Pith. sign in

REVIEW 3 major objections 4 minor 4 cited by

Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single watermarked image and an unrelated diffusion model are enough to forge semantic watermarks.

desk verdict Single-reference black-box forgery and removal against Tree-Ring and Gaussian Shading is a real, carefully evaluated result that deserves serious peer review; only the 'fundamental vulnerability' framing slightly overstates the weak Tree-Ring/FLUX.1 case. read the letter →

arxiv 2412.03283 v3 pith:SSFUBVW4 submitted 2024-12-04 cs.CR cs.AIcs.CV

Andreas Müller , Denis Lukovnikov , Jonas Thietke , Asja Fischer , Erwin Quiring This is my paper · ORCID
classification cs.CRcs.AIcs.CV
keywords semanticwatermarkingdiffusionmodelswatermarkforgeryremovalTree-RingGaussianShadingblack-boxattacksDDIMinversion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Tree-Ring and Gaussian Shading protect AI-generated images by embedding a watermark into the initial noise of a diffusion model's generation, recoverable only by inverting that model, with the security of the scheme resting on the target model staying secret. The paper claims this secrecy is unnecessary to break. An attacker armed with one watermarked reference image and any diffusion model of their own — even one with a different architecture and an independently trained autoencoder — can imprint the watermark onto arbitrary real images, strip it from watermarked images, or generate new images that verify as watermarked and are attributed to the reference image's user. If the claim holds, watermark-based detection and attribution of AI content can be spoofed without any access to the protected model, and a single publicly posted generated image becomes enough to compromise the system.

What carries the argument

The central object is the inverse DDIM sampler $\mathcal{I}_{0\to T}(z_0; u)$, which walks a latent back along the denoising trajectory of a model $u$ to recover the initial noise in which the watermark lives. All attacks run inside an attacker-chosen proxy model $\Theta_A = (E_A, u_A, D_A)$; the target model is never queried. The Imprint-Forgery attack is carried by the loss $$\mathcal{L}_{\text{forgery}}(\delta) = \left| \mathcal{I}_{0\to T}(\tilde{z}$_0^{{(c)}}$ + \delta; u_A) - \tilde{z}$_T^{{(w)}}$ \right|^2,$$ minimized over a perturbation $\delta$ of the cover image's latent with gradient checkpointing to backpropagate through the whole inversion, while a mask preserves sensitive regions such as faces and text. The mechanism that makes the attack work is transferability: a distance reduction in the proxy's latent space appears as a distance reduction in the target's latent space as well. The paper measures this across seven models and finds a correlation with the functional similarity of the models' autoencoders, but notes the correlation does not fully explain the transfer, so transferability itself, rather than any single shared component, is the load-bearing phenomenon. For Reprompting, the recovered noise $\tilde{z}_T^{(w)}$ is the only artifact reused.

What would settle it

Run the Imprint-Forgery attack over a grid of proxy–target pairs chosen to minimize latent compatibility, for instance a 16-channel DiT-based autoencoder as target with a 4-channel UNet-based proxy, or pairs selected for near-zero functional cosine similarity between their latents. If detection rates on Gaussian Shading at FPR $10^{-6}$ stay at chance for all such pairs even beyond 150 optimization steps, the claim that unrelated models with different latent spaces suffice for forgery would be falsified; if even one such pair transfers, the claim survives at its weakest point, which the 23% Tree-Ring result against FLUX.1 already marks.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that watermark forgery and removal reduce to an optimization problem in the attacker's own latent space, not the target's. Given a watermarked image, the attacker inverts it with a proxy model to recover the watermarked initial noise $\tilde{z}_T^{(w)}$; the Imprint-Forgery attack then minimizes, by gradient descent through the proxy's inverse DDIM sampler, the Euclidean distance between $\tilde{z}_T^{(w)}$ and the inverted noise of a clean cover image, pulling the cover image's latent toward the watermark. The reduced distance transfers to the target model's latent space, so the target verifier detects the watermark in the modified cover image, and the same construction with the target noise negated removes it instead. The Reprompting attack feeds the recovered $\tilde{z}_T^{(w)}$ back into the proxy generator with a new prompt, resampling values inside the recovered sign bins for Gaussian Shading. The authors report near-perfect detection and attribution for Gaussian Shading on all four target models and, for Tree-Ring, above 84% on three of four; the hardest case is FLUX.1, with its different latent geometry, where Tree-Ring detection reaches only 23% at 150 steps, and the authors themselves note a corrected data-processing error in earlier PSNR figures that leaves the detection-rate claims unaffected.

Load-bearing premise

The attacks assume that pulling a forged image's latent noise closer to the watermark's noise inside the attacker's own model also pulls it closer inside the target model's latent space, and the paper's own evidence shows this transfer is real but incomplete, since against FLUX.1, a model with an unfamiliar latent geometry, Tree-Ring forgery succeeds in only 23% of cases at 150 steps.

Editorial extensions

If this is right

  • Detection stops separating real from generated: with Imprint-Forgery, an arbitrary clean image becomes verified as watermarked, so a provider's "is this AI-generated?" flag can be raised against images the model never produced.
  • Attribution stops being trustworthy: because the forged latent recovers the reference image's message bits, the service attributes the forged or reprompted content to the innocent user who posted the single reference image.
  • Removal uses the same machinery: negating the recovered watermark noise erases both detection and attribution of genuinely generated content, with Gaussian Shading detection falling to zero after 100 steps on all tested targets.
  • Threshold tightening is not a defense: forged images and legitimately watermarked images under common perturbations such as JPEG, salt-and-pepper noise, and rotation produce overlapping p-values and bit accuracies, so no stricter threshold separates them.
  • The single-reference requirement changes the threat model: earlier baselines needed thousands of watermarked images or knowledge of the target model, while these attacks need one public image and an off-the-shelf proxy model.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the attacks never touch the target model, the paper's results imply that inversion-based watermark schemes whose security rests on the model being secret have already lost that basis; a scheme that wants to survive this attack family likely must bind verification to a target-specific transformation, such as a decoder-dependent re-encoding, that a proxy's latent geometry cannot replicate.
  • The imperfect correlation between attack success and autoencoder functional similarity suggests a practical pre-deployment audit: compute latent cosine similarity between a candidate watermark host and publicly available models of several families; high similarity would predict vulnerability, while the paper's anomalous pairs, where dissimilar autoencoders still transfer, mark where a second predi
  • Operationally, the one-image requirement means any watermarked image that becomes public, such as a social-media post or shared screenshot, is a sufficient oracle for forgery, so an operator should assume the watermark is compromised at the moment of publication rather than when misuse appears.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes two black-box forgery attacks against semantic watermarks (Tree-Ring and Gaussian Shading) in latent diffusion models, plus a removal variant. Using a proxy model (by default SD2.1), the attacker first inverts a single watermarked reference image to obtain its estimated initial latent noise. The Imprint-Forgery attack then optimizes Eq. (4) to bring the inverted latent of a clean cover image closer to that watermarked latent, while the Imprint-Removal attack targets the negated latent via Eq. (5). The Reprompting attack instead regenerates a new image from the extracted latent with a different prompt, optionally probing multiple prompts and Gaussian Shading bin resamplings. The evaluation covers four target models (SD2.1-Anime, SDXL, PixArt-Σ, FLUX.1), a 7×7 transferability matrix over seven proxy/target models, ablations over samplers and inversion steps, a threshold-defense analysis, and comparisons with averaging, regeneration, adversarial embedding, and surrogate baselines.

Significance. The paper makes a timely and practically relevant contribution to the security evaluation of semantic watermarks. Its main experiments are carefully set up: watermark detection is judged by the original verifiers, Gaussian Shading is deployed with fresh keys and nonces per image (avoiding a known deployment pitfall), the code is released, and the authors are transparent about cases where the attack is weaker, notably Tree-Ring against FLUX.1. The baseline comparison clarifies that previously proposed attacks often fail when Gaussian Shading is implemented correctly. If the underlying cross-model latent transfer is a general property, the single-reference, black-box attack would be an important negative result for current semantic watermarking. However, the evidence for generality is the paper's main vulnerability: the transfer mechanism is only empirically demonstrated on a limited set of model pairs and is not fully explained, so the abstract's claim that unrelated models with different architectures suffice is stronger than the data shown.

major comments (3)
  1. [Abstract; Sec. 4.2, Table 1; Sec. 4.4, Table 3]
  2. [Sec. 4.5; Sec. F, Fig. 20]
  3. [Sec. 4.6, Fig. 9 and Sec. G, Fig. 21]
minor comments (4)
  1. [Sec. 4.1 / Table 1 footnote]
  2. [Sec. 3.1, Eq. (4)]
  3. [Sec. 4.4, Reprompt+]
  4. [Sec. F, Fig. 20]

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attacks are evaluated by the original watermark verifiers and the transfer assumption is empirically tested, not definitionally forced.

full rationale

The paper's central claim is that a proxy model can forge or remove Tree-Ring and Gaussian Shading watermarks. The optimization objective (Eq. 4) minimizes Euclidean distance in the proxy model's latent space, but attack success is not measured by that loss; it is measured by the original schemes' verifiers: Tree-Ring p-values at TPR@1% FPR and Gaussian Shading bit accuracy against thresholds calibrated to fixed FPRs (Secs. 4.1 and D.7). No fitted constant or threshold from this paper defines detection; the thresholds come from the watermarked schemes' statistical tests. The cross-model transfer of Eq. (4) is an empirical assumption, not a definitional equivalence, and the paper explicitly tests it (Secs. 4.5 and F), reporting imperfect transfer (e.g., Tree-Ring on FLUX.1 reaches 0.23 detection at 150 imprinting steps) and noting that autoencoder similarity correlates with transfer but does not fully explain it. The only self-citation ([39]) concerns the correct deployment of Gaussian Shading with fresh nonces and keys; this choice is conservative (it makes the attack harder), is corroborated by the original implementation, and does not supply the attack's success condition. Thus the derivation is self-contained against external benchmarks, and any limitations are empirical robustness concerns, not circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical or algorithmic entities and no data-fitted constants. The attack hyperparameters (learning rate 0.01, up to 150 optimization steps, masking choices) are ablated and shown as a trade-off rather than fitted to the target result. The central risk is the cross-model latent-transfer axiom, which is empirical and not fully explained.

assumptions (4)
  • domain assumption Semantic watermarks are decoded from the initial latent noise obtained by inverting the denoising process, and this inversion is available to the attacker through a proxy model.
    The attacks target Tree-Ring and Gaussian Shading exactly as designed: verification inverts the image and extracts a pattern from the latent (Sec. 2.2, Sec. A). The attack assumes the proxy model's DDIM inversion follows a trajectory close enough to the target model's inversion.
  • ad hoc to paper Reducing Euclidean distance between inverted latents in the proxy model's latent space transfers to watermark detection in the target model's latent space.
    This is the load-bearing empirical premise. Section 4.5 and Sec. F show correlation with autoencoder functional similarity, but the paper explicitly notes that similarity does not fully explain transfer, and success varies strongly with model pair.
  • domain assumption The attacker can obtain at least one watermarked reference image from the target service.
    This is the stated threat model. Both attacks require a single watermarked image, and the paper argues this is realistic because users share generated images publicly.
  • domain assumption For Gaussian Shading, the correct deployment draws a new nonce and key for every generated image, and the attack is evaluated under that deployment.
    The paper argues this is the intended secure usage, citing the original implementation and the authors' own workshop paper [39]. This assumption makes the attack stronger because it blocks prior averaging and surrogate attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models." pith.science (2026). https://pith.science/paper/SSFUBVW4

@misc{pith2026241203283,
  author       = {Pith},
  title        = {Pith review of: Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SSFUBVW4}},
  note         = {Machine review of arXiv:2412.03283}
}
read the original abstract

Integrating watermarking into the generation process of latent diffusion models (LDMs) simplifies detection and attribution of generated content. Semantic watermarks, such as Tree-Rings and Gaussian Shading, represent a novel class of watermarking techniques that are easy to implement and highly robust against various perturbations. However, our work demonstrates a fundamental security vulnerability of semantic watermarks. We show that attackers can leverage unrelated models, even with different latent spaces and architectures (UNet vs DiT), to perform powerful and realistic forgery attacks. Specifically, we design two watermark forgery attacks. The first imprints a targeted watermark into real images by manipulating the latent representation of an arbitrary image in an unrelated LDM to get closer to the latent representation of a watermarked image. We also show that this technique can be used for watermark removal. The second attack generates new images with the target watermark by inverting a watermarked image and re-generating it with an arbitrary prompt. Both attacks just need a single reference image with the target watermark. Overall, our findings question the applicability of semantic watermarks by revealing that attackers can easily forge or remove these watermarks under realistic conditions.

Figures

Figures reproduced from arXiv: 2412.03283 by the authors.

Figure 1
Figure 1. Semantic watermark forgery. The attacker can transfer [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Concept of Semantic Watermarking. The initial latent [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. Imprint-Forgery attack with and without masking. Mask [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (17 more)
Figure 5
Figure 5. Figure 5: Bit accuracy for the Imprint-Forgery attack [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: P-values for the Imprint-Forgery attack on [PITH_FULL_IMAGE:figures/full_fig_p005_6.png]
Figure 7
Figure 7. Figure 7: Bit accuracy of removal attack against Gaus [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: P-values of removal attack against Tree-Ring [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]
Figure 10
Figure 10. Figure 10: Transferability in terms of bit accuracy (Gaussian Shading, top) and p-value (Tree-Ring, bottom) of the Reprompting attack across models. Forgery Attacks. While there is prior work on the forgery of post-hoc watermarks [20, 40], only few works study se￾mantic watermar…
Figure 11
Figure 11. Figure 11: Concept of the two inversion-based semantic watermarking approaches [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Progression of our Imprint-Forgery attack with respect to optimization steps. The target model is PixArt- [PITH_FULL_IMAGE:figures/full_fig_p014_12.png]
Figure 13
Figure 13. Figure 13: Examples of our Imprint-Forgery attack on different target models and both watermark approaches. For each cover image [PITH_FULL_IMAGE:figures/full_fig_p015_13.png]
Figure 14
Figure 14. Figure 14: Examples of our watermark removal attack on different target models and both watermark approaches. For each target model [PITH_FULL_IMAGE:figures/full_fig_p016_14.png]
Figure 15
Figure 15. Figure 15: Examples of the Reprompting attack on different target models and both watermarking approaches. In each section, the top [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]
Figure 16
Figure 16. Figure 16: Trade-off between attack success and image quality. To this end, we plot the detection rate vs. PSNR for watermark forgery (top) [PITH_FULL_IMAGE:figures/full_fig_p018_16.png]
Figure 17
Figure 17. Figure 17: Visual comparison of our Imprint attacks against baselines for watermark forgery (top) and removal (bottom) against a service [PITH_FULL_IMAGE:figures/full_fig_p018_17.png]
Figure 18
Figure 18. Figure 18: Examples of common image transformations [PITH_FULL_IMAGE:figures/full_fig_p024_18.png]
Figure 19
Figure 19. Figure 19: Ablation study over samplers used by the attacker and the target model used by the SP (left), as well as inversion steps used by [PITH_FULL_IMAGE:figures/full_fig_p025_19.png]
Figure 20
Figure 20. Figure 20: Transferability across different pairs of target and attacker model and functional similarity of autoencoders. For convenience, the [PITH_FULL_IMAGE:figures/full_fig_p026_20.png]
Figure 21
Figure 21. Figure 21: Comparison between image perturbations (blue bars) and our attacks (orange, red and purple bars), for Gaussian Shading (left) [PITH_FULL_IMAGE:figures/full_fig_p027_21.png]
Figure 22
Figure 22. Figure 22: Performance of the Reprompting attack for Gaussian Shading (left, measured using bit accuracy) and Tree-Ring (right, measured [PITH_FULL_IMAGE:figures/full_fig_p028_22.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA

    cs.CR 2026-08 reject novelty 6.0 of 10

    HaloMark proposes publishing an LSH commitment in the C2PA sidecar to watermark embeddings, but it derives the secret key from public manifest data, making the key recoverable by any sidecar observer.

  2. FARI: Robust One-Step Inversion for Watermarking in Diffusion Models

    cs.CR 2026-07 accept novelty 6.0 of 10

    One-step adversarially LoRA-tuned inversion exploits low-curvature reverse trajectories to beat 50-step DDIM on watermark robustness after ~20 minutes of fine-tuning.

  3. Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image

    cs.CV 2025-04 conditional novelty 6.0 of 10

    A black-box attack using one watermarked image and a proxy VAE can forge or remove latent-noise diffusion watermarks by perturbing images in the VAE's latent space.

  4. Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models

    cs.CV 2025-04 conditional novelty 6.0 of 10

    Gaussian Shading++ hides an invisible watermark in diffusion images using a fixed key, storing the random seed in a pseudorandom error-correcting header and improving extraction with soft-decision decoding.

Reference graph

Works this paper leans on

53 extracted references · 50 canonical work pages · cited by 4 Pith papers

  1. [1]

    A. Al-Haj. Combined dwt-dct digital image watermarking. Journal of computer science, 3(9):740–746, 2007. 2

    work page 2007

  2. [2]

    B. An, M. Ding, T. Rabbani, A. Agrawal, Y . Xu, C. Deng, S. Zhu, A. Mohamed, Y . Wen, T. Goldstein, and F. Huang. W A VES: benchmarking the robustness of image watermarks. InProc. of Int. Conference on Machine Learning (ICML),

    work page

  3. [3]

    Bartz and K

    D. Bartz and K. Hu. Openai, google, others pledge to watermark ai content for safety, white house says. https: / / www . reuters . com / technology / openai - google - others - pledge - watermark - ai - content- safety- white- house- 2023- 07- 21/,

    work page 2023

  4. [4]

    D. J. Bernstein et al. Chacha, a variant of salsa20. InWork- shop record of SASC, 2008. 12

    work page 2008

  5. [5]

    J. R. Biden. Executive order on the safe, se- cure, and trustworthy development and use of arti- ficial intelligence. https : / / www . whitehouse . gov/briefing- room/presidential- actions/ 2023/10/30/executive- order- on- the- safe- secure- and- trustworthy- development- and- use-of-artificial-intelligence/, 2023. 2

    work page 2023

  6. [6]

    J. Chen, J. Yu, C. Ge, L. Yao, E. Xie, Y . Wu, Z. Wang, J. Kwok, P. Luo, H. Lu, and Z. Li. PixArt- α: Fast train- ing of diffusion transformer for photorealistic text-to-image synthesis. arXiv:2310.00426, 2023. 4

    arXiv 2023

  7. [7]

    H. Ci, Y . Song, P. Yang, J. Xie, and M. Z. Shou. WMAdapter: Adding watermark control to latent diffusion models. arXiv:2406.08337, 2024. 3

    arXiv 2024

  8. [8]

    H. Ci, P. Yang, Y . Song, and M. Z. Shou. RingID: Rethinking tree-ring watermarking for enhanced multi-key identification. InProc. of the European Conference on Computer Vision (ECCV), 2024. 1, 3, 12

    work page 2024

Show all 53 references
  1. [9]

    N. Clegg. Labeling AI-Generated images on Facebook, Insta- gram and Threads. https://about.fb.com/news/ 2024/02/labeling-ai-generated-images-on- facebook-instagram-and-threads/, 2024. 1

    2024

  2. [10]

    I. Cox, M. Miller, J. Bloom, J. Fridrich, and T. Kalker.Dig- ital Watermarking and Steganography. Morgan Kaufmann Publishers Inc., San Francisco, CA, USA, 2 edition, 2007. 2

    2007

  3. [11]

    Artificial intelligence act: Regulation (EU) 2024/1689 of the european parliament and of the coun- cil, 2024

    European Union. Artificial intelligence act: Regulation (EU) 2024/1689 of the european parliament and of the coun- cil, 2024. https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32024R1689. 2

    2024

  4. [12]

    Facing reality? law en- forcement and the challenge of deepfakes

    Europol Innovation Lab. Facing reality? law en- forcement and the challenge of deepfakes. https : / / www . europol . europa . eu / publications - events / publications / facing - reality - law - enforcement - and - challenge - of - deepfakes,

  5. [13]

    Fernandez, G

    P. Fernandez, G. Couairon, H. J´egou, M. Douze, and T. Furon. The stable signature: Rooting watermarks in latent diffusion models. InProc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2023. 3

    2023

  6. [14]

    Gokaslan, A

    A. Gokaslan, A. F. Cooper, J. Collins, L. Seguin, A. Jacob- son, M. Patel, J. Frankle, C. Stephenson, and V . Kuleshov. Commoncanvas: Open diffusion models trained on creative- commons images. InProc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 7

    2024

  7. [15]

    J. A. Goldstein and S. Grossman. How disinformation evolved in 2020, 2021. https://www.brookings. edu/articles/how-disinformation-evolved- in-2020/. 1

    2020

  8. [16]

    SynthID: Identifying ai-generated con- tent with SynthID

    Google DeepMind. SynthID: Identifying ai-generated con- tent with SynthID. https://deepmind.google/ technologies/synthid/, Last visit: Nov. 2024. 1

    2024

  9. [17]

    S. Gunn, X. Zhao, and D. Song. An undetectable watermark for generative image models. InInternational Conference on Learning Representations (ICLR), 2025. 1, 3, 13, 19

    2025

  10. [18]

    J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilis- tic models. InAdvances in Neural Information Processing Systems, 2020. 2

    2020

  11. [19]

    Stable diffusion XL repos- itory

    Hugging Face / Diffusers. Stable diffusion XL repos- itory. https : / / github . com / huggingface / diffusers / blob / main / src / diffusers / pipelines/stable_diffusion_xl/pipeline_ stable_diffusion_xl.py, Last visit: Nov. 2024. 1

    2024

  12. [20]

    Kinakh, B

    V . Kinakh, B. Pulfer, Y . Belousov, P. Fernandez, T. Furon, and S. V oloshynovskiy. Evaluation of security of ML-based watermarking: Copy and removal attacks. InIEEE Inter- national Workshop on Information Forensics and Security (WIFS), 2024. 8

    2024

  13. [21]

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ra- manan, P. Doll´ar, and C. L. Zitnick. Microsoft COCO: Com- mon objects in context. InProceedings of the European Conference on Computer Vision (ECCV), 2014. 19, 22, 26

    2014

  14. [22]

    L. Liu, Y . Ren, Z. Lin, and Z. Zhao. Pseudo numerical methods for diffusion models on manifolds. InInternational Conference on Learning Representations (ICLR), 2022. 2

    2022

  15. [23]

    Y . Liu, Y . Song, H. Ci, Y . Zhang, H. Wang, M. Z. Shou, and Y . Bu. Image watermarks are removable using controllable regeneration from clean noise. InInternational Conference on Learning Representations (ICLR), 2025. 8

    2025

  16. [24]

    C. Lu, Y . Zhou, F. Bao, J. Chen, C. Li, and J. Zhu. DPM- solver: A fast ODE solver for diffusion probabilistic model sampling in around 10 steps. InAdvances in Neural Informa- tion Proccessing Systems (NeurIPS), 2022. 2

    2022

  17. [25]

    S. Lu, Z. Zhou, J. Lu, Y . Zhu, and A. W.-K. Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. InInternational Conference on Learning Representations (ICLR), 2025. 2

    2025

  18. [26]

    Lukas, A

    N. Lukas, A. Diaa, L. Fenaux, and F. Kerschbaum. Leverag- ing optimization for adaptive attacks on image watermarks. InInternational Conference on Learning Representations (ICLR), 2024. 8

    2024

  19. [27]

    Mokady, A

    R. Mokady, A. Hertz, K. Aberman, Y . Pritch, and D. Cohen- Or. Null-text inversion for editing real images using guided diffusion models. InProc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2023. 2

    2023

  20. [28]

    Peebles and S

    W. Peebles and S. Xie. Scalable diffusion models with trans- formers. InProceedings of the IEEE/CVF International Con- ference on Computer Vision (ICCV), 2023. 9

    2023

  21. [29]

    Podell, Z

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. M ¨uller, J. Penna, and R. Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis. InInternational Conference on Learning Representations (ICLR), 2024. 4

    2024

  22. [30]

    Rombach, A

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Om- mer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 4

    2022

  23. [31]

    Russakovsky, J

    O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, A. C. Berg, and L. Fei-Fei. ImageNet large scale visual recognition chal- lenge.International Journal of Computer Vision (IJCV), 115 (3):211–252, 2015. 19

    2015

  24. [32]

    Saberi, V

    M. Saberi, V . S. Sadasivan, K. Rezaei, A. Kumar, A. M. Chegini, W. Wang, and S. Feizi. Robustness of AI-image detectors: Fundamental limits and practical attacks. InIn- ternational Conference on Learning Representations (ICLR),

  25. [33]

    Salimans and J

    T. Salimans and J. Ho. Progressive distillation for fast sam- pling of diffusion models. InInternational Conference on Learning Representations (ICLR), 2022. 2

    2022

  26. [34]

    Sohl-Dickstein, E

    J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Gan- guli. Deep unsupervised learning using nonequilibrium ther- modynamics. InProc. of Int. Conference on Machine Learn- ing (ICML), 2015. 2

    2015

  27. [35]

    J. Song, C. Meng, and S. Ermon. Denoising diffusion implicit models. InInternational Conference on Learning Represen- tations (ICLR), 2021

    2021

  28. [36]

    Song and S

    Y . Song and S. Ermon. Generative modeling by estimating gradients of the data distribution. InAdvances in Neural Information Proccessing Systems (NeurIPS), 2019

    2019

  29. [37]

    Y . Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Er- mon, and B. Poole. Score-based generative modeling through stochastic differential equations. InInternational Conference on Learning Representations (ICLR), 2021. 2

    2021

  30. [38]

    Tancik, B

    M. Tancik, B. Mildenhall, and R. Ng. Stegastamp: Invisi- ble hyperlinks in physical photographs. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020. 2

    2020

  31. [39]

    Thietke, A

    J. Thietke, A. M¨uller, D. Lukovnikov, A. Fischer, and E. Quir- ing. Towards a correct usage of cryptography in semantic wa- termarks for diffusion models. InICLR Workshop on GenAI Watermarking, 2025. arXiv: 2503.11404. 13

    2025 arXiv

  32. [40]

    R. Wang, C. Lin, Q. Zhao, and F. Zhu. Watermark Faker: towards forgery of digital image watermarking. InIEEE International Conference on Multimedia and Expo (ICME),

  33. [41]

    Y . Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein. Tree- Ring watermarks: Invisible fingerprints for diffusion im- ages. InAdvances in Neural Information Proccessing Systems (NeurIPS), 2023. 1, 2, 3, 4, 12, 23

    2023

  34. [42]

    Z. Xiao, K. Kreis, and A. Vahdat. Tackling the generative learning trilemma with denoising diffusion GANs. InInterna- tional Conference on Learning Representations (ICLR), 2022. 2

    2022

  35. [43]

    Xiong, C

    C. Xiong, C. Qin, G. Feng, and X. Zhang. Flexible and secure watermarking for latent diffusion model. InProceedings of the 31st ACM International Conference on Multimedia, 2023. 3

    2023

  36. [44]

    P. Yang, H. Ci, Y . Song, and M. Z. Shou. Can simple averag- ing defeat modern watermarks? In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural Information Proccessing Systems (NeurIPS), 2024. 5, 6, 8, 13, 19, 20, 21

    2024

  37. [45]

    Z. Yang, K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu. Gaussian Shading: Provable performance-lossless image wa- termarking for diffusion models. InProc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 1, 2, 3, 4, 5, 12, 13, 24

    2024

  38. [46]

    K. A. Zhang, L. Xu, A. Cuesta-Infante, and K. Veeramacha- neni. Robust invisible video watermarking with attention. arXiv:1909.01285, 2019. 2

    1909 arXiv

  39. [47]

    Zhang and Y

    Q. Zhang and Y . Chen. Fast sampling of diffusion models with exponential integrator. InInternational Conference on Learning Representations (ICLR), 2023. 2

    2023

  40. [48]

    Zhang, P

    R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features as a percep- tual metric. InProc. of IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018. 5

    2018

  41. [49]

    W. Zhao, L. Bai, Y . Rao, J. Zhou, and J. Lu. UniPC: A unified predictor-corrector framework for fast sampling of diffusion models. InAdvances in Neural Information Proccessing Systems (NeurIPS), 2023. 2

    2023

  42. [50]

    X. Zhao, K. Zhang, Z. Su, S. Vasan, I. Grishchenko, C. Kruegel, G. Vigna, Y .-X. Wang, and L. Li. Invisible image watermarks are provably removable using generative AI. InAdvances in Neural Information Proccessing Systems (NeurIPS), 2024. 8, 19, 21

    2024

  43. [51]

    diffused

    J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei. HiDDeN: Hid- ing data with deep networks. InProceedings of the European Conference on Computer Vision (ECCV), 2018. 2 Supplementary Material for Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models Table of Conten...

  44. [52]

    With FLUX.1 as target model, the baseline outperforms our attack in terms of detection rate (of the forged watermarks)

    Watermark Forgery.For Tree-Ring, the Averaging Attack performs similarly to our attack on three out of four target models. With FLUX.1 as target model, the baseline outperforms our attack in terms of detection rate (of the forged watermarks). To avoid visible distortions, howe...

  45. [53]

    Reprompt

    Watermark Removal.For Tree-Ring, the Averaging Attack is the only removal attack that consistently works on all four target models—again with the assumption to have a large number of images with the same watermark key. For Gaussian Shading, our proposed attacks are the only at...

    1920

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.