Watermark Forging: Attacks & Defenses

• Watermark Forging is the adversarial creation of content with fake watermarks that mimic authentic marks while preserving visual and semantic integrity.
• It employs methods like latent alignment, regenerative forgery, and GAN-based techniques across images, datasets, and language models to produce false ownership proofs.
• Understanding watermark forging informs the development of robust defenses such as cryptographic binding and dynamic detection metrics to mitigate false attribution.

Searching arXiv for the cited watermark-forging papers to ground the article in current literature. Searching arXiv for "^^^^^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^^^^^" and related watermark forging papers. Tool call: arxiv_search({"^^^^^^^^3query3 OR \3^^^^^^^^" Robust Content Watermarking Against Removal and Forgery Attacks3^^^^^^^^\"","max_results":5,"sort_by":"submittedDate"}) Searching arXiv for the main paper and several related works on watermark forging. Watermark forging denotes the adversarial production of content that is recognized as legitimately watermarked even though it was not produced by the protected generator, owner, or model. In text-to-image diffusion models, the canonical formulation takes a benign image PRESERVED_PLACEHOLDER_^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ and seeks a small perturbation PRESERVED_PLACEHOLDER_^^^^3query3^^^^ such that PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^ is accepted by the detector, $D(\hat I)=1$, while preserving perceptual and semantic fidelity (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). Closely related formulations appear in backdoor-based dataset protection, where a forged trigger $t_{fw}$ yields statistically equivalent ownership tests to the original trigger $t_{op}$ (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&), in post-hoc image watermarking, where a stolen watermark is transferred to arbitrary images (Dong et al., 28 Mar 2025), and in language-model watermarking, where forged prompt–response associations motivate integrity-verifiable schemes (Bai, 2024). Across these settings, the central risk is false attribution: a detector or verifier accepts provenance, ownership, or authorship claims that are not genuine.

^^^^3query3^^^^. Definitions, objectives, and attacker models

In diffusion watermarking, forgery is usually formalized as detector spoofing under a perceptual budget. A standard objective minimizes the distance between the surrogate forward diffusion of a perturbed benign latent and the estimated watermark latent of a reference image,

$$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$

where $z_0^b=\mathcal{E}(I^b)$, $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$, and the adversary finally decodes $\hat I=\mathcal{D}(z_0^b+\delta)$ (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). The stated objective is twofold: forgery, meaning PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^, and preservation, meaning high perceptual and semantic fidelity to the original benign image.

The capability assumptions vary by modality but converge on a common asymmetry: the attacker lacks the true secret but exploits transferable structure. In the diffusion setting, the attacker may have no access to target model weights or the exact watermark algorithm, may possess one or multiple reference watermarked images, may use surrogate diffusion or VAE models to compute gradients, and may estimate latent inversions via DDIM-inversion or VAE encoders (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). Recent image attacks further tighten the setting to no-box or black-box variants in which only a single watermarked image is available, with no access to the encoder, decoder, or watermark/unwatermarked pairs (Ba et al., 10 Feb 2025, Jain et al., 27 Apr 2025).

Outside image generation, the same adversarial logic appears in different verification pipelines. In backdoor-based dataset ownership, the accused party may recover the original trigger and target class and then present a forged trigger whose model outputs are statistically indistinguishable from the owner’s evidence (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&). In publicly verifiable LLM watermarking, the adversary may have full white-box access to the public detection network and unlimited black-box ^^^^^^^^3query3^^^^^^^^ access to it, while lacking the secret generation network (&&&^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). In weight-based neural network watermarking, the adversary may have full access to the stolen model’s weights and know the embedding algorithm except the secret key, then attempt forging or overwriting under fine-tuning and pruning constraints (&&&^^^^3query3query3^^^^&&&).

^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^. Attack constructions and algorithmic families

The literature now contains several distinct families of watermark forgery attacks.

Attack family	Core mechanism	Representative sources
Latent alignment	Move a clean or cover image toward a watermarked latent region	(&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&, Jain et al., 27 Apr 2025)
Regenerative forgery	Extract a watermark latent once, then regenerate arbitrary covers	(&&&^^^^3query3^^^^4&&&, Dong et al., 28 Mar 2025)
Feature-leakage transfer	Isolate watermark-bearing channels or artifact directions from one image	(Ba et al., 10 Feb 2025, &&&^^^^3query3^^^^7&&&)
GAN or distillation forgery	Learn a forged trigger or forged watermarked image distribution from examples	(&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&, &&&^^^^3query3^^^^9&&&, &&&^^^^3(Zhu et al., 8 Apr 2026) OR \3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&)

Gradient-based latent attacks are the most direct. “Imp-Forgery” aligns a benign latent with a reference watermarked latent under an PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^ perturbation budget (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). A related single-image attack on latent-noise diffusion watermarks argues that there is a many-to-one mapping between images and initial noises, and therefore a nontrivial region PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^ in clean-image latent space whose inversion recovers the same watermark key. The attacker solves

PRESERVED_PLACEHOLDER_^^^^3query33^^^^

optionally with PRESERVED_PLACEHOLDER_^^^^3query3^^^^4, using only a proxy encoder and one watermarked example (Jain et al., 27 Apr 2025).

A second family avoids explicit optimization at attack time by exploiting diffusion inversion and regeneration. PnP (“Plug-and-Plant”) first estimates a watermark latent PRESERVED_PLACEHOLDER_^^^^3query3^^^^5 from one watermarked image using a public proxy diffusion model and DDIM inversion, then uses a regenerative diffusion model conditioned on visual and textual priors from a cover image to generate a forged image PRESERVED_PLACEHOLDER_^^^^3query3^^^^6 (&&&^^^^3query3^^^^4&&&). WMCopier, called “DiffForge” in its description, instead trains an unconditional diffusion model on scraped watermarked images, performs shallow DDIM inversion on a clean target image, and chooses the deepest inversion step whose PSNR remains above a lower bound PRESERVED_PLACEHOLDER_^^^^3query3^^^^7, thereby balancing watermark strength and fidelity (Dong et al., 28 Mar 2025).

A third family treats robust watermarking as a source of exploitable leakage. DAPAO uses a DenseNet-^^^^3query3(Zhu et al., 8 Apr 2026) OR \3query3^^^^ feature extractor, clusters its channel activations, identifies the two smallest clusters as watermark-biased channels, and then performs a two-stage adversarial optimization: leakage extraction on the watermarked reference image and semantic transfer to the clean target image (Ba et al., 10 Feb 2025). A related one-shot attack trains a ConvNeXt V^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^-Tiny preference model PRESERVED_PLACEHOLDER_^^^^3query3^^^^8 to rank clean images above procedurally artifacted images, extracts a watermark-like residual from a single watermarked image by maximizing PRESERVED_PLACEHOLDER_^^^^3query3^^^^9, and forges by simple addition PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ on a new image (&&&^^^^3query3^^^^7&&&).

GAN- and distillation-based attacks dominate in older image watermarking and dataset watermarking literature. FW-Gen is a lightweight autoencoder PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3query3^^^^ trained with a benign-model distillation loss PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3(Zhu et al., 8 Apr 2026) OR \3^^^^ and a watermarked-model distillation loss PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \33^^^^, combined as PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^4, so that the forged trigger PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^5 mimics the behavior of the original trigger PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^6 under both a benign model and a watermarked model (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&). Warfare scrapes victim-watermarked images, removes the watermark approximately with a public diffusion mediator, and then trains a conditional GAN to re-impose the victim’s watermark onto arbitrary images (&&&^^^^3query3^^^^9&&&). “Watermark Faker” is an earlier conditional GAN approach that assumes paired original and watermarked images, uses U-Net plus domain-specific preprocessing such as Pixel-Expansion or blind DCT preprocessing, and learns to synthesize fake watermarked images that pass the victim extractor (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&).

3. Evaluation protocols and empirical behavior

Forgery is evaluated differently across watermarking modalities, but the metrics consistently separate detector acceptance from perceptual quality. Diffusion watermarking studies commonly report ROC-AUC and True Positive Rate at PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^7 False Positive Rate, with lower AUC and TPR under forgery indicating a stronger defense (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). Semantic watermark studies additionally report bit accuracy, user attribution, or p-value distance after inversion into latent space (&&&^^^^3query3^^^^4&&&). Post-hoc image watermarking reports forged bit accuracy, false-positive rate, Success Rate, PSNR, and SSIM (Dong et al., 28 Mar 2025). Dataset watermarking relies on paired T-tests, Wilcoxon tests, and PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^8 because the ownership claim is behavioral rather than reconstructive (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&).

Recent diffusion results show that forgery can be either highly effective or sharply reduced, depending on the defense. Under three forgery attacks—Imp-Forgery, Avg-Forgery, and VAE-Forgery—the ISTS defense reports detection AUC / TPR@^^^^3query3^^^^%FPR of PRESERVED_PLACEHOLDER_^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^9 on original images, $D(\hat I)=1$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ for Imp-Forgery, $D(\hat I)=1$^^^^3query3^^^^ for Avg-Forgery, and $D(\hat I)=1$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^ for VAE-Forgery. The same study states that ISTS reduces Imp-Forgery AUC from .99 to .63 and Avg-Forgery from .6^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^ to .47, demonstrating a $D(\hat I)=1$3–$D(\hat I)=1$4 drop in forging success (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&).

Other image-forging studies document the opposite outcome: near-perfect spoofing against current schemes. Across $D(\hat I)=1$5 model-data-watermark scenarios, PnP reports that watermark detectability and user attribution can reach $D(\hat I)=1$6, with PnP(CtrlRegen) matching or staying within $D(\hat I)=1$7 of Imprint in detectability and attribution while reducing per-image overhead from $D(\hat I)=1$8 s to $D(\hat I)=1$9 s–$t_{fw}$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ s (&&&^^^^3query3^^^^4&&&). WMCopier reports average PSNR $t_{fw}$^^^^3query3^^^^ dB, average forged bit accuracy $t_{fw}$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^, and average FPR $t_{fw}$3 on open-source schemes; on Amazon Titan watermark API, it reports average PSNR $t_{fw}$4 dB, SR $t_{fw}$5, and average confidence $t_{fw}$6 (Dong et al., 28 Mar 2025). Warfare reports, on CIFAR-^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ with an 8-bit watermark, forged Bit Acc $t_{fw}$7, FID $t_{fw}$8, PSNR $t_{fw}$9 dB, SSIM $t_{op}$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^, and CLIP $t_{op}$^^^^3query3^^^^; on CelebA with a 3^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^-bit watermark, forged Bit Acc $t_{op}$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^, FID $t_{op}$3, PSNR $t_{op}$4, and SSIM $t_{op}$5 (&&&^^^^3query3^^^^9&&&).

Single-image leakage methods also report strong performance. DAPAO states a $t_{op}$6 success-rate gain in detection evasion and $t_{op}$7 improvement in forgery accuracy compared to state-of-the-art methods while maintaining visual fidelity (Ba et al., 10 Feb 2025). Its COCO forgery excerpt gives CopyAttack SR $t_{op}$8, Steganalysis $t_{op}$9, WmRobust $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^, and DAPAO $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$^^^^3query3^^^^, with DAPAO at SSIM $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^ and PSNR $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$3 dB (Ba et al., 10 Feb 2025). The one-shot preference-model attack likewise reports competitive forging from only one reference image: on CIN, MBRS, TrustMark, and VideoSeal, its Table ^^^^3query3^^^^ gives bit-accuracy $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$4, $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$5, $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$6, and $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$7, respectively, with PSNR $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$8 (&&&^^^^3query3^^^^7&&&).

In dataset protection, the empirical claim is not that the trigger looks similar but that the verification result becomes indistinguishable. Li et al. report that, in every setting, the p-value and $$\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2 \quad\text{s.t.}\quad \|\delta\|_2\le\epsilon,$$9 obtained with the forged trigger $z_0^b=\mathcal{E}(I^b)$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ are virtually identical to those obtained with the original trigger $z_0^b=\mathcal{E}(I^b)$^^^^3query3^^^^, and in the CIFAR-^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^, ResNet, BadNets–Cross stealing scenario they give original $z_0^b=\mathcal{E}(I^b)$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^, $z_0^b=\mathcal{E}(I^b)$3, versus forged $z_0^b=\mathcal{E}(I^b)$4, $z_0^b=\mathcal{E}(I^b)$5 (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&).

4. Defensive designs and formal unforgeability

One line of defense attempts to preserve detector-based watermarking while making the embedded signal instance-specific. ISTS does this by extracting CLIP features from a clean generation, assigning a cluster label through a small classifier, and mapping that label through a secret permutation $z_0^b=\mathcal{E}(I^b)$6 to an injection timestep $z_0^b=\mathcal{E}(I^b)$7 and a Fourier-domain offset $z_0^b=\mathcal{E}(I^b)$8. The watermark is then embedded as a circular ring pattern $z_0^b=\mathcal{E}(I^b)$9 inside a shifted mask $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^, and detection recovers $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$^^^^3query3^^^^, inverts to the corresponding mid-step latent, and computes

$z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^

with the two-sided score $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$3 (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). The paper explicitly attributes robustness to the two-sided metric and dynamic keying rather than to adversarially trained detection.

A second line of defense shifts from detector acceptance to integrity verification. In LLMs, “Let Watermarks Speak” first introduces Dual Inverse-Transform Sampling, a single-bit scheme in which the marginal distribution of generated bits remains equal to the model distribution $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$4, then lifts it into a multi-bit construction where each watermark link encodes the hash of the prompt or the previous link. Detection parses watermark blocks, and Verify checks the hash-chain. The paper defines prefix-unforgeability and reports a forgery success rate against prompt-swapping of $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$5; under up to $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$6 random token edits, detection still succeeds $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$7 (Bai, 2024). UPV pursues the same goal by separating a secret generation network $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$8 from a public detection network $z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)$9 that shares only the token embedding $\hat I=\mathcal{D}(z_0^b+\delta)$^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^. Its reverse-training evaluation states that even $\hat I=\mathcal{D}(z_0^b+\delta)$^^^^3query3^^^^ random texts produce only a crude mimic with $\hat I=\mathcal{D}(z_0^b+\delta)$^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^, while the legitimate detector continues to operate at $\hat I=\mathcal{D}(z_0^b+\delta)$3 on genuine watermarked text (&&&^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&).

A third line of defense introduces cryptographic or key-separation structure. NeuralMark hashes a secret key $\hat I=\mathcal{D}(z_0^b+\delta)$4 with SHAKE-^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^56 to obtain $\hat I=\mathcal{D}(z_0^b+\delta)$5, uses $\hat I=\mathcal{D}(z_0^b+\delta)$6 as a repeated filter that selects which parameters carry the watermark, applies average pooling to the repeatedly filtered weights, and verifies by thresholding the bit-agreement rate $\hat I=\mathcal{D}(z_0^b+\delta)$7. For $\hat I=\mathcal{D}(z_0^b+\delta)$8 and $\hat I=\mathcal{D}(z_0^b+\delta)$9, the probability that a random counterfeit key achieves agreement above threshold is stated as PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^; empirically, forging on ResNet-^^^^3query3^^^^8 yields PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3query3^^^^ and PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3(Zhu et al., 8 Apr 2026) OR \3^^^^ bit agreement on CIFAR-^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ and CIFAR-^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^, respectively, i.e. near chance, while baselines such as VanillaMark and VoteMark reach PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks33^^^^ (&&&^^^^3query3query3^^^^&&&). Multi-key watermarking offers a post-hoc black-box defense: the provider samples one of PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^4 keys at generation time and tests all PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^5 keys at detection time, returning “forgery” if multiple keys fire. The cited experiments report that increasing PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^6 from PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^7 to PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^8 reduces text spoofing roughly from PRESERVED_PLACEHOLDER_^^^^3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^9–PRESERVED_PLACEHOLDER_^^^^3query3query3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ to PRESERVED_PLACEHOLDER_^^^^3query3query3query3^^^^–PRESERVED_PLACEHOLDER_^^^^3query3query3(Zhu et al., 8 Apr 2026) OR \3^^^^, and reduces image spoofing to as low as PRESERVED_PLACEHOLDER_^^^^3query3query33^^^^ (Aremu et al., 10 Jul 2025).

A fourth line makes content dependence explicit and cryptographically verifiable. MetaSeal extracts a deterministic semantic bitstring PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^4, signs it with a digital signature PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^5, encodes PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^6 into a QR-like pattern PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^7, and embeds PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^8 with an invertible neural network PRESERVED_PLACEHOLDER_^^^^3query3query3^^^^9. Verification succeeds only if PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ after extraction (Zhou et al., 13 Sep 2025). Its reported false-accept rate under Replay, Mixup, and PGD is PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3query3^^^^, while verification accuracy under moderate benign transforms remains PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3(Zhu et al., 8 Apr 2026) OR \3^^^^ for JPEG PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \33^^^^ and PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^4, PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^5 for Gaussian noise PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^6, and PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^7 for Gaussian blur PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^8 (Zhou et al., 13 Sep 2025).

5. Structural weaknesses, failure modes, and controversies

A recurring result is that robustness against ordinary distortions can create exploitable regularity. DAPAO formulates this as a robustness–stealthiness paradox: to survive JPEG compression, noise addition, or screen-shooting, an encoder must amplify or spatially spread watermark signals, thereby leaking watermark fingerprints into feature channels that a pre-trained extractor can isolate and manipulate (Ba et al., 10 Feb 2025). This does not merely weaken secrecy; it can simultaneously improve removal and forgery.

A second weakness is reliance on behavioral or detector-only verification. In the dataset setting, forged watermarks are reported to have the same statistical significance as original watermarks in copyright verification tests under various conditions and scenarios, leading to the conclusion that ownership verification results are insufficient to determine infringement (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&). The paper attributes this to behavioral equivalence and rebuttal symmetry: both parties can present a trigger and a response-distribution pair that passes the same judicial test (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&). MetaSeal makes the same criticism from the image side, stating that content-agnostic schemes allow replay attacks and mixup attacks, and that learned detectors can be fooled by adversarial perturbations such as PGD (Zhou et al., 13 Sep 2025).

A third controversy concerns semantic diffusion watermarks that are detected only through inversion of initial noise. Black-box attacks on Tree-Ring and Gaussian Shading show that unrelated models with different latent spaces and architectures can still be used for targeted watermark imprinting or re-generation, and that threshold tightening is ineffective because benign post-processing also pushes genuine watermarked images into the same low-confidence regime (Müller et al., 2024). The related PnP and WMCopier results suggest that once inversion and regeneration pipelines are publicly available, provenance claims based solely on detector output become much harder to defend (&&&^^^^3query3^^^^4&&&, Dong et al., 28 Mar 2025).

Current defenses also retain explicit limitations. ISTS states that worst-case forging robustness is still not perfect, with PRESERVED_PLACEHOLDER_^^^^3query3(Zhu et al., 8 Apr 2026) OR \3^^^^9 against powerful VAE attacks, and that reliance on a secret key and on the security of the parameter selector creates a side-channel leakage risk if not carefully managed (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). This suggests that instance specificity and stronger detection metrics improve resistance, but do not by themselves provide formal non-forgeability.

6. Research directions

The recent literature proposes several nonexclusive directions for strengthening watermark systems against forgery. For diffusion watermarking, the ISTS work lists increasing pattern space through larger PRESERVED_PLACEHOLDER_^^^^3query33Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^ and more geometric transforms, integrating adversarial training of both watermark injection and detection in a minimax framework, and exploring cryptographically provable watermark schemes with formal security guarantees against adaptive adversaries (&&&^^^^3Towards Robust Content Watermarking Against Removal and Forgery Attacks3^^^^&&&). PnP motivates latent randomization, key-based conditional watermarks, multi-layer watermarks that combine semantic-latent and pixel-space markings, joint forensic detection of improbable latent-space couplings, and adversarially robust watermark design against DDIM inversion and cross-model transfer (&&&^^^^3query3^^^^4&&&).

For dataset ownership, the proposed responses are multiple randomized trigger patterns with varying target classes, invisible or encrypted backdoor watermarks that evade data-level detectors, and verification mechanisms that go beyond simple statistical tests by requiring structural matching or embedding cryptographic proofs and keys inside the data (&&&^^^^3(Zhu et al., 8 Apr 2026) OR \3^^^^&&&). For post-hoc image watermarking, suggested countermeasures include stronger content awareness in the decoder, adversarial training against stolen-watermark attacks, and challenge–response protocols embedding dynamic nonces unique to each image (&&&^^^^3query3^^^^7&&&).

A broader trend is the migration from detector-centric robustness to content-dependent or cryptographically bound verification. MetaSeal binds attribution to semantic features through a digital signature (Zhou et al., 13 Sep 2025); the LLM hash-chain construction binds later text to earlier context (Bai, 2024); NeuralMark binds the watermark to an irreversible hashed filter over weights (&&&^^^^3query3query3^^^^&&&); and multi-key watermarking weakens averaging-style stealing attacks without changing the underlying black-box watermark algorithm (Aremu et al., 10 Jul 2025). Taken together, these proposals suggest that future progress is likely to depend less on making a fixed pattern harder to estimate and more on making attribution inseparable from keyed generation, semantic consistency, or cryptographic verification.