Title: WMCopier: Forging Invisible Watermarks on Arbitrary Images
Venue: NeurIPS 2025
Accepted: yes
Keywords: AI-generated content Watermarking; Forgery Attack;
Abstract: Invisible Image Watermarking is crucial for ensuring content provenance and accountability in generative AI. While Gen-AI providers are increasingly integrating invisible watermarking systems, the robustness of these schemes against forgery attacks remains poorly characterized. This is critical, as forging traceable watermarks onto illicit content leads to false attribution, potentially harming the reputation and legal standing of Gen-AI service providers who are not responsible for the content. In this work, we propose WMCopier, an effective watermark forgery attack that operates without requiring any prior knowledge of or access to the target watermarking algorithm. Our approach first models the target watermark distribution using an unconditional diffusion model, and then seamlessly embeds the target watermark into a non-watermarked image via a shallow inversion process. We also incorporate an iterative optimization procedure that refines the reconstructed image to further trade off the fidelity and forgery efficiency. Experimental results demonstrate that WMCopier effectively deceives both open-source and closed-source watermark systems (e.g., Amazon’s system), achieving a significantly higher success rate than existing methods. Additionally, we evaluate the robustness of forged samples and discuss the potential defense against our attack. Code is available at: https://github.com/holdrain/WMCopier.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe submission proposes what is known in the watermarking community as a *copy attack*: thanks to the observation of some watermarked contents, the attacker can imitate the watermark in the sense that he can watermark any piece of content illegally.\nIn the context of GenAI, this is a way to pretend that an original image is indeed AI-generated.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n1. The paper brings additional proof that new watermarking schemes are not secure.\n\n2. Appendix E.2 is very interesting. It is really a pity that the study gets interesting so late. Investigating defenses against a proposed attack is a sign of soundness.\n\n# Weakness\n1. **No reference to watermarking history**\n\nDigital watermarking is an old science (dates back to 1995), so is the art of attacking it. The copy attack was invented in 2000, and since then, defenses and more complex attacks have been proposed. This history is not mentioned (not a single citation).\nPlease read\nhttps://en.wikipedia.org/wiki/Copy_attack\n\nFor instance\n   - All the references about watermarking are less than 7 years old, except the worst watermarking papers I know [3] [34]. \n   - Works on copy attack and defenses proposed in the 2000s are ignored\n   - The terminology of watermarking security is ignored. No need for new wordings like \"black box\" or \"no box\". The type of attacks (WOA      - Watermark Only Attack / KOA - Known Original Attack / KMA ... ) has been defined a long time ago. There are many papers, surveys, books about watermarking security. Please, use the long-established terminology.\n\nLine 261: \"*Classical approaches like LSB, DWT-DCT suffer from poor robustness*\" These are not good representatives of classical approaches. Why not compare to *Broken Arrows* (used in international challenges)?\n\nLine 456: the same holds. DWT-DCT is a very poor technique which is not a representative of classical watermarking techniques. \n\n 2. **FPR=5% Is this watermarking?**\n\nThe introduction mentions the application of detecting AI-generated content. This implies a very low False Positive Rate, at most $10^{-6}$. FPR=5% is extraordinarily high and absolutely unrealistic. **I strongly disagree** with line 211: \"*Following common practice [30], [...] 5% false positive rate*\". It turns out that [30] has only 21 citations. I am not sure this paper is a reference for common practices.\n\nThe problem is that this choice impacts the experimental results a lot.\n\nFor instance, I propose the following attack: Do nothing special. Its distortion is remarkably low (PSNR = $\\inf$) and its success rate equals the FPR, ie. already 5%. The higher the FPR, the higher the success rate of any copy-attack.\n\n3. **Attack Distortion**\n\nSeveral times, the paper claims that the attack \"*introduces only slight artifacts*\". See caption Fig. 3. , line 216, line 244.\nI can clearly see the attack artefacts in Fig. 9, 10, 11, 12 and Fig. 3 last line. Just look at flat, uniform regions, such as the sky.\n**I strongly disagree** with line 244:\n> Given that PSNR values above 30 dB are generally considered visually indistinguishable to the human eye a PSNR above 30dB means high perceptual quality.\n\nNo, typical values in image compression range between 30 and 50dB, where 30dB is for a very poor lossy compression scheme and 50dB is a pristine quality. I say that 40dB is acceptable for watermarking if a perceptual mask based on a Human Visual System model is employed, like Watson, Just-Noticeable-Difference etc.\n\nMoreover, the watermark distortion is not given in the text. Since the authors believe that 30dB is acceptable, perhaps the attack is learned from watermarked images with a high watermarking strength. This facilitates the attack.\n\n4. **Comparison**\n\nThere are two alternatives:\n- Old attacks are based on averaging (what [47] rediscovered), as well as more elaborate processes such as PCA or ICA. Please read\n*Watermarking security: theory and practice*, Teddy Furon, François Cayre, Caroline Fontaine, 2005. This submission only compares with averaging. BTW, I am not convinced by the argument of line 46. The averaging attack is limited because it only works against watermarking schemes where the watermark signal is constant (from one image to another) or almost.\n- Learn a proxy watermark detector from the observed watermarked images and run an adversarial example attack to add or remove watermarking. Here are some references:\n\nA transfer attack to image watermarks, arXiv:2403.15365\n\nThe Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis, arXiv:2412.02576\n\n5. **Lack of analysis**\n\nAs noted in Sect. 4.1, $x^w = x + w$. It would be better to write $x^w = x + w(x)$ for a state-of-the-art (ie. side-informed watermark embedding) zero-bit watermarking scheme. The real question is whether the learned diffusion will capture the dependency of w w.r.t. x.\n\nIf the scheme is not SotA and just adds a constant watermark signal (like DCT-DWT), then a simple averaging reveals this secret signal. There is no need for learning a diffusion process. Indeed, it is questionable that the proposed attack does not work so well on such a simple scheme. I also disagree with Line 46. This simple baseline, if well-executed (for instance, by removing low-frequency components before averaging), works well. However, if the watermark signal w depends on x (like in any SotA watermarking scheme) then the averaging makes no sense.\n\nQUESTIONS:\n- What is the impact of the FPR?\n- What is the PSNR of the considered watermark embedding?\n- How the attack (learning a diffusion process) compares to other alternatives (statistical analysis ou learning a proxy watermark decoder)?\n- How the performances of the attack (sucess rate vs. distortion) vary with the number of observed watermarked contents?\n\nLIMITATIONS:\nLimitations are poorly handled within 5 lines in Appendix H. The main limitation (the attack does not apply to semantic watermarking) is obvious.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents WMCopier, a no-box watermark-forgery attack that requires no knowledge of, nor access to, the target watermarking algorithm. The attacker merely gathers already-watermarked images produced by a generative-AI service. WMCopier proceeds in three stages: 1. Watermark estimation (Train an unconditional diffusion model on the scraped watermarked images, leveraging the systematic prediction bias that watermark signals add to the model’s noise estimates); 2. Watermark injection (Perform a shallow DDIM inversion (≈ 40 steps of 100) so the latent retains semantic content of any clean image, then run the forward denoising trajectory to let the learned bias imprint the watermark); 3. Refinement (Iteratively optimize the forged image with a score-matching term and an MSE term to reduce artifacts while preserving fidelity).\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n1. It is a no-box attack.\n2. The method is simple and effective.\n\n## Weaknesses\n1. The watermarking techniques used to be forged are outdated, particularly the post-processing methods, which were developed five years ago (e.g., Hidden 2018, RivaGan 2019). It remains uncertain whether WMCopier can effectively counter modern post-processing watermarks, such as TrustMark (2023) [1] and VINE (2025) [2]. To ensure a more comprehensive evaluation, experiments involving at least VINE should be included in Tables 1 and 3, as well as Figure 5.\n\n2. How long is the message in the test setting? Is it 32 bits? The ablation study on message pool sizes does not specify bit length.\n\n3. The method requires training one unconditional diffusion model for forging each watermarking method, which could be expensive compared with the baseline [3]. How many A100 GPU hours are required for forging one watermarking model?\n\n4. The training dataset consists of 5,000 images, which is smaller than the amount typically required to train a standard diffusion model. As noted by the authors, this limited size may lead to overfitting and memorization. Is the test set distinct from the training set? How well does this method generalize? I was unable to find these details in the paper, and I’m unsure if I overlooked them.\n\n[1] [TrustMark: Universal Watermarking for Arbitrary Resolution Images](https://github.com/adobe/trustmark)\n\n[2] [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://github.com/Shilin-LU/VINE)\n\n[3] Can simple averaging defeat modern watermarks?\n\nQUESTIONS:\nSee Weaknesses. If my concerns are thoroughly addressed, I would be pleased to further increase my score. Conversely, if the evaluation remains incomplete, I may lower the score accordingly.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper shows a forgery attack on image watermarks. That is, the attack takes a dataset of watermarked images, and uses an unconditional diffusion model to embed a watermark in a clean image of the attacker’s choice. This attack is “no-box” in that it requires no knowledge of the watermarking scheme being used, nor query access to a watermarking algorithm or detector. It uses only the dataset of watermarked images. The paper includes a large suite of experiments showing effectiveness of the attack. In particular, it shows that the attack is successful at forging Amazon’s closed-source watermark, which is verifiable using a public detection API.\n\nThe attack involves training a diffusion model to learn the watermark. The attacker first maps a clean image to its latent representation, then uses the watermark-incorporated diffusion model to denoise it. This denoising process may introduce some artifacts into the clean image, and the paper introduces several optimizations to minimize this distortion. The attacked images are visually very similar to the original clean images.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- This paper has comprehensive experiments showing the effectiveness of the attack on several different watermarking schemes, and it also includes a comparison to the attack of Yang et al., which it outperforms.\n- The paper shows real-world impact of the attack, by forging Amazon’s closed-source watermark.\n- The paper is very clearly written, and includes potential defenses as well as the attack.\n\nWeaknesses\n- The attack seems to apply only to image watermarks that work by embedding a fixed message in every image. Some image watermarks, such as the PRC watermark, instead vary this message. It is not clear whether the attack would work here.\n\nOverall, this is a clearly written paper that shows a meaningful attack with comprehensive experiments backing it up.\n\nQUESTIONS:\n- Section 2.2 suggests a bit that all image watermarks involve embedding a fixed message. As mentioned above, certain schemes such as the PRC watermark vary the embedded message. It would be helpful to mention that the class of “fixed-message” watermarks considered in this work is in fact a restricted subclass of schemes.\n- How does the attack success vary with the size of the dataset of watermarked images?\n- The attack is quite powerful in that it operates in the no-box setting. While query access to a watermarked image generator would help the attacker in theory, it’s not clear to me how the attacker can actually use this access. In developing your attack, did you gain any insight on what kinds of queries would be helpful for the attacker to make in that setting?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces WMCopier, a novel no-box watermark forgery attack targeting invisible watermarks in images generated by AI systems. Unlike prior methods requiring access to watermarking algorithms or paired data, WMCopier trains an unconditional diffusion model on collected watermarked images to estimate the watermark distribution. It then injects the estimated watermark into arbitrary clean images through a shallow inversion and refinement process, producing forged images that convincingly mimic genuine watermarked content. The authors demonstrate that WMCopier achieves high forgery success rates across multiple open-source and closed-source watermarking schemes, including Amazon’s system, while maintaining strong visual fidelity. The paper also explores potential defenses and analyzes the robustness of the forged watermarks.\n\nSTRENGTHS AND WEAKNESSES:\n$\\textbf{Strengths:}$\n\n1 -- The paper presents a novel no-box watermark forgery attack that requires no prior knowledge of the watermarking scheme, addressing a realistic and challenging threat model.\n\n2 -- Extensive experiments demonstrate state-of-the-art performance across multiple watermarking schemes, including a deployed commercial system (Amazon Titan).\n\n3 -- The method is well-motivated and clearly presented, with thoughtful exploration of potential defenses and limitations, contributing valuable insights for improving watermark robustness.\n\n$\\textbf{Weaknesses:}$\n\n1 -- The paper does not compare WMCopier with semantic watermarking approaches like Tree-Ring and Gaussian Shading; these methods are now well-established rather than as claimed “early-stage,” and evaluating against them is essential given their relevance to forging semantic watermarks.\n\n2 -- It is unclear whether the proposed method requires training a separate diffusion model for each watermarking scheme or if a single diffusion model can generalize across multiple watermarks.\n\n3 -- As shown in the paper (Table 3), the forged watermarks exhibit significantly lower robustness to common image distortions than genuine ones, making them easy to break or reveal through routine post-processing and undermining the attack’s practicality in real-world use.\n\n4 -- The authors acknowledge in Appendix G that training on limited auxiliary datasets may cause diffusion models to memorize patterns, leading to potential overfitting. However, the paper lacks systematic evaluation of how this overfitting affects generalizability to images outside the training distribution, casting doubt on the claimed robustness in realistic scenarios.\n\n5 -- The authors should discuss or compare their approach with Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (Müller et al., 2024-- CVPR2025), which effectively forges semantic watermarks in a black-box setting; such a comparison is necessary to contextualize WMCopier’s strengths and limitations\n\nQUESTIONS:\nPlease see the weaknesses.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-06"}