Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark

Rui Bao, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Yang Song, Jiaojiao Jiang

Abstract

Diffusion-based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose $\underline{\mathbf{S}}$tochastic $\underline{\mathbf{Hi}}$dden-Trajectory De$\underline{\mathbf{f}}$lec$\underline{\mathbf{t}}$ion ($\mathbf{SHIFT}$), a training-free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark-embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise-space, frequency-domain, and optimization-based paradigms show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.

SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark

Abstract

Diffusion-based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose tochastic dden-Trajectory Delecion (), a training-free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark-embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise-space, frequency-domain, and optimization-based paradigms show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.

Paper Structure

This paper contains 25 sections, 8 theorems, 42 equations, 6 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Roadmap.
  3. Related Work
  4. Diffusion Models and Sampling Mechanisms
  5. Watermarking for Diffusion Models
  6. Attacks on Image Watermarks
  7. Method
  8. Threat Model
  9. Attack Objective
  10. Stage I: Partial Forward Diffusion
  11. Procedure.
  12. Stage II: Stochastic Reverse Resampling
  13. Procedure.
  14. Algorithm
  15. Theoretical Justification on Trajectory Decoupling
  16. ...and 10 more sections

Key Result

Theorem 4.1

Under mild regularity assumptions on the public denoiser, the stochastic reverse sampler, and the DDIM inversion map, the following hold for every $\lambda\in(0,1]$:

Figures (6)

  • Figure 1: The overall framework of SHIFT
  • Figure 2: Comparison of $L_1$ and $L_2$ noise distances across nine watermarking methods.
  • Figure 3: Qualitative comparison with different attack.
  • Figure 4: Qualitative comparison of visual fidelity before and after attack across nine watermarking methods. In each subfigure, the left column shows the watermarked images and the right column shows the attacked images at attack strength $\lambda=0.50$.
  • Figure 5: Visual comparison of watermark robustness under different attack strengths. PRC, ROBIN, and Tree-Ring represent weakly, moderately, and highly robust watermarking methods, respectively. As $\lambda$ increases, the attacked outputs reveal clear differences in the fidelity--evasion trade-off across robustness levels.
  • ...and 1 more figures

Theorems & Definitions (19)

  • Definition 3.1: Watermarked Generation Pipeline
  • Remark 3.3: Role of $\lambda$
  • Theorem 4.1: Informal
  • Remark 4.2: Why Stochasticity Is Essential
  • Lemma A.2: One-step stability of the ancestral update
  • proof
  • Lemma A.3: Multi-step stability
  • proof
  • Lemma A.4: Stability of the recovered-noise map
  • proof
  • ...and 9 more