Pith. sign in

REVIEW 4 major objections 4 minor 65 references

A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A public VAE lets an attacker strip Tree-Ring watermarks from diffusion images, cutting detector ROC-AUC from 0.993 to 0.153.

desk verdict A solid, honest empirical attack on Tree-Ring whose headline result holds under its stated black-box setting; the practical catch is exact VAE reuse, which the paper acknowledges, and a minor threat-model slip in one training regime. read the letter →

arxiv 2506.10502 v1 pith:KQOBMBWM submitted 2025-06-12 cs.CR cs.LG

Junhua Lin , Marc Juarez (University of Edinburgh) This is my paper
classification cs.CRcs.LG
keywords Tree-Ringwatermarkingwatermarkremovaldiffusionmodelslatentspaceattacksurrogatedetectorvariationalautoencoderprojectedgradientdescentprecision
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that Tree-Ring, a widely used watermark for diffusion-generated images, can be defeated by an attacker who only needs the same variational autoencoder (VAE) the victim model uses, plus black-box query access. The attack trains a surrogate classifier to recognize watermarked latents in the Fourier domain, then uses projected gradient descent to push an image's recovered latent out of the watermarked region. In the authors' evaluation on Stable Diffusion v2.1, Tree-Ring's ROC-AUC falls from 0.993 to 0.153 and its PR-AUC from 0.994 to 0.385, with small changes in image quality metrics. This matters because VAE reuse is common practice, so the attack's main assumption is much weaker than prior attacks that assume white-box or same-architecture access to the diffusion model.

What carries the argument

The load-bearing object is the surrogate detector trained on VAE-recovered latents in the Fourier domain, combined with projected gradient descent in latent space. Tree-Ring embeds a key as a circular pattern in the low-frequency center of the initial noise vector's Fourier spectrum; the paper shows this creates a non-Gaussian, compact hypersphere of watermarked latents that a ResNet-18 can separate almost perfectly. The VAE, which is AutoencoderKL by default in Stable Diffusion v2.1, provides the attacker with a mapping from image to latent that approximates the victim's own latent space, letting the surrogate learn the watermarked region rather than spurious image statistics. Projected gradient descent then perturbs the recovered latent to minimize the surrogate's loss for the non-watermarked class, with the perturbation budget scaled by the inverse maximum latent magnitude, and decoding with the VAE yields the attacked image.

What would settle it

Take a diffusion model trained on a privately fine-tuned VAE that is never published, run the same surrogate-detector PGD attack using the closest publicly available VAE, and measure Tree-Ring's ROC-AUC. If it stays near its no-attack value of about 0.99 while the attacked images remain high quality, then the paper's practical threat model of public VAE reuse fails for that deployment.

Watch

Extended reading notes

Core claim

The central claim is that Tree-Ring's watermark leaves detectable traces in the intermediate latent space, and that these traces can be exploited through a surrogate detector trained on latents recovered by a public VAE. The authors show that Tree-Ring's embedding of a fixed Fourier ring into the initial noise vector violates the Gaussian assumption on the latents: watermarked initial latents are compactly clustered and almost perfectly separable from non-watermarked ones, and remnants of the ring survive backward diffusion into the recovered latent. An attacker who has the exact VAE can encode an image, take the Fourier transform of the recovered latent, train a ResNet-18 binary classifier to distinguish watermarked from non-watermarked latents, and then run projected gradient descent in latent space to flip the surrogate's decision. The resulting perturbations transfer to the real Tree-Ring detector, reducing its ROC-AUC to 0.153 and its PR-AUC to 0.385 while preserving image quality, and the attack outperforms adversarial noising and pixel-space surrogate attacks that assume more access.

Load-bearing premise

The headline result rests on the attacker getting the exact variational autoencoder the victim's diffusion model uses; with a different or custom VAE, the attack's power drops sharply, as the paper's own ablation shows.

Editorial extensions

If this is right

  • Tree-Ring watermarking is not robust against a black-box adversary who can query the model and obtain its VAE; even without any white-box knowledge, the detector's ROC-AUC drops to 0.153.
  • Because the attack outperforms baselines that assume full or same-architecture access to the diffusion model, VAE reuse becomes a first-order security decision for anyone deploying latent diffusion.
  • Precision matters: when watermarked images are a small fraction of traffic, Tree-Ring's detector is unreliable even without an attack, and the VAE attack reduces PR-AUC from 0.994 to 0.385 at a balanced base rate.
  • Other latent-space watermarking schemes that embed a distinctive pattern in the diffusion latents are exposed to the same VAE-based surrogate strategy, since the attack targets the latent distribution rather than Tree-Ring's specific key shape.
  • A short-term defense is to train a custom private VAE, but the paper notes this sacrifices the cost savings that make latent diffusion attractive and does not close the door to similar surrogate attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial extension: the attack's dependence on the exact VAE suggests a practical robustness audit—before deploying a latent-space watermark, measure how much ROC-AUC drops under a PGD surrogate trained on the same public VAE; a large drop indicates the scheme is not deployment-ready.
  • Editorial extension: the Fourier-domain concentration of the perturbation around the key ring is a testable signature; analyzing attack success as a function of ring radius and frequency band could identify key designs that resist this attack without visible artifacts.
  • Editorial extension: if VAE reuse is as widespread as the paper argues, one public VAE could be a single point of failure for many watermarked services, meaning a single surrogate might strip watermarks across multiple models that share that VAE.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a new removal attack against Tree-Ring, a latent-space watermark for diffusion models. The attacker trains a surrogate binary detector on VAE-recovered latent representations of watermarked versus non-watermarked images, then runs projected gradient descent (PGD) in the latent space to push watermarked images into the non-watermarked class. Under the assumption that the attacker has access to the exact VAE used by the victim diffusion model, the attack reduces Tree-Ring's ROC-AUC from 0.993 to 0.153 and PR-AUC from 0.994 to 0.385, with small changes in CLIP score, LPIPS, and FID. The paper also measures detector precision under varying base rates, arguing that Tree-Ring's precision is insufficient for realistic deployment. Ablations with mismatched VAEs (SDXL VAE, 16-channel VAE) and with a non-latent diffusion model (Guided Diffusion) show that the attack degrades when the exact VAE is unavailable.

Significance. If the exact-VAE reuse assumption holds in practice, this is a meaningful advance over prior surrogate-detector attacks: it removes the need for white-box access to the diffusion model or for a same-architecture replica, and it is evaluated against the actual Tree-Ring detector with an external benchmark. The attack is also supported by reproducible code, honest ablations, and a useful precision-based analysis that goes beyond the ROC-AUC metrics used in prior work. The central caveat is that the headline result depends on the victim reusing a publicly available VAE; the paper is transparent about this dependency, but the practical strength of the claim rests on how common that reuse actually is. Overall, the contribution is significant for the watermark-removal literature, provided the threat-model inconsistencies and evaluation confounds identified below are resolved.

major comments (4)
  1. [Section 4.2 (Wm & UnWm dataset) vs. Section 3.1 (Threat Model)] The Wm & UnWm training setting is inconsistent with the stated threat model. Section 3.1 says the adversary has only black-box query access to a proprietary model that always embeds Tree-Ring, but Section 4.2 says the adversary generates the non-watermarked images by using the same diffusion model and skipping the watermarking step. This is not possible under the defined capabilities. Please clarify whether Wm & UnWm is an idealized upper-bound scenario or a separate threat model; if it is idealized, state this explicitly and identify the Wm & Pub row as the realistic headline result.
  2. [Section 4.2 / Table 2 (Wm & Pub evaluation)] The Wm & Pub evaluation uses ImageNet validation images as the non-watermarked class, so the reported ROC-AUC and PR-AUC improvements may be inflated by the distributional gap between generated images and natural images rather than purely by watermark removal. The no-attack baseline of 0.993/0.994 is consistent with prior work, but the attack could, in principle, be exploiting a generated-vs-natural artifact. To support the claim that the watermark itself is removed, please report the same detection metrics on a test set of non-watermarked images generated by the same diffusion model (or a same-architecture model), for both the no-attack and post-attack conditions.
  3. [Section 5.4 / Table 2 (Alternative VAEs)] The practical strength of the attack is conditional on the attacker having the exact VAE used by the victim. With the fine-tuned SDXL VAE, ROC-AUC only drops to 0.540 (and FID increases by 33.71 in the Wm & UnWm condition), and with the 16-channel VAE it drops only to 0.774; both are far from the 0.153 headline result. The abstract and introduction should more prominently state that the headline result assumes exact VAE reuse, and the anecdotal evidence for 'often publicly available' should be either quantified with a measurement or softened to avoid overclaiming.
  4. [Section 3.4 / Algorithm 1 (Perturbation budget)] The description of the PGD perturbation budget is unclear. The text says 'we take the maximum number of watermarked latents in our dataset p and set our perturbation budget to 1/p,' but later reports a budget of δ=32 without specifying the norm used for clipping or how δ maps to image-space distortion. Please provide a precise definition of δ, the norm in P_δ, and the value of p, since this is essential for reproducing the attack.
minor comments (4)
  1. [Throughout] There are several typos and formatting errors, including 'watermaked' (Section 3.2), 'caputres' (Section 4.2), and inconsistent labels such as 'WmvsUnwm' in Figure 9 and Table 2. These should be fixed in a revision.
  2. [Table 2] The text says standard deviations were consistently below 0.01 and are omitted, but no standard deviations are shown anywhere. Please consider adding them to an appendix or at least reporting them for the headline rows.
  3. [Section 5.3] The discussion of why ROC-AUC values below 0.5 cannot simply be inverted by the defender is interesting but somewhat speculative; it might fit better in the Discussion section, where the arms-race argument is made.
  4. [Title page] The note stating that the work has been accepted for USENIX Security 2025 is unusual for a journal submission; if this is a prior-publication note, it should be clearly marked, otherwise it should be removed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the attack's effectiveness is measured against the actual Tree-Ring detector with independent labels and external benchmarks, not against the authors' own surrogate.

full rationale

The paper's central claim is empirical and externally anchored. The surrogate detector is trained on watermarked versus non-watermarked latents, but the reported ROC-AUC, PR-AUC, and TPR@1%FPR values are computed from the real Tree-Ring detector's decisions on attacked images, not from the surrogate's own predictions or loss. The VAE is used only as an encoder/decoder to approximate the target latent space; the detector being attacked is Wen et al.'s Tree-Ring implementation with its own DDIM inversion and key-distance threshold. No fitted parameter is renamed as a prediction: the PGD budget and step count are standard hyperparameters, and the ablation in Section 5.4 explicitly varies the VAE and reports degraded attack performance (ROC-AUC 0.540 with SDXL's VAE, 0.774 with a 16-channel VAE), which is a threat-model limitation rather than a circular reduction. The only self-citation is reference [30] on the base-rate fallacy in Section 5.6; it supports a general methodological point and is independently demonstrated by the paper's own PR-AUC and precision curves, so it is not load-bearing. The Wm & UnWm training regime assumes the adversary can generate non-watermarked images from the victim model, which is inconsistent with the stated black-box threat model, but the headline Wm & Pub result does not depend on that regime; this is a validity concern, not circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The attack's success rests on access assumptions and tuned hyperparameters rather than on new mathematical entities. No particles, forces, dimensions, or conserved quantities are invented. The main free parameters are the PGD budget, step schedule, and surrogate training choices; the key axioms concern exact VAE availability, latent separability, transferability, and the adequacy of public non-watermarked images.

free parameters (3)
  • PGD perturbation budget delta = 1/p per dataset; swept up to 32 in Figure 7
    Controls the strength of the latent-space perturbation; the results in Table 2 depend on the chosen budget.
  • PGD step size and iteration count = alpha = 0.05, N = 200
    Chosen following An et al.; no first-principles derivation is given.
  • Surrogate training hyperparameters = ResNet18, batch size 32, learning rate 1e-3, validation model selection every 100 epochs
    Architecture and training choices affect surrogate accuracy and transfer; the paper does not show that these are optimal.
assumptions (4)
  • domain assumption The victim's diffusion model uses a VAE that is publicly available and matches the attacker's VAE.
    Section 3.1 argues public VAE reuse is common; Section 5.4 shows the attack degrades substantially with different VAEs, so this assumption is load-bearing.
  • domain assumption Watermarked and non-watermarked images are separable in the VAE-recovered Fourier latent space.
    Established empirically via t-SNE in Figure 4 and surrogate training accuracy in Table 1; no theoretical proof is given.
  • domain assumption Perturbations that fool the surrogate detector transfer to the real Tree-Ring detector.
    Central empirical link in Section 5.3; Table 2 demonstrates transfer for the tested setup, but no transfer theory is provided.
  • domain assumption Public ImageNet images are an adequate non-watermarked training class compared with watermarked images obtained from the black-box API.
    The Wm & Pub dataset in Section 4.2 supports the abstract's headline numbers; the surrogate must learn watermark-specific features rather than dataset distribution features.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks." pith.science (2026). https://pith.science/paper/KQOBMBWM

@misc{pith2026250610502,
  author       = {Pith},
  title        = {Pith review of: A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KQOBMBWM}},
  note         = {Machine review of arXiv:2506.10502}
}
read the original abstract

We present a novel attack specifically designed against Tree-Ring, a watermarking technique for diffusion models known for its high imperceptibility and robustness against removal attacks. Unlike previous removal attacks, which rely on strong assumptions about attacker capabilities, our attack only requires access to the variational autoencoder that was used to train the target diffusion model, a component that is often publicly available. By leveraging this variational autoencoder, the attacker can approximate the model's intermediate latent space, enabling more effective surrogate-based attacks. Our evaluation shows that this approach leads to a dramatic reduction in the AUC of Tree-Ring detector's ROC and PR curves, decreasing from 0.993 to 0.153 and from 0.994 to 0.385, respectively, while maintaining high image quality. Notably, our attacks outperform existing methods that assume full access to the diffusion model. These findings highlight the risk of reusing public autoencoders to train diffusion models -- a threat not considered by current industry practices. Furthermore, the results suggest that the Tree-Ring detector's precision, a metric that has been overlooked by previous evaluations, falls short of the requirements for real-world deployment.

Figures

Figures reproduced from arXiv: 2506.10502 by the authors.

Figure 2
Figure 2. Detection scheme. Using forward diffusion, Tree [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The Fourier transform (magnitude) of the fourth channel for the intermediate latents of the backward diffusion process. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Two t-SNE components of the initial latents of the [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Surrogate detector training pipeline. The input data [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: PGD attack pipeline. The attack uses the surrogate [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: Results of our attack while varying 𝛿 to adjust the strength of the attack. Next to each score in the legend, we denote what direction of magnitude indicates a successful attack. We only include metrics that range within the unit interval, as such we exclude FID. when …
Figure 8
Figure 8. Figure 8: Detector precision over the base rate for each attack. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Attacked images. Each row corresponds to a combination of dataset and input type. The columns from left to right are: [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: PR curves for all the attacks when the base rate is 0.5. [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

65 extracted references · 60 canonical work pages

  1. [1]

    Deep Dream Generator.https://deepdreamgenerator

    Aifnet. Deep Dream Generator.https://deepdreamgenerator. com. Accessed: May 27, 2025

    work page 2025

  2. [2]

    AISEO Art - AI art generation.https://art.aiseo.ai

    AISEO. AISEO Art - AI art generation.https://art.aiseo.ai. Accessed: May 27, 2025

    work page 2025

  3. [3]

    CombinedDWT-DCTdigitalimagewatermarking

    Al-Haj, A. CombinedDWT-DCTdigitalimagewatermarking. Journal of computer science 3, 9 (2007), 740–746. 1https://doi.org/10.5281/zenodo.15595719

    work page doi:10.5281/zenodo.15595719 2007

  4. [4]

    InInternational Conference on Machine Learning (ICML)(2024)

    An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y ., Deng, C., Zhu, S., Mohamed, A., Wen, Y ., Goldstein, T., and Huang, F.WAVES: Benchmarking the Robustness of Image Watermarks. InInternational Conference on Machine Learning (ICML)(2024)

    work page 2024

  5. [5]

    Dos and don’ts of machine learning in computer security

    Arp, D., Quiring, E., Pendlebury, F., Warnecke, A., Pierazzi, F., Wressnegger, C., Cavallaro, L., and Rieck, K. Dos and don’ts of machine learning in computer security. In31st USENIX Security Symposium (USENIX Security 22)(2022), pp. 3971–3988

    work page 2022

  6. [6]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Proceedings of the 35th International Conference on Machine Learning(10–15 Jul 2018),J. Dy and A. Krause,Eds.,vol. 80 ofProceedings of Machine Learning Research, PMLR, pp. 274–283

    work page 2018

  7. [7]

    Thebase-ratefallacyanditsimplicationsforthedifficulty of intrusion detection

    Axelsson, S. Thebase-ratefallacyanditsimplicationsforthedifficulty of intrusion detection. InProceedings of the 6th ACM Conference on Computer and Communications Security(1999), pp. 1–7

    work page 1999

  8. [8]

    CogView 4 - Large Vision Language Model.https: //open.bigmodel.cn/pricing

    BigModel. CogView 4 - Large Vision Language Model.https: //open.bigmodel.cn/pricing. Accessed: May 27, 2025

    work page 2025

Show all 65 references
  1. [9]

    Typology of risks of generativetext-to-imagemodels

    Bird, C., Ungless, E., and Kasirzadeh, A. Typology of risks of generativetext-to-imagemodels. InProceedingsofthe2023AAAI/ACM Conference on AI, Ethics, and Society(2023), pp. 396–410

    2023

  2. [10]

    FLUX 1.1 Pro.https://huggingface.co/ black-forest-labs/FLUX.1-dev, 2024

    Black Forest Labs. FLUX 1.1 Pro.https://huggingface.co/ black-forest-labs/FLUX.1-dev, 2024. Accessed: May 27, 2025

    2024

  3. [11]

    A systematic review on model watermarking for neural networks

    Boenisch, F. A systematic review on model watermarking for neural networks. Frontiers in big Data 4(2021), 729663

    2021

  4. [12]

    Ostris vae - kl-f8-d16, 7 2024

    Burkett, J. Ostris vae - kl-f8-d16, 7 2024

    2024

  5. [13]

    Undetectable watermarks for languagemodels

    Christ, M., Gunn, S., and Zamir, O. Undetectable watermarks for languagemodels. InTheThirtySeventhAnnualConferenceonLearning Theory (2024), PMLR, pp. 1125–1139

    2024

  6. [14]

    Clipdrop - AI tools powered by Stable Diffusion.https: //clipdrop.co

    Clipdrop. Clipdrop - AI tools powered by Stable Diffusion.https: //clipdrop.co. Accessed: May 27, 2025

    2025

  7. [15]

    Certified adversarial ro- bustness via randomized smoothing

    Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial ro- bustness via randomized smoothing. Ininternational conference on machine learning(2019), PMLR, pp. 1310–1320

    2019

  8. [16]

    Digital watermarking and steganography

    Cox, I., Miller, M., Bloom, J., Fridrich, J., and Kalker, T. Digital watermarking and steganography. Morgan kaufmann, 2007

    2007

  9. [17]

    Craiyon - AI model based on DALL-E.https://www

    Craiyon. Craiyon - AI model based on DALL-E.https://www. craiyon.com. Accessed: May 27, 2025

    2025

  10. [18]

    Davinci AI - Powered by SDXL.https://davinci.ai

    Davinci AI. Davinci AI - Powered by SDXL.https://davinci.ai. Accessed: May 27, 2025

    2025

  11. [19]

    Synthid: Identifying ai-generated images

    DeepMind, G. Synthid: Identifying ai-generated images. https: //deepmind.google/technologies/synthid, 2023. Accessed: 2024-09-08

    2023

  12. [20]

    In Advances in Neural Information Processing Systems (2021), M

    Dhariwal, P ., and Nichol, A.Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems (2021), M. Ranzato, A. Beygelzimer, Y. Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34, Curran Associates, Inc., pp. 8780–8794

    2021

  13. [21]

    Sok: Dataset copyright auditing in machine learning systems

    Du, L., Zhou, X., Chen, M., Zhang, C., Su, Z., Cheng, P ., Chen, J., and Zhang, Z. Sok: Dataset copyright auditing in machine learning systems. arXiv preprint arXiv:2410.16618(2024)

    2024 arXiv

  14. [22]

    Publicly-Detectable Watermarking for Language Models, 2023

    Fairoze, J., Garg, S., Jha, S., Mahloujifar, S., Mahmoody , M., and Wang, M. Publicly-Detectable Watermarking for Language Models, 2023

    2023

  15. [23]

    The stable signature: Rooting watermarks in latentdiffusion models

    Fernandez, P ., Couairon, G., Jégou, H., Douze, M., and Furon, T. The stable signature: Rooting watermarks in latentdiffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision(2023), pp. 22466–22477

    2023

  16. [24]

    An undetectable watermark for generative image models.arXiv preprint arXiv:2410.07369(2024)

    Gunn, S., Zhao, X., and Song, D. An undetectable watermark for generative image models.arXiv preprint arXiv:2410.07369(2024)

    2024 arXiv

  17. [25]

    Deep residual learning for imagerecognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for imagerecognition. InProceedingsoftheIEEEConferenceonComputer Vision and Pattern Recognition (CVPR)(6 2016)

    2016

  18. [26]

    Denoising diffusion probabilistic models

    Ho, J., Jain, A., and Abbeel, P . Denoising diffusion probabilistic models. InAdvances in Neural Information Processing Systems(2020), H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33, Curran Associates, Inc., pp. 6840–6851

    2020

  19. [27]

    J., Shen, Y ., W allis, P ., Allen-Zhu, Z., Li, Y ., W ang, S., W ang, L., and Chen, W .LoRA:Low-rankadaptationoflargelanguagemodels

    Hu, E. J., Shen, Y ., W allis, P ., Allen-Zhu, Z., Li, Y ., W ang, S., W ang, L., and Chen, W .LoRA:Low-rankadaptationoflargelanguagemodels. In The Tenth International Conference on Learning Representations (2022)

    2022

  20. [28]

    HuggingFace

    Hugging Face, I. HuggingFace. https://huggingface.co/,2016. Accessed: May 21, 2025

    2016

  21. [29]

    Openclip, July 2021

    Ilharco, G., Wortsman, M., Wightman, R., Gordon, C., Carlini, N., Taori, R., Dave, A., Shankar, V ., Namkoong, H., Miller, J., Hajishirzi, H., Farhadi, A., and Schmidt, L. Openclip, July 2021. If you use this software, please cite it as below

    2021

  22. [30]

    A critical evaluation of website fingerprinting attacks

    Juarez, M., Afroz, S., Acar, G., Diaz, C., and Greenstadt, R. A critical evaluation of website fingerprinting attacks. InProceedings of the 2014 ACM SIGSAC conference on computer and communications security(2014), pp. 263–274

    2014

  23. [31]

    How to distinguish ai-generated images from authentic photographs, 2024

    Kamali, N., Nakamura, K., Chatzimparmpas, A., Hullman, J., and Groh, M. How to distinguish ai-generated images from authentic photographs, 2024

    2024

  24. [32]

    P ., and Welling, M

    Kingma, D. P ., and Welling, M. Auto-encoding variational bayes. In 2ndInternationalConferenceonLearningRepresentations,ICLR2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings (2014), Y. Bengio and Y. LeCun, Eds

    2014

  25. [33]

    Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet clas- sification with deep convolutional neural networks. InAdvances in Neural Information Processing Systems(2012), F. Pereira, C. Burges, L. Bottou, and K. Weinberger, Eds., vol. 25, Curran Associates, Inc

    2012

  26. [34]

    Leonardo.Ai - Generative AI with Stable Diffusion

    Leonardo AI. Leonardo.Ai - Generative AI with Stable Diffusion. https://leonardo.ai. Accessed: May 27, 2025

    2025

  27. [35]

    Y .An unforgeable publicly verifiable watermark for large language models

    Liu, A., Pan, L., Hu, X., Li, S., Wen, L., King, I., and Philip , S. Y .An unforgeable publicly verifiable watermark for large language models. In The Twelfth International Conference on Learning Representations (2023)

    2023

  28. [36]

    Seeing is not always believing: benchmarking human and model perception of ai-generated images.Advances in Neural Information Processing Systems (NeurIPS) 36(2024)

    Lu, Z., Huang, D., Bai, L., Qu, J., Wu, C., Liu, X., and Ouyang, W. Seeing is not always believing: benchmarking human and model perception of ai-generated images.Advances in Neural Information Processing Systems (NeurIPS) 36(2024)

    2024

  29. [37]

    Leveraging optimization for adaptive attacks on image watermarks

    Lukas, N., Diaa, A., Fenaux, L., and Kerschbaum, F. Leveraging optimization for adaptive attacks on image watermarks. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024(2024)

    2024

  30. [38]

    In32nd USENIX Security Symposium (USENIX Security 23)(2023), pp

    Lukas, N., and Kerschbaum, F.{PTW}: Pivotal tuning watermark- ing for{Pre-Trained} image generators. In32nd USENIX Security Symposium (USENIX Security 23)(2023), pp. 2241–2258

    2023

  31. [39]

    Maier, J. CivitAI. https://civitai.com/, 2022. Accessed: Jan 21, 2025

    2022

  32. [40]

    openai/DALL-E

    OpenAI. openai/DALL-E. https://github.com/openai/DALL-E,

  33. [41]

    Sora: Text-to-Video Generation.https://openai.com/ sora, 2024

    OpenAI. Sora: Text-to-Video Generation.https://openai.com/ sora, 2024. Accessed: May 27, 2025

    2024

  34. [42]

    SDXL: improving latent diffusion models for high-resolution image synthesis

    Podell, D., English, Z., Lacey, K., Blattmann, A., Dockhorn, T., Müller, J., Penna, J., and Rombach, R. SDXL: improving latent diffusion models for high-resolution image synthesis. InThe Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, ...

    2024

  35. [43]

    W., Hallacy, C., Ramesh, A., Goh, G., Agar- wal, S., Sastry , G., Askell, A., Mishkin, P ., Clark, J., Krueger, G., and Sutskever, I

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agar- wal, S., Sastry , G., Askell, A., Mishkin, P ., Clark, J., Krueger, G., and Sutskever, I. Learning transferable visual models from natural language supervision. InICML (2021)

    2021

  36. [44]

    High-resolution image synthesis with latent diffusion models

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P ., and Ommer, B. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)(June 2022), pp. 10684–10695

    2022

  37. [45]

    U-net: Convolutional networks for biomedical image segmentation

    Ronneberger, O., Fischer, P ., and Brox, T. U-net: Convolutional networks for biomedical image segmentation. InMedical Image Com- puting and Computer-Assisted Intervention – MICCAI 2015(Cham, 2015), N. Navab, J. Hornegger, W. M. Wells, and A. F. Frangi, Eds., Springer Internat...

    2015

  38. [46]

    Dreambooth:Finetuningtext-to-imagediffusionmodelsforsubject- driven generation

    Ruiz, N., Li, Y ., Jampani, V ., Pritch, Y ., Rubinstein, M., and Aberman, K. Dreambooth:Finetuningtext-to-imagediffusionmodelsforsubject- driven generation. In2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)(Los Alamitos, CA, USA, 6 2023), IEEE Compu...

    2023

  39. [47]

    C., and Fei-Fei, L

    Russakovsky , O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy , A., Khosla, A., Bernstein, M., Berg, A. C., and Fei-Fei, L. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV) 115, 3 (2015), 211– 252

    2015

  40. [48]

    W ., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P ., Kundurthy , S

    Schuhmann, C., Beaumont, R., Vencu, R., Gordon, C. W ., Wightman, R., Cherti, M., Coombes, T., Katta, A., Mullis, C., Wortsman, M., Schramowski, P ., Kundurthy , S. R., Crowson, K., Schmidt, L., Kaczmarczyk, R., and Jitsev , J. LAION-5b: An open large-scale dataset for trainin...

    2022

  41. [49]

    shuttleai/shuttle-3-diffusion

    ShuttleAI. shuttleai/shuttle-3-diffusion. https://huggingface. co/shuttleai/shuttle-3-diffusion/blob/main/vae/ config.json, 2024. Accessed: May 27, 2025

    2024

  42. [50]

    Deep unsupervised learning using nonequilibrium thermodynam- ics

    Sohl-Dickstein, J., Weiss, E., Maheswaranathan, N., and Ganguli, S. Deep unsupervised learning using nonequilibrium thermodynam- ics. InInternational conference on machine learning(2015), PMLR, pp. 2256–2265

    2015

  43. [51]

    InInternational Conference on Learning Representations(2021)

    Song, J., Meng, C., and Ermon, S.Denoisingdiffusionimplicitmodels. InInternational Conference on Learning Representations(2021)

    2021

  44. [52]

    DreamStudio - Image generation using Stable Diffusion

    Stability AI. DreamStudio - Image generation using Stable Diffusion. https://beta.dreamstudio.ai/generate. Accessed: May 27, 2025

    2025

  45. [53]

    InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (6 2016)

    Szegedy , C., V anhoucke, V ., Ioffe, S., Shlens, J., and Wojna, Z.Re- thinking the inception architecture forcomputervision. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (6 2016)

    2016

  46. [54]

    Stegastamp: Invisible hyperlinks in physical photographs

    Tancik, M., Mildenhall, B., and Ng, R. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)(6 2020)

    2020

  47. [55]

    Z., Rankin, G., V an Schyndel, R., Ho, W ., Mee, N., and Osborne, C

    Tirkel, A. Z., Rankin, G., V an Schyndel, R., Ho, W ., Mee, N., and Osborne, C. F. Electronic watermark. Digital Image Computing, Technology and Applications (DICTA’93)(1993), 666–673

    1993

  48. [56]

    In37th Confer- ence on Neural Information Processing Systems (NeurIPS)(2023)

    Wen, Y ., Kirchenbauer, J., Geiping, J., and Goldstein, T.Tree-rings watermarks: Invisible fingerprints for diffusion images. In37th Confer- ence on Neural Information Processing Systems (NeurIPS)(2023)

    2023

  49. [57]

    In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition(2024), pp

    Yang, Z., Zeng, K., Chen, K., Fang, H., Zhang, W ., and Yu, N.Gaus- sian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition(2024), pp. 12162–12171

    2024

  50. [58]

    Artificial finger- printing for generative models: Rooting deepfake attribution in training data

    Yu, N., Skripniuk, V ., Abdelnabi, S., and Fritz, M. Artificial finger- printing for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision(2021), pp. 14448–14457

    2021

  51. [59]

    M.Securing deep gen- erative models with universal adversarial signature.arXiv preprint arXiv:2305.16310(2023)

    Zeng, Y ., Zhou, M., Xue, Y ., and Patel, V . M.Securing deep gen- erative models with universal adversarial signature.arXiv preprint arXiv:2305.16310(2023)

    2023 arXiv

  52. [60]

    A., Xu, L., Cuesta-Infante, A., and Veeramachaneni, K

    Zhang, K. A., Xu, L., Cuesta-Infante, A., and Veeramachaneni, K. Robust invisible video watermarking with attention.arXiv preprint arXiv:1909.01285(2019)

    2019 arXiv

  53. [61]

    A., Shechtman, E., and Wang, O

    Zhang, R., Isola, P ., Efros, A. A., Shechtman, E., and Wang, O. The unreasonable effectiveness of deep features as a perceptual metric. InCVPR (2018)

    2018

  54. [62]

    Sok: Watermarking for ai-generated content.arXiv preprint arXiv:2411.18479(2024)

    Zhao, X., Gunn, S., Christ, M., Fairoze, J., Fabrega, A., Carlini, N., Garg, S., Hong, S., Nasr, M., Tramer, F., et al. Sok: Watermarking for ai-generated content.arXiv preprint arXiv:2411.18479(2024)

    2024 arXiv

  55. [63]

    Invisible image watermarks are provably removable using generative ai, 2023

    Zhao, X., Zhang, K., Su, Z., V asan, S., Grishchenko, I., Kruegel, C., Vigna, G., Wang, Y .-X., and Li, L. Invisible image watermarks are provably removable using generative ai, 2023

    2023

  56. [64]

    Hidden: Hiding data with deep networks

    Zhu, J., Kaplan, R., Johnson, J., and Fei-Fei, L. Hidden: Hiding data with deep networks. InProceedings of the European conference on computer vision (ECCV)(2018), pp. 657–672. Appendix A Attack Visualization FromFigure9,wecanseethateachattacklearnsacorrelation between the are...

    2018

  57. [2021]

    Accessed: May 27, 2025

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.