Watermark Forging: Attacks & Defenses

• Watermark Forging is the adversarial creation of content with fake watermarks that mimic authentic marks while preserving visual and semantic integrity.
• It employs methods like latent alignment, regenerative forgery, and GAN-based techniques across images, datasets, and language models to produce false ownership proofs.
• Understanding watermark forging informs the development of robust defenses such as cryptographic binding and dynamic detection metrics to mitigate false attribution.

Searching arXiv for the cited watermark-forging papers to ground the article in current literature. Searching arXiv for "Towards Robust Content Watermarking Against Removal and Forgery Attacks" and related watermark forging papers. Tool call: arxiv_search({"query":"(Zhu et al., 8 Apr 2026) OR \"Towards Robust Content Watermarking Against Removal and Forgery Attacks\"","max_results":5,"sort_by":"submittedDate"}) Searching arXiv for the main paper and several related works on watermark forging. Watermark forging denotes the adversarial production of content that is recognized as legitimately watermarked even though it was not produced by the protected generator, owner, or model. In text-to-image diffusion models, the canonical formulation takes a benign image $I^b$ and seeks a small perturbation $\delta$ such that $\hat I = I^b + \delta$ is accepted by the detector, $D(\hat I)=1$, while preserving perceptual and semantic fidelity (Zhu et al., 8 Apr 2026). Closely related formulations appear in backdoor-based dataset protection, where a forged trigger $t_{fw}$ yields statistically equivalent ownership tests to the original trigger $t_{op}$ (Li et al., 2024), in post-hoc image watermarking, where a stolen watermark is transferred to arbitrary images (Dong et al., 28 Mar 2025), and in language-model watermarking, where forged prompt–response associations motivate integrity-verifiable schemes (Bai, 2024). Across these settings, the central risk is false attribution: a detector or verifier accepts provenance, ownership, or authorship claims that are not genuine.

1. Definitions, objectives, and attacker models

In diffusion watermarking, forgery is usually formalized as detector spoofing under a perceptual budget. A standard objective minimizes the distance between the surrogate forward diffusion of a perturbed benign latent and the estimated watermark latent of a reference image,

$$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$

where $z_0^b=\mathcal{E}(I^b)$, $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$, and the adversary finally decodes $\hat I=\mathcal{D}(z_0^b+\delta)$ (Zhu et al., 8 Apr 2026). The stated objective is twofold: forgery, meaning $\delta$0, and preservation, meaning high perceptual and semantic fidelity to the original benign image.

The capability assumptions vary by modality but converge on a common asymmetry: the attacker lacks the true secret but exploits transferable structure. In the diffusion setting, the attacker may have no access to target model weights or the exact watermark algorithm, may possess one or multiple reference watermarked images, may use surrogate diffusion or VAE models to compute gradients, and may estimate latent inversions via DDIM-inversion or VAE encoders (Zhu et al., 8 Apr 2026). Recent image attacks further tighten the setting to no-box or black-box variants in which only a single watermarked image is available, with no access to the encoder, decoder, or watermark/unwatermarked pairs (Ba et al., 10 Feb 2025, Jain et al., 27 Apr 2025).

Outside image generation, the same adversarial logic appears in different verification pipelines. In backdoor-based dataset ownership, the accused party may recover the original trigger and target class and then present a forged trigger whose model outputs are statistically indistinguishable from the owner’s evidence (Li et al., 2024). In publicly verifiable LLM watermarking, the adversary may have full white-box access to the public detection network and unlimited black-box query access to it, while lacking the secret generation network (Liu et al., 2023). In weight-based neural network watermarking, the adversary may have full access to the stolen model’s weights and know the embedding algorithm except the secret key, then attempt forging or overwriting under fine-tuning and pruning constraints (Yao et al., 15 Jul 2025).

2. Attack constructions and algorithmic families

The literature now contains several distinct families of watermark forgery attacks.

Attack family	Core mechanism	Representative sources
Latent alignment	Move a clean or cover image toward a watermarked latent region	(Zhu et al., 8 Apr 2026, Jain et al., 27 Apr 2025)
Regenerative forgery	Extract a watermark latent once, then regenerate arbitrary covers	(Zhu et al., 6 Jun 2025, Dong et al., 28 Mar 2025)
Feature-leakage transfer	Isolate watermark-bearing channels or artifact directions from one image	(Ba et al., 10 Feb 2025, Souček et al., 23 Oct 2025)
GAN or distillation forgery	Learn a forged trigger or forged watermarked image distribution from examples	(Li et al., 2024, Li et al., 2023, Wang et al., 2021)

Gradient-based latent attacks are the most direct. “Imp-Forgery” aligns a benign latent with a reference watermarked latent under an $\delta$1 perturbation budget (Zhu et al., 8 Apr 2026). A related single-image attack on latent-noise diffusion watermarks argues that there is a many-to-one mapping between images and initial noises, and therefore a nontrivial region $\delta$2 in clean-image latent space whose inversion recovers the same watermark key. The attacker solves

$\delta$3

optionally with $\delta$4, using only a proxy encoder and one watermarked example (Jain et al., 27 Apr 2025).

A second family avoids explicit optimization at attack time by exploiting diffusion inversion and regeneration. PnP (“Plug-and-Plant”) first estimates a watermark latent $\delta$5 from one watermarked image using a public proxy diffusion model and DDIM inversion, then uses a regenerative diffusion model conditioned on visual and textual priors from a cover image to generate a forged image $\delta$6 (Zhu et al., 6 Jun 2025). WMCopier, called “DiffForge” in its description, instead trains an unconditional diffusion model on scraped watermarked images, performs shallow DDIM inversion on a clean target image, and chooses the deepest inversion step whose PSNR remains above a lower bound $\delta$7, thereby balancing watermark strength and fidelity (Dong et al., 28 Mar 2025).

A third family treats robust watermarking as a source of exploitable leakage. DAPAO uses a DenseNet-121 feature extractor, clusters its channel activations, identifies the two smallest clusters as watermark-biased channels, and then performs a two-stage adversarial optimization: leakage extraction on the watermarked reference image and semantic transfer to the clean target image (Ba et al., 10 Feb 2025). A related one-shot attack trains a ConvNeXt V2-Tiny preference model $\delta$8 to rank clean images above procedurally artifacted images, extracts a watermark-like residual from a single watermarked image by maximizing $\delta$9, and forges by simple addition $\hat I = I^b + \delta$0 on a new image (Souček et al., 23 Oct 2025).

GAN- and distillation-based attacks dominate in older image watermarking and dataset watermarking literature. FW-Gen is a lightweight autoencoder $\hat I = I^b + \delta$1 trained with a benign-model distillation loss $\hat I = I^b + \delta$2 and a watermarked-model distillation loss $\hat I = I^b + \delta$3, combined as $\hat I = I^b + \delta$4, so that the forged trigger $\hat I = I^b + \delta$5 mimics the behavior of the original trigger $\hat I = I^b + \delta$6 under both a benign model and a watermarked model (Li et al., 2024). Warfare scrapes victim-watermarked images, removes the watermark approximately with a public diffusion mediator, and then trains a conditional GAN to re-impose the victim’s watermark onto arbitrary images (Li et al., 2023). “Watermark Faker” is an earlier conditional GAN approach that assumes paired original and watermarked images, uses U-Net plus domain-specific preprocessing such as Pixel-Expansion or blind DCT preprocessing, and learns to synthesize fake watermarked images that pass the victim extractor (Wang et al., 2021).

3. Evaluation protocols and empirical behavior

Forgery is evaluated differently across watermarking modalities, but the metrics consistently separate detector acceptance from perceptual quality. Diffusion watermarking studies commonly report ROC-AUC and True Positive Rate at $\hat I = I^b + \delta$7 False Positive Rate, with lower AUC and TPR under forgery indicating a stronger defense (Zhu et al., 8 Apr 2026). Semantic watermark studies additionally report bit accuracy, user attribution, or p-value distance after inversion into latent space (Zhu et al., 6 Jun 2025). Post-hoc image watermarking reports forged bit accuracy, false-positive rate, Success Rate, PSNR, and SSIM (Dong et al., 28 Mar 2025). Dataset watermarking relies on paired T-tests, Wilcoxon tests, and $\hat I = I^b + \delta$8 because the ownership claim is behavioral rather than reconstructive (Li et al., 2024).

Recent diffusion results show that forgery can be either highly effective or sharply reduced, depending on the defense. Under three forgery attacks—Imp-Forgery, Avg-Forgery, and VAE-Forgery—the ISTS defense reports detection AUC / TPR@1%FPR of $\hat I = I^b + \delta$9 on original images, $D(\hat I)=1$0 for Imp-Forgery, $D(\hat I)=1$1 for Avg-Forgery, and $D(\hat I)=1$2 for VAE-Forgery. The same study states that ISTS reduces Imp-Forgery AUC from .99 to .63 and Avg-Forgery from .62 to .47, demonstrating a $D(\hat I)=1$3–$D(\hat I)=1$4 drop in forging success (Zhu et al., 8 Apr 2026).

Other image-forging studies document the opposite outcome: near-perfect spoofing against current schemes. Across $D(\hat I)=1$5 model-data-watermark scenarios, PnP reports that watermark detectability and user attribution can reach $D(\hat I)=1$6, with PnP(CtrlRegen) matching or staying within $D(\hat I)=1$7 of Imprint in detectability and attribution while reducing per-image overhead from $D(\hat I)=1$8 s to $D(\hat I)=1$9 s–$t_{fw}$0 s (Zhu et al., 6 Jun 2025). WMCopier reports average PSNR $t_{fw}$1 dB, average forged bit accuracy $t_{fw}$2, and average FPR $t_{fw}$3 on open-source schemes; on Amazon Titan watermark API, it reports average PSNR $t_{fw}$4 dB, SR $t_{fw}$5, and average confidence $t_{fw}$6 (Dong et al., 28 Mar 2025). Warfare reports, on CIFAR-10 with an 8-bit watermark, forged Bit Acc $t_{fw}$7, FID $t_{fw}$8, PSNR $t_{fw}$9 dB, SSIM $t_{op}$0, and CLIP $t_{op}$1; on CelebA with a 32-bit watermark, forged Bit Acc $t_{op}$2, FID $t_{op}$3, PSNR $t_{op}$4, and SSIM $t_{op}$5 (Li et al., 2023).

Single-image leakage methods also report strong performance. DAPAO states a $t_{op}$6 success-rate gain in detection evasion and $t_{op}$7 improvement in forgery accuracy compared to state-of-the-art methods while maintaining visual fidelity (Ba et al., 10 Feb 2025). Its COCO forgery excerpt gives CopyAttack SR $t_{op}$8, Steganalysis $t_{op}$9, WmRobust $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$0, and DAPAO $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$1, with DAPAO at SSIM $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$2 and PSNR $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$3 dB (Ba et al., 10 Feb 2025). The one-shot preference-model attack likewise reports competitive forging from only one reference image: on CIN, MBRS, TrustMark, and VideoSeal, its Table 1 gives bit-accuracy $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$4, $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$5, $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$6, and $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$7, respectively, with PSNR $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$8 (Souček et al., 23 Oct 2025).

In dataset protection, the empirical claim is not that the trigger looks similar but that the verification result becomes indistinguishable. Li et al. report that, in every setting, the p-value and $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$9 obtained with the forged trigger $z_0^b=\mathcal{E}(I^b)$0 are virtually identical to those obtained with the original trigger $z_0^b=\mathcal{E}(I^b)$1, and in the CIFAR-10, ResNet, BadNets–Cross stealing scenario they give original $z_0^b=\mathcal{E}(I^b)$2, $z_0^b=\mathcal{E}(I^b)$3, versus forged $z_0^b=\mathcal{E}(I^b)$4, $z_0^b=\mathcal{E}(I^b)$5 (Li et al., 2024).

4. Defensive designs and formal unforgeability

One line of defense attempts to preserve detector-based watermarking while making the embedded signal instance-specific. ISTS does this by extracting CLIP features from a clean generation, assigning a cluster label through a small classifier, and mapping that label through a secret permutation $z_0^b=\mathcal{E}(I^b)$6 to an injection timestep $z_0^b=\mathcal{E}(I^b)$7 and a Fourier-domain offset $z_0^b=\mathcal{E}(I^b)$8. The watermark is then embedded as a circular ring pattern $z_0^b=\mathcal{E}(I^b)$9 inside a shifted mask $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$0, and detection recovers $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$1, inverts to the corresponding mid-step latent, and computes

$z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$2

with the two-sided score $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$3 (Zhu et al., 8 Apr 2026). The paper explicitly attributes robustness to the two-sided metric and dynamic keying rather than to adversarially trained detection.

A second line of defense shifts from detector acceptance to integrity verification. In LLMs, “Let Watermarks Speak” first introduces Dual Inverse-Transform Sampling, a single-bit scheme in which the marginal distribution of generated bits remains equal to the model distribution $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$4, then lifts it into a multi-bit construction where each watermark link encodes the hash of the prompt or the previous link. Detection parses watermark blocks, and Verify checks the hash-chain. The paper defines prefix-unforgeability and reports a forgery success rate against prompt-swapping of $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$5; under up to $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$6 random token edits, detection still succeeds $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$7 (Bai, 2024). UPV pursues the same goal by separating a secret generation network $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$8 from a public detection network $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$9 that shares only the token embedding $\hat I=\mathcal{D}(z_0^b+\delta)$0. Its reverse-training evaluation states that even $\hat I=\mathcal{D}(z_0^b+\delta)$1 random texts produce only a crude mimic with $\hat I=\mathcal{D}(z_0^b+\delta)$2, while the legitimate detector continues to operate at $\hat I=\mathcal{D}(z_0^b+\delta)$3 on genuine watermarked text (Liu et al., 2023).

A third line of defense introduces cryptographic or key-separation structure. NeuralMark hashes a secret key $\hat I=\mathcal{D}(z_0^b+\delta)$4 with SHAKE-256 to obtain $\hat I=\mathcal{D}(z_0^b+\delta)$5, uses $\hat I=\mathcal{D}(z_0^b+\delta)$6 as a repeated filter that selects which parameters carry the watermark, applies average pooling to the repeatedly filtered weights, and verifies by thresholding the bit-agreement rate $\hat I=\mathcal{D}(z_0^b+\delta)$7. For $\hat I=\mathcal{D}(z_0^b+\delta)$8 and $\hat I=\mathcal{D}(z_0^b+\delta)$9, the probability that a random counterfeit key achieves agreement above threshold is stated as $\delta$00; empirically, forging on ResNet-18 yields $\delta$01 and $\delta$02 bit agreement on CIFAR-10 and CIFAR-100, respectively, i.e. near chance, while baselines such as VanillaMark and VoteMark reach $\delta$03 (Yao et al., 15 Jul 2025). Multi-key watermarking offers a post-hoc black-box defense: the provider samples one of $\delta$04 keys at generation time and tests all $\delta$05 keys at detection time, returning “forgery” if multiple keys fire. The cited experiments report that increasing $\delta$06 from $\delta$07 to $\delta$08 reduces text spoofing roughly from $\delta$09–$\delta$10 to $\delta$11–$\delta$12, and reduces image spoofing to as low as $\delta$13 (Aremu et al., 10 Jul 2025).

A fourth line makes content dependence explicit and cryptographically verifiable. MetaSeal extracts a deterministic semantic bitstring $\delta$14, signs it with a digital signature $\delta$15, encodes $\delta$16 into a QR-like pattern $\delta$17, and embeds $\delta$18 with an invertible neural network $\delta$19. Verification succeeds only if $\delta$20 after extraction (Zhou et al., 13 Sep 2025). Its reported false-accept rate under Replay, Mixup, and PGD is $\delta$21, while verification accuracy under moderate benign transforms remains $\delta$22 for JPEG $\delta$23 and $\delta$24, $\delta$25 for Gaussian noise $\delta$26, and $\delta$27 for Gaussian blur $\delta$28 (Zhou et al., 13 Sep 2025).

5. Structural weaknesses, failure modes, and controversies

A recurring result is that robustness against ordinary distortions can create exploitable regularity. DAPAO formulates this as a robustness–stealthiness paradox: to survive JPEG compression, noise addition, or screen-shooting, an encoder must amplify or spatially spread watermark signals, thereby leaking watermark fingerprints into feature channels that a pre-trained extractor can isolate and manipulate (Ba et al., 10 Feb 2025). This does not merely weaken secrecy; it can simultaneously improve removal and forgery.

A second weakness is reliance on behavioral or detector-only verification. In the dataset setting, forged watermarks are reported to have the same statistical significance as original watermarks in copyright verification tests under various conditions and scenarios, leading to the conclusion that ownership verification results are insufficient to determine infringement (Li et al., 2024). The paper attributes this to behavioral equivalence and rebuttal symmetry: both parties can present a trigger and a response-distribution pair that passes the same judicial test (Li et al., 2024). MetaSeal makes the same criticism from the image side, stating that content-agnostic schemes allow replay attacks and mixup attacks, and that learned detectors can be fooled by adversarial perturbations such as PGD (Zhou et al., 13 Sep 2025).

A third controversy concerns semantic diffusion watermarks that are detected only through inversion of initial noise. Black-box attacks on Tree-Ring and Gaussian Shading show that unrelated models with different latent spaces and architectures can still be used for targeted watermark imprinting or re-generation, and that threshold tightening is ineffective because benign post-processing also pushes genuine watermarked images into the same low-confidence regime (Müller et al., 2024). The related PnP and WMCopier results suggest that once inversion and regeneration pipelines are publicly available, provenance claims based solely on detector output become much harder to defend (Zhu et al., 6 Jun 2025, Dong et al., 28 Mar 2025).

Current defenses also retain explicit limitations. ISTS states that worst-case forging robustness is still not perfect, with $\delta$29 against powerful VAE attacks, and that reliance on a secret key and on the security of the parameter selector creates a side-channel leakage risk if not carefully managed (Zhu et al., 8 Apr 2026). This suggests that instance specificity and stronger detection metrics improve resistance, but do not by themselves provide formal non-forgeability.

6. Research directions

The recent literature proposes several nonexclusive directions for strengthening watermark systems against forgery. For diffusion watermarking, the ISTS work lists increasing pattern space through larger $\delta$30 and more geometric transforms, integrating adversarial training of both watermark injection and detection in a minimax framework, and exploring cryptographically provable watermark schemes with formal security guarantees against adaptive adversaries (Zhu et al., 8 Apr 2026). PnP motivates latent randomization, key-based conditional watermarks, multi-layer watermarks that combine semantic-latent and pixel-space markings, joint forensic detection of improbable latent-space couplings, and adversarially robust watermark design against DDIM inversion and cross-model transfer (Zhu et al., 6 Jun 2025).

For dataset ownership, the proposed responses are multiple randomized trigger patterns with varying target classes, invisible or encrypted backdoor watermarks that evade data-level detectors, and verification mechanisms that go beyond simple statistical tests by requiring structural matching or embedding cryptographic proofs and keys inside the data (Li et al., 2024). For post-hoc image watermarking, suggested countermeasures include stronger content awareness in the decoder, adversarial training against stolen-watermark attacks, and challenge–response protocols embedding dynamic nonces unique to each image (Souček et al., 23 Oct 2025).

A broader trend is the migration from detector-centric robustness to content-dependent or cryptographically bound verification. MetaSeal binds attribution to semantic features through a digital signature (Zhou et al., 13 Sep 2025); the LLM hash-chain construction binds later text to earlier context (Bai, 2024); NeuralMark binds the watermark to an irreversible hashed filter over weights (Yao et al., 15 Jul 2025); and multi-key watermarking weakens averaging-style stealing attacks without changing the underlying black-box watermark algorithm (Aremu et al., 10 Jul 2025). Taken together, these proposals suggest that future progress is likely to depend less on making a fixed pattern harder to estimate and more on making attribution inseparable from keyed generation, semantic consistency, or cryptographic verification.