Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery

• URL: http://arxiv.org/abs/2609.12909v1
• Date: Fri, 11 Sep 2026 14:35:42 GMT
• Title: Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
• Abstract summary: We reproduce the Reprompt forgery attack of Mller et al. against Tree-Ring on Stable Diffusion XL.<n>We detect genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 s per attack.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Semantic watermarking schemes such as Tree-Ring hide a detectable pattern in the initial noise latent of a diffusion model. Recent work shows these watermarks are not only removable but forgeable: an attacker who never sees the watermarking key can still produce images the genuine detector accepts. We reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring on Stable Diffusion XL, using the authors' released code, on free-tier dual T4 GPUs with 14.6 GB of usable memory per device, substantially less per-GPU memory than the A40 hardware used in the original study. The attack reproduces. Over six trials of three arms we detect genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 s per attack. Three further results came out of running it under constraint. The released detector computes a non-central $χ^2$ statistic and hands back only its CDF, so we recovered the discarded statistic; our recovery matches the released detector exactly, and two natural scores built from it separate the forged arm from the clean null at AUC 0.861 and 0.972 on the same eighteen observations. Running SDXL in half precision requires patching the pipeline's direct autoencoder calls, and a controlled probe confirms the patched path leaves the detector statistic unchanged. Finally, we report a prediction we made from reading the detector source that our measurements then contradicted. The notebook, the pinned fork and every measurement artifact are released with the paper.

Related papers

• Explaining AI-Image Detection: What the Heatmap Actually Shows [65.01025489527173]
  We build a detector and attach an attribution map as its evidence.<n>We measure what that pair delivers on 186,527 images under controls.<n>Whether an attribution ranking exists at all depends on whether the detector reacts to the image.
  arXiv  Detail & Related papers  (2026-07-31T16:07:05Z)
• The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection [5.288260916272508]
  Provenance watermarking is increasingly treated as a safeguard for synthetic speech.<n>We identify a previously uncharacterized liability: when synthetic speech is watermarked and human speech is not, detectors trained alongside latch onto the watermark as a spurious "mark fake" shortcut.<n>We show that retraining with the watermark on both classes decorrelates it and restores clean behavior.
  arXiv  Detail & Related papers  (2026-06-22T13:42:31Z)
• Retrying vs Resampling in AI Control [0.42970700836450476]
  We study retrying from an AI control perspective, which treats the model as potentially adversarial.<n>We find that while retrying reduces honest suspicion scores, the untrusted model can exploit monitor rationale to construct sneakier attacks.
  arXiv  Detail & Related papers  (2026-05-25T17:10:41Z)
• Watermarking and Anomaly Detection in Machine Learning Models for LORA RF Fingerprinting [0.0]
  We present a stronger RFFI system combining watermarking for ownership proof and anomaly detection for spotting suspicious inputs.<n>On the LoRa dataset, our system achieves 94.6% accuracy, 98% watermark success, and 0.94 AUROC, offering verifiable, tamper-resistant authentication.
  arXiv  Detail & Related papers  (2025-09-18T17:21:33Z)
• Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Models [52.877452505561706]
  We propose the first copyright evasion attack specifically designed to undermine dataset ownership verification (DOV)<n>Our CEAT2I comprises three stages: watermarked sample detection, trigger identification, and efficient watermark mitigation.<n>Our experiments show that our CEAT2I effectively evades DOV mechanisms while preserving model performance.
  arXiv  Detail & Related papers  (2025-05-05T17:51:55Z)
• An Undetectable Watermark for Generative Image Models [65.31658824274894]
  We present the first undetectable watermarking scheme for generative image models.<n>In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric.<n>Our scheme works by selecting the initial latents of a diffusion model using a pseudorandom error-correcting code.
  arXiv  Detail & Related papers  (2024-10-09T18:33:06Z)
• Towards Robust Model Watermark via Reducing Parametric Vulnerability [57.66709830576457]
  backdoor-based ownership verification becomes popular recently, in which the model owner can watermark the model. We propose a mini-max formulation to find these watermark-removed models and recover their watermark behavior. Our method improves the robustness of the model watermarking against parametric changes and numerous watermark-removal attacks.
  arXiv  Detail & Related papers  (2023-09-09T12:46:08Z)
• An Unforgeable Publicly Verifiable Watermark for Large Language Models [84.2805275589553]
  Current watermark detection algorithms require the secret key used in the watermark generation process, making them susceptible to security breaches and counterfeiting during public detection. We propose an unforgeable publicly verifiable watermark algorithm named UPV that uses two different neural networks for watermark generation and detection, instead of using the same key at both stages.
  arXiv  Detail & Related papers  (2023-07-30T13:43:27Z)
• Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust [55.91987293510401]
  Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. We introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed.
  arXiv  Detail & Related papers  (2023-05-31T17:00:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.