Optimization-Free Universal Watermark Forgery with Regenerative Diffusion Models

TL;DR

This paper introduces PnP, an optimization-free, universal watermark forgery method using regenerative diffusion models that can successfully forge watermarks across various scenarios without prior knowledge of the watermarking scheme.

Contribution

The paper presents PnP, a novel forgery attack leveraging regenerative diffusion models for universal, optimization-free watermark forgery applicable to any image or watermarking scheme.

Findings

Successfully forges watermarks with up to 100% detectability

Maintains high visual quality of forged images

Works across diverse model-data-watermark combinations

Abstract

Watermarking becomes one of the pivotal solutions to trace and verify the origin of synthetic images generated by artificial intelligence models, but it is not free of risks. Recent studies demonstrate the capability to forge watermarks from a target image onto cover images via adversarial optimization without knowledge of the target generative model and watermark schemes. In this paper, we uncover a greater risk of an optimization-free and universal watermark forgery that harnesses existing regenerative diffusion models. Our proposed forgery attack, PnP (Plug-and-Plant), seamlessly extracts and integrates the target watermark via regenerating the image, without needing any additional optimization routine. It allows for universal watermark forgery that works independently of the target image's origin or the watermarking model used. We explore the watermarked latent extracted from the target image and visual-textual context of cover images as priors to guide sampling of the regenerative process. Extensive evaluation on 24 scenarios of model-data-watermark combinations demonstrates that PnP can successfully forge the watermark (up to 100% detectability and user attribution), and maintain the best visual perception. By bypassing model retraining and enabling adaptability to any image, our approach significantly broadens the scope of forgery attacks, presenting a greater challenge to the security of current watermarking techniques for diffusion models and the authority of watermarking schemes in synthetic data generation and governance.