DRIFT is a black‑box attack that removes diffusion watermarks by deflecting the generative trajectory. It combines partial forward diffusion with stochastic reverse resampling to limit the source information available to a fixed‑depth recovery pipeline and to explore alternative noise‑driven paths. Across nine watermarks, DRIFT achieves 98–100% success while preserving image quality, without requiring secret keys, verifier internals, or per‑image gradient optimization.
By Rui Bao, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Yang Song, Jiaojiao Jiang
arXiv:2608. 10166v1 Announce Type: cross Abstract: Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored.
By Jie Cao, Qi Li, Zelin Zhang, Xiaodong Wu, Lingshuang Liu, Xiangman Li, Jianbing Ni
arXiv:2610.02010v1 Announce Type: cross
Abstract: Invisible watermarking has become a central tool for tracing AI-generated images, but its robustness against adaptive removal attacks remains an open...
By Kirill Aistov, Khaled Abud, Irina Serzhenko, Egor Kovalev, Aleksey Yakushev, Aleksandr Akimenkov, Dmitry Obydenkov, Yury Markin, Sergey Lavrushkin, Dmitriy Vatolin, Anastasia Antsiferova
arXiv:2607. 26723v1 Announce Type: cross Abstract: Inversion-based watermarking is a promising approach to authenticate diffusion-generated images, yet practical use is bottlenecked by inversion that is both slow and error-prone.
By Jindong Yang, Han Fang, Weiming Zhang, Nenghai Yu, Kejiang Chen
Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated content and ensuring traceable sources to prevent man...
arXiv:2609.40031v1 Announce Type: cross
Abstract: Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated co...
By Khaled Abud, Aleksey Yakushev, Aleksandr Akimenkov, Irina Serzhenko, Kirill Aistov, Egor Kovalev, Dmitry Obydenkov, Sergey Lavrushkin, Anastasia Antsiferova, Dmitriy Vatolin, Yury Markin, Kirill Lukianov
The paper introduces the first systematic robustness benchmark for local invisible image watermarking, evaluating five methods across 55 image transformations that include signal distortions, coordinate misalignments, indirect local edits, and direct watermark edits. Results show that all methods are vulnerable to some transformation, with MaskWM achieving the best payload recovery and localization but at the cost of image quality. The study highlights that robustness varies strongly with transformation type, especially noting that geometric misalignment and generative local edits can completely disrupt payload recovery.
By Kai Yao, Bence Szil\'agyi, Sebesty\'en Kamp, M\'at\'e Po\'or, M\'at\'e Szilveszter, Matyas K. Zsoldos, Marc Juarez
The paper introduces TIGA, a source‑image‑free, training‑free attack that injects adversarial properties into a diffusion model’s sampling trajectory to evade black‑box AIGC forensic detectors. TIGA aggregates gradients from white‑box surrogate detectors to create a transferable prior, then uses anisotropic directional search with finite‑difference queries to estimate and stabilize directions for the DDIM trajectory, applying frequency‑domain reshaping to reduce artifacts. Experiments demonstrate strong black‑box attack performance, transferability, and robustness to post‑processing while maintaining high perceptual quality.
By Xia Du, Zhuosen Bao, Zheng Lin, Jizhe Zhou, Chi-man Pun, Jun Luo, Symeon Chatzinotas
The paper investigates whether pixels alone can determine an image’s origin—human, AI class, or specific generator—under adversarial edits. It establishes a minimax limit: the best possible robust acceptance gap equals the minimum total‑variation distance between the target distribution and attacked source distributions, independent of verifier design. The study also shows that practical public verifiers can fail before reaching this theoretical ceiling, highlighting the need to evaluate both statistical limits and deployed verifier behavior separately.
By Kai Yao
arXiv:2505. 22839v2 Announce Type: replace-cross Abstract: Recent studies suggest that diffusion models significantly improve the empirical adversarial robustness of deep neural network models.
By Liu Yuezhang, Xue-Xin Wei
arXiv:2608. 08999v1 Announce Type: cross Abstract: The proliferation of AI-generated images produced by Latent Diffusion Models (LDMs) has raised critical concerns regarding copyright infringement and misinformation.
By Chen-Hsiu Huang, Mario K\"oppen, Ja-Ling Wu
arXiv:2506. 03933v2 Announce Type: replace-cross Abstract: Vision Language Models (VLMs) have shown remarkable capabilities in multimodal understanding, yet their susceptibility to adversarial perturbations poses a significant threat to their reliability in real-world applications.
By Jia Fu, Yongtao Wu, Yihang Chen, Kunyu Peng, Xiao Zhang, Volkan Cevher, Sepideh Pashami, Anders Holst