arXiv:2608. 10166v1 Announce Type: cross Abstract: Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI-generated imagery, yet its robustness against realistic, model-agnostic removal attacks remains poorly explored.
The paper introduces Latent Frequency Masking, an attack that removes or weakens invisible watermarks in AI-generated images by altering selected Fourier coefficients in the latent space. It demonstrates that this method can effectively compromise six diffusion watermarking techniques while maintaining image quality and running faster than existing attacks. The study provides a theoretical distortion bound and evaluates the attack on images from DiffusionDB and MS-COCO prompts.
arXiv:2610.12952v1 Announce Type: cross Abstract: Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attac...
arXiv:2609.40031v1 Announce Type: cross Abstract: Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated co...
Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated content and ensuring traceable sources to prevent man...
IRIS is a training‑free watermarking scheme for diffusion‑generated images that binds a watermark to the image’s visual semantics. It derives an intrinsic ring identifier from a content code of the non‑watermarked image and injects it late in the generation trajectory, ensuring the mark survives common processing while breaking under semantic changes or foreign images. Experiments on three prompt datasets show IRIS reliably detects watermarks, maintains fidelity to the original image, and resists forgery techniques that defeat other marks.
The paper introduces the concept of watermark laundering, where an attacker uses a single reconstruction prompt on public foundation image models to produce a visually faithful output that renders invisible watermarks undecodable. The authors evaluate this failure mode across six OpenAI and Google image editing models, three watermarking schemes, and 1,800 reconstructions, finding that OpenAI models cause the strongest payload disruption while Nano Banana 2 shows vulnerability of DwtDct under high-fidelity reconstruction. Prompt ablation experiments reveal that the disruption is driven by the reconstruction pathway itself rather than any specific removal instruction, highlighting prompt-conditioned reconstruction as a distinct attack interface.
FeatMark is a watermarking framework that protects images from text‑to‑image diffusion model mimicry attacks by embedding small, scene‑consistent micro‑features instead of pixel‑level perturbations. It constructs domain‑specific feature banks, selects executable features, and injects them via mask‑guided concept editing to create highly localized, natural edits. Experiments on VGGFace2, CelebA‑HQ, and WikiArt show FeatMark remains robust against ten strong watermark removal attacks and several adaptive attacks, with minimal impact on perceptual quality and extending to video mimicry scenarios.
DRIFT is a black‑box attack that removes diffusion watermarks by combining partial forward diffusion with stochastic reverse resampling. It limits the source information available to a fixed‑depth recovery pipeline and uses stochastic reversal to explore alternative noise‑driven paths, refining fidelity only on updates rejected by the same verifier. Across nine watermarks, DRIFT achieves 98–100% attack success and the best image quality without requiring secret keys, verifier internals, or per‑image gradient optimization.
arXiv:2608.29212v1 Announce Type: cross Abstract: Existing video watermarking systems are symmetric: the party that can verify a mark holds the extractor weights or generator secret and can therefore...
The paper proposes a defense against watermark forgery in generative models by randomizing the selection of watermark keys for each query and accepting content only if exactly one key detects a watermark. This approach provides a sample‑count‑independent upper bound on forgery success for blind attackers while preserving model utility. Experiments show a dramatic drop in forgery success rates—from 87% to 1% with four keys for text and from 100% to 2% for images—without significant computational overhead.
DRIFT is a black‑box attack that removes diffusion watermarks by deflecting the generative trajectory. It combines partial forward diffusion with stochastic reverse resampling to limit the source information available to a fixed‑depth recovery pipeline and to explore alternative noise‑driven paths. Across nine watermarks, DRIFT achieves 98–100% success while preserving image quality, without requiring secret keys, verifier internals, or per‑image gradient optimization.