DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory
Introduces DRIFT, a black-box attack removing diffusion watermarks by deflecting generative trajectories, achieving 98-100% success across nine watermarking schemes.
Researchers propose DRIFT, a black-box watermark removal attack combining partial forward diffusion with stochastic reverse resampling to break trajectory-dependent verification. The paper derives information-theoretic and Wasserstein source-dependence bounds and shows the first verifier-rejected rung is least distorted among rejected rungs. Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success with the best image quality among compared attacks, without secret keys, verifier internals, or per-image gradient optimization.
- Identifies reliance on recoverable generative trajectories as a shared attack surface in diffusion watermarking
- Combines partial forward re-noising with stochastic reverse resampling to deflect watermark-bearing latent structure
- Adaptive variant searches a ladder of depths and refines fidelity only on verifier-rejected updates
- Achieves 98-100% removal success across nine watermarks in three paradigms with best image quality
- Provides theoretical bounds on source dependence at fixed recovery depth
From the original article
1 min read at arxiv.orgDiffusion watermarking embeds verifiable signals into the generative process and commonly verifies them by recovering trajectory-dependent evidence, making the marks robust to conventional pixel-space distortions. Existing removal attacks either regenerate along deterministic trajectories, which often preserve the watermark-bearing latent structure, or optimize every image separately.
By Rui Bao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.