PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

TL;DR

This paper introduces PGID, a training-free framework that enhances watermark detection robustness against attacks by projecting perturbed latents back to their original watermarked regions through iterative inversion and denoising.

Contribution

The paper presents PGID, a novel plug-and-play, training-free method for defending semantic watermarking against forgery and imprint removal attacks.

Findings

PGID effectively restores watermark detection accuracy under attack.

It successfully mitigates adversarial perturbations through iterative inversion-denoising.

PGID outperforms existing methods in defending against watermark forgery.

Abstract

With the proliferation of AI-generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug-and-play, training-free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion-denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.