mlsanityData to 14 Oct 2026

Leveraging Optimization for Adaptive Attacks on Image Watermarks

arXiv 2309.16952 ↗First posted 29 Sep 2023cs.CR cs.LGcited by 52

Not on the map. Why?

Cited by 27 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Untrustworthy users can misuse image generators to synthesize high-quality deepfakes and engage in unethical activities. Watermarking deters misuse by marking generated content with a hidden message, enabling its detection using a secret watermarking key. A core security property of watermarking is robustness, which states that an attacker can only evade detection by substantially degrading image quality. Assessing robustness requires designing an adaptive attack for the specific watermarking algorithm. When evaluating watermarking algorithms and their (adaptive) attacks, it is challenging to determine whether an adaptive attack is optimal, i.e., the best possible attack. We solve this problem by defining an objective function and then approach adaptive attacks as an optimization problem. The core idea of our adaptive attacks is to replicate secret watermarking keys locally by creating surrogate keys that are differentiable and can be used to optimize the attack's parameters. We demonstrate for Stable Diffusion models that such an attacker can break all five surveyed watermarking methods at no visible degradation in image quality. Optimizing our attacks is efficient and requires less than 1 GPU hour to reduce the detection accuracy to 6.3% or less. Our findings emphasize the need for more rigorous robustness testing against adaptive, learnable attackers.

Key facts. Cited by 52 papers in the map (data through 14 Oct 2026). Builds on 31 of its 39 references that are in the map. First posted on arXiv 29 Sep 2023.

Builds on

31 of 39 references.

References · 31

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  6. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  7. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  8. 2022Generative Adversarial Networkscited by 5,627
  9. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
  10. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  11. 2022InstructPix2Pix: Learning to Follow Image Editing Instructionscited by 2,611
  12. 2022DPM-Solver++: Fast Solver for Guided Sampling of Diffusion Probabilistic Modelscited by 938
19 more
  1. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  2. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  3. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Modelscited by 304
  4. 2017Embedding Watermarks into Deep Neural Networkscited by 248
  5. 2020The Creation and Detection of Deepfakes: A Surveycited by 247
  6. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 201
  7. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robustcited by 187
  8. 2019Robust Invisible Video Watermarking with Attentioncited by 149
  9. 2023A Recipe for Watermarking Diffusion Modelscited by 141
  10. 2020Responsible Disclosure of Generative Models Using Scalable Fingerprintingcited by 91
  11. 2023Identifying and Mitigating the Security Risks of Generative AIcited by 91
  12. 2023Evading Watermark based Detection of AI-Generated Contentcited by 78
  13. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 69
  14. 2023Diffusion-based Data Augmentation for Skin Disease Classification: Impact Across Original Medical Datasets to Fully Synthetic Imagescited by 45
  15. 2023DiffusionShield: A Watermark for Copyright Protection against Generative Diffusion Modelscited by 43
  16. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 41
  17. 2023PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generatorscited by 37
  18. 2022The Ethical Need for Watermarks in Machine-Generated Languagecited by 32
  19. 2019How Relevant is the Turing Test in the Age of Sophisbots?cited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 17; 2025: 17; 2026: 16.

52 papers.

Sort:

By area:

  1. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 97
  2. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Modelscited by 87
  3. 2024Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Modelscited by 52
  4. 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 50
  5. 2025SynthID-Image: Image watermarking at internet scalecited by 31
  6. 2024A Transfer Attack to Image Watermarkscited by 27
  7. 2024UnMarker: A Universal Attack on Defensive Image Watermarkingcited by 24
  8. 2024InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenancecited by 23
  9. 2024Stable Signature is Unstable: Removing Image Watermark from Diffusion Modelscited by 20
  10. 2024Optimizing Adaptive Attacks against Watermarks for Language Modelscited by 16
  11. 2024A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authenticationcited by 13
  12. 2025Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Imagecited by 13
38 more
  1. 2025Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Modelscited by 12
  2. 2024Steganalysis on Digital Watermarking: Is Your Defense Truly Impervious?cited by 10
  3. 2024JIGMARK: A Black-Box Approach for Enhancing Image Watermarks against Diffusion Model Editscited by 9
  4. 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challengecited by 9
  5. 2024Watermark-based Attribution of AI-Generated Contentcited by 8
  6. 2024FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Spacecited by 8
  7. 2023A Somewhat Robust Image Watermark against Diffusion-based Editing Modelscited by 5
  8. 2025VideoMarkBench: Benchmarking Robustness of Video Watermarkingcited by 5
  9. 2024Certifiably Robust Image Watermarkcited by 4
  10. 2025Secure and Efficient Watermarking for Latent Diffusion Models in Model Distribution Scenarioscited by 4
  11. 2025A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarkscited by 4
  12. 2025Mitigating Watermark Forgery in Generative Models via Randomized Key Selectioncited by 4
  13. 2025SPRINT: Robust Model Attribution of Generated Images via Secret Pixel Reconstructioncited by 4
  14. 2024Finding needles in a haystack: A Black-Box Approach to Invisible Watermark Detectioncited by 3
  15. 2025When There Is No Decoder: Removing Watermarks from Stable Diffusion Models in a No-box Settingcited by 3
  16. 2026Authenticated Contradictions from Desynchronized Provenance and Watermarkingcited by 3
  17. 2026Towards Robust Content Watermarking Against Removal and Forgery Attackscited by 3
  18. 2025Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulationcited by 2
  19. 2025Image Watermarking of Generative Diffusion Modelscited by 2
  20. 2025The Coding Limits of Robust Watermarking for Generative Modelscited by 2
  21. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  22. 2026RAVEN: Erasing Invisible Watermarks via Novel View Synthesiscited by 2
  23. 2026Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Imagescited by 2
  24. 2026Watermarking Should Be Treated as a Monitoring Primitivecited by 2
  25. 2024Robustness of Watermarking on Text-to-Image Diffusion Modelscited by 1
  26. 2025TokenPure: Watermark Removal through Tokenized Appearance and Structural Guidancecited by 1
  27. 2026Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstructioncited by 1
  28. 2026On the Robustness of Watermarking for Autoregressive Image Generationcited by 1
  29. 2026FARI: Robust One-Step Inversion for Watermarking in Diffusion Modelscited by 1
  30. 2026Semantic Watermarking with Order-Robust Detection over Sub-sentence Unitscited by 1
  31. 2024Exploiting Watermark-Based Defense Mechanisms in Text-to-Image Diffusion Models for Unauthorized Data Usagecited by 0
  32. 2025Robust and Secure Code Watermarking for Large Language Models via ML/Crypto Codesigncited by 0
  33. 2025DeepForgeSeal: Latent Space-Driven Semi-Fragile Watermarking for Deepfake Detection Using Adversarial Reinforcement Learningcited by 0
  34. 2026SoK: Colluding Adversaries in Machine Learning Pipelinescited by 0
  35. 2026FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Modelscited by 0
  36. 2026RemTraceNet: Few-Shot Forensic Detection of Invisible Watermark Attackscited by 0
  37. 2026WARP: A Unified Benchmark for Invisible Image Watermarking -- Robustness and Protection Against Attackscited by 0
  38. 2026Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Maskingcited by 0

50 most cited of 52 All 52 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025On the Information-Theoretic Fragility of Robust Watermarking under Diffusion Editing
  2. 2024The Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis ↗
  3. 2026Watermarks Attack Watermarks: Re-Watermarking as a Generic Removal Strategy
  4. 2025Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks
  5. 2026Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models
  6. 2024Investigating Deep Watermark Security: An Adversarial Transferability Perspective
  7. 2026Vanishing Watermarks: Diffusion-Based Image Editing Undermines Robust Invisible Watermarking
  8. 2026Decoupling Defense Strategies for Robust Image Watermarking