D2RA: Watermark Attack vs. Adaptive Scheduling

• D2RA is an ambiguous acronym representing two distinct systems: one that removes image watermarks via frequency-domain reconstruction and diffusion-based semantic refinement, and one that schedules multipath packets in dynamic 5G+ networks.
• The watermark attack (D²RA) employs a three-stage process—frequency reconstruction, diffusion refinement, and color correction—achieving high success rates while preserving perceptual quality.
• The adaptive scheduling system (DARA/D2RA) uses Transformer-based short-horizon forecasting combined with a Deep Q-Network to dynamically allocate per-path rates, reducing delays in volatile wireless environments.

D2RA is an ambiguous acronym in recent arXiv literature. It denotes two unrelated technical systems: D²RA, “Dual Domain Regeneration Attack,” a training-free, single-image attack on modern image watermarking schemes that projects a watermarked image onto natural-image priors in complementary frequency and semantic domains (Meshram et al., 8 Oct 2025); and DARA, “Deep Adaptive Rate Allocation,” often written D2RA, a predictive multipath packet scheduler for heterogeneous 5G+ wireless networks that combines Transformer-based path-state forecasting with a Deep Q-Network (DQN) for per-path congestion-window allocation (Maglione et al., 21 Mar 2026). The shared acronym is therefore nominal rather than conceptual. One system belongs to generative-media provenance and watermark robustness, while the other addresses multi-access transport scheduling under high mobility.

1. Acronym scope and disambiguation

The two uses of D2RA are distinct in objective, threat model, and technical substrate.

Term	Expansion	Domain and core mechanism
D²RA	Dual Domain Regeneration Attack	Single-image, model-agnostic watermark removal via frequency-domain reconstruction, diffusion-based semantic refinement, and color correction
DARA / D2RA	Deep Adaptive Rate Allocation	Predictive multipath scheduling via Transformer forecasts of $\text{CWND}$ and $\text{SRTT}$, followed by DQN selection of per-path $\phi_p$ fractions

D²RA targets watermark detectors for generated images, including semantic or latent watermarking schemes such as Tree-Ring and ZoDiac, as well as classical pixel- and frequency-domain schemes (Meshram et al., 8 Oct 2025). DARA targets multi-access 5G+ wireless systems, especially vehicular environments in which reactive schedulers suffer from observation–reaction lag because link conditions fluctuate faster than transport feedback loops can respond (Maglione et al., 21 Mar 2026).

A plausible implication is that references to “D2RA” require immediate contextual disambiguation in bibliographic databases, surveys, and systems discussions.

2. D²RA: attack model and conceptual basis

D²RA in the watermarking literature is formulated as a training-free, single-image attack that removes or weakens image watermarks without access to the watermarking algorithm, detector, key, generator, or auxiliary watermarked datasets (Meshram et al., 8 Oct 2025). The setting is explicitly one image at a time, model-agnostic, training-free at attack time, and constrained by perceptual and semantic fidelity. The attack operates in a no-box, exemplar-free regime.

The motivating observation is that watermarking, including semantic watermarking, necessarily perturbs natural image statistics in some representation. Classical schemes such as StegaStamp, RivaGAN, DwtDct, and DwtDctSvd embed signals directly in pixel values or low-dimensional frequency coefficients. Newer semantic schemes such as Tree-Ring, ZoDiac, FreqMark, and SSL latent watermarking embed signals in latent or high-dimensional frequency spaces during generation so that the watermark correlates with global semantics rather than local pixel noise. D²RA argues that both classes remain vulnerable because watermark signals still manifest as deviations from natural priors in one or more domains.

The paper’s central intuition is that a watermarked image is “off the manifold” of natural images in at least two complementary senses. In the frequency domain, watermark energy may appear as structured, narrow-band anomalies such as annular or mid-frequency spikes. In the semantic domain, diffusion-model priors may regard the watermarked image as slightly inconsistent with learned natural-image structure. D²RA therefore performs a sequential projection onto natural priors in both domains, followed by a lightweight global correction step. The paper formalizes the projection intuition as

$$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$

where $\mathcal{M}$ is the natural-image manifold characterized by approximate $1/f^\alpha$ spectral decay, with $\alpha \approx 1$.

This framing is important because it recasts watermark removal as manifold projection rather than watermark-specific inversion. That interpretation helps explain why the attack is watermark-agnostic and why it can generalize across pixel, frequency, and latent watermarking schemes.

3. D²RA methodology, implementation, and empirical results

The D²RA pipeline has three stages (Meshram et al., 8 Oct 2025). Given a watermarked image $x_w$, it first performs frequency-domain reconstruction with blockwise $8\times 8$ DCT, a trained frequency-domain UNet, and inverse DCT:

$$X_w = \text{DCT}(x_w),\qquad X_{\text{rec}} = f_{\text{freq}}(X_w),\qquad \tilde{x}_{\text{freq}} = \text{IDCT}(X_{\text{rec}}).$$

The offline-trained UNet $\text{SRTT}$0 is learned on 20k clean images, specifically 10k MS-COCO 2017 images and 10k Stable Diffusion Prompts images. Synthetic corruption is produced by adding Gaussian noise to DCT coefficients in band ranges $\text{SRTT}$1, $\text{SRTT}$2, and $\text{SRTT}$3 over index sums $\text{SRTT}$4, with noise standard deviation sampled from $\text{SRTT}$5. A learnable frequency mask is introduced as

$\text{SRTT}$6

and the UNet is trained with an $\text{SRTT}$7 reconstruction loss:

$\text{SRTT}$8

The second stage is semantic refinement via diffusion:

$\text{SRTT}$9

where $\phi_p$0 is a pretrained img2img model, either Stable Diffusion v2 or SDXL, used in a single forward pass with no per-image optimization or prompt engineering. The third stage is perceptual color correction, implemented as channel-wise mean-variance matching between the original $\phi_p$1 and the diffusion-refined output:

$\phi_p$2

The implementation is explicitly forward-pass-based at inference time: DCT, one UNet pass, one diffusion pass, and color-statistics adjustment. The paper reports a runtime of “a couple of seconds” per image, and states that relative to optimization-based imprint-removal requiring approximately 125 steps per image, D²RA is two orders of magnitude cheaper.

Evaluation covers six watermarking schemes: DwtDct, DwtDctSvd, RivaGAN, SSL Watermarking, Tree-Ring, and ZoDiac. On both MS-COCO and Stable Diffusion Prompts evaluation sets, the reported Attack Success rates are 99.8% for DwtDct, 98.4–95.8% for DwtDctSvd, 100% for RivaGAN, 95.8–97% for SSL, 70.2% and 77.4% for Tree-Ring, and 92.2% and 94.4% for ZoDiac. For classical watermarks, image quality remains around PSNR $\phi_p$3 dB, LPIPS $\phi_p$4–0.53, SSIM $\phi_p$5–0.55, SSIM$\phi_p$6, CLIP $\phi_p$7–0.84, and CLIP$\phi_p$8. For semantic watermarks, the attack is more disruptive numerically—Tree-Ring PSNR is 14.56–16.12 dB and ZoDiac PSNR is approximately 16–17 dB—but SSIM$\phi_p$9 and CLIP$$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$0 remain high, indicating preservation of structure and semantics despite color shifts.

The ablation results are particularly diagnostic. Removing frequency reconstruction reduces Tree-Ring success to approximately 27%. Removing semantic refinement yields 23.8–30% success, with PSNR around 17 dB and SSIM around 0.67–0.69. Frequency reconstruction plus semantic refinement but without color correction reaches approximately 61–66% success, but PSNR drops to around 7–8 dB. Full D²RA attains the best balance, with approximately 70–77% success, PSNR around 15–16 dB, SSIM around 0.45–0.48, and CLIP around 0.69–0.73. The paper therefore identifies frequency projection as essential for removal, and semantic refinement plus color correction as essential for perceptual recovery.

4. DARA/D2RA: predictive multipath scheduling in volatile 5G+ networks

In wireless networking, DARA—often written D2RA—is a predictive scheduler for heterogeneous 5G+ multi-access environments, especially vehicular scenarios characterized by frequent handovers, rapid SINR and bandwidth fluctuations, and highly volatile RTT and queueing (Maglione et al., 21 Mar 2026). The motivating systems context is 3GPP ATSSS, where traffic may be steered or split across several access networks. Under these conditions, conventional multipath schedulers that react to current RTT, CWND, or loss exhibit an observation–reaction lag: conditions change at time $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$1, but the scheduler reacts only after one or more RTTs.

The design goal is not merely path selection, but dynamic control over how much of each path’s available sending capacity should be exposed to the packet scheduler. DARA therefore introduces per-path congestion-window utilisation fractions $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$2, selected every 100 ms by a DQN informed by a Transformer forecaster. This differs from path-only schedulers because it provides fine-grained rate control rather than a discrete choice of “best path.”

The overall framework has two modules. The offline module is a Transformer-based predictor trained on congestion-control telemetry; it forecasts per-path $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$3 and $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$4 at 100, 200, 300, 400, and 500 ms horizons. The online module is a DQN scheduler running in userspace alongside MP-DCCP. Every 100 ms it collects current per-path metrics, predicted trends, previous actions, and binary congestion flags, forms a state vector, performs inference in approximately 3 ms, and emits new $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$5 values. The kernel-level scheduler then uses those fractions at per-packet granularity.

The action space is discrete:

$$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$6

For each path $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$7,

$$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$8

For $$\hat x = \arg\min_{z \in \mathcal{M}} \|x_w - z\|_2^2,$$9 paths, the joint action space has $\mathcal{M}$0 actions. Importantly, the paper states that DARA does not enforce $\mathcal{M}$1; the $\mathcal{M}$2 are independent rate-limiters rather than split ratios.

The state is 18-dimensional for two paths, or $\mathcal{M}$3 dimensions in general. It contains current CWND $\mathcal{M}$4, current SRTT $\mathcal{M}$5, predicted relative CWND and RTT changes at mid and far horizons, the previous action $\mathcal{M}$6, and binary congestion flags

$\mathcal{M}$7

This state couples present conditions with short-horizon forecasts, which is the mechanism by which DARA aims to remove observation–reaction lag at burst timescales of 100–700 ms.

5. DARA learning formulation, forecasting stack, and evaluation

DARA uses a Deep Q-Network to learn a policy over the discrete action space (Maglione et al., 21 Mar 2026). The Bellman target is

$\mathcal{M}$8

with discount $\mathcal{M}$9, and the loss over a mini-batch $1/f^\alpha$0 is

$1/f^\alpha$1

Soft target-network updates use

$1/f^\alpha$2

with $1/f^\alpha$3. The deployed DQN takes the 18-dimensional state, uses two fully connected hidden layers with 256 units each, and outputs 25 Q-values for the two-path action space. Training uses a replay buffer of capacity 15,000, batch size 128, and $1/f^\alpha$4-greedy exploration with $1/f^\alpha$5, $1/f^\alpha$6, and decay over 900 steps.

The reward is a six-component normalised objective combining throughput, delay, preemptive adaptation, stability, quality sustainability, and idleness prevention:

$1/f^\alpha$7

The components are defined explicitly as relative predicted CWND gain, relative predicted RTT reduction, anticipatory alignment between forecasted CWND direction and $1/f^\alpha$8 adjustments, an $1/f^\alpha$9-style penalty on changes in $\alpha \approx 1$0, a bitrate-like CWND/RTT proxy, and a penalty for setting all paths to the minimum $\alpha \approx 1$1. The final weights are $\alpha \approx 1$2, $\alpha \approx 1$3, $\alpha \approx 1$4, $\alpha \approx 1$5, $\alpha \approx 1$6, and $\alpha \approx 1$7. The paper interprets these as a weight-mediated conflict resolution mechanism, for example prioritising throughput over stability and throughput over delay except under sufficiently adverse forecasts.

The forecasting module is a 3-layer Transformer trained on 30,243,085 samples, approximately 3.7 GB of telemetry from YouTube streaming over multipath tunnels. The per-path input features are CWND, available CWND fraction, bytes in flight, SRTT, subflow queue depth, meta queue depth, lost packets, and delivered packets. The model operates on 8 time steps representing 100 ms bins, thus 800 ms of history, and predicts CWND and SRTT at five horizons from 100 to 500 ms. The deployed architecture uses 5 attention heads, feedforward dimension 360, GELU activation, LayerNorm with residual connections, and dropout rates of 10%, 10%, and 15% across layers. The paper reports that a 3-layer Transformer achieves NRMSE 0.0009 with approximately 305k parameters and 1.8 ms inference, outperforming a linear model, LSTM, and MLP in prediction accuracy.

The ablation evidence indicates that predictive state information is critical. A no-Transformer variant achieves mean reward 14.7 and preemptive rate 0%, whereas full DARA reaches mean reward 157.9 and preemptive rate 62.5%. A “Ground-Truth DQN” using perfect future values yields reward 116.9 and preemptive rate 73.1%. The paper reports Welch’s $\alpha \approx 1$8-test and Mann-Whitney $\alpha \approx 1$9 results with $x_w$0, and bootstrap 95% confidence intervals for reward differences that exclude zero.

Experimental evaluation uses a Mininet-based MP-DCCP testbed, vehicular Mahi-Mahi traces, and three traffic scenarios: 150 MB file transfers, YouTube streaming with periodic seeks, and live HLS with an approximately 0.5 s buffer. In a controlled asymmetric burst scenario, Path 1 provides 700 ms bursts at 10 Mbps every 2.5 s with a 0.2 Mbps baseline between bursts, while Path 2 is stable at 1.8 Mbps. The combined capacity thus fluctuates from 2 Mbps to 11.8 Mbps. Under this setting, DARA achieves the highest throughput across transfer types, the lowest mean and median delays among multipath schedulers, and no periodic delay spikes at burst–trough transitions. For live streaming under the same burst regime, it achieves significant APR gains and approximately 25% rebuffering reduction, while state-of-the-art schedulers exhibit near-continuous stalling.

Across five real vehicular traces, DARA achieves the largest median throughput and tightest interquartile range on moderate-volatility traces for FTP/TCP, though performance degrades on an extreme-volatility UMTS trace while remaining above the single-path baseline. For QUIC, gains are smaller because of nested congestion control, but DARA still attains the highest throughput on some traces. For YouTube streaming, it achieves the highest median resolution across traces, along with higher rebuffering index than CPF, higher quality-switch rate, and significantly reduced initial startup delay. For live streaming, the paper reports greatly reduced initial delay and less severe rebuffering under tight buffers.

6. Limitations, misconceptions, and broader significance

A recurrent misconception is that D2RA refers to a single cross-domain framework. The literature represented here instead shows an acronym collision: one D²RA is an attack on watermarking systems, while the other DARA/D2RA is a proactive scheduler for multipath wireless transport. The overlap is purely orthographic.

The two systems also illuminate different kinds of robustness failure. In D²RA, the central result is that even semantic or latent watermarking schemes advertised as robust to naive regeneration remain vulnerable when an attacker combines frequency-domain projection with diffusion-based semantic refinement. The paper therefore argues that robustness claims based only on resistance to small spatial edits or simple regenerations are over-optimistic (Meshram et al., 8 Oct 2025). Suggested defensive directions include embedding signals across multiple spectral bands and semantic layers, combining spatial, spectral, and semantic watermarking, and using cryptographic authentication rather than relying solely on statistical watermarks.

In DARA, the central result is that reactive schedulers underperform in highly volatile multi-access settings because they respond too late to sub-second path changes. DARA’s predictive control loop suggests that transport-layer scheduling can benefit from explicit short-horizon forecasting and anticipatory rate shaping rather than instantaneous metric heuristics (Maglione et al., 21 Mar 2026). The paper identifies practical assumptions and limits, including the need for per-path telemetry, approximately 3 ms inference overhead per 100 ms cycle, limited testbed scale, and evaluation focused on a small number of paths and traffic classes. Future directions include better reward shaping, multi-agent RL, deployment in ATSSS-HL or NWDAF-like infrastructures, online or transfer learning, and support for additional traffic types.

Taken together, the two D2RA usages illustrate a broader methodological pattern in contemporary systems research: both replace narrowly reactive mechanisms with prior-informed or forecast-informed projections. In the watermarking case, the projection is onto natural-image priors in spectral and semantic space. In the networking case, the projection is onto predicted path-state evolution via Transformer forecasts and DQN-mediated CWND allocation. This suggests a shared meta-theme—anticipatory control through learned priors—even though the application domains, mathematical objects, and threat models are entirely different.