DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory

• URL: http://arxiv.org/abs/2609.08213v1
• Date: Tue, 08 Sep 2026 03:54:17 GMT
• Title: DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory
• Abstract summary: Diffusion watermarking embeds verifiable signals into the generative process.<n>We propose DRIFT, a black-box attack that combines partial forward diffusion with reverse resampling.<n>Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success and the best image quality.
• Score: 9.706332101916248
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Diffusion watermarking embeds verifiable signals into the generative process and commonly verifies them by recovering trajectory-dependent evidence, making the marks robust to conventional pixel-space distortions. Existing removal attacks either regenerate along deterministic trajectories, which often preserve the watermark-bearing latent structure, or optimize every image separately. We identify the reliance on a recoverable generative trajectory as a common attack surface among the schemes we study. Based on this observation, we propose DRIFT, a black-box attack that combines partial forward diffusion with stochastic reverse resampling. Forward re-noising limits source information available to a fixed-depth recovery pipeline, while stochastic reversal supplies alternative noise-driven paths whose removal benefit we isolate through matched sampler comparisons. Adaptive DRIFT searches a selected ladder for each image's first verifier-rejected rung and refines fidelity while retaining only updates rejected by the same verifier. At fixed depth, we derive information-theoretic and Wasserstein source-dependence bounds; under realized-ladder monotonicity, the first rejected rung is least distorted among rejected rungs on that ladder, and verifier-gated refinement preserves rejection. Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success and the best image quality among the compared attacks, without secret keys, verifier internals, or per-image gradient optimization.

Related papers

• Scale-Consistent Posterior Dynamics for Diffusion Inverse Problems [16.685352002333225]
  Posterior sampling with a pretrained diffusion prior is governed by a conditional score whose likelihood component is generally intractable.<n>We show that a noise-conditioned path whose targets approach the clean posterior produces a continuous surrogate SDE.<n>Experiments on FFHQ and ImageNet with 100 score evaluations demonstrate competitive reconstruction fidelity for superresolution and deblurring.
  arXiv  Detail & Related papers  (2026-08-15T09:38:41Z)
• TIGA: Trajectory-Injected Generative Attack against Black-box AIGC Detectors [76.4118981404995]
  Trajectory-Injected Generative Attack (TIGA) is a source-image-free and training free framework that generates detector-evasive images.<n>TIGA steers the latent Denoising Diffusion Implicit Model (DDIM) trajectory so that adversarial properties emerge during generation.<n>TIGA achieves strong blackbox attack performance, transferability, and high robustness under common post-processing operations.
  arXiv  Detail & Related papers  (2026-07-28T15:51:39Z)
• DOC-GS: Dual-Domain Observation and Calibration for Reliable Sparse-View Gaussian Splatting [80.43237927269575]
  In this paper, we revisit sparse-view 3DGS reconstruction from a new perspective.<n>We identify the core challenge as the unobservability of Gaussian primitive reliability.<n>Motivated by this observation, we propose a unified Dual-domain Observation and geometrics in rendered images framework.
  arXiv  Detail & Related papers  (2026-04-08T07:01:24Z)
• SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark [9.706332101916248]
  Diffusion-based watermarking methods embed marks by manipulating the initial noise or the reverse diffusion trajectory.<n>We propose SHIFT, a training-free attack that exploits this common weakness across diverse watermarking paradigms.<n>We show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.
  arXiv  Detail & Related papers  (2026-03-31T13:39:37Z)
• Where, What, Why: Toward Explainable 3D-GS Watermarking [24.13795691386156]
  3D Gaussian Splatting is the de facto representation for interactive 3D assets.<n>We present a representation-native framework that separates where to write from how to preserve quality.<n>Compared with state-of-the-art methods, our approach achieves a PSNR improvement of +0.83 dB and a bit-accuracy gain of +1.24%.
  arXiv  Detail & Related papers  (2026-03-09T18:05:27Z)
• ForensicsSAM: Toward Robust and Unified Image Forgery Detection and Localization Resisting to Adversarial Attack [56.0056378072843]
  We show that highly transferable adversarial images can be crafted solely via the upstream model.<n>We propose ForensicsSAM, a unified IFDL framework with built-in adversarial robustness.
  arXiv  Detail & Related papers  (2025-08-10T16:03:44Z)
• Active Adversarial Noise Suppression for Image Forgery Localization [56.98050814363447]
  We introduce an Adversarial Noise Suppression Module (ANSM) that generate a defensive perturbation to suppress the attack effect of adversarial noise.<n>To our best knowledge, this is the first report of adversarial defense in image forgery localization tasks.
  arXiv  Detail & Related papers  (2025-06-15T14:53:27Z)
• Deep priors for satellite image restoration with accurate uncertainties [4.879530644978008]
  We propose a generic method involving a single network to restore images from several sensors.<n>VBLE-xz is a scalable method to get realistic posterior samples and accurate uncertainties.<n>SatDPIR is a compelling alternative to direct inversion methods when uncertainty is not required.
  arXiv  Detail & Related papers  (2024-12-05T12:56:03Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Deblurring via Stochastic Refinement [85.42730934561101]
  We present an alternative framework for blind deblurring based on conditional diffusion models. Our method is competitive in terms of distortion metrics such as PSNR.
  arXiv  Detail & Related papers  (2021-12-05T04:36:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.