Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks

TL;DR

This paper demonstrates that diffusion-based image editing models can effectively remove or distort robust invisible watermarks, exposing a fundamental vulnerability in current watermarking techniques against generative AI transformations.

Contribution

The paper provides a theoretical and empirical analysis of how diffusion models degrade watermarks and introduces diffusion-driven attacks that can erase watermarks with high visual fidelity.

Findings

Diffusion models can nearly eliminate watermark signals in images.

Diffusion-based attacks drastically reduce watermark decoding accuracy.

Current watermarking methods are vulnerable to generative model-based edits.

Abstract

Robust invisible watermarking aims to embed hidden messages into images such that they survive various manipulations while remaining imperceptible. However, powerful diffusion-based image generation and editing models now enable realistic content-preserving transformations that can inadvertently remove or distort embedded watermarks. In this paper, we present a theoretical and empirical analysis demonstrating that diffusion-based image editing can effectively break state-of-the-art robust watermarks designed to withstand conventional distortions. We analyze how the iterative noising and denoising process of diffusion models degrades embedded watermark signals, and provide formal proofs that under certain conditions a diffusion model's regenerated image retains virtually no detectable watermark information. Building on this insight, we propose a diffusion-driven attack that uses generative image regeneration to erase watermarks from a given image. Furthermore, we introduce an enhanced \emph{guided diffusion} attack that explicitly targets the watermark during generation by integrating the watermark decoder into the sampling loop. We evaluate our approaches on multiple recent deep learning watermarking schemes (e.g., StegaStamp, TrustMark, and VINE) and demonstrate that diffusion-based editing can reduce watermark decoding accuracy to near-zero levels while preserving high visual fidelity of the images. Our findings reveal a fundamental vulnerability in current robust watermarking techniques against generative model-based edits, underscoring the need for new watermarking strategies in the era of generative AI.