Warfare:Breaking the Watermark Protection of AI-Generated Content
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
AI-Generated Content (AIGC) is rapidly expanding, with services using advanced generative models to create realistic images and fluent text. Regulating such content is crucial to prevent policy violations, such as unauthorized commercialization or unsafe content distribution. Watermarking is a promising solution for content attribution and verification, but we demonstrate its vulnerability to two key attacks: (1) Watermark removal, where adversaries erase embedded marks to evade regulation, and (2) Watermark forging, where they generate illicit content with forged watermarks, leading to misattribution. We propose Warfare, a unified attack framework leveraging a pre-trained diffusion model for content processing and a generative adversarial network for watermark manipulation. Evaluations across datasets and embedding setups show that Warfare achieves high success rates while preserving content quality. We further introduce Warfare-Plus, which enhances efficiency without compromising effectiveness. The code can be found in https://github.com/GuanlinLee/warfare.
Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 41 of its 55 references that are in the map. First posted on arXiv 27 Sep 2023.
Builds on
41 of 55 references.
Closest ancestors · 8
Same direction, newest first
- 2023DiffWA: Diffusion Models for Watermark Attack22 Jun
- 2023On the Reliability of Watermarks for Large Language Models7 Jun
- 2023Invisible Image Watermarks Are Provably Removable Using Generative AI2 Jun
- 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
- 2023DiffusionShield: A Watermark for Copyright Protection against Generative Diffusion Models25 May
- 2023Watermarking Diffusion Model21 May
- 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
- 2023A Recipe for Watermarking Diffusion Models17 Mar
Other references · 33
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 6,013
- 2014Deep Learning Face Attributes in the Wildcited by 3,693
- 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 3,045
- 2022Video Diffusion Modelscited by 2,305
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
- 2015LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loopcited by 1,355
21 more
- 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,354
- 2017Deep Image Priorcited by 1,098
- 2017Wasserstein GANcited by 639
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
- 2022Diffusion Models for Adversarial Purificationcited by 476
- 2018HiDDeN: Hiding Data With Deep Networkscited by 397
- 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 265
- 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 163
- 2019Robust Invisible Video Watermarking with Attentioncited by 149
- 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesiscited by 120
- 2021Watermarking Images in Self-Supervised Latent Spacescited by 94
- 2023Identifying and Mitigating the Security Risks of Generative AIcited by 91
- 2023Spear Phishing With Large Language Modelscited by 52
- 2022Supervised GAN Watermarking for Intellectual Property Protectioncited by 40
- 2020WDNet: Watermark-Decomposition Network for Visible Watermark Removalcited by 37
- 2023From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloadscited by 32
- 2017Wasserstein Divergence for GANscited by 22
- 2021Visible Watermark Removal via Self-calibrated Localization and Background Refinementcited by 14
- 2021Watermark Faker: Towards Forgery of Digital Image Watermarkingcited by 8
- 2019The Mass, Fake News, and Cognition Securitycited by 3
- 2020From Attack to Protection: Leveraging Watermarking Attack Network for Advanced Add-on Watermarkingcited by 3
Built on by
Citing papers per year: 2024: 2; 2025: 3; 2026: 3.
8 papers.
- 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
- 2025Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Modelscited by 12
- 2024CopyrightMeter: Revisiting Copyright Protection in Text-to-image Modelscited by 6
- 2025WMCopier: Forging Invisible Image Watermarks on Arbitrary Imagescited by 6
- 2025Low-Compute Watermark Removal via Dual-Domain Natural Projectioncited by 1
- 2026Synthetic Counteradaptation: A Principle of Human-AI Co-evolutioncited by 0
- 2026Beyond AI-Generated Labels: Watermarking, Co-Creation, and Conflation of AI-Generation with Disinformationcited by 0
- 2026Representation Learning in Diffusion and Flow-based Model: An Application Aspectcited by 0
- 2026Representation Learning in Diffusion and Flow-based Model: An Application Aspect25 Aug 2026
- 2026Beyond AI-Generated Labels: Watermarking, Co-Creation, and Conflation of AI-Generation with Disinformation13 Jul 2026
- 2026Synthetic Counteradaptation: A Principle of Human-AI Co-evolution31 Mar 2026
- 2025Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models23 Oct 2025
- 2025Low-Compute Watermark Removal via Dual-Domain Natural Projection8 Oct 2025
- 2025WMCopier: Forging Invisible Image Watermarks on Arbitrary Images28 Mar 2025
- 2024CopyrightMeter: Revisiting Copyright Protection in Text-to-image Models20 Nov 2024
- 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems11 Jan 2024
Similar, not cited
Close in wording, no citation either way
- 2023Evading Watermark based Detection of AI-Generated Content
- 2025Removal Attack and Defense on AI-generated Content Latent-based Watermarking
- 2025Watermarking across Modalities for Content Tracing and Generative AI
- 2024SoK: Watermarking for AI-Generated Content
- 2024SoK: On the Role and Future of AIGC Watermarking in the Era of Gen-AI
- 2024Robustness of Watermarking on Text-to-Image Diffusion Models
- 2025Watermarking for AI Content Detection: A Review on Text, Visual, and Audio Modalities
- 2024Exploiting Watermark-Based Defense Mechanisms in Text-to-Image Diffusion Models for Unauthorized Data Usage