mlsanityData to 7 Oct 2026

Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models

arXiv 2412.03283 ↗First posted 4 Dec 2024cs.CR cs.AI cs.CVcited by 48

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Integrating watermarking into the generation process of latent diffusion models (LDMs) simplifies detection and attribution of generated content. Semantic watermarks, such as Tree-Rings and Gaussian Shading, represent a novel class of watermarking techniques that are easy to implement and highly robust against various perturbations. However, our work demonstrates a fundamental security vulnerability of semantic watermarks. We show that attackers can leverage unrelated models, even with different latent spaces and architectures (UNet vs DiT), to perform powerful and realistic forgery attacks. Specifically, we design two watermark forgery attacks. The first imprints a targeted watermark into real images by manipulating the latent representation of an arbitrary image in an unrelated LDM to get closer to the latent representation of a watermarked image. We also show that this technique can be used for watermark removal. The second attack generates new images with the target watermark by inverting a watermarked image and re-generating it with an arbitrary prompt. Both attacks just need a single reference image with the target watermark. Overall, our findings question the applicability of semantic watermarks by revealing that attackers can easily forge or remove these watermarks under realistic conditions.

Key facts. Cited by 48 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 37 of its 56 references that are in the map. First posted on arXiv 4 Dec 2024.

Builds on

37 of 56 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024An Undetectable Watermark for Generative Image Models9 Oct
  2. 2024WMAdapter: Adding WaterMark Control to Latent Diffusion Models12 Jun
  3. 2024AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA18 May
  4. 2024Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models7 Apr
  5. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar

Other references · 32

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  5. 2020Denoising Diffusion Implicit Modelscited by 9,655
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  7. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2022Scalable Diffusion Models with Transformerscited by 5,931
  10. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,290
  11. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  12. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
20 more
  1. 2022Null-text Inversion for Editing Real Images using Guided Diffusion Modelscited by 1,168
  2. 2023PixArt-α: Fast Training of Diffusion Transformer for Photorealistic Text-to-Image Synthesiscited by 854
  3. 2022Pseudo Numerical Methods for Diffusion Models on Manifoldscited by 695
  4. 2022Fast Sampling of Diffusion Models with Exponential Integratorcited by 526
  5. 2021Tackling the Generative Learning Trilemma with Denoising Diffusion GANscited by 515
  6. 2023UniPC: A Unified Predictor-Corrector Framework for Fast Sampling of Diffusion Modelscited by 441
  7. 2018HiDDeN: Hiding Data With Deep Networkscited by 384
  8. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 256
  9. 2019Robust Invisible Video Watermarking with Attentioncited by 144
  10. 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 124
  11. 2024Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advancescited by 105
  12. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  13. 2024RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identificationcited by 87
  14. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
  15. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  16. 2024Image Watermarks are Removable Using Controllable Regeneration from Clean Noisecited by 43
  17. 2023CommonCanvas: An Open Diffusion Model Trained with Creative-Commons Imagescited by 15
  18. 2024Steganalysis on Digital Watermarking: Is Your Defense Truly Impervious?cited by 10
  19. 2021Watermark Faker: Towards Forgery of Digital Image Watermarkingcited by 7
  20. 2024Evaluation of Security of ML-based Watermarking: Copy and Removal Attackscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 18; 2026: 30.

48 papers.

Sort:

By area:

  1. 2025SEAL: Semantic Aware Image Watermarkingcited by 13
  2. 2025Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Modelscited by 12
  3. 2025Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Imagecited by 12
  4. 2025Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Modelscited by 10
  5. 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challengecited by 7
  6. 2025T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Modelscited by 7
  7. 2026Breaking Semantic-Aware Watermarks via LLM-Guided Coherence-Preserving Semantic Injectioncited by 7
  8. 2025WMCopier: Forging Invisible Image Watermarks on Arbitrary Imagescited by 5
  9. 2025NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Modelscited by 5
  10. 2026SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarkingcited by 5
  11. 2025Mitigating Watermark Forgery in Generative Models via Randomized Key Selectioncited by 4
  12. 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Surveycited by 4
36 more
  1. 2026SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attackscited by 4
  2. 2025Towards A Correct Usage of Cryptography in Semantic Watermarks for Diffusion Modelscited by 3
  3. 2025Optimization-Free Universal Watermark Forgery with Regenerative Diffusion Modelscited by 3
  4. 2025ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clusteringcited by 3
  5. 2026Attack-Resistant Watermarking for AIGC Image Forensics via Diffusion-based Semantic Deflectioncited by 3
  6. 2026SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermarkcited by 3
  7. 2026TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectoriescited by 3
  8. 2025OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimizationcited by 2
  9. 2026RAVEN: Erasing Invisible Watermarks via Novel View Synthesiscited by 2
  10. 2026Towards Robust Content Watermarking Against Removal and Forgery Attackscited by 2
  11. 2026Dual-Guard: Dual-Channel Latent Watermarking for Provenance and Tamper Localization in Diffusion Imagescited by 2
  12. 2026Watermarking Should Be Treated as a Monitoring Primitivecited by 2
  13. 2025MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarkscited by 1
  14. 2025Causal Fingerprints of AI Generative Modelscited by 1
  15. 2025Low-Compute Watermark Removal via Dual-Domain Natural Projectioncited by 1
  16. 2025TokenPure: Watermark Removal through Tokenized Appearance and Structural Guidancecited by 1
  17. 2026On the Robustness of Watermarking for Autoregressive Image Generationcited by 1
  18. 2026Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion Perspectivecited by 1
  19. 2026FARI: Robust One-Step Inversion for Watermarking in Diffusion Modelscited by 1
  20. 2026MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbationcited by 0
  21. 2026Position: 3D Gaussian Splatting Watermarking Should Be Scenario-Driven and Threat-Model Explicitcited by 0
  22. 2026ALIEN: Analytic Latent Watermarking for Controllable Generationcited by 0
  23. 2026TokenTrace: Multi-Concept Attribution through Watermarked Token Recoverycited by 0
  24. 2026Beyond Detection: Multi-Scale Hidden-Code for Natural Image Deepfake Recovery and Factual Retrievalcited by 0
  25. 2026Proof-of-Authorship for Diffusion-based AI Generated Contentcited by 0
  26. 2026Whether, Which, and Whose: Solving the Triple Challenge of Deepfake Proactive Forensics in Multi-Face Scenarioscited by 0
  27. 2026PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detectioncited by 0
  28. 2026Robust Watermarks Meet Backdoored Models: Evading Diffusion Semantic Watermarks via Stealthy Backdoorcited by 0
  29. 2026MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulationcited by 0
  30. 2026A Locally Tokenized Generative Model for Robust Time-Series Watermarkingcited by 0
  31. 2026Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgerycited by 0
  32. 2026MoSign: Challenge-Response Motion-Watermark Authentication for Anonymous Virtual-Reality Userscited by 0
  33. 2026Residual Transferability in Neural Image Watermarkingcited by 0
  34. 2026Trustworthy synthetic visual media: Evidence across the media lifecyclecited by 0
  35. 2026Persistent Watermarking of Text-to-Image Modelscited by 0
  36. 2026Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Maskingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Secure and Efficient Watermarking for Latent Diffusion Models in Model Distribution Scenarios
  2. 2025SWA-LDM: Toward Stealthy Watermarks for Latent Diffusion Models
  3. 2025When There Is No Decoder: Removing Watermarks from Stable Diffusion Models in a No-box Setting
  4. 2025Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks
  5. 2026Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking
  6. 2026WMVLM: Evaluating Diffusion Model Image Watermarking via Vision-Language Models
  7. 2025Visual Watermarking in the Era of Diffusion Models: Advances and Challenges
  8. 2025PT-Mark: Invisible Watermarking for Text-to-image Diffusion Models via Semantic-aware Pivotal Tuning