Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models

TL;DR

This work tackles the vulnerability of post-hoc image watermarking to watermark forging in a black-box, data-scarce setting. It introduces a two-stage attack: first, train a watermarked-image preference model on procedurally generated artifacts using a ranking loss; second, use this model as a surrogate loss to backpropagate directly on pixels and extract/forge a watermark from a single watermarked image, without access to the watermarking model or paired data. The authors demonstrate the approach across multiple post-hoc watermarking schemes, showing strong forging performance with minimal data and competitive removal results, while highlighting weaknesses in several content-aware schemes. The results underscore the need for more robust, content-aware decoders and provide public code to facilitate further assessment and defense development in watermarking for AI-generated content authenticity.

Abstract

Recent years have seen a surge in interest in digital content watermarking techniques, driven by the proliferation of generative models and increased legal pressure. With an ever-growing percentage of AI-generated content available online, watermarking plays an increasingly important role in ensuring content authenticity and attribution at scale. There have been many works assessing the robustness of watermarking to removal attacks, yet, watermark forging, the scenario when a watermark is stolen from genuine content and applied to malicious content, remains underexplored. In this work, we investigate watermark forging in the context of widely used post-hoc image watermarking. Our contributions are as follows. First, we introduce a preference model to assess whether an image is watermarked. The model is trained using a ranking loss on purely procedurally generated images without any need for real watermarks. Second, we demonstrate the model's capability to remove and forge watermarks by optimizing the input image through backpropagation. This technique requires only a single watermarked image and works without knowledge of the watermarking model, making our attack much simpler and more practical than attacks introduced in related work. Third, we evaluate our proposed method on a variety of post-hoc image watermarking models, demonstrating that our approach can effectively forge watermarks, questioning the security of current watermarking approaches. Our code and further resources are publicly available.

Figures (12)

• Figure 1: Overview of our attack pipeline. Given a single watermarked image (left), Bob's goal is to either remove the watermark (top path) or forge it onto another image (bottom path). He first trains a preference model to predict a score indicating the likelihood that an image will be watermarked, and then optimizes the input image to maximize this score. This enables both watermark removal (producing a clean image classified as non-watermarked) and watermark forging (producing an image classified as watermarked). Notably, the approach does not require access to the watermarking model or paired data.
• Figure 2: Synthetic artifacts. We train our preference model to prefer original images over synthetically corrupted images. To cover a broad range of possible artifacts, we use three types of artifacts: wave style, noise, and line style. The artifacts are first generated in the Fourier space and then transformed to the image space to be added to the original images.
• Figure 3: Comparison of the forged watermarks by different watermark forging methods. The shown watermarks are averaged from 100 different images to remove any image-specific artifacts. The recovered watermark by our method closely resembles the actual watermark (left column), containing the least number of other distracting artifacts, such as the noise present in DiffPure watermarks.
• Figure 4: Qualitative results for watermark forging. The figure shows a watermarked image (top) with its watermark removed by our method (middle row). The watermark is pasted onto a new image (bottom row). We use $k=50$ steps for the watermark extraction.
• Figure 5: Qualitative results for watermark removal. The figure shows a watermarked image (left) with its watermark removed by different methods (top row) and the actual removed watermark by each method (bottom row).