Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework

Abstract: Digital image watermarking has advanced rapidly for copyright protection of generative AI, yet the comparatively limited progress in watermark attack techniques has broken the attack-defense balance and hindered further advances in the field. In this paper, we propose FMDiffWA, a frequency-domain modulated diffusion framework for watermark attacks. Specifically, we introduce a frequency-domain watermark modulation (FWM) module and incorporate it into the sampling stages both the forward and reverse diffusion processes. This mechanism enables selective modulation of watermark-related frequency components, thereby allowing FMDiffWA to effectively neutralize the invisible watermark signals while preserving the perceptual quality of the attacked watermarked images. To achieve a better trade-off between attack efficacy and visual fidelity, we reformulate the training strategy of conventional diffusion models by augmenting the canonical noise estimation objective with an auxiliary refinement constraint. Comprehensive experiments demonstrate that FMDiffWA achieves superior visual fidelity compared to existing watermark attacks, while exhibiting strong generalization across diverse watermarking schemes.

• The paper presents FMDiffWA, a modulated diffusion attack framework integrating frequency-domain watermark modulation with a two-stage optimization process for improved removal efficacy.
• The method employs a conditional patchwise diffusion model with Fourier-based modulation to achieve high watermark removal rates and strong image quality preservation (PSNR >40 dB).
• Extensive experiments on CelebA and ImageNet demonstrate FMDiffWA's superior generalization over various watermarking algorithms, setting a new benchmark in anti-watermark methods.

Frequency-Domain Modulated Diffusion Attacks on Image Watermarking

Introduction

The paper "Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework" (2604.22220) introduces FMDiffWA, a novel watermark attack framework that leverages frequency-domain modulation within a conditional diffusion model. The work addresses the persistent gap between advancements in watermark embedding algorithms and the relatively stagnant progress in watermark removal techniques, especially those robust to a wide variety of watermarking methods and capable of maintaining high visual fidelity. By integrating frequency-domain manipulation within the generative process and employing a two-stage optimization strategy, FMDiffWA achieves a consistently superior balance between the efficacy of watermark removal and perceptual image quality.

Figure 1: Overview of the proposed FMDiffWA watermark attack framework pipeline, including watermark embedding, FMDiffWA-based attack, and watermark extraction.

Methodological Framework

Frequency-Domain Modulated Diffusion Model

FMDiffWA extends the classical denoising diffusion probabilistic model (DDPM) by infusing frequency-domain manipulations into both the forward and reverse diffusion dynamics. The core innovation is the Frequency-domain Watermark Modulation (FWM) module, which applies Fourier transforms to decompose image patches into magnitude and phase components. Modulation in the Fourier domain allows selective suppression of watermark-induced frequency components. During each sampling step in the generative reverse process, FWM fuses magnitude and phase information from clean (original) and attacked image representations, aligned in the Fourier domain and guided by a low-frequency mask $\Phi_\beta$ parameterized by $\beta$. This enables FMDiffWA to target both spectrum statistics (magnitude, generally low-frequency and watermark-rich) and geometric/structural aspects (phase, high-frequency, encoding textures) of watermark signals.

Figure 2: FMDiffWA’s FWM module facilitates both training and sampling, allowing adaptive frequency mixing to suppress watermark traces while conserving image semantics.

Conditional Patchwise Diffusion

FMDiffWA utilizes a patch-based processing scheme to support high-resolution images efficiently. During each batch, images are randomly partitioned into overlapping patches, which are independently processed through the diffusion model and then fused via averaging over the overlapped pixels. This strategy enhances generalization and controllability across resolutions and image types.

Two-Stage Optimization

A key element is the two-stage training protocol:

• Stage 1: The network is optimized using a classic noise estimation objective, allowing stable convergence in denoising and aligning the denoising process with the true data distribution.
• Stage 2: An auxiliary refinement constraint is added, where the outputs from preliminary sampling are further supervised with corresponding ground-truth watermark-free images. Losses include an $\mathcal{L}_1$ term for pixel-level fidelity and a multi-scale SSIM term for structural similarity, significantly improving the clarity and realism of reconstructed images.

Experimental Evaluation

Dataset, Baselines, and Setup

The authors evaluate FMDiffWA on CelebA and ImageNet datasets, employing four representative watermarking algorithms (spatial, frequency, orthogonal-moment, and deep learning–based). The comparisons span against both traditional (e.g., Additive/Multiplicative noise, JPEG, filtering) and modern deep learning–based attack baselines (RD-IWAN, DiffWA, HIWANet).

Watermark Removal Efficacy

FMDiffWA achieves the highest watermark removal rates, as assessed by bit error rate (BER) during watermark extraction post-attack. Notably, even on watermarks embedded by the highly robust orthogonal moment–based and deep learning–based methods, FMDiffWA renders the embedded information non-recoverable (high BER), outperforming all other approaches. The approach maintains this efficacy across both test datasets.

Figure 3: Visualization of extracted watermarks after various attacks (Speckle noise, HIWANet, FMDiffWA), alongside corresponding BER metrics on CelebA and ImageNet.

Figure 4: Visual inspection of attacked images: FMDiffWA not only destroys watermark recoverability but preserves perceptual image similarity.

Visual Quality Preservation

A critical challenge in watermark attacks is maintaining the original image’s perceptual quality. FMDiffWA demonstrates consistent superiority in PSNR (exceeding 40 dB after attack), with notably smaller perceptual deviations compared to spatial-noise-based and CNN-based attacks. Images processed by FMDiffWA visually align with their watermark-free sources, as corroborated by qualitative assessments.

Generalization to Unseen Schemes

Robustness to previously unseen watermarking algorithms is a key desideratum for practical attack frameworks. FMDiffWA generalizes effectively, consistently destroying embedded information across four additional watermarking methods not encountered during training.

Figure 5: FMDiffWA outperforms speckle noise and HIWANet attackers when generalizing to unseen watermark embedding protocols.

Ablation Analyses

Ablation studies confirm the necessity of both the FWM module and two-stage training. Removing FWM drastically reduces watermark removal, while omitting refinement optimization results in lower image quality. Further inquiry into key sampling/spectral parameters reveals that optimal settings (e.g., $\beta=0.6$, $S=10$) ensure the strongest trade-off for real-world deployment.

Figure 6: Performance sensitivity of FMDiffWA to perturbation mask scale ($\beta$) and sampling iterations ($S$), highlighting the optimal operational regime.

Theoretical and Practical Implications

FMDiffWA reframes the watermark attack paradigm by combining frequency-domain priors and generative probabilistic modeling. This enables unprecedented performance in attacking a wide variety of watermarking algorithms while controlling perceptual quality, which poses a significant challenge for watermarking algorithm designers. The proposed framework exposes the limitations of spatial-domain attacks and sets a new benchmark for attack robustness and imperceptibility.

Practically, these findings mandate a reconsideration of current and future watermark embedding methodologies, advocating for the incorporation of defenses robust to frequency-modulated, generative attacks. Theoretically, FMDiffWA’s architecture introduces opportunities for refined frequency-aware priors in diffusion models and targets new research on the interplay between generative modeling and information hiding/copyright enforcement.

Looking forward, relevant avenues include scaling FMDiffWA to more complex or composite watermarks, real-time high-resolution attacks, and extending frequency-domain priors to other inverse tasks. Moreover, adversarial co-evolution of embedding and removal networks may catalyze advances in both watermarking and anti-watermarking strategies.

Conclusion

FMDiffWA establishes a new state-of-the-art in digital watermark attack by integrating a frequency-domain watermark modulation mechanism with conditional diffusion processes and a staged training regime. It achieves both complete destruction of embedded watermarks (demonstrated by consistently high BER) and superior post-attack perceptual quality (high PSNR, minimal visual distortion) across a wide spectrum of watermarking algorithms, including those previously considered robust. The implications of FMDiffWA are significant for both watermarking and anti-watermarking communities, suggesting that future watermarking must be designed with explicit countermeasures against frequency-aware generative attackers.