WMCopier: Forging Invisible Watermarks on Arbitrary Images
Authors: Ziping Dong
Chao Shuai
Zhongjie Ba
Peng Cheng
Zhan Qin
Qinglong Wang
Kui Ren
Venue: NeurIPS 2025 poster ()
Keywords: AI-generated content Watermarking; Forgery Attack;
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: A watermark forgery attack

Abstract: Invisible Image Watermarking is crucial for ensuring content provenance and accountability in generative AI. While Gen-AI providers are increasingly integrating invisible watermarking systems, the robustness of these schemes against forgery attacks remains poorly characterized. This is critical, as forging traceable watermarks onto illicit content leads to false attribution, potentially harming the reputation and legal standing of Gen-AI service providers who are not responsible for the content. In this work, we propose WMCopier, an effective watermark forgery attack that operates without requiring any prior knowledge of or access to the target watermarking algorithm. Our approach first models the target watermark distribution using an unconditional diffusion model, and then seamlessly embeds the target watermark into a non-watermarked image via a shallow inversion process. We also incorporate an iterative optimization procedure that refines the reconstructed image to further trade off the fidelity and forgery efficiency. Experimental results demonstrate that WMCopier effectively deceives both open-source and closed-source watermark systems (e.g., Amazon’s system), achieving a significantly higher success rate than existing methods. Additionally, we evaluate the robustness of forged samples and discuss the potential defense against our attack. Code is available at: https://github.com/holdrain/WMCopier.

WMCopier: Forging Invisible Image Watermarks on Arbitrary Images
Ziping Dong'
Chao Shuai'
Zhongjie Ba 1.+ Peng Cheng Qinglong Wang Kui Ren
Zhan Qin 1.2
"Th State Key Laboratory of Blockchain and Data Security, Zhejiang University
Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security
Hangzhou, Zhejiang, China
(Aanzzhhnncchoouuuiiihogoigeeeee http::/wwgggeaaoooooooooooooonno haigaanniinnnoog.gagg.iieieen (aaerennn@zueediii @zju.edu.cn
Abstract
Invisible Image Watermarking is crucial for ensuring content provenance and ac- countability in generative AI. While Gen-Al providers are increasingly integrating invisible watermarking systems, the robustness of these schemes against forgery at- tacks remains poorly characterized. This is critical, as forging traceable watermarks onto illicit content leads false attribution, potentially harming the reputation and legal standing of Gen-Al service providers who are not responsible for the content. In this work, we propose WMCopier, an effective watermark forgery attack that operates without requiring any prior knowledge of or access to the target water- marking algorithm. Our approach first models the target watermark distribution using an unconditional diffusion model, and then seamlessly embeds the target watermark into a waterraradd image via shallow inversion process. We also incorporate an iterative optimization procedure that refines the reconstructed image further trade off the fidelity and forgery efficiency. Experimental results demon- strate that WMCopier effectively deceives both open-source and closed-source watermark systems (e.g., Amazon's 's system), achieving significantly higher suc- cess rate than existing methods Additionally, we evaluate the robustness of forged samples and discuss the potential defenses against our attack. Code is available at:] htttp:://githii httpt//gtttt.ttt// www.coo////ooeme wom/hollrain///oooooooooomoomaat httphh/ddrain////ppiiier
Introduction
As generative models raise concerns about the potential misuse of such technologies for generating misleading or fictitious imagery [T]. watermarking techniques have become key solution for embed- ding traceable information into generated content, ensuring its provenance (2]. Driven by government initiatives (3], Al companies, including Google and Amazon, are increasingly adopting invisible
watermarking techniques for their generated content 4 5]. owing to the benefits of imperceptibiliiy
and robustness 6 7
However, existing invisible watermark systems are vulnerable to diverse attacks, including detec- tion evasion 8 9 and forgery [10 D.). Although the former has received considerable research attention, forgery attacks remain poorly explored. Forgery attacks, where non-watermarked content is falsely detected watermarked, pose a significant challenge to the reliability of watermarking systems. These attacks maliciously attribute harmful watermarked content to innocent parties, such as Generative AI (Gen-Al) service providers, damaging the reputation of providers 13).
meaas corresponding author. "We have reported this Amazon AGI's Responsible Al team and collaborated on developing potential defense strategies. For the official statement from Amazon, see Appendix
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Existing watermark forgery attacks are broadly categorized into two scenarios: the black-box setting and the no-box setting. In the black-box setting, the attacker has partial access the watermarking system: such as knowledge of the specific watermarking algorithm [14], the ability to obtain paired
data (clean images and their watermark versions) via the embedding interface [15] [6], or query access to the watermark detector [1]. However, such black-box access is unrealistic in practice, as
the watermark embedding process is typically integrated into the generative service itself, rendering it inaccessible to end users, thus disabling paired data acquisition. Moreover, service providers rarely disclose the specific watermarking algorithms they employ [5]] Therefore, our focus is primarily on the no- no-box setting, where the attacker has neither knowledge of the watermarking algorithm access to its implementation, and only a collection of generated images with unknown watermarking schemes is available. Under this setting, Yang et al. [10] attempt to extract the watermark pattern by computing the mean residual between watermarked images and natural images from ImageNet [17], and then directly adding the estimated pattern to forged images at the pixel level. However, this achieves limited performance because it assumes that the watermark signal remains constant across all images. Moreover, its estimation is further hindered by the domain gap between ImageNet images and the unknown clean counterparts of the watermarked samples.
Inspired by recent work [8-21, demonstrating that diffusion models serve as powerful priors capable of capturing complex data distributions, we ask a more exploratory question:
Can diffusion models act as copiers for invisible watermarks?
To be more precise, can we leverage them to copy the underlying watermark signals embedded in watermarked images?
Building on this insight, we propose WMCopier, a no-box watermark forgery attack framework tailored for practical adversarial scenarios. In this setting, the attacker has no prior knowledge of the watermarking scheme used by the provider and only has access to watermarked content generated by the Gen-Al service. Specifically, we first train an unconditional diffusion model on watermarked images to capture their underlying distribution. Then, we perform a shallow inversion to map clean images to their latent representations, followed by denoising process that injects the watermark signal utilizing the trained diffusion model. To further mitigate artifacts introduced during inversion, we propose refinement procedure that jointly optimizes image quality and alignment with the target watermark distribution.
To evaluate the effectiveness of WMCopier, we perform comprchensive experiments across a range of watermarking schemes, including a closed-source one (Amazon's 's system). Experimental results demonstrate that our attack achieves high forgery success rate while preserving excellent visual fidelity. Furthermore, we conduct comparative robustness analysis between genuine and forged watermarks. Finally, we explore a multi-message defense strategy that provides practical guidance for improving future watermark design and deployment.
Our key contributions are summarized as follows:
We propose WMCopier, the first no-box watermark forgery attack based on diffusion models, which forges watermark signals directly from watermarked images without requiring any knowledge of the watermarking scheme.
We introduce a shallow inversion strategy and refinement procedure, which injects the target watermark signal into arbitrary clean images while jointly optimizing image quality and conformity to the watermark distribution.
Through extensive experiments, we demonstrate that WMCopier effectively forges wide range of watermark schemes, achieving superior forgery success rates and visual fidelity,
including on Amazon's deployed watermarking system.
We explore potential defense strategy that provides insights to improve future watermarking systems.
2 Preliminary
2.1 DDIM and DDIM Inversion
DDIM. Diffusion models generate data by progressively adding noise in the forward process and then denoising from pure Gaussian noise during the reverse process. The forward diffusion process is

---

modeled as a Markov chain, where Gaussian noise is gradually added to the data 20 over time. At each time step i, the noised sample 24 can be obtained closed form as:
F2 VoiTo + vI Or c~ (O,(
(I)
where Oe is the noise schedule, and is standard Gaussian noise.
DDIM 22 is deterministic sampling approach for diffusion models, enabling faster sampling and inversion through deterministic trajectory tracing. DDIM sampling, the denoising process starts from Gaussian noise ~ ~N II) and proceeds according to:
Ct
vI ar co( 1) + /1 11--a-1 ,0)
Tt-1 = va-1
(2)
Va
1, eventually yielding the generated sample Tg. Here, eg (a t) denotes a neural network, which is trained to predict the noise added zo at step t during the forward process, by minimizing the following objective:
for -,,-=----,,...
E Eno-Paa t-((1,) e-N(0.))
[|co(Ze: 1) cc2]
allows an image zo to be approximately mapped back its corresponding latent representation x at step / by reversing the sampling trajectory. DDIM inversion has found widespread applications in computer vision, such as image editing [23 24 and watermarking
DDIM Inversion. DDIM inversion 23 22
25 26
We denote this inversion procedure from Zo 24 as:
Zt Inversion(zo,tt) t).
(4)
2.2 Invisible Image Watermarking
Invisible image watermarking helps regulators and the public identify Al Al-generated content and trace harmful outputs (such as NSFW or misleading material) back to the responsible service provider, thus enabling accountability attribution. Specifically, the watermark message inserted by the service provider typically serves as a model identifier (27]. For example, Stability Al embeds the identifier StableDiffusions by converting it into bit string and encoding currently deployed real-world watermarking systems is provided in Table 6 in Appendix B
watermark (28) A list of
Invisible image watermarking typically involves three stages: embedding, extraction, and verification. Given a clean (non-ward watermaarr)))) image æ E x and a binary watermark message m {0, 1) " the embedding process uses encoder E produce watermarked image:
x nC F(x,m). m).
During the extraction stage, detector D attempts to recover the embedded message from x":
m'
Dx*").
During the verification stage, the extracted message m' is evaluated against the original message m using a verification function V, which measures their similarity in terms of bit accuracy. An image is considered watermarked if its bit accuracy exceeds predefined threshold p. where is typically selected to achieve a desired false positive rate (FPR). For instance, achieve a FPR below 0.05 for a 40-bit message, P should be set to 40 the verification function is defined as:
26 based on Bernoulli distribution assumption 29 Formally,
Watermarked,
Actccuucuaa m²) 2
(m, m',p) p) = Non-Watermarked, otherwise.
(5)
Threat Model
In watermark forgery attack, the attacker forges the watermark of a service provider onto clean images, including malicious or illegal content. As a result, these forged images may be incorrectly attributed to the service provider, leading reputation harm and legal ramifications.
Attacker's Goal. The attacker aims to produce a forged watermarked image xf that visually resembles given clean image x, yet is detected by detector D containing target watermark
3

---

Watermark Estimation
Refinement
Watermark Injection via Shallow Inversion
a|f]
Denaising
Collected waternarked images
Image
Forged Image
Diffusion Model
(x)
Inversion
image
Figure 1: The pipeline of WMCopier. The WMCopier consists three stages. In the first stage, an unconditional diffusion model is trained to estimate the watermark distribution. In the second stage, the estimated watermark is injected into non-watermarked image using shallow inversion and denoising. Finally, refinement procedure is applied to mitigate artifacts and ensure conformity to the target watermark distribution (x)).
message Specifically, visual consistency is required to retain the original (possibly harmful) semantic content and to avoid visible artifacts that may reveal the attack.
Attacker's Capability. We consider a threat model under the no-box setting:
The attacker does not know the target watermarking scheme and its internal parameters. They have no access embed watermarks into their own images and the corresponding detection pipeline.
The attacker can collect subset of watermarked images from Al-generated content platforms (e.g..
PromptBase [30), PromptHero (3I) or directly the target Gen-AI service.
The attacker assumes static watermarking scheme, i.e., the service provider does not alter the watermarking scheme during the attack period.
4 WMCopier
In this section, we introduce WMCopier, a watermark forgery attack pipeline consisting of three stages: (1) Watermark Estimation, (2) Watermark Injection, and (3) Refinement. An overview of the proposed framework is illustrated in Figure [
4.1 Watermark Estimation
Diffusion models are used to fit a plausible data manifold 22 32 33
by optimizing Equation
The
noise predictor cœ(x,, t) approximates the conditional expectation of the noise:
c0(
Eie
21] ē(xz).
(6)
which effectively turns co into regressor for the conditional noise distribution.
Now consider a clean image x and its watermarked version xx = x + w(w), where denotes embedded watermark signal, which can also be interpreted as the perturbation introduced by the embedding process. During the forward diffusion process, we have:
(x + vI aye
+ Va,w,
(7)
where is the noisy version of the clean image at step t. The presence of the additive term / faw implies that the input to the noise predictor carries a watermark watermark-dependent shift. As result, the predicted noise satisfies:
c0 11
ē(x)") ē(æ, + Varw) É(Øx) + de(w),
(8)

---

Watermark Detectability During Diffusion
Watermark Detectability During Denolsing
DwtDct
DwtDct
1600el
HIDDeN
RIvaGAN
RivoGAM
Stable Signature
Stable Signature
Bit A.--cccura
0.0
0.4
Watermark Destruction
Watermark Restoration
400
800
800
1000
1000
800
800
200
Step
Step
Figure Watermark detectability of four open-source watermarking schemes throughout the diffusion and denoising processes (7 = 1000). As a reference, the bit accuracy of non-watermarked images remains around 0.5.
where 6, (w) denotes the systematic prediction bias introduced by the watermark signal. These biases accumulate subtly at each denoising step, gradually steering the model's output distribution toward the watermarked distribution (z))
To exploit this behavior, we construct an auxiliary dataset Daux = {xx | ~ Pw (=) (z)). where each image contains embedded watermark message m. We then train unconditional diffusion model Mo on Daux-
Our goal is to obtain forged images xf with watermark signals while preserving the semantic content of a clean image æ. Therefore, given the pretrained model MM and a clean image æ, we first apply DDIM inversion to obtain latent representation zT:
IT Inversion (x, T").
The latent representation retains semantic information about the clean image. Starting from TT, apply the denoising process described in Equation ( obtain the forged image x', where the bias in Equation g naturally guides the denoising process toward the distribution of watermarked images.
4.2 Watermark Injection
We observe that the reconstructed images with full-step inversion suffer from severe quality degra- dation, as illustrated in the top row of Figure 3 This phenomenon is attributed to the fact that the inversion of images tends to accumulate reconstruction errors when the input clean images are out of the training data distribution, especially as the inversion depth increases [23] 34 22 To mitigate this, we investigate the watermark detectability in watermarked images with four open-source wa- termarking methods throughout the diffusion and denoising processes. As illustrated in Figure 2 the watermark signal tends to be destroyed gradually during the shallow steps (e.g.. t s 400 for T = 1000), Consequently, the watermark signal is restored during these denoising steps.
Therefore, we propose a shallow inversion strategy that performs the inversion process up to an early timestep Ts < T. By skipping deeper diffusion steps that contribute minimally to watermark injection yet substantially distort image semantics, our method effectively preserves the visual fidelity of reconstructed images while ensuring reliable watermark injection.
4.3 Refinement
Although shallow inversion effectively reduces reconstruction errors, forged images may still exhibit minor artifacts (as shown in Figure 3) that cause the forged images to be visually distinguishable. thus exposing the forgery. To address this, propose a refinement procedure adjust the forged image x/, defined as:
x. f(++1) x. (1)
2/3) log pw (x)())) 1000---1p0 \| - x|| i E (0, 10.....,,
(10)
where is the step size, balances semantic fidelity and watermark injection and is the optimization iterations. The log- likelihooood log Po constrains the samples to lie in regions of high probability
5

---

Figure Forged samples generated using full-step inversion, shallow inversion, and shallow inversion with refinement. The first row shows results from full-step inversion (Ts T 100), where the semantic content of the original clean image is heavily disrupted. The second row corresponds shallow inversion (Ts- 40, T 100), which introduces only slight artifacts. The third row demonstrates shallow inversion with refinement, where these artifacts are further reduced.
under the watermarked image distribution Pw (z), while the mean squared error (MSE) term ||x)(0 z1|² ensures that the refined image remains similar the clean image Since the distribution Pa (x) and the conditional noise distribution p'u (z,) are nearly identical at a low noise step t,, the score
function V log (2r) be approximated by V log (xa). This score can be estimated using
pre-trained diffusion model Mg B5 36),
defined in Equation where x! Vaie + +VI- atc.
Vas logpo(())) a!, log (xr)))
1
co 11).
(11)
V1 Ot
By performing this refinement for iterations, we obtain the forged watermarked image dfy after the refinement process. This refinement improves both watermark detectability and the image quality of the forged images, as demonstrated in Figure SegureBand Table []] procedure is summarized in Algorithm
A complete overview of our WMCopier
5 Evaluation
Datasets. To simulate real-world watermark forgery scenarios, train our diffusion model on Al-generated images and apply watermark forgeries to both Al-generated and real photographs. For Al-generated images, we use DiffusionDB (37 that contains diverse collection of images generated by Stable Diffusion 38 For real photographs, we adopt three widely-used datasets in computer
vision: MS-COCO
39 ImageNet [17), and CelebA-HQ [40].
Watermarking Schemes. We evaluate four watermarking schemes: three post-pros post-processing
in-processing method, Stable Signature 27 and a close-source watermark system, Amazon Each watermarking scheme evaluated using its official default configuration. A comprehensive description of these methods is
Becthods-DWT-DCEE [41], HiDDeN [42] and RivaGAN 43
included the Appendix C
Attack Parameters and Baselines. For the diffusion model, we adopt DDIM sampling DDIM sampling with total step T' 100 and perform inversion up step T's 40. Further details regarding the training of the diffusion model are provided in the Appendix For the refinement procedure, we set the trade-off coefficient À as 100, the number refinement iterations L 100, low-noise step tę in the refinement as I and the step size as 1 x 14 by default. To balance the attack performance and the potential cost of acquiring generated images (e.g., fees from GenAl services), we set the size of the auxiliary dataset D Dm,x to 5,000 in our main experiments. For comparison, we consider the method by Yang et al. [10] that operates under the same no-box setting as ours, and Wang et al. [16) that assumes black-box setting with access to paired watermarked and clean images.

---

No-Box
Attacks
Wang et al. [66]
Yang et al. 10
Ours
Watermark selemme
Dataset
PSNRT
Forged Bit-acef FPR
Forgel Bit-ace:1 KPRØ1O PSNRT
Forged Bit-ace-1 1PR@10
MS-C0CD
31.33
74.32%
57.20%
$2.87
53.08%
0.50%
33.69
89.195
60.21%
CelehAHQ
32,90
35.29
53.20%
DWT-DCT
ImageNet
30.16
79.64%
55.10%
$2.92
51.96%
0.30%
33.75
88. 25%
55.80%
Diffusiondh
32,90
0.40%
54.30%
MS-COCO 31,02
80.56%
77.60%
29.68
63.12%
0.00%
31.74
99 34%
95, 33.90%
HiddeN
CelchAHQ 31.57
29.79
0.00%
33.12
08S
50.
ImageNet 31.24
78.61%
83.90%
29.78
62.66%
0.00%
31.76
98. 99%9
94.30%
Diffusiondb
31.46
MS-COCO 32,94
93.26%
88, 80%
29.12
50.80%
0.00%
34,07
95. 74%
90. 9095
RiaGAN
CelebAHQ
29.23
96.00%
ImageNet 33.11
90.911%
71.40%
29.22
50.92%
0.00%
33.87
93. 93.83%
77, 10%
Diflusiondh 33.31
34.50
84.80%
MS ASCC 28.87
91.68%
88.90%
30.77
52.67%
0.00%
31.29
98. 04.04%
94.60%
Stable Signature
CelebAHQ
79.900
30.54
ImageNet 29,59
85.77%
85, 9055
30.75
$1.59%
0.00%
31.33
97 0.3%)
98. 60%
Diffusiondb
31.59
Average
31,50
84.3218
76.6-158
30.62
$1.525
0.08%
32.94
91.58%
83.71%
Table 1: Comparison of our WMCopier with two baselines on four open-source watermarking methods. The cells highlighted in indicate the highest values in each row for the corresponding metrics. Arrows indicate the desired direction of each metric (1 for higher values being better).
Metrics. We evaluate the visual quality of forged images using Peak Signal-to-Noise Ratio (PSNR), defined as PSNR(2, = -10 log [MSE(z, zi)) where x is the clean image and d'y is the forged image after the refinement process. A higher PSNR indicates better visual fidelity, i.e., the forged image is more similar to the original. We evaluate the attack effectiveness in terms of bit accuracy and false positive rate (FPR). Bit accuracy measures the proportion of watermark bits in the extracted message that match the target. FPR refers to the rate at which forged samples are incorrectly identified as valid watermarked images. A higher FPR thus indicates more successful attack. We report FPR at threshold calibrated to yield 10-6 false positive rate on clean images.
5.1 Attacks on Open-Source Watermarking Schemes
As shown in T our WMCopier achieves the highest forged bit accuracy and FPR across all watermarking schemes, even surpassing the baseline in the black-box setting. In terms of visual fidelity, all forged images exhibit PSNR above 30dB, demonstrating that our WMCopier effectively achieves high image quality. For the frequency-domain watermarking DWT-DCT, the bit accuracy is slightly lower compared other schemes. We attribute this to the inherent limitations of DWT-DCT, which originally exhibits low bit accuracy on certain images. A detailed analysis is presented in Appendix D.I
Forged Bit Accuracy Distribution
Watermark Scheme
Attack
Yang
[00
Ours
0.4
Ying
Dataset
PSNR" SRy/Con. PSNRT
SKP/Con.
Diffusiondh
23.42
29.09/2
32.57
1000%%/2.94
Amazon WM
MS-COCO
24.18
32.0%/
32.93
100.0%
ColebA-HO
24.10
42.0%/
31.84
100.0%
ImageNet
23.95
28.0%/2
32,88
99.0%/2.88
20%
90%
Table 2: Performance comparison of baseline and WMCopier on Amazon Watermark.
Bit-Accuracy
Figure 4: Comparison of forged bit accuracy distribution: Yang's 's method. vs. Ours.
5.2 Attacks on Closed-Source Watermarking Systems
In this subsection, we evaluate the effectiveness of our attack and Yang's 's method in attacking the Amazon watermarking scheme. The results are shown in Table 2 The success rate (SR), which represents the proportion of images detected as watermarked, and the confidence levels (Con.) returned by the API, are used to evaluate the effectiveness of the attacks on deployed watermarking systems. Compared with Yang's method, attack achieves superior performance in terms of
7

---

Effect of on PSNR and Bit-Accuracy (A 100)
Effect on PSNR and Bit-Accuracy (L 100)
(SN)(dB) Bit-Accuracy (%)
100
90
90
80
DWTT AR
80
DWVT DCT BRA
PSNR
Hildon PSAR
Hiddon PSEM
lidden Bt-Acc
liideen Acc
60
Rivatian PSNR
60
Rivalian PSNN
RhvaGan BR
RhcaGan
50
Stable Signature
PSNR((B)
50
40
Sgranure
40
Stynature
30
0
50
100
150
200
250
300
50
100
150
200
250
300
Figure 5: Effect of refinement iterations L (left) and trade off coefficient À (right) on PSNR and Bit-Accuracy under our forgery attacks, with fixed 17 10
both visual fidelity and forgery effectiveness. Specifically, our method achieves an average PSNR exceeding 30dB and a success rate(SR) close to 100%, whereas Yang's 's method typically results in PSNR values below 25dB and SR ranging from 28% to 42%.
Furthermore, our forged images generally receive a confidence level of the highest rating defined by Amazon's 's watermark detection API-while Yang's 's results consistently remain at level 2. Since Amazon does not disclose the exact computation of the confidence score, we guess that it may correlate with bit accuracy, based on common assumptions (29]. To further investigate this, we analyzed the distribution of forged bit accuracy of both our method and Yang's 's on a open-source watermarking scheme. As shown in Figure our method achieves over 80% bit accuracy on RivaGan, significantly outerrforming Yang's method, which remains below 70%.
5.3 Ablation Study
To evaluate the impact of parameter choices on image quality and forgery effectiveness, we conduct two sets of ablation studies by varying (i) the number of refinement optimization steps L and (ii) the trade-off coefficient A. As shown in Figure increasing initially improves both PSNR and forged bit accuracy. with performance saturating beyond L. = 100. In contrast, larger À values continuously enhance PSNR but lead slight degradation in bit accuracy, likely due to over-regularization While higher PSNR values generally indicate better visual fidelity, we note that visible artefacts may still occur even at elevated PSNR levels. Nevertheless, since an attacker may prioritize forgery success over perceptual quality, we adopt À = 100 in our main experiments. The results presented in further validate the effectiveness of the refinement process.
Table 11
Appendix E
5.4 Robustness
To investigate the robustness of the forged images, we evaluated its forged bit accuracy of genuine and forged watermarked images under common image distortions, including Gaussian noise, JPEG compression, Gaussian blur, and brightness adjustment. Since the Stable Signature does not support watermark embedding into arbitrary images, we instead report results on generated images. As shown in Table 3 the forged watermark generally exhibits slightly lower robustness compared the genuine watermark. While some cases show over 20% degradation (highlighted in red), relying on bit accuracy under distortion for separation is inadequate, as it would substantially compromise the true positive rate (TPR), as discussed in Appendix D.3
6 Related Work
6.1 Image Watermarking
Image watermarking techniques can generally be categorized into post-procsssing and in in-processing methods, depending on when the watermark is embedded.
Post-processing methods embed watermark messages into images after generation. Non-learning-
based methods (e.g., LSB 44), DWT-DCT [1 45) suffer from poor robustness under common
8

---

Distortion
JPEG
Blur
Gaussian Noise
Brightness
Watermark scheme
Dataset
Genuine
Forged
Genuine
Forged
Genuine
Forged
Genuine
Forged
MS-COCO
56.44%
53 00%
59.84%
56.56%
67.86%
66.90%
54.66%
58. 36%6%%
DWT-DCT
CelebAHQ
ImageNet
56.08%
55.42%
51. 51.14%
52.31%
59.37%
63.12%
58 28.26%
$4.39%
68.27%
64.84%
67.60%
66.49%
53.89%
54.08%
57.37%
57.71%
Diffusiondb
56.1
53.23%
62.12%
55.74%
66.90%
64.43%
54.73%
56.83%
MS-COCO
58.68%
58.06%
78.50%
71.95%
54.13%
49.55%
82.40%
78.99%
HiddeN
CelebAHQ
ImageNet
57.05%
58 86%
55.07%
83%
79.83%
78, 20%
69.07%
71.
54, 54.10%
48, 88.94%
46.02%
49.57%
83.63%
80.95%
77,4098
73.21%
Diffusiondb
58.57%
57 57.61%
79.69%
72.89%
54.41%
50.19%
81.53%
77. 77.66%
MS-COCO
99.44%
93. 93.32%
99.60%
94.99%
85.71%
75.00%
84.51%
78.81%
RivaGAN
CelebAHQ
99.92%
97 22%
99.97%
98, 23%
85 93%
74.83%
84.60%
79.53%
ImageNet
98.95%
92.00%
99 28%
93.89%
84, 95%
74.74%
82.77%
77.25%
Diflusiondb
96.56%
84.85%
97.27%
86.96%
77.33%
66,27%
79.14%
71.65%
MS MS-COCO
89 48%
68. 68%334%
67.14%
88.63%
StableSignature
CelebAHQ
93.99%
86. 73%6
86.91 %6
65.42%
73.78%
65.33%
92.30%
86.86%
NmtgeNet
87.73%
64,, 88%
61.79%
91.41%
Diffusiondb
85.69%
65.45%
%7.45%
Table 3: Bit Accuracy of the genuine watermark and the forged watermark under various image distortions. The distortion parameters are: Gaussian Noise (a 0.05), JPEG (quality=90), Blur (radius=1), l), and Brightness (factor=6). Cells with background indicate a degradation gap between 10% and 20%, and cells with background indicate a degradation gap greater than 20%.
distortions such as compression and noise. Neural network- approaches mitigate these issues by combining encoder-decoder architectures and adversarial training [42 46 However, these methods often rely on heavy training and may generalize poorly to unknown attacks.
In-processing methods embed watermarks during image generation, either by modifying train- ing data or model weights [19 49 [9], or by adjusting specific components such as diffusion
decoders (27]. Recent trends explore semantic watermarking, which binds messages to generative semantics (e.g., Tree-Ring (50): Gaussian shading (51).. However, semantic watermarking has
not seen real-world deployment [1]. We discuss the effectiveness of our attack on the semantic
watermarking in the Appendix D.2
6.2 Watermark Forgery
Kutter et al. (52 first introduced the concept, also known the watermark copy attack, under the assumption that the watermark signal was a fixed constant. While this assumption was reasonable for early handcrafted watermarking methods, it no longer holds for modern neural network- schemes. Subsequent studies [53] [6 (54] [4] have investigated watermark forgery under either white-box black-box settings, where the attacker either has full access to the watermarking model or can embed watermarks into their own images. However, these approaches still rely on strong assumptions that may not hold in realistic deployment scenarios.
In contrast, the no-box setting assumes that only watermarked images are available to the attacker, without access to the model embedding process. Yang al. [10] proposed heuristic method under this setting by estimating the watermark signal through averaging the residuals between watermarked and clean images, and subsequently re-embedding the estimated pattern the pixel level. This is the scenario we focus on in this work, as it more accurately reflects practical constraints.
7 Defense Analysis
To enhance the deployed watermarking system, we suggest modifying the existing watermark system by disrupting the ability of diffusion models to model the watermark distribution effectively, Specifically, we propose mullii-message strategy as simple yet effective countermeasure, Instead of embedding a fixed watermark message, the system randomly selects one from a predefined message pool m1, M2, My..... m for each image. During detection, the detector verifies the presence of any valid message in the pool. This strategy introduces uncertainty into the watermark signal, increasing the entropy of possible watermark patterns and making it substantially more difficult for generative models to learn consistent features necessary for forgery. We implement this defense using different message pool sizes (K 10, 50, 100) and test 100 images for simplicity.

---

As shown in the Table 4 increasing the value of K leads to the FPR drops to 0% at K = 50 and K 100. We further strengthen our attack by collecting more watermarked images. Specifically, we collect 5,000, 20,000, and 50,000 watermarked samples to evaluate the effect of data volume on this defense. As shown Table 12 the FPR remained consistently at 0% even the size of D increased. Therefore, embedding multiple messages proves to be simple yet effective countermeasure against our attack.
Table 4: Performance comparison across different K values.
K-10
Kw50
K=100
Dataset
PSNR Forged Bit-ace,f FPR@10-11 PSNR Forged Bit-ace.1 7PR@10-"
PSNR Forged Bit-acc.1 FPR@ 10 10-00
MS-COCO 34.73
81.63%
34.00%
34.62
69.78%
0.00%
34.86
71.56%
0.00%
CelebAHQ 36.13
83.41%
44.00%
35.89
71.00%
0.00%
35.87
72.91
0.00%
ImageNet 34.55
79.25%
25.00%
34.35
70.09%
0.00%
34.58
71.44%
0.00%
Diffusiondb 35.14
76.28%
17.00%
35.10
70.66%
0.00%
35.40
72.28%
0.00%
Table 5: Performance comparison across datasets with larger size of Dous for K 100.
5000
20000
50000
Dataset
PSNR Forged Bit-acc.1 FPR 10
PSNR Forged Bit-ace.1 FPR@11 10
PSNR Forged Bit-ace.1 FPR@ 10
MS-COCO 34.86
71.56%
0.00%
34.78
71.91%
0.00%
30.77
71.94%
0.00%
CelebA-HQ
35,87
72.91%
0.00%
34.15
72.97%
1.00%
27.99
72.72%
1.00%
ImageNet
71.44%
72.56%
72.19%
0.00%
DillusionDB
35.40
72.28%
0.00%
34.99
72.34%
0.00%
31.15
72.06%
0.00%
8
Conclusion
We propose WMCopier, a diffusion model-based watermark forgery attack designed for the no-box setting, which leverages the diffusion model to estimate the target watermark distribution and performs shallow inversion to forge watermarks on a specific image. We also introduce a refinement procedure that improves both image quality and forgery effectiveness. Extensive experiments demonstrate that WMCopier achieves state-of-the-ar performance on both open-source watermarking and real- world deployed systems. We explore potential defense strategies, multi-message strategy, offering valuable insights for the future development of AIGC watermarking techniques.
Acknowledge
We sincerely thank our anonymous reviewers for their valuable feedback and Amazon AGI's Respon- sible team for their prompt response. This paper is supported in part by the National Key Research and Development Program of China(2021 YFB3 2023YFB2904000 and 2023YFB2904001) the National Natural Science Foundation of China662441238, 62072395, U20A20178, 62172359 and 62472372), the Zhejiang Provincial Natural Science Foundation of China under Gran(LD224002000) the Key Research and Development Program of Hangzhou (tty(2024S7DAA27)) and the Key R&D Programme of Zhejiang Provinee(2025C02266),
References
[1] Kayleen Devlin and Joshua Cheetham. Fake trump amesst photos: How spot ai- ai-generated image. https://www bbc. wttp://bb...o///////orrr.r./oo/e us- 650699311 2023.
[2] Zhengyuan Jiang, Moyang Guo, Yuepeng Hu, and Neil Zhenqiang Gong. Watermark-based detection and attribution of ai- ti-generated content. arXiv preprint arXiv:2404.04254, 2024.
[3] Diane Bartz and Krystal Hu. Openai, google, others pledge to watermark ai content for safety, white house says. Scttp://www.reuteet thers-phee galeege-waterrmrr-aaiiee
-goolee-- howss-e223-00022222222
[4] Amazon. Watermark detection for amazon titan image generator now available in amazon bedrock. https://asxt aaat::::/aasaaaazonn... ctw
www.hhhtsseee//2/////////a/ k-detection amazon titan -
2024.
10

---

[5] Google Deepmind. Synthid: Identifying ai ai-generated content with synthid. nd. ht..goggl///ccmmoooggee///////// 2023. 2023..
https://deepmi
[6] Emilia David, Openai is adding new watermarks to dall-e 3. https://www.theveeree com
coeteeaaa-tttttt----eeeeeaaaaaaa 2024.
[7] Yusuf Mchdi
Announcing microsoft copilot, your everyday ai companion. com.///oooo.ccoooooo///2222222 http://////.///oooooomooooooooo/ 2023.
[8] Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai-generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1168-1181, 2023.
[9] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ily Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in Neural Information Processing Systems, 37:8643- 8672, 2024.
[10] Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks? Advances Neural Information Processing Systems, 37:56644-56673. 2024.
[1]] Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramer, et al. Sok: Watermarking for ai-generated content. arXiv preprint arXiv:2411. 2024.
[12] Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156, 2023.
[13] Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. arXiv preprint arXiv:23/2.0446) 2023.
[14] Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks semantic watermarks for diffusion models. arXiv preprint arXiv:2412.03283, 2024.
[15] Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks. arXiv preprint arXiv:2310.00076 2023.
[16] Ruowei Wang, Chenguo Lin, Qijun Zhao, and Feiyu Zhu. Watermark faker: towards forgery of digital image watermarking. In 2021 IEEE International Conference on Multimedia and Expo (ICME), pages 1-6. IEEE, 2021.
[17] Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJV), 115(3):2111255 252, 2015. doi: 10.1007/s1 -263-015-0816-..
[18) Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5253-5270, 2023.
[19] Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry S Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting. In International Conference on Learning Representations, 2021.
[20] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang. Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303, 10137, 2023.
[21] Zhenguang Liu, Chao Shuai, Shaojing Fan, Ziping Dong, Jinwu Hu, Zhongjie Ba, and Kui Ren. Harnessing frequency spectrum insights for image copyright protection against diffusion models. Proceedings of the Computer Vision and Pattern Recognition Conference, pages 18653-18662, 2025.
11

---

[22] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
[23] Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, pages 6038-6047, 2023.
[24] Xuan Ju, Ailing Zeng, Yuxuan Bian, Shaoteng Liu, and Qiang Xu. Direct inversion: Boosting diffusion-based editing with 3 lines of code. arXiv preprint arXIv:2310.01506, 2023.
[25] Wenda Li. Huijie Zhang, and Qing Qu. Shallow diffuse: Robust and invisible watermarking through low-dimensional subspaces in diffusion models. arXiv preprint arXiv:2410.21088. 2024.
[26] Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937-3963, 2024.
[27] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466-22477, 2023.
[28] StabilityAI. Stable diffusion github repository. ablediffusin
httres//gtaabb.oo//Sbbbiittt.t
[29] Nils Lukas and Florian Kerschbaum. {PTW): Pivotal tuning watermarking for (Pre-Trained) image generators. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2241- 2258, 2023.
[30] Promptbase.
https://promptbase.co com/ 2024.
[31] Prompthero. https://prompthhers wtwp://ooooomomccoooooeeeeeeeree
2024.
[32] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
[33] John J Vastlla. Generalization through variance: how noise shapes inductive biases in diffusion models. arXiv preprint arXiv:2504. 12532, 2025.
[34] Daniel Garibi, Or Patashnik, Andrey Voynov, Hadar Averbuch-Elow and Daniel Cohen-On Renoise:
Real image inversion through iterative noising. In European Conference on Computer Vision, pages 413. Springer, 2024.
[35] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
[36] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:201 1.14556,,.1 2020.
[37] Zijie Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. Diffusiondb: A large-scale prompt gallery dataset for text-to-image genera- tive models. arXiv preprint arXiv:2210. 14..99 2022.
[38] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[39] Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer VCCV 2014: 13th European Conference, Zurich, Switzerland, September 6- 12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
12

---

[40] Huaibo Huang, Ran He, Zhenan Sun, Tieniu Tan, et al. Introvae: Introspective variational autoencoders for photographic image synthesis. Advances neural information processing systems, 31, 2018.
[41] Ali Al-Haj. Combined dwt-dct digital image watermarking, Journal of computer science, 3(9): 740-746, 2007.
[42] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pages 657-672, 2018.
[43] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv: 1909.99090000 085, 2019.
[44] Deepshikha Chopra, Preeti Gupta, Gaur Sanjay, and Anil Gupta. Lsb based digital image watermarking for gray scale image. IOSR Journal of Computer Engineering, 6(1):36-41, 2012.
[45] K. A. Navas, Mathews Cheriyan Ajay, M. Lekshmi, Tampy S. Archana. and M. Sasikumar. DWT-DCT-SVD based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops ( (COMSWARE '08), pages 271-274. IEEE, January 2008
[46] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117-2126, 2020.
[47] Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang. and Weiming Zhang. PIMoG: Effective Screen-shooting Noise-Layer Simulation for Deep-Learning Based Watermarking Network. In Proceedings of the 30th ACM International Conference on Multimedia, pages 2267-2275, Lisboa Portugal, October 2022. ACM.
[48] Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, pages 41-49, 2021.
[49] Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution Training Data. 2021 IEEE/CVF International Conference Computer Vision (ICCV), pages 14428-14433 14437, Montreal, QC, Canada, October 2021. IEEE. ISBN 978-1-66544-812-5. doi: 10.10991CCV49922.0011 01418.
[50] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 2023.
[51] Zijin Yang. Kai Zeng, Kejiang Chen, Han Fang. Weiming Zhang, and Nenghai Yu. Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models, May 2024. Comment: 17 pages, 11 figures, accepted by CVPR 2024.
[52] Martin Kutter, Sviatoslav V Voloshynovskiy, and Alexander Herrigel. Watermark copy attack. In Security and Watermarking of Multimedia Contents II, volume 3971, pages 371-380. SPIE, 2000.
[53] Vitaliy Kinakh, Brian Pulfer, Yury Belousov, Pierre Fernandez, Teddy Furon, and Slava Voloshynovskiy. Evaluation of security of ml-based watermarking: Copy and removal at- tacks. arXiv preprint arXiv:2409.18211, 2024.
[54] Guanlin Li, Yifei Chen, Jie Zhang, Jiwei Li, Shangwei Guo, and Tianwei Zhang Warfare: Breaking the watermark protection of ai- ai-generated content. arXiv e-prints, pages arXiv-2310, 2023.
[55] Google Deepmind. Imagen 2.
13

---

[56] Amazon. Amazon titan foundation models generative ai. https: /as..//www.... www.aa.aaaa..... com cn/
[57]
Amazon. Amazon titan image generator and watermark detection api are now available ama- zon bedrock. https://aws amazon wwwmco//boo///aaaeaaaeeaaaaaee/e wwwpss/mmazz--aaae tinn image- gener ator- - and watermark detection. api are now available in- amazon bedrock/
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Please Section G
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model sell-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
The code will be available at the URL mentioned in the abstract.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer: [Yes]
Justification: The code will be available at the URL mentioned in the abstract. We use an open-source diffusion model and data, which are cited correctly in the main paper and the appendix.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines https://nips. cc/pu
/Lic/guides/ http:///eeemmmmmiiooooooooooe//e
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run reproduce the results. See the NeurIPS code and data submission guidelines (
https://nips httpiips.ccppbbciccc www.cccppcccaaececcceeeeee.eetle Beaplliigggiee//CCe http://ooddummissioooooeee
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Please see Appendix F and Section 5.3
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification; Error bars are not presented because it would be too computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emror bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
17

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please see Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer:
[Yes]
Justification:
The research conducted in the paper conform with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please Appendix
H
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: Please see Section 7
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All dotasets,codes and models we used are public and cited properly.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ cww/cooo/tt///e /et/atttsetsss has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
19

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
The code and data will be available at the URL mentioned in the abstract.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/cooe/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
20

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification:
The LLM is used only for writing.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer our LLM policy for what should or should not be described.
21

---

A
Algorithm
Algorithm WMCopier
Require:
Clean image x; Noise predictor eg of pretrained diffusion model Ma; Inversion steps Ts:
Refinement iterations L,; Low noise step f for refinement; Step size yi; Trade off coefficient A.
Ensure: Forged watermarked image x
IT. Inversion(2: Ts)#t Obtain noisy latent step Iss via DDIM inversion
TT - 2Ts Initial the start point of sampling
for t Ts, Ts - ,,.... do # DDIM sampling
a - (o((,,)
( x/-1 - var-1 (5/-VI-art) + v1 1--1--1
end for x
+ x
for 1 L. do Refinement
Sample 2 IO,
f()) Tt
vau (() VT-ai, Add noise to low noise step
x(++)) (1) + V V
(-vi-an
1
co(o)) (() ,tt) A ||x =x1??
end for return x (LL)
B Real-World Deployment
In line with commitments made to the White House, leading U.S. Al companies that provide generative AI services are implementing watermarking systems embed watermark information into model-generated content before it is delivered to users [3].
Google introduced SynthID [5]. which adds invisible watermarks both Imagen and Imagen 2 55 Amazon has deployed invisible watermarks on its Titan image generator 4
Meanwhile, OpenAl I and Microsoft are transitioning from metadata- based watermarking to invisible methods. OpenAl points out that invisible watermarking techniques are superior to the visible genre and metadata methods previously used in DALL-E 2 and DALL-E 3 [6], due to their imperceptibility and robustness to common image manipulations, such as screenshots, compression, and cropping. Microsoft has announced plans to incorporate invisible watermarks into Al-generated images in Bing 7 6 summarizes watermarking systems deployed in iext-to-image models.
Table 6: Watermarking deployment across major Gen-Al service providers.
Service Provider
Watermark
Generative Model
Deployed
Detector
OpenAl Google (SynthID)
Invisible Invisible Invisible
DALLLE 2 & DALLEE3
In Progress
Unknown
Imagen 2 Imagen 3
Deployed
Not Public
Microsoft
DALL-E 3 (Bing)
In Progress
Unknown
Amazon
Invisible
Titan
Deployed
Public
Watermark Schemes
C.1
Open-source Watermarking Schemes
is a classical watermarking technique that embeds watermark bits into the frequency domain of the image. It first applies the discrete wavelet transform (DWT) to decompose the image into sub-bands and then performs the discrete cosine transform (DCT) on selected sub-bands.
DWT-DCT, DWT-DCT 41
HiDDeN. HiDDeN 42 is a neural network-based watermarking framework using an encoder-decoder architecture. A watermark message is embedded into image via convolutional encoder, and
22

---

decoder is trained to recover the message. Additionally, a noise simulation layer is inserted between the encoder and decoder to encourage robustness.
RivaGAN. RivaGAN embeds watermark messages into video or image frames using GAN-based architecture. A generator network embeds the watermark into the input image, while discriminator ensures visual quality.
Stable Signature. As an in- in-processing watermarking technique, Stable Signature 27 couples the watermark message with parameters of the stable diffusion model. It is an invisible watermarking method proposed by Meta AI, which embeds unique binary signature into images generated by latent diffusion models (LDMs) through mee-tuning the model's decoder.
Setup. In our experiments, all schemes are evaluated under their default configurations, including the default image resolutions ( (128x128 for HiDDeN, 256x256 for RivaGAN, and 512x512 for both Stable Signature and Amazon), as well as their default watermark lengths (32 bits for DWT-DCT and RivaGAN, 30 bits for HiDDeN, and 48 bits for Stable Signature). With regard to PSNR, we report both the original PSNR of these schemes and the PSNR of our forged samples in Table
Table 7: PSNR of watermarking schemes and our forged samples
Scheme
DWT-DCT
HiddeN
RivaGAN
Stable Signature
PSNR (Original)
38.50
31.88 31.74
38.61 34.07
31.83
PSNR (Ours)
33.69
31.29
C.2 Closed-Source Watermarking System
Among the available options, Google does not open its watermark detection mechanisms to users, making it impossible to evaluate the success of our attack. In contrast, Amazon provides access to its watermark detection for the Titan model [56), allowing us to directly measure the performance of our attack. Therefore, we chose Amazon's 's watermarking scheme for our experiments. Amazon's watermarking scheme, referred as Amazon WM, ensures that Al-generated content can be traced back to its source. The watermark detection API detect whether image is generated by the Titan model and provides a confidence level for the detection This confidence level reflects the likelihood that the image contains valid watermark, as illustrated in Figure 6
In our experiments, we generated 5,000 images from the Titan model using Amazon Bedrock [57 Specifically, we used ten different prompts to generate images with the Titan model, which were then employed carry out our attack. The examples of prompts we used are listed in Figure 7 In this attack, we embedded Amazon's 's watermark onto four datasets, each containing 100 images. Finally, we submitted the forged images to Amazon's 's watermark detection API. Additionally, we forged Amazon's ss watermark on images from non-public datasets, including human-captured photos and web-sourced images, all of which were flagged as -tter-generated..
Results
determine image was generated using Image model, upload image above select analyze.
Watermark detected (Confidence: High)
Bedrock detected a watermark generated by the Titan Image Generator model ? on this image.
Figure 6: Result from Amazon's 's watermark detection API.
Both the Titan model API and the watermark detection service API accessible via Amazon Bedrock 57
23

---

A serene landscape nisty forest at sunrise, with golden 1ight filtering through the trees and caln river flowing in the foreground, ultra-realistic and soft lighting.
2. A futuristic cityscape at night, with glowing neon lights reflecting on wet streets, flying cars and towering skyscrapers, cyberpunk style, highly detailed.
najestic Hon standing proudly cliff sunset, dranatic orange and rolling hills in the background, hypor-realistic, high detail for texture.
4. abstract painting of swirling vibrant colors, reminiscent of Van Gogh's "starry Night', using bold brushstrokes and nix of blue, yellow, and white.
5. A beautiful, tranquil Japanese garden with koi pond, cherry blosson trees in full bloon, and traditional house, sunlight filtering through the branches.
and 7. A close-up of doverod spiderweb in the norning, with sunlight sparkling on the draplats, extranely detailed, sharp focus the texture and reflection.
dragon flying stormy sky in the background, highly detailed, dark fantasy style.
fantasy
nedieval castle,
rising
A peaceful 1928s Parisian street vieu, featuring cozy outdoor cafes, charning cobblestone pathways, and vintage buildings with intricate architecture.
9. astronaut standing the surface Nars, gazing at Earth distance, terrain and clear blue sky, photorealistic, high contrast.
rocky 10.A nagical winter wonderland with snow-covered trees, frozen lake reflecting the pale blue sky, and soft sunlight peeking through branches, ultra-realistic
Figure 7: Example prompts used for image generation with the Titan model.
D External Experiment Results
D.1 Further Analysis of DWT-DCT Attack Results
We observed that DWT-DCT suffers from low bit-accuracy on certain images, which leads to unreliable watermark detection and verification. To reflect more practical scenario, we assume that the service provider only returns images with high bit accuracy to users to ensure traceability. Specifically, we select 5,000 images with 100% bit accuracy to construct our auxiliary dataset D Dauz- We then apply both the original DWTDCT scheme and our attack to add watermarks to clean images from four datasets. As shown in Table our method achieves even higher bit-accuracy than the original watermarking process itself.
Table 8: Comparison of bit accuracy between original DWT-DCT and DWT-DCT (Ours).
DWTDCT-Oriignal
DWTDDCT-WMCopier
Dataset
Bit-acc.
FPR@ 10
Bit-acc.1
FPR@10-1
MS-COCO
82. 15%
56.60%
89.19%
60.20 %
CelebA-HQ
84.70%
54.70%
89.46 %
53.20% %
ImageNet
85.37%
55.30%
88.25%
55.80 %
DiffusionDB
82.42%
52.90%
85.17%
54.30 %
D.2 Semantic Watermark
Semantic watermarking 10 51 embeds watermark information that is intrinsically tied to the semantic content of the image. To further investigate the effectiveness of our attack on semantic watermarking, we compare it with the forgery attack proposed by Müller et al. [14), which is specifi- cally designed for semantic watermark schemes. We adopt Treering (50) as the target watermark. As shown in Table both our method and Müller's achieve a 100% false positive rate (FPR) under Treering's s default threshold 0.01. However, our method produces significantly higher forgery quality, with an average PSNR over 30 dB, compared to around 26 dB for Müller's.

---

We also evaluate Müller's method on non semantic watermark, Stable Signature. As summarized in T Müller's approach fails to attack this type of watermark, while our method maintains high success rate.
Table 9: Comparison with Müller et al. 14 and our attack on Treering.
Müller et al. [14]
Ours
Dataset
PSNR
FPR@0.00
PSNRT
P.R00.011
MS-COCO
26.14
100.00%
32.72
100.00%
CelebA-HQ
25.22
100.00%
31.52
100.00%
ImageNet
26.82
100.00%
32.99
100.00%
DiffusionDB
25.19
100.00%
32.78
100.00%
Table 10: Comparison with Müller et al. [4] and our attack on Stable Signature.
Müller et 14
Ours
Dataset
PSNR
Forged Bit-Ace.t FPR@ 10 Sf
PSNR
Forged Bit-Acc.f FPR@ 10 of
MS-COCO 25.66
45.70%
0.00%
31.29
98.04%
94.60%
CelebA-HQ 24.73
51.23%
0.00%
30.54
96.04%
100.00%
ImageNet 25.91
47.71%
0.00%
31.33
97.03%
98.60%
DiffusionDB
26.12
48.45%
0.00%
31.59
96.24%
96.60%
D.3 Discrimination of Forged Watermarks by Robustness Gap
While the robustness gap between genuine and forged watermarks offers a promising direction for detecting forged samples, we find it is insufficient for reliable discrimination. This limitation becomes particularly evident when genuine samples have already been subjected to mild distortions.
In discrimination, samples are classified forgeries if their bit accuracy falls below a predefined threshold и after applying single perturbation. Specifically, we apply perturbation A to both genuine and forged watermark images and then distinguish them based on their bit accuracy. However, considering the inherent robustness images have already undergone slight perturbation B, the bit accuracy values of genuine and forged samples become indistinguishable. For distortion A, we use Gaussian noise with o 0.05, while for distortion B, Gaussian noise with 0.02 is applied. The ROC curve and the bit-accuracy distribution for this case are shown Figure
watermarking scheme itself, when genuine watermarked
ROC Curve
Bit-Accuracy Distribution (KDE)
Genuine Forged
Mean: 75.57%
Mean: 79.24%
True Positive (TPR)
2.0
Density
1.5
0.4
0.2
ROC Curve (AUC 0.575)
Random guess
0.0
20%
40%
60%
80%
100%
Rate
Bit-Accuracy
Figure 8: ROC curve and bit accuracy distribution (KDE) for genuine and forged watermark samples under Gaussian noise.
25

---

E Additional Ablation Studies
Table I1 shows that the proposed refinement step substantially improves visual fidelity, as measured by PSNR, while simultancously enhancing forgery performance (forged-bit accuracy).
We also explore the impact of varying the size of Daux- Specifically, we use 1,000, 5,000, and 10,000 collected RivaGAN watermarked images. As shown in Table [2] larger Daux generally yields higher forged- bit accuracy and higher FPR across datasets. However, the improvement becomes marginal once the size of Daux reaches around 5,000, indicating that the attack performance saturates beyond this point.
Table 11: Impact of refinement forgery performance.
PSNR f
Forged Bit-acc. 1
FPRG @ 10 10-6+
Watermark Scheme
Ref.
Ref.
W/o Ref.
Ref.
W/o Ref.
W/ Ref.
DWT-DCT
32.40
33.77
63.03%
89.62%
16.00%
57.00 %
HiddeN
29.81
32.79
80.60%
99.40 %
89.00%
94.00 %
RivaGAN
31.89
34.03
89.90%
95.90 %
84.00%
96.00 %
StableSignature
25.60
31.27
97.58%
98.19% %
91.00%
98.00 %
Table 12: Performance comparison across datasets with different sizes of D Dava
1000
5000
10000
Dataset
PSNR Forged Bit-ace:f FPR 10
PSNRT Forged Bit-ace:1 FPR@10
PSNRT Forged Bit-ace:1 FPR@
MS-COCO
34.16
81.82%
80.70%
34.07
74%
96.40%
34.47
97.81%
96.30%
CelebA-HQ
35.74
89.10%
89.50%
35.28
98.61%
99.10%
35.25
98.63%
98.50%
ImugeNet
34.10
81.25%
71.50%
33.87
93.83%
94.90%
34.29
93.53%
95.80%
DiffusionDB
34.77
74.76%
64.10%
34.50
90.43%
91.20%
34.96
91.70%
93.60%
F
Training Details of the Diffusion Model
We adopt a standard DDIM framework for training, following the official Hugging Face tutoria The model is trained for 20,000 iterations with batch size of 256 and learning rate of 10 The entire training process takes roughly 40 A100 GPU hours. To support different watermarking schemes, only adjust the input resolution of the model match the input dimensions for each watermark. Other training settings and model configurations remain unchanged. Although the current training setup suffices for watermark forgery, enhancing the model's ability to better capture the watermark signal is left for future work. For our primary experiments, we train an unconditional diffusion model from scratch using 5,000 watermarked images. Due the limited amount of training data, the diffusion model demonstrates memorization (18), resulting in reduced sample diversity, as illustrated in Figure All of the experiments are conducted on an NVIDIA A100 GPU.
G Limitation
In this section, we discuss the limitations of our attack. While our current training paradigm already achieves effective watermark forgery, we have not yet systematically explored how to guide diffusion models better to capture the underlying watermark distribution. In this work, we employ a standard diffusion architecture without any specialized training strategies. We leave the exploration of alternative architectures and training schemes to future work. Moreover, understanding why different watermark types exhibit varying forgery and learning behaviors remains an open problem. Additionally, our method requires substantial amount of data and incurs training costs.
H Broader Impact
Invisible watermarking plays a critical role in detecting and holding accouttable Al-generated content, making it solution of significant societal importance. Our research introduces novel
'HugginFFace Tutorial:
ining
26

---

watermark forgery attack, revealing the vulnerabilities of current watermarking schemes to such attacks. Although our work involves the watermarking system deployed by Amazon, responsible researchers, we have worked closely with Amazon's Responsible Al team to develop solution, which has now been deployed. The Amazon Responsible Al team has issued the following statement:
"On March 28, 2025, we released an update that improves the watermark detection robustness of our image generation foundation models (Titan Image Generator and Amazon Nova Canvas), With this change, we have maintained our existing watermark detection accuracy. No customer action required. We appreciate the researchers from the State Key Laboratory of Blockchain and Data Security at Zhejiang University for reporting this issue and collaborating with us.'
While our study highlights the potential risks of existing watermarking systems, believe it plays positive role in the early stages of their deployment. By providing valuable insights for improving current technologies, work contributes enhancing the security and robustness of watermarking systems, ultimately fostering more reliable solutions with a positive societal impact.
Figure 9: Generated images from diffusion models trained on 5,000 watermarked images
27

---

I Forged Samples
rnd COMNSS BOOEES the Ingrts
18 TRSNS WTE SEROS NTRMERERR.
Necive
th an ua tre
aaleas is maaaha
agg finago hast
neas then pet
de iB los the
iies covelars
MOUNAIN
Figure 10: Examples of forged Amazon watermark samples on the DiffusionDB
28

---

Figure 11: Examples of forged Amazon watermark samples on the MS-COCO
29

---

O
URU
VA
EM
VAN
Figure 12: Examples of forged Amazon watermark samples the CelebA-HQ
30

---

EM NO
Trw
U.S. AIPS
E CORPS
ICN GTICK F
PEEL
STICK!
RIGA
Figure 13: Examples of forged Amazon watermark samples the ImageNet
31


Reviews:
[{"review_id": "lM6dEjrIDT", "reviewer": "Reviewer_VmnM", "summary": "This paper introduces WMCopier, a novel no-box watermark forgery attack targeting invisible watermarks in images generated by AI systems. Unlike prior methods requiring access to watermarking algorithms or paired data, WMCopier trains an unconditional diffusion model on collected watermarked images to estimate the watermark distribution. It then injects the estimated watermark into arbitrary clean images through a shallow inversion and refinement process, producing forged images that convincingly mimic genuine watermarked content. The authors demonstrate that WMCopier achieves high forgery success rates across multiple open-source and closed-source watermarking schemes, including Amazon’s system, while maintaining strong visual fidelity. The paper also explores potential defenses and analyzes the robustness of the forged watermarks.", "questions": "Please see the weaknesses.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "$\\textbf{Strengths:}$\n\n1 -- The paper presents a novel no-box watermark forgery attack that requires no prior knowledge of the watermarking scheme, addressing a realistic and challenging threat model.\n\n2 -- Extensive experiments demonstrate state-of-the-art performance across multiple watermarking schemes, including a deployed commercial system (Amazon Titan).\n\n3 -- The method is well-motivated and clearly presented, with thoughtful exploration of potential defenses and limitations, contributing valuable insights for improving watermark robustness.\n\n$\\textbf{Weaknesses:}$\n\n1 -- The paper does not compare WMCopier with semantic watermarking approaches like Tree-Ring and Gaussian Shading; these methods are now well-established rather than as claimed “early-stage,” and evaluating against them is essential given their relevance to forging semantic watermarks.\n\n2 -- It is unclear whether the proposed method requires training a separate diffusion model for each watermarking scheme or if a single diffusion model can generalize across multiple watermarks.\n\n3 -- As shown in the paper (Table 3), the forged watermarks exhibit significantly lower robustness to common image distortions than genuine ones, making them easy to break or reveal through routine post-processing and undermining the attack’s practicality in real-world use.\n\n4 -- The authors acknowledge in Appendix G that training on limited auxiliary datasets may cause diffusion models to memorize patterns, leading to potential overfitting. However, the paper lacks systematic evaluation of how this overfitting affects generalizability to images outside the training distribution, casting doubt on the claimed robustness in realistic scenarios.\n\n5 -- The authors should discuss or compare their approach with Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (Müller et al., 2024-- CVPR2025), which effectively forges semantic watermarks in a black-box setting; such a comparison is necessary to contextualize WMCopier’s strengths and limitations", "was_revised": true, "final_justification": "The authors have addressed several key concerns raised in the initial review. They clarified the training/testing split, corrected the TreeRing evaluation, and provided a fair comparison with Müller et al. While Müller’s method is slower, it avoids retraining and large watermarked datasets—offering practical advantages not discussed in depth in the original submission. Some issues remain partially addressed, such as scalability to higher resolutions and comparisons with other semantic watermarking methods like Gaussian Shading. However, the core contributions are now better supported. Given these improvements and the consensus among reviewers, I have raised my score to borderline accept.", "rebuttal": "Thank you very much for your valuable comments. Below, we carefully address each of your concerns in detail.\n\n#### **W1&W5.** \n1) The paper does not compare WMCopier with semantic watermarking approaches and compare their approach with Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (Müller et al., 2024-- CVPR2025), which effectively forges semantic watermarks in a black-box settings...such a comparison is necessary to contextualize WMCopier’s strengths and limitations.\n\n2) Semantic watermarking is now well-established rather than as claimed “early-stage”.\n#### **A1.** \nThank you for raising this issue. \n1) We previously evaluated attacks against the semantic watermarking method Treering, as discussed in Appendix E.1.\n    At that time, we were unable to attack it successfully. Upon revisiting our experiments, we realized that this was due to a mistake. We had overlooked that Treering uses a different definition of the true positive rate (TPR).\n    After correcting this issue, we found that our attack can successfully break the Treering watermark without any parameter tuning.\n    The FPR threshold is set according to the default used in the Treering paper, and we will release the updated model checkpoints on Treering soon. \n    Our attack results and the comparison with Müller’s black-box attack are as follows:\n\n    | Watermark Scheme | Dataset     | PSNR ↑ (Müller) | FPR@0.01 ↑ (Müller) | PSNR ↑ (Ours) | FPR@0.01 ↑ (Ours) |\n    |------------------|-------------|------------------|----------------------|----------------|--------------------|\n    | Treering         | MS-COCO     | 26.14            | 100.00%              | 32.72          | 100.00%            |\n    |                  | CelebAHQ    | 25.22            | 100.00%              | 31.52          | 100.00%            |\n    |                  | ImageNet    | 26.82            | 100.00%              | 32.99          | 100.00%            |\n    |                  | Diffusiondb | 25.19            | 100.00%              | 32.78          | 100.00%            |\n\n    As shown above, our method achieves a consistently higher image quality while maintaining the same success rate(FPR). \n\n    Their method is primarily tailored for semantic watermarking and has not been validated on invisible watermarking schemes, making its general applicability unclear. In contrast, our method has demonstrated effectiveness on both semantic and invisible watermarks. While their approach is relatively lightweight in terms of computation, our WMCopier involves training a diffusion model, which introduces some computational cost. However, this cost is modest (e.g., 40 A100 GPU hours for 256×256 images), and enables broader applicability and higher success rates across a range of watermarking schemes.\n\n2) Regarding the use of the term \"early-stage,\" our intention was to refer to watermarking methods that have emerged in the past two to three years and are still relatively few in number. We appreciate you pointing this out and will revise the wording to use a more accurate and appropriate expression.\n\n#### **W2.** \nIt is unclear whether the proposed method requires training a separate diffusion model for each watermarking scheme.\n\n#### **A2.** \nThank you for your comment.\n\nOur approach does require training a separate diffusion model for each watermarking scheme.\nHowever, as discussed in our threat model, we assume the reasonable scenario that service providers do not frequently change the watermarking scheme in practice. \nThe cost of performing our attack is also modest: for 256 × 256 images, training our attack model takes roughly 40 A100‑GPU hours.\nGiven the potential value an adversary could gain by forging a provider’s watermark, this one‑time cost remains relatively modest.\n\n#### **W3.** \nAs shown in the paper (Table 3), the forged watermarks exhibit significantly lower robustness to common image distortions than genuine ones, making them easy to break or reveal through routine post-processing and undermining the attack’s practicality in real-world use.\n\n#### **A3.**\nThank you for your comment. \n\nWe agree that forged watermarks sometimes achieve slightly lower bit‑accuracy than genuine ones after common image distortions; in our experiments, this gap is typically less than 10 percentage points.\nHowever, such a small gap is difficult to exploit in practice. Any detection threshold low enough to catch most forged images would likely also reject many genuine watermarked images that have undergone compression or noise, thereby reducing the true positive rate required for robustness.\nFor example, a genuine watermark that has been JPEG-compressed may yield a similar bit-accuracy as a forged watermark under the same distortion.\nWe further analyze this in Appendix D.2, where we plot ROC curves for distinguishing between genuine and forged watermarks under typical distortions. The resulting AUCs are close to 0.5, indicating that the robustness gap is insufficient for reliably filtering out forgeries.\n\n#### **W4.** \nThe paper lacks systematic evaluation of how this overfitting affects generalizability to images outside the training distribution.\n\n#### **A4.**\nThank you for your comment. This is also something we consider important.\n\nTherefore, we have considered the generalization issue in our main experiments by ensuring that the training and testing data come from different distributions.\nTo evaluate generalization, we train the forgery model on AI-generated images from the DiffusionDB training set and test it on both the DiffusionDB test set and three real-world datasets (MS-COCO, ImageNet, and CelebA-HQ) that differ significantly in distribution.\nPlease see Section 5 for detailed dataset settings.\nThanks to our shallow diffusion design and subsequent refinement step, our method performs consistently well across all datasets as shown in Table 1 of the main paper."}, {"review_id": "UXLnh10wpD", "reviewer": "Reviewer_1Fpt", "summary": "This paper shows a forgery attack on image watermarks. That is, the attack takes a dataset of watermarked images, and uses an unconditional diffusion model to embed a watermark in a clean image of the attacker’s choice. This attack is “no-box” in that it requires no knowledge of the watermarking scheme being used, nor query access to a watermarking algorithm or detector. It uses only the dataset of watermarked images. The paper includes a large suite of experiments showing effectiveness of the attack. In particular, it shows that the attack is successful at forging Amazon’s closed-source watermark, which is verifiable using a public detection API.\n\nThe attack involves training a diffusion model to learn the watermark. The attacker first maps a clean image to its latent representation, then uses the watermark-incorporated diffusion model to denoise it. This denoising process may introduce some artifacts into the clean image, and the paper introduces several optimizations to minimize this distortion. The attacked images are visually very similar to the original clean images.", "questions": "- Section 2.2 suggests a bit that all image watermarks involve embedding a fixed message. As mentioned above, certain schemes such as the PRC watermark vary the embedded message. It would be helpful to mention that the class of “fixed-message” watermarks considered in this work is in fact a restricted subclass of schemes.\n- How does the attack success vary with the size of the dataset of watermarked images?\n- The attack is quite powerful in that it operates in the no-box setting. While query access to a watermarked image generator would help the attacker in theory, it’s not clear to me how the attacker can actually use this access. In developing your attack, did you gain any insight on what kinds of queries would be helpful for the attacker to make in that setting?", "limitations": "Yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- This paper has comprehensive experiments showing the effectiveness of the attack on several different watermarking schemes, and it also includes a comparison to the attack of Yang et al., which it outperforms.\n- The paper shows real-world impact of the attack, by forging Amazon’s closed-source watermark.\n- The paper is very clearly written, and includes potential defenses as well as the attack.\n\nWeaknesses\n- The attack seems to apply only to image watermarks that work by embedding a fixed message in every image. Some image watermarks, such as the PRC watermark, instead vary this message. It is not clear whether the attack would work here.\n\nOverall, this is a clearly written paper that shows a meaningful attack with comprehensive experiments backing it up.", "was_revised": true, "final_justification": "Overall, this is a clearly written paper that shows a meaningful attack with comprehensive experiments backing it up. It shows real-world impact by forging Amazon's watermark. The authors satisfactorily addressed my questions in the rebuttal. \n\nWhile the attack does not fully extend to schemes that vary the message, the paper does consider this case and the authors are running further experiments for the PRC watermark. While I am doubtful that the attack will work against the PRC watermark, the attack against fixed-message schemes is already a significant contribution. I recommend acceptance.", "rebuttal": "We thank you for your positive feedback and we have carefully addressed the raised concerns in the responses below.\n\n#### **W1&Q1.** \nSome image watermarks, such as the PRC watermark, instead vary this message. It is not clear whether the attack would work here.\n\n#### **A1.**\nThank you for your comment. \nWe are still conducting experiments on the PRC watermark and will update the results as soon as they are available.\nIn the meantime, we have performed similar experiments on watermarking schemes with varied messages as a potential defense, as described in Appendix E.2.\nIn particular, we varied the watermark message over 10, 50, and 100 values. \nWe found the success rate of our attack decreased as message diversity increased, dropping to approximately 87%, 77%, and 75%, respectively.\nHowever, we also found that increasing the number of watermarked images in the training set significantly mitigates this performance drop.\nFor example, when the number of watermarked samples was increased to 20,000, the attack success rate recovered to around 90%.\nPlease refer to Tables 7 and  8 for detailed results.\nWe hope this helps address your concern.\n\n#### **Q2.** \nHow does the attack success vary with the size of the dataset of watermarked images?\n\n#### **A2.**\nThank you for raising this important point.\n\nWe evaluated our method using watermark datasets of 1,000, 5,000, and 10,000 images, as shown in the results below (with dataset sizes indicated in parentheses). We will add it in our revision.\n\n| Watermark Scheme |Dataset|PSNR(1k)|Forged bitacc.(1k)|FPR@0.05(1k)|PSNR(5k)|Forged bitacc.(5k)|FPR@0.05(5k)|PSNR(10k)|Forged bitacc.(10k)|FPR@0.05(10k)|\n|-|-|-|-|-|-|-|-|-|-|-|\n| RivaGan |MS-COCO|34.16|81.82%|86.80%|34.07|95.74%|100.00%|34.47|97.81%|100.00%|\n|         |CelebAHQ|35.74|89.10%|98.70%|35.28|98.61%|100.00%|35.25|98.63%|99.80%|\n|         |ImageNet|34.10|81.25%|83.70%|33.87|93.83%|100.00%|34.29|93.53%|95.60%|\n|         |Diffusiondb|34.77|74.76%|67.30%|34.50|90.43%|97.40%|34.96|91.70%|98.60%|\n\n\n#### **Q3.** \nWhile query access to a watermarked image generator would help the attacker in theory, it’s not clear to me how the attacker can actually use this access. In developing your attack, did you gain any insight on what kinds of queries would be helpful for the attacker to make in that setting?\n\n#### **A3.**\nThank you for the insightful question.\n\nThe most direct way to access watermarked images is to use the image generation service provided by the AI company.\nFor example, in our attack on Amazon's watermarking scheme, we used their product Titan text-to-image model, in the same way as a normal user.\nThe detailed setup is described in Appendix C.2. \n\nBased on our empirical observations, using a diverse set of prompts instead of repeatedly using a single prompt tends to yield better attack performance.\nThis is likely because diverse image content helps the diffusion model better isolate the watermark signal, which remains relatively consistent across samples.\nWe are currently further exploring effective query strategies, and we believe this represents an important and promising direction for future research."}, {"review_id": "HHDb8o6GzU", "reviewer": "Reviewer_JXkv", "summary": "The paper presents WMCopier, a no-box watermark-forgery attack that requires no knowledge of, nor access to, the target watermarking algorithm. The attacker merely gathers already-watermarked images produced by a generative-AI service. WMCopier proceeds in three stages: 1. Watermark estimation (Train an unconditional diffusion model on the scraped watermarked images, leveraging the systematic prediction bias that watermark signals add to the model’s noise estimates); 2. Watermark injection (Perform a shallow DDIM inversion (≈ 40 steps of 100) so the latent retains semantic content of any clean image, then run the forward denoising trajectory to let the learned bias imprint the watermark); 3. Refinement (Iteratively optimize the forged image with a score-matching term and an MSE term to reduce artifacts while preserving fidelity).", "questions": "See Weaknesses. If my concerns are thoroughly addressed, I would be pleased to further increase my score. Conversely, if the evaluation remains incomplete, I may lower the score accordingly.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "## Strengths\n1. It is a no-box attack.\n2. The method is simple and effective.\n\n## Weaknesses\n1. The watermarking techniques used to be forged are outdated, particularly the post-processing methods, which were developed five years ago (e.g., Hidden 2018, RivaGan 2019). It remains uncertain whether WMCopier can effectively counter modern post-processing watermarks, such as TrustMark (2023) [1] and VINE (2025) [2]. To ensure a more comprehensive evaluation, experiments involving at least VINE should be included in Tables 1 and 3, as well as Figure 5.\n\n2. How long is the message in the test setting? Is it 32 bits? The ablation study on message pool sizes does not specify bit length.\n\n3. The method requires training one unconditional diffusion model for forging each watermarking method, which could be expensive compared with the baseline [3]. How many A100 GPU hours are required for forging one watermarking model?\n\n4. The training dataset consists of 5,000 images, which is smaller than the amount typically required to train a standard diffusion model. As noted by the authors, this limited size may lead to overfitting and memorization. Is the test set distinct from the training set? How well does this method generalize? I was unable to find these details in the paper, and I’m unsure if I overlooked them.\n\n[1] [TrustMark: Universal Watermarking for Arbitrary Resolution Images](https://github.com/adobe/trustmark)\n\n[2] [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://github.com/Shilin-LU/VINE)\n\n[3] Can simple averaging defeat modern watermarks?", "was_revised": true, "final_justification": "Thank you very much for your effort and thorough response. \n\nI have carefully read all the review comments as well as the authors’ responses. I believe the authors have adequately addressed my concerns, and I have raised my score.", "rebuttal": "Thank you for your insightful comments and constructive feedback. We address your questions and concerns point by point below.\n\n#### **W1.** \nIt remains uncertain whether WMCopier can effectively counter modern post-processing watermarks, such as TrustMark (2023) [1] and VINE (2025) [2]. To ensure a more comprehensive evaluation, experiments involving at least VINE should be included...\n#### A1.\nThank you very much for pointing out several newly proposed watermarking algorithms.\n\nWe are also very interested in evaluating whether our method remains effective against these new watermarking schemes.\nDue to time constraints, we have only tested the effectiveness of our attack against the VINE (2025). \nThe results are provided below, and we will include them (Table 1,Table 3,and Figure 5) in the updated version of our paper.\n\n| Watermark Scheme | Dataset     | PSNR ↑ | Forged Bit-Accuracy ↑ | FPR@0.05 ↑ |\n|------------------|-------------|--------|------------------------|-------------|\n| VINE             | MS-COCO     | 30.07  | 73.81%                 | 72.90%      |\n|                  | CelebAHQ    | 29.21  | 69.43%                 | 68.80%      |\n|                  | ImageNet    | 31.08  | 71.13%                 | 69.10%      |\n|                  | DiffusionDB | 31.19  | 69.93%                 | 68.90%      |\n\nOur results on VINE were not as strong as those on other watermarking benchmarks.\nWe attribute this to the fact that VINE is based on SDXL-Turbo, whose model size is significantly larger than that of typical watermarking algorithms. This enables it to embed longer watermarks with stronger robustness.\nAs a result, our relatively lightweight diffusion model may struggle to approximate or replicate such complex watermark embeddings.\nWe are considering employing more advanced diffusion architectures with greater capacity, which we leave for future work.\n\n#### **W2.** \nHow long is the message in the test setting? Is it 32 bits? The ablation study on message pool sizes does not specify bit length.\n#### **A2.**\nThank you for the question, and sorry for the confusion.\n\nIn our test setting, we follow the default message lengths of each watermarking scheme: 32 bits for DWT-DCT and RivaGAN, 30 bits for HiddeN, and 48 bits for Stable Signature.\nFor the ablation study on message pool sizes, we used RivaGAN, whose default message length is 32 bits.\n\n#### **W3.** \nThe method requires training one unconditional diffusion model for forging each watermarking method, which could be expensive compared with the baseline [3]. How many A100 GPU hours are required for forging one watermarking model?\n#### **A3.**\nThank you for you comment.\n\nOur method is indeed more expensive compared to baseline(a simple averaging based approach).\nHowever, baseline is largely ineffective in practice, achieving only around 11% average success rate and thus posing little real threat to deployed watermarking schemes.\nIn contrast, our approach achieves strong performance using a minimal diffusion architecture. For 256×256 images, training the model requires approximately 40 A100 GPU hours.\nGiven the potential value an adversary could gain by forging a provider’s watermark, this one‑time cost remains relatively modest.\n\n#### **W4.** \nIs the test set distinct from the training set? How well does this method generalize?\n#### **A4.**\nSorry for the confusion.\n1) We have considered the generalization issue in our main experiments by ensuring that the training and testing data come from different distributions. \nSpecifically, we train the forgery model on AI-generated images from the DiffusionDB training set, and test it on both the DiffusionDB test set and three real-world datasets (MS-COCO, ImageNet, and CelebA-HQ) that differ significantly in distribution.\nPlease see Section 5 for detailed dataset settings.\n\n2) As shown in Table 1, our method maintains high PSNR and forged bit accuracy even when evaluated on test sets that are significantly different from the training data (e.g., human faces in CelebA-HQ), \ndemonstrating its strong generalization ability."}, {"review_id": "22C8gdLCAA", "reviewer": "Reviewer_aB9i", "summary": "The submission proposes what is known in the watermarking community as a *copy attack*: thanks to the observation of some watermarked contents, the attacker can imitate the watermark in the sense that he can watermark any piece of content illegally.\nIn the context of GenAI, this is a way to pretend that an original image is indeed AI-generated.", "questions": "- What is the impact of the FPR?\n- What is the PSNR of the considered watermark embedding?\n- How the attack (learning a diffusion process) compares to other alternatives (statistical analysis ou learning a proxy watermark decoder)?\n- How the performances of the attack (sucess rate vs. distortion) vary with the number of observed watermarked contents?", "limitations": "Limitations are poorly handled within 5 lines in Appendix H. The main limitation (the attack does not apply to semantic watermarking) is obvious.", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "# Strengths\n1. The paper brings additional proof that new watermarking schemes are not secure.\n\n2. Appendix E.2 is very interesting. It is really a pity that the study gets interesting so late. Investigating defenses against a proposed attack is a sign of soundness.\n\n# Weakness\n1. **No reference to watermarking history**\n\nDigital watermarking is an old science (dates back to 1995), so is the art of attacking it. The copy attack was invented in 2000, and since then, defenses and more complex attacks have been proposed. This history is not mentioned (not a single citation).\nPlease read\nhttps://en.wikipedia.org/wiki/Copy_attack\n\nFor instance\n   - All the references about watermarking are less than 7 years old, except the worst watermarking papers I know [3] [34]. \n   - Works on copy attack and defenses proposed in the 2000s are ignored\n   - The terminology of watermarking security is ignored. No need for new wordings like \"black box\" or \"no box\". The type of attacks (WOA      - Watermark Only Attack / KOA - Known Original Attack / KMA ... ) has been defined a long time ago. There are many papers, surveys, books about watermarking security. Please, use the long-established terminology.\n\nLine 261: \"*Classical approaches like LSB, DWT-DCT suffer from poor robustness*\" These are not good representatives of classical approaches. Why not compare to *Broken Arrows* (used in international challenges)?\n\nLine 456: the same holds. DWT-DCT is a very poor technique which is not a representative of classical watermarking techniques. \n\n 2. **FPR=5% Is this watermarking?**\n\nThe introduction mentions the application of detecting AI-generated content. This implies a very low False Positive Rate, at most $10^{-6}$. FPR=5% is extraordinarily high and absolutely unrealistic. **I strongly disagree** with line 211: \"*Following common practice [30], [...] 5% false positive rate*\". It turns out that [30] has only 21 citations. I am not sure this paper is a reference for common practices.\n\nThe problem is that this choice impacts the experimental results a lot.\n\nFor instance, I propose the following attack: Do nothing special. Its distortion is remarkably low (PSNR = $\\inf$) and its success rate equals the FPR, ie. already 5%. The higher the FPR, the higher the success rate of any copy-attack.\n\n3. **Attack Distortion**\n\nSeveral times, the paper claims that the attack \"*introduces only slight artifacts*\". See caption Fig. 3. , line 216, line 244.\nI can clearly see the attack artefacts in Fig. 9, 10, 11, 12 and Fig. 3 last line. Just look at flat, uniform regions, such as the sky.\n**I strongly disagree** with line 244:\n> Given that PSNR values above 30 dB are generally considered visually indistinguishable to the human eye a PSNR above 30dB means high perceptual quality.\n\nNo, typical values in image compression range between 30 and 50dB, where 30dB is for a very poor lossy compression scheme and 50dB is a pristine quality. I say that 40dB is acceptable for watermarking if a perceptual mask based on a Human Visual System model is employed, like Watson, Just-Noticeable-Difference etc.\n\nMoreover, the watermark distortion is not given in the text. Since the authors believe that 30dB is acceptable, perhaps the attack is learned from watermarked images with a high watermarking strength. This facilitates the attack.\n\n4. **Comparison**\n\nThere are two alternatives:\n- Old attacks are based on averaging (what [47] rediscovered), as well as more elaborate processes such as PCA or ICA. Please read\n*Watermarking security: theory and practice*, Teddy Furon, François Cayre, Caroline Fontaine, 2005. This submission only compares with averaging. BTW, I am not convinced by the argument of line 46. The averaging attack is limited because it only works against watermarking schemes where the watermark signal is constant (from one image to another) or almost.\n- Learn a proxy watermark detector from the observed watermarked images and run an adversarial example attack to add or remove watermarking. Here are some references:\n\nA transfer attack to image watermarks, arXiv:2403.15365\n\nThe Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis, arXiv:2412.02576\n\n5. **Lack of analysis**\n\nAs noted in Sect. 4.1, $x^w = x + w$. It would be better to write $x^w = x + w(x)$ for a state-of-the-art (ie. side-informed watermark embedding) zero-bit watermarking scheme. The real question is whether the learned diffusion will capture the dependency of w w.r.t. x.\n\nIf the scheme is not SotA and just adds a constant watermark signal (like DCT-DWT), then a simple averaging reveals this secret signal. There is no need for learning a diffusion process. Indeed, it is questionable that the proposed attack does not work so well on such a simple scheme. I also disagree with Line 46. This simple baseline, if well-executed (for instance, by removing low-frequency components before averaging), works well. However, if the watermark signal w depends on x (like in any SotA watermarking scheme) then the averaging makes no sense.", "was_revised": true, "final_justification": "After discussing with the authors, and especially reading their list of commitments, I raise my score.", "rebuttal": "We sincerely thank you for your insightful comments and constructive feedback. Your review has helped us better refine and clarify our work.\n\n#### **W1.** \nNo reference to watermarking history.\n#### **A1.**\nThank you for the detailed and insightful feedback.\nWe sincerely apologize for overlooking the part of history of classical digital watermarking and the well-established taxonomy used in the community. \nIn the revised version, we will update the Related Work section to include classical literature you mentioned and adopt the long-standing terminology.\nAdditionally, we will revise inaccurate claims about methods (e.g., LSB, DWT-DCT).\n\n#### **W2&Q1.** \nFPR=5% Is this watermarking? What is the impact of the FPR?\n#### **A2.**\nThank you for your insightful comment.\nTo address the your concern, we have conducted additional experiments under stricter operating points (e.g., FPR = $10^{-6}$) and confirmed that our method maintains strong performance. \nBenefiting from our high bit accuracy, our method maintains a strong forgery success rate even under a stricter evaluation setting (FPR = $10^{-6}$), which requires a much higher number of matching bits for a watermark to be considered valid.\nSpecifically, our approach achieves an average success rate of over 80%, while the baseline method by Yang et al. fails almost entirely under the same criterion.\nThe results are as follow:\n\n| Watermark Scheme| Dataset| PSNR ↑ (Yang) | Forged Bit-Acc ↑ (Yang) | FPR@10-6 ↑ (Yang) | PSNR ↑ (Ours) | Forged Bit-Acc ↑ (Ours) | FPR@10-6 ↑ (Ours) |\n|-|-|-|-|-|-|-|-|\n|DWT-DCT|MS-COCO|32.87|53.08%|0.50%|33.69|89.19%|60.20%|\n||CelebAHQ|32.90|53.68%|0.10%|35.29|89.46%|53.20%|\n||ImageNet|32.92|51.96%|0.20%|33.75|88.25%|55.80%|\n||Diffusiondb|32.90| 51.59%|0.40%|33.84|85.17%|95.30%|\n|HiddeN| MS-COCO|29.68|63.12%|0.00%|31.74|99.34%|95.90%|\n||CelebAHQ| 29.79|61.52%|0.00%|33.12|98.08%|92.50%|\n||ImageNet| 29.78|62.66%|0.00%|31.76|98.99%|94.30%|\n||Diffusiondb|29.68|63.36%|0.00%|31.46|98.83%|94.60%|\n|RivaGAN| MS-COCO|29.12|50.80%|0.00%|34.07|95.74%|90.90%|\n||CelebAHQ|29.23|52.29%|0.00%|35.28|98.61%|96.00%|\n||ImageNet|29.22|50.92%|0.00%|33.87|93.83%|77.10%|\n||Diffusiondb|29.12|48.70%|0.00%|34.50|90.43%|84.80%|\n|Stable Signature|MS-COCO|30.77|52.67%|0.00%|31.29|98.04%|94.60%|\n||CelebAHQ|30.51|51.73%|0.00%|30.54|96.04%|100.0%|\n||ImageNet|30.75|51.59%|0.00%|31.33|97.03%|98.60%|\n||Diffusiondb|30.65|52.69%|0.00%|31.59|96.24%|96.60%|\n|**Average**||**30.62**|**54.52%**|**0.08%**|**32.94**|**94.58%**|**83.71%**|\n\n\n\n#### **W3&Q3.** \n1) The watermark distortion is not given in the text. What is the PSNR of the considered watermark embedding?\n2) I can clearly see the attack artefacts in Fig. 9, 10, 11, 12 and Fig. 3 last line. Just look at flat, uniform regions, such as the sky.\n3) I strongly disagree with line 244...\n\n#### **A3.**\nThank you for your comment. \n1) To clarify, we report the PSNR of the original watermarking schemes and our forgery on the MS‑COCO dataset below. For Stable Signature, we include the PSNR of its generated outputs, as it is not a post-processing method.\n\n|Method|DWT-DCT|HiddeN|RivaGan|Stable Signature|\n|-|-|-|-|-|\n| PSNR (Original)|38.50|31.88|38.61|31.83|\n| PSNR (Ours)|33.69|31.74|34.07|31.29 |\n\nAs shown in the table, the PSNR values of our forged images are very close to those of the original watermarking schemes. The largest difference is less than 5 dB.\n\n2) You also mentioned visible traces in some forged samples from Amazon, especially in background regions such as the sky. \nWhile our forged images may exhibit slightly lower PSNR compared to the originals, we did not observe obvious visual artifacts in other watermarking schemes.\nTo understand this better, we examined the original images watermarked by Amazon. \nWe found that similar minor traces also appear in the originals, particularly in low-texture areas like sky or flat color regions.\n\n3) We will also revise the inappropriate wording in line 244. Thank you for pointing it out.\n\n\n#### **W4&Q3.** \n1) Old attacks are based on averaging, as well as more elaborate processes such as PCA or ICA in Watermarking security. \n2) Learn a proxy watermark detector from the observed watermarked images and run an adversarial example attack to add or remove watermarking. \n\n#### **A4.**\nThank you for your comment. \n1) Following [1], we used PCA and ICA to estimate the carriers of the watermark signal, \nand then applied an averaging method to forge the RivaGan watermark. \nAs the results show, baseline remains difficult to successfully forgery even with techniques such as PCA and ICA.\nWe believe this may be because RivaGan does not embed a constant watermark, which aligns with the reason you mentioned.\n\n    |Method|Dataset|PSNR|Forged bit-accuracy|FPR@5%|\n    |-|-|-|-|-|\n    |RivaGAN|MS-COCO|30.23|53.73%|3.20%|\n    ||CelebAHQ|30.16|54.92%|4.10%|\n    ||ImageNet|31.12|50.11%|1.40%|\n    ||Diffusiondb|30.51|48.49%|0.60%|\n\n2) We reviewed the learing proxy model based method you suggested and attempted to reproduce it. \nThis approach [2] involves training 100 proxy watermark models (with different architectures and watermark messages), and then generating adversarial examples against these proxy models, hoping they will generalize to the real watermark model. \nHowever, this method is designed specifically for watermark removal, adapting this method for watermark forgery (i.e., generating targeted adversarial examples) would be challenging.\nIn particular, practical forgery attack assumes no knowledge of the target watermark message, making it difficult to define an appropriate target watermark message for each proxy decoder within their framework.\nAs noted in Reference [3], their reproduction of [2] also focused solely on watermark removal rather than forgery.\n\nWe also attempted to train a binary classifier to identify ... with architecture Restnet18 and Restnet34 as a proxy watermark detector and perform PGD attack, the results are as follow:\n\n|Proxy Model|Watermark Scheme|PSNR|Forged Bit-Accuracy|FPR@5%|\n|-|-|-|-|-|\n|ResNet-18|RivaGan (MSCOCO)|33.21|47.97%|0.00%|\n|ResNet-34|RivaGan (MSCOCO)|34.19|49.86%|0.00%|\n\n[1] Watermarking security: theory and practice.\n\n[2] A Transfer Attack to Image Watermarks. \n\n[3] The Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis.\n\n#### **W5.** \n1) As noted in Sect. 4.1, it would be better to write \\( x^w = x + w(x) \\).\n2) The argument of line 46 is not convincing... If the scheme is not SotA and just adds a constant watermark signal (like DCT-DWT), then a simple averaging reveals this secret signal. \n3) This simple baseline, if well-executed (for instance, by removing low-frequency components before averaging), works well.\n\n#### **A5.**\nThank you for your comment.\n1) We agree that the expression \\( x^w = x + w(x) \\) is better, and we will revise our formulation in Section 4.1.\n\n2) We acknowledge that the statement in line 46 may have been imprecise, and we will revise it accordingly.\nAt the same time, we would like to clarify our original intention.\nWe believe that using ImageNet samples as substitutes for the clean counterparts is another reason for the limited effectiveness of the baseline method. \nEven if the watermark signal is constant, using the true clean counterparts yields significantly better results compared to using unrelated natural images such as those from ImageNet. \nAdditionally, for watermarking schemes such as DWT-DCT, even when the embedded message remains the same, the actual residual added to each image is not constant due to differences in the image content. This explains why the baseline averaging-based attack performs poorly in our setting. \nAs you rightly mentioned, while such baselines can be effective on constant watermark signals, our method still demonstrates strong performance on more advanced, learning-based watermarking schemes.\n\n3) To investigate the effect of removing low-frequency components, we applied Gaussian filtering prior to averaging, using kernel sizes of 7 and 13 with \\(\\sigma\\) values of 1 and 2, respectively, to suppress low-frequency components. The results on the DWT-DCT watermark are reported below.\n\n    | Dataset|PSNR(k=7)|Forged Bit-Acc (k=7)|FPR@5% (k=7)|PSNR (k=13)|Forged Bit-Acc (k=13)|FPR@5% (k=13)|\n    |-|-|-|-|-|-|-|\n    |MS-COCO|36.19|50.64%|2.20%|32.47|50.17%|3.10%|\n    |CelebAHQ|36.24|50.72%|2.20%|32.57|50.12%|2.80%|\n    |ImageNet|36.67|50.64%|2.20%|32.94|49.99%|2.30%|\n    |Diffusiondb|36.13|50.26%|2.30%|32.42|49.77%|2.90%|\n\n    We will continue to explore whether there are better parameter settings to improve the baseline’s performance. \n    If you have any suggestions or insights, we would greatly appreciate your guidance.\n\n#### **Q4.**\nHow the performances of the attack (sucess rate vs. distortion) vary with the number of observed watermarked contents?\n#### **A6.**\nThank you for raising this important point.\nWe evaluated our method using watermark datasets of 1,000, 5,000, and 10,000 images, as shown in the results below (with dataset sizes indicated in parentheses). \n\n| Watermark Scheme |Dataset|PSNR(1k)|Forged bitacc.(1k)|FPR@0.05(1k)|PSNR(5k)|Forged bitacc.(5k)|FPR@0.05(5k)|PSNR(10k)|Forged bitacc.(10k)|FPR@0.05(10k)|\n|-|-|-|-|-|-|-|-|-|-|-|\n| RivaGan |MS-COCO|34.16|81.82%|86.80%|34.07|95.74%|100.00%|34.47|97.81%|100.00%|\n|         |CelebAHQ|35.74|89.10%|98.70%|35.28|98.61%|100.00%|35.25|98.63%|99.80%|\n|         |ImageNet|34.10|81.25%|83.70%|33.87|93.83%|100.00%|34.29|93.53%|95.60%|\n|         |Diffusiondb|34.77|74.76%|67.30%|34.50|90.43%|97.40%|34.96|91.70%|98.60%|"}]

Author rebuttal:

Meta-review: The manuscript proposes ​​WMCopier​​, the first effective no-boxwatermark forgery attack, training a diffusion model on watermarked images to forge target watermarks into arbitrary images without algorithm access. It is novel, effective, and well evaluated. The reviewer's concerns are mostly about missing modern schemes comparison, generalization and some inaccurate terminology. The authors addressed these concerns by adding new results and clearly clarify their limitations. Based on the rebuttal process, I recommend acceptance of this manuscript.
Decision: Accept (poster)