Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
Reprompt watermark forgery reproduces on Stable Diffusion XL using free-tier T4 GPUs, with forged images accepted by the genuine detector 5 of 6 times.
The authors reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring watermarking on Stable Diffusion XL using the released code on free-tier dual T4 GPUs with 14.6 GB usable memory, versus the A40 hardware of the original study. Over six trials, the genuine detector flagged genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 seconds per attack. They also recovered the detector's discarded non-central chi-square statistic and built two natural scores separating forged images from the clean null at AUC 0.861 and 0.972. The notebook, pinned fork, and all measurement artifacts are released with the paper.
- Reprompt forgery reproduced on SDXL with free-tier dual T4 GPUs (14.6 GB).
- Genuine detector accepts forged images in 5 of 6 trials.
- Recovered chi-square statistic separates forged from clean at AUC 0.972.
- Attack runs at 325-332 seconds per image on constrained hardware.
- Notebook, pinned fork, and measurement artifacts publicly released.
From the original article
1 min read at arxiv.orgSemantic watermarking schemes such as Tree-Ring hide a detectable pattern in the initial noise latent of a diffusion model. Recent work shows these watermarks are not only removable but forgeable: an attacker who never sees the watermarking key can still produce images the genuine detector accepts. We reproduce the Reprompt forgery attack of Müller et al.
By Saifur Rahman Tamim · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.