Title: Optimization-Free Universal Watermark Forgery with Regenerative Diffusion Models Show Chinese title

Title: 基于再生扩散模型的无优化通用水印伪造

Abstract: Watermarking becomes one of the pivotal solutions to trace and verify the origin of synthetic images generated by artificial intelligence models, but it is not free of risks. Recent studies demonstrate the capability to forge watermarks from a target image onto cover images via adversarial optimization without knowledge of the target generative model and watermark schemes. In this paper, we uncover a greater risk of an optimization-free and universal watermark forgery that harnesses existing regenerative diffusion models. Our proposed forgery attack, PnP (Plug-and-Plant), seamlessly extracts and integrates the target watermark via regenerating the image, without needing any additional optimization routine. It allows for universal watermark forgery that works independently of the target image's origin or the watermarking model used. We explore the watermarked latent extracted from the target image and visual-textual context of cover images as priors to guide sampling of the regenerative process. Extensive evaluation on 24 scenarios of model-data-watermark combinations demonstrates that PnP can successfully forge the watermark (up to 100% detectability and user attribution), and maintain the best visual perception. By bypassing model retraining and enabling adaptability to any image, our approach significantly broadens the scope of forgery attacks, presenting a greater challenge to the security of current watermarking techniques for diffusion models and the authority of watermarking schemes in synthetic data generation and governance. Show Chinese abstract

Abstract: 水印成为追踪和验证人工智能模型生成的合成图像来源的关键解决方案之一，但也并非没有风险。近期研究表明，可以通过对抗性优化，在不知晓目标生成模型和水印方案的情况下，从目标图像伪造水印并植入到载体图像中。本文揭示了一种无需优化且通用的水印伪造风险，这种风险利用现有的再生扩散模型实现。我们提出的伪造攻击方法PnP（即插即种），通过重新生成图像无缝提取并整合目标水印，而无需任何额外的优化过程。该方法能够独立于目标图像的来源或所使用的水印模型，实现通用的水印伪造。我们探索了从目标图像中提取的带水印潜码以及载体图像的视觉-文本上下文作为先验信息，以指导再生过程中的采样。在24种模型-数据-水印组合场景下的广泛评估表明，PnP可以成功伪造水印（检测率和用户归属率高达100%），同时保持最佳的视觉感知效果。通过绕过模型再训练并适应任意图像，我们的方法显著扩大了伪造攻击的范围，对当前扩散模型水印技术和合成数据生成与治理中的水印方案的安全性提出了更大的挑战。