

  31. [39]

    Gaussian shading: Prov- able performance-lossless image watermarking for diffusion models

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weim- ing Zhang, and Nenghai Yu. Gaussian shading: Prov- able performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 12162– 12171, ...

    2024

  32. [40]

    Robust invisible video watermark- ing with attention

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermark- ing with attention. arXiv preprint arXiv:1909.01285, 2019. 3

    1909 arXiv

  33. [41]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018. 7, 8, 3, 4

    2018

  34. [42]

    Invisible image watermarks are provably removable using generative ai

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu- Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in Neural Information Processing Systems, 37:8643–8672, 2025....

    2025

  35. [43]

    Experimental Results using Alternative Loss Formulations In this section, we present an alternative design of the ad- versarial loss function to remove and forge the watermark signal. 8.1. Using Progressive Gradient Descent In our main experiments (Equation 3), we control the ...

  36. [44]

    We have set hy- perparametersϵ in Eq

    at imperceptibility metrics even at higher ASR. We have set hy- perparametersϵ in Eq. 5 to be 0.1, (ϵ,αN ) in Eq. 6 to be (3,300) andλ in Eq. 3 to be 2.5× 104. Method ASR l2 l∞ LPIPS SSIM PSNR FID Eq. 5 83.24 68.04 0.10 0.35 0.66 28.31 69.35 Eq. 6 83.33 67.77 0.93 0.32 0.66 28...

  37. [45]

    In this section, we show that this works better in practice as compared to using a fixed pixel value of 127.5

    Watermark Removal using Images with Fixed Pixel Values In Section 4.3 for watermark removal, we use images with all pixel values equal to the mean value of the given water- marked image for guidance. In this section, we show that this works better in practice as compared to us...

  38. [46]

    The optimization objective remains the same as Equation 7, i.e., min δ ∥Eϕ(x(w) +δ)−Eϕ(x(c))∥2 +λ∥δ∥2, (7) where x(c) is a randomly selected real image

    Watermark Removal using Real Images In this case, we use non-watermarked images from the COCO [19] dataset for guidance such that we minimize the distance between their respective representations while per- turbing the watermarked image. The optimization objective remains the ...

  39. [47]

    Prompt Datasets We utilize two datasets namely, the Gustavosta/Stable- Diffusion-Prompts1 dataset and the runwayml-stable- diffusion-v1-5-eval-random-prompts2 dataset

    Detailed Experiment Settings 11.1. Prompt Datasets We utilize two datasets namely, the Gustavosta/Stable- Diffusion-Prompts1 dataset and the runwayml-stable- diffusion-v1-5-eval-random-prompts2 dataset. The former contains around 80,000 prompts extracted from the image finder ...

  40. [48]

    We show examples of forgery attacks on Tree-Ring in Figure 11, RingID in Figure 12, WIND in Figure 13, and Gaussian Shading in Figure 14

    More Visual Examples We provide additional visual examples to show that suc- cessful watermark forgery and removal attacks do not harm 1https://huggingface.co/datasets/Gustavosta/Stable-Diffusion-Prompts 2https://huggingface.co/datasets/yuvalkirstain/runwayml-stable- diffusion...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.