SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark

• URL: http://arxiv.org/abs/2603.29742v2
• Date: Wed, 01 Apr 2026 13:47:16 GMT
• Title: SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark
• Abstract summary: Diffusion-based watermarking methods embed marks by manipulating the initial noise or the reverse diffusion trajectory.<n>We propose SHIFT, a training-free attack that exploits this common weakness across diverse watermarking paradigms.<n>We show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.
• Score: 9.706332101916248
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Diffusion-based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose $\underline{\mathbf{S}}$tochastic $\underline{\mathbf{Hi}}$dden-Trajectory De$\underline{\mathbf{f}}$lec$\underline{\mathbf{t}}$ion ($\mathbf{SHIFT}$), a training-free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark-embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise-space, frequency-domain, and optimization-based paradigms show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.

Related papers

• DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory [9.706332101916248]
  Diffusion watermarking embeds verifiable signals into the generative process.<n>We propose DRIFT, a black-box attack that combines partial forward diffusion with reverse resampling.<n>Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success and the best image quality.
  arXiv  Detail & Related papers  (2026-09-08T03:54:17Z)
• Hidden in Plain Tokens: Simply Robust, Gradient-Free Watermark for Synthetic Audio [58.612001688217056]
  Inference-time watermarks for autoregressive models are unfit for continuous modalities due to discretization inconsistencies.<n>We propose an elegant solution for powerful and robust watermarking of synthetic audio.
  arXiv  Detail & Related papers  (2026-05-25T15:43:20Z)
• Gaussian Shannon: High-Precision Diffusion Model Watermarking Based on Communication [4.347817782863135]
  Diffusion models generate high-quality images but pose serious risks like copyright violation and disinformation.<n>We propose a watermarking framework that treats the diffusion process as a noisy communication channel.<n>Our method embeds watermarks in the initial Gaussian noise without fine-tuning or quality loss.
  arXiv  Detail & Related papers  (2026-03-27T08:34:53Z)
• SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking [13.169581979130058]
  Watermarking the initial noise of diffusion models has emerged as a promising approach for image provenance.<n>Recent semantic-aware watermarking methods improve robustness by conditioning verification on image semantics.<n>We propose $underlinetextbfS$emantic $underlinetextbfL$atent $underlinetextbfI$njection via $underlinetextbfC$ompartmentalized $underlinetextbfE$m.
  arXiv  Detail & Related papers  (2026-03-13T07:49:01Z)
• OSI: One-step Inversion Excels in Extracting Diffusion Watermarks [56.210696479553945]
  We propose One-step Inversion (OSI), a significantly faster and more accurate method for extracting Gaussian Shading style watermarks.<n>OSI reformulates watermark extraction as a learnable sign classification problem, which eliminates the need for precise regression of the initial noise.<n>Our OSI substantially outperforms the multi-step diffusion inversion method: it is 20x faster, achieves higher extraction accuracy, and doubles the watermark payload capacity.
  arXiv  Detail & Related papers  (2026-02-10T07:43:16Z)
• T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models [89.29541056113442]
  T2SMark is a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS)<n>We evaluate T2SMark on diffusion models with both U-Net and DiT backbones.
  arXiv  Detail & Related papers  (2025-10-25T16:55:55Z)
• DiffMark: Diffusion-based Robust Watermark Against Deepfakes [49.05095089309156]
  Deepfakes pose significant security and privacy threats through malicious facial manipulations.<n>Existing watermarking methods often lack sufficient robustness against Deepfake manipulations.<n>We propose a novel robust watermarking framework based on diffusion model, called DiffMark.
  arXiv  Detail & Related papers  (2025-07-02T07:29:33Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models [71.13610023354967]
  Copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. We propose a diffusion model watermarking technique that is both performance-lossless and training-free.
  arXiv  Detail & Related papers  (2024-04-07T13:30:10Z)
• Attack-Resilient Image Watermarking Using Stable Diffusion [24.40254115319263]
  We present ZoDiac, which uses a pre-trained stable diffusion model to inject a watermark into the trainable latent space. We find that ZoDiac is robust against state-of-the-art watermark attacks, with a watermark detection rate above 98% and a false positive rate below 6.4%. Our research demonstrates that stable diffusion is a promising approach to robust watermarking, able to withstand even stable-diffusion-based attack methods.
  arXiv  Detail & Related papers  (2024-01-08T21:42:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.