---
title: 'Watermark Forging: Attacks & Defenses'
url: https://www.emergentmind.com/topics/watermark-forging
type: topic
---

# Watermark Forging: Attacks & Defenses

Searching arXiv for the cited watermark-forging papers to ground the article in current literature.
Searching arXiv for "Towards Robust Content Watermarking Against Removal and Forgery Attacks" and related watermark forging papers.
Tool call: arxiv_search({"query":"2604.06662 OR \"Towards Robust Content Watermarking Against Removal and Forgery Attacks\"","max_results":5,"sort_by":"submittedDate"})
Searching arXiv for the main paper and several related works on watermark forging.
Watermark forging denotes the adversarial production of content that is recognized as legitimately watermarked even though it was not produced by the protected generator, owner, or model. In text-to-image diffusion models, the canonical formulation takes a benign image \(I^b\) and seeks a small perturbation \(\delta\) such that \(\hat I = I^b + \delta\) is accepted by the detector, \(D(\hat I)=1\), while preserving perceptual and semantic fidelity [2604.06662]. Closely related formulations appear in backdoor-based dataset protection, where a forged trigger \(t_{fw}\) yields statistically equivalent ownership tests to the original trigger \(t_{op}\) [2411.15450], in post-hoc image watermarking, where a stolen watermark is transferred to arbitrary images [2503.22330], and in language-model watermarking, where forged prompt–response associations motivate integrity-verifiable schemes [2412.19603]. Across these settings, the central risk is false attribution: a detector or verifier accepts provenance, ownership, or authorship claims that are not genuine.

## 1. Definitions, objectives, and attacker models

In diffusion watermarking, forgery is usually formalized as detector spoofing under a perceptual budget. A standard objective minimizes the distance between the surrogate forward diffusion of a perturbed benign latent and the estimated watermark latent of a reference image,
\[
\min_{\delta} \;\big\|\,\mathcal{M}_{0\to T}\big(p,\;z_0^b+\delta\big)\;-\;z_T^w\big\|_2^2
\quad\text{s.t.}\quad
\|\delta\|_2\le\epsilon,
\]
where \(z_0^b=\mathcal{E}(I^b)\), \(z_T^w=\mathcal{M}_{0\to T}(p,z_0^w)\), and the adversary finally decodes \(\hat I=\mathcal{D}(z_0^b+\delta)\) [2604.06662]. The stated objective is twofold: forgery, meaning \(D(\hat I)=1\), and preservation, meaning high perceptual and semantic fidelity to the original benign image.

The capability assumptions vary by modality but converge on a common asymmetry: the attacker lacks the true secret but exploits transferable structure. In the diffusion setting, the attacker may have no access to target model weights or the exact watermark algorithm, may possess one or multiple reference watermarked images, may use surrogate diffusion or VAE models to compute gradients, and may estimate latent inversions via DDIM-inversion or VAE encoders [2604.06662]. Recent image attacks further tighten the setting to no-box or black-box variants in which only a single watermarked image is available, with no access to the encoder, decoder, or watermark/unwatermarked pairs [2502.06418; 2504.20111].

Outside image generation, the same adversarial logic appears in different verification pipelines. In backdoor-based dataset ownership, the accused party may recover the original trigger and target class and then present a forged trigger whose model outputs are statistically indistinguishable from the owner’s evidence [2411.15450]. In publicly verifiable LLM watermarking, the adversary may have full white-box access to the public detection network and unlimited black-box query access to it, while lacking the secret generation network [2307.16230]. In weight-based neural network watermarking, the adversary may have full access to the stolen model’s weights and know the embedding algorithm except the secret key, then attempt forging or overwriting under fine-tuning and pruning constraints [2507.11137].

## 2. Attack constructions and algorithmic families

The literature now contains several distinct families of watermark forgery attacks.

| Attack family | Core mechanism | Representative sources |
|---|---|---|
| Latent alignment | Move a clean or cover image toward a watermarked latent region | [2604.06662], [2504.20111] |
| Regenerative forgery | Extract a watermark latent once, then regenerate arbitrary covers | [2506.06018], [2503.22330] |
| Feature-leakage transfer | Isolate watermark-bearing channels or artifact directions from one image | [2502.06418], [2510.20468] |
| GAN or distillation forgery | Learn a forged trigger or forged watermarked image distribution from examples | [2411.15450], [2310.07726], [2103.12489] |

Gradient-based latent attacks are the most direct. “Imp-Forgery” aligns a benign latent with a reference watermarked latent under an \(\ell_2\) perturbation budget [2604.06662]. A related single-image attack on latent-noise diffusion watermarks argues that there is a many-to-one mapping between images and initial noises, and therefore a nontrivial region \(Z_0^{(w)}\) in clean-image latent space whose inversion recovers the same watermark key. The attacker solves
\[
\min_{\bm\delta}\; \bigl\|\,\mathcal E_\phi(\mathbf x^{(c)}+\bm\delta)-\mathcal E_\phi(\mathbf x^{(w)})\bigr\|_2 + \lambda\|\bm\delta\|_2,
\]
optionally with \(\|\bm\delta\|_\infty\le\epsilon\), using only a proxy encoder and one watermarked example [2504.20111].

A second family avoids explicit optimization at attack time by exploiting diffusion inversion and regeneration. PnP (“Plug-and-Plant”) first estimates a watermark latent \(\hat z_T^{(w)}\) from one watermarked image using a public proxy diffusion model and DDIM inversion, then uses a regenerative diffusion model conditioned on visual and textual priors from a cover image to generate a forged image \(x_c^{(w)}\) [2506.06018]. WMCopier, called “DiffForge” in its description, instead trains an unconditional diffusion model on scraped watermarked images, performs shallow DDIM inversion on a clean target image, and chooses the deepest inversion step whose PSNR remains above a lower bound \(\kappa\), thereby balancing watermark strength and fidelity [2503.22330].

A third family treats robust watermarking as a source of exploitable leakage. DAPAO uses a DenseNet-121 feature extractor, clusters its channel activations, identifies the two smallest clusters as watermark-biased channels, and then performs a two-stage adversarial optimization: leakage extraction on the watermarked reference image and semantic transfer to the clean target image [2502.06418]. A related one-shot attack trains a ConvNeXt V2-Tiny preference model \(R\) to rank clean images above procedurally artifacted images, extracts a watermark-like residual from a single watermarked image by maximizing \(R(x_w-\delta)\), and forges by simple addition \(y_{\hat w}=y+\hat w\) on a new image [2510.20468].

GAN- and distillation-based attacks dominate in older image watermarking and dataset watermarking literature. FW-Gen is a lightweight autoencoder \(M(\epsilon)=g(h(\epsilon))\) trained with a benign-model distillation loss \(\mathcal L_B\) and a watermarked-model distillation loss \(\mathcal L_W\), combined as \(\mathcal L_{BW}=\mathcal L_B+\mathcal L_W\), so that the forged trigger \(t_{fw}\) mimics the behavior of the original trigger \(t_{op}\) under both a benign model and a watermarked model [2411.15450]. Warfare scrapes victim-watermarked images, removes the watermark approximately with a public diffusion mediator, and then trains a conditional GAN to re-impose the victim’s watermark onto arbitrary images [2310.07726]. “Watermark Faker” is an earlier conditional GAN approach that assumes paired original and watermarked images, uses U-Net plus domain-specific preprocessing such as Pixel-Expansion or blind DCT preprocessing, and learns to synthesize fake watermarked images that pass the victim extractor [2103.12489].

## 3. Evaluation protocols and empirical behavior

Forgery is evaluated differently across watermarking modalities, but the metrics consistently separate detector acceptance from perceptual quality. Diffusion watermarking studies commonly report ROC-AUC and True Positive Rate at \(1\%\) False Positive Rate, with lower AUC and TPR under forgery indicating a stronger defense [2604.06662]. Semantic watermark studies additionally report bit accuracy, user attribution, or p-value distance after inversion into latent space [2506.06018]. Post-hoc image watermarking reports forged bit accuracy, false-positive rate, Success Rate, PSNR, and SSIM [2503.22330]. Dataset watermarking relies on paired T-tests, Wilcoxon tests, and \(\Delta P=\mathrm{mean}_i[P_w(i,\hat y)-P_{bn}(i,\hat y)]\) because the ownership claim is behavioral rather than reconstructive [2411.15450].

Recent diffusion results show that forgery can be either highly effective or sharply reduced, depending on the defense. Under three forgery attacks—Imp-Forgery, Avg-Forgery, and VAE-Forgery—the ISTS defense reports detection AUC / TPR@1%FPR of \(1.0000/1.00\) on original images, \(.6340/.00\) for Imp-Forgery, \(.4737/.00\) for Avg-Forgery, and \(.9491/.37\) for VAE-Forgery. The same study states that ISTS reduces Imp-Forgery AUC from .99 to .63 and Avg-Forgery from .62 to .47, demonstrating a \(20\)–\(30\%\) drop in forging success [2604.06662].

Other image-forging studies document the opposite outcome: near-perfect spoofing against current schemes. Across \(24\) model-data-watermark scenarios, PnP reports that watermark detectability and user attribution can reach \(100\%\), with PnP(CtrlRegen) matching or staying within \(2\%\) of Imprint in detectability and attribution while reducing per-image overhead from \(\sim 1{,}188\) s to \(3.7\) s–\(29.3\) s [2506.06018]. WMCopier reports average PSNR \(\approx 29.8\) dB, average forged bit accuracy \(\approx 91.4\%\), and average FPR \(\approx 96.4\%\) on open-source schemes; on Amazon Titan watermark API, it reports average PSNR \(\approx 30.4\) dB, SR \(\approx 98.7\%\), and average confidence \(\approx 2.86\) [2503.22330]. Warfare reports, on CIFAR-10 with an 8-bit watermark, forged Bit Acc \(=97.84\%\), FID \(=21.09\), PSNR \(=24.94\) dB, SSIM \(=0.82\), and CLIP \(=0.93\); on CelebA with a 32-bit watermark, forged Bit Acc \(=99.11\%\), FID \(=8.75\), PSNR \(=24.92\), and SSIM \(=0.90\) [2310.07726].

Single-image leakage methods also report strong performance. DAPAO states a \(60\%\) success-rate gain in detection evasion and \(51\%\) improvement in forgery accuracy compared to state-of-the-art methods while maintaining visual fidelity [2502.06418]. Its COCO forgery excerpt gives CopyAttack SR \(0.13\), Steganalysis \(0.10\), WmRobust \(0.86\), and DAPAO \(1.00\), with DAPAO at SSIM \(0.81\) and PSNR \(33.5\) dB [2502.06418]. The one-shot preference-model attack likewise reports competitive forging from only one reference image: on CIN, MBRS, TrustMark, and VideoSeal, its Table 1 gives bit-accuracy \(1.00\), \(0.83\), \(0.61\), and \(0.83\), respectively, with PSNR \(31.3\) [2510.20468].

In dataset protection, the empirical claim is not that the trigger looks similar but that the verification result becomes indistinguishable. Li et al. report that, in every setting, the p-value and \(\Delta P\) obtained with the forged trigger \(t_{fw}\) are virtually identical to those obtained with the original trigger \(t_{op}\), and in the CIFAR-10, ResNet, BadNets–Cross stealing scenario they give original \(p\approx 1.2\times 10^{-173}\), \(\Delta P\approx 0.99\), versus forged \(p\approx 1.1\times 10^{-173}\), \(\Delta P\approx 0.99\) [2411.15450].

## 4. Defensive designs and formal unforgeability

One line of defense attempts to preserve detector-based watermarking while making the embedded signal instance-specific. ISTS does this by extracting CLIP features from a clean generation, assigning a cluster label through a small classifier, and mapping that label through a secret permutation \(\phi\) to an injection timestep \(t\) and a Fourier-domain offset \(l=(l_x,l_y)\). The watermark is then embedded as a circular ring pattern \(W\) inside a shifted mask \(M\oplus l\), and detection recovers \((t,l)\), inverts to the corresponding mid-step latent, and computes
\[
d^+ = \frac1{|M|}\sum_{(i,j)\in M\oplus l} \bigl|W[i-l_x,j-l_y]-F[i,j]\bigr|,
\quad
d^- = \frac1{|M|}\sum_{(i,j)\in M\oplus l} \bigl|W[i-l_x,j-l_y]+F[i,j]\bigr|,
\]
with the two-sided score \(d=\min(d^+,d^-)\) [2604.06662]. The paper explicitly attributes robustness to the two-sided metric and dynamic keying rather than to adversarially trained detection.

A second line of defense shifts from detector acceptance to integrity verification. In language models, “Let Watermarks Speak” first introduces Dual Inverse-Transform Sampling, a single-bit scheme in which the marginal distribution of generated bits remains equal to the model distribution \((p(0),p(1))\), then lifts it into a multi-bit construction where each watermark link encodes the hash of the prompt or the previous link. Detection parses watermark blocks, and Verify checks the hash-chain. The paper defines prefix-unforgeability and reports a forgery success rate against prompt-swapping of \(<0.1\%\); under up to \(20\%\) random token edits, detection still succeeds \(>99\%\) [2412.19603]. UPV pursues the same goal by separating a secret generation network \(\mathcal W\) from a public detection network \(\mathcal D\) that shares only the token embedding \(E\). Its reverse-training evaluation states that even \(10{,}000\) random texts produce only a crude mimic with \(F_1\approx 60\%\), while the legitimate detector continues to operate at \(\approx 99\% F_1\) on genuine watermarked text [2307.16230].

A third line of defense introduces cryptographic or key-separation structure. NeuralMark hashes a secret key \(K\) with SHAKE-256 to obtain \(b=\mathcal H(K)\in\{0,1\}^n\), uses \(b\) as a repeated filter that selects which parameters carry the watermark, applies average pooling to the repeatedly filtered weights, and verifies by thresholding the bit-agreement rate \(\rho\). For \(n=256\) and \(\rho^*=0.8828\), the probability that a random counterfeit key achieves agreement above threshold is stated as \(<2^{-128}\); empirically, forging on ResNet-18 yields \(48.6\%\) and \(49.4\%\) bit agreement on CIFAR-10 and CIFAR-100, respectively, i.e. near chance, while baselines such as VanillaMark and VoteMark reach \(100.0\%\) [2507.11137]. Multi-key watermarking offers a post-hoc black-box defense: the provider samples one of \(r\) keys at generation time and tests all \(r\) keys at detection time, returning “forgery” if multiple keys fire. The cited experiments report that increasing \(r\) from \(1\) to \(4\) reduces text spoofing roughly from \(70\)–\(80\%\) to \(15\)–\(26\%\), and reduces image spoofing to as low as \(2\%\) [2507.07871].

A fourth line makes content dependence explicit and cryptographically verifiable. MetaSeal extracts a deterministic semantic bitstring \(M=f(I)\), signs it with a digital signature \(S\leftarrow \mathrm{Sign}(\mathrm{sk},M)\), encodes \((M,S)\) into a QR-like pattern \(V\), and embeds \(V\) with an invertible neural network \(g_\theta\). Verification succeeds only if \(\mathrm{SigVerify}(\mathrm{pk},\hat S)=\hat M\) after extraction [2509.10766]. Its reported false-accept rate under Replay, Mixup, and PGD is \(0.00\), while verification accuracy under moderate benign transforms remains \(100\%\) for JPEG \(Q=95\) and \(Q=85\), \(99.8\%\) for Gaussian noise \(\sigma=0.02\), and \(99.5\%\) for Gaussian blur \(\sigma=0.7, k=3\) [2509.10766].

## 5. Structural weaknesses, failure modes, and controversies

A recurring result is that robustness against ordinary distortions can create exploitable regularity. DAPAO formulates this as a robustness–stealthiness paradox: to survive JPEG compression, noise addition, or screen-shooting, an encoder must amplify or spatially spread watermark signals, thereby leaking watermark fingerprints into feature channels that a pre-trained extractor can isolate and manipulate [2502.06418]. This does not merely weaken secrecy; it can simultaneously improve removal and forgery.

A second weakness is reliance on behavioral or detector-only verification. In the dataset setting, forged watermarks are reported to have the same statistical significance as original watermarks in copyright verification tests under various conditions and scenarios, leading to the conclusion that ownership verification results are insufficient to determine infringement [2411.15450]. The paper attributes this to behavioral equivalence and rebuttal symmetry: both parties can present a trigger and a response-distribution pair that passes the same judicial test [2411.15450]. MetaSeal makes the same criticism from the image side, stating that content-agnostic schemes allow replay attacks and mixup attacks, and that learned detectors can be fooled by adversarial perturbations such as PGD [2509.10766].

A third controversy concerns semantic diffusion watermarks that are detected only through inversion of initial noise. Black-box attacks on Tree-Ring and Gaussian Shading show that unrelated models with different latent spaces and architectures can still be used for targeted watermark imprinting or re-generation, and that threshold tightening is ineffective because benign post-processing also pushes genuine watermarked images into the same low-confidence regime [2412.03283]. The related PnP and WMCopier results suggest that once inversion and regeneration pipelines are publicly available, provenance claims based solely on detector output become much harder to defend [2506.06018; 2503.22330].

Current defenses also retain explicit limitations. ISTS states that worst-case forging robustness is still not perfect, with \(\mathrm{AUC}\approx 0.95\) against powerful VAE attacks, and that reliance on a secret key and on the security of the parameter selector creates a side-channel leakage risk if not carefully managed [2604.06662]. This suggests that instance specificity and stronger detection metrics improve resistance, but do not by themselves provide formal non-forgeability.

## 6. Research directions

The recent literature proposes several nonexclusive directions for strengthening watermark systems against forgery. For diffusion watermarking, the ISTS work lists increasing pattern space through larger \(C\) and more geometric transforms, integrating adversarial training of both watermark injection and detection in a minimax framework, and exploring cryptographically provable watermark schemes with formal security guarantees against adaptive adversaries [2604.06662]. PnP motivates latent randomization, key-based conditional watermarks, multi-layer watermarks that combine semantic-latent and pixel-space markings, joint forensic detection of improbable latent-space couplings, and adversarially robust watermark design against DDIM inversion and cross-model transfer [2506.06018].

For dataset ownership, the proposed responses are multiple randomized trigger patterns with varying target classes, invisible or encrypted backdoor watermarks that evade data-level detectors, and verification mechanisms that go beyond simple statistical tests by requiring structural matching or embedding cryptographic proofs and keys inside the data [2411.15450]. For post-hoc image watermarking, suggested countermeasures include stronger content awareness in the decoder, adversarial training against stolen-watermark attacks, and challenge–response protocols embedding dynamic nonces unique to each image [2510.20468].

A broader trend is the migration from detector-centric robustness to content-dependent or cryptographically bound verification. MetaSeal binds attribution to semantic features through a digital signature [2509.10766]; the LLM hash-chain construction binds later text to earlier context [2412.19603]; NeuralMark binds the watermark to an irreversible hashed filter over weights [2507.11137]; and multi-key watermarking weakens averaging-style stealing attacks without changing the underlying black-box watermark algorithm [2507.07871]. Taken together, these proposals suggest that future progress is likely to depend less on making a fixed pattern harder to estimate and more on making attribution inseparable from keyed generation, semantic consistency, or cryptographic verification.

Source: https://www.emergentmind.com/topics/watermark-forging