Towards Robust Content Watermarking Against Removal and Forgery Attacks

Yifan Zhu; Yihan Wang; Xiao-Shan Gao

cs.CVApr 8, 2026

Towards Robust Content Watermarking Against Removal and Forgery Attacks

Authors: Yifan Zhu, Yihan Wang, Xiao-Shan Gao

Organizations: Academy of Mathematics and Systems Science, Chinese Academy of Sciences and University of Chinese Academy of Sciences. · University of Waterloo

Abstract

Generated contents have raised serious concerns about copyright protection, image provenance, and credit attribution. A potential solution for these problems is watermarking. Recently, content watermarking for text-to-image diffusion models has been studied extensively for its effective detection utility and robustness. However, these watermarking techniques are vulnerable to potential adversarial attacks, such as removal attacks and forgery attacks. In this paper, we build a novel watermarking paradigm called Instance-Specific watermarking with Two-Sided detection (ISTS) to resist removal and forgery attacks. Specifically, we introduce a strategy that dynamically controls the injection time and watermarking patterns based on the semantics of users' prompts. Furthermore, we propose a new two-sided detection approach to enhance robustness in watermark detection. Experiments have demonstrated the superiority of our watermarking against removal and forgery attacks.

Figures & tables

Figure 1: Overview of our ISTS method. The top row shows the original Tree-Ring watermarking. To generate watermarked images, it injects tree-ring patterns in the center of the frequency domain at the initial noisy space. Such a static scheme leaks information about the watermark pattern and thus exposes high vulnerability to removal and forgery attacks. The bottom row shows our dynamic approach. For each generation, we first generate a non-watermarked image and decide time and location parameters $(t,l)$ using a semantic-based selector . Then, we execute the first $T-t$ steps of DDIM, inject watermarks at coordinate $l$ in the frequency domain, and continue the rest of DDIM generation. During detection, we retrieve the parameters from a suspicious image and extract the watermarking area, followed by two-sided detection . In adversarial settings, an attacker unaware of time and location parameters fails to extract the ground-truth watermark patterns from reference images. Thus, the proposed approach achieves enhanced robustness against removal and forgery attacks.

Figure 2: The detection AUC of benign watermarking, and watermarking after removal and forgery attacks [ 41 ] . Results demonstrate that existing methods are vulnerable to removal attacks (lower AUC) and forgery attacks (higher AUC), while our ISTS is robust against them.

Watermarking Method	Original	Imp-Removal	Avg-Removal	VAE-Removal	Average	Worst-Case
Tree-Ring	0.9999/1.00	0.2672/0.00	0.5266/0.08	0.9728/0.34	0.5889/0.14	0.2672/0.00
Shallow Diffuse	1.0000/1.00	0.6752/0.00	0.9730/0.49	0.9987/0.93	0.8823/0.47	0.6752/0.00
Gaussian Shading	1.0000/1.00	0.0000/0.00	0.3707/0.01	1.0000/1.00	0.4569/0.34	0.0000/0.00
ROBIN	1.0000/1.00	0.0815/0.00	0.7415/0.00	0.9610/0.58	0.5947/0.19	0.0815/0.00
RingID	1.0000/1.00	0.0121/0.01	0.4035/0.16	1.0000/1.00	0.4719/0.39	0.0121/0.01
Zodiac	0.9999/1.00	0.0625/0.00	0.2558/0.00	0.7901/0.04	0.3695/0.01	0.0625/0.00

Table 1: The detection metric (AUC/TPR@1%FPR) of various watermarking methods against removal attacks. “Average” means the average AUC/TPR@1%FPR across three removal attacks, Imp-Removal, Avg-Removal and VAE-Removal. “Worst-Case” means the worst performance against these removal attacks, i.e., the lowest AUC and TPR@1%FPR under a certain attack. Our ISTS demonstrates the strongest robustness against Imp-Removal and Avg-Removal, and outperforms all existing baselines in both averaged and worst-case scenarios for removal attacks.

Watermarking Method	Original	Imp-Forgery	Avg-Forgery	VAE-Forgery	Average	Worst-Case
Tree-Ring	0.9999/1.00	0.9914/0.73	0.7932/0.01	0.9525/0.48	0.9124/0.41	0.9914/0.73
Shallow Diffuse	1.0000/1.00	0.7621/0.11	0.6285/0.02	0.9533/0.55	0.7813/0.23	0.9533/0.55
Gaussian Shading	1.0000/1.00	1.0000/1.00	0.4702/0.00	1.0000/1.00	0.8234/0.67	1.0000/1.00
ROBIN	1.0000/1.00	0.9995/0.95	0.8784/0.03	0.9290/0.29	0.9356/0.42	0.9995/0.95
RingID	1.0000/1.00	1.0000/1.00	1.0000/1.00	1.0000/1.00	1.0000/1.00	1.0000/1.00
Zodiac	0.9999/1.00	1.0000/1.00	0.2436/0.00	0.9541/0.42	0.7326/0.47	1.0000/1.00

Table 2: The detection metric (AUC/TPR@1%FPR) of various watermarking methods against forgery attacks. “Average” and “Worst-Case” mean the average and the lowest AUC/TPR@1%FPR across three forgery attacks, Imp-Forgery, Avg-Forgery and VAE-Forgery, respectively. Our ISTS demonstrates the strongest robustness against Imp-Forgery, and outperforms all existing baselines in both averaged and worst-case scenarios for forgery attacks.

Figure 3: The PSNR, SSIM, LPIPS and CLIP-Score for various content watermarking. Our ISTS achieves comparable results with ROBIN and outperforms other methods. G-S means Guassian-Shading.

Figure 4: Watermarking detection AUC under various image distortions (Rotation, Noise, Blurring, Cropping, JPEG) and diffusion purification (Diffpure). Results demonstrate that our method achieves high AUC across these data augmentations.

AUC	T-R	RingID	G-S	ROBIN	SEAL	ISTS(Ours)
Average	0.9750	0.9874	0.9120	0.9276	0.7699	0.9742
Worst-Case	0.9276	0.9526	0.5194	0.7504	0.5228	0.9331

Table 3: The average and worst-case detection AUC across Rotation, Noise, Blurring, Cropping, JPEG, and Diffpure. T-R means Tree-Ring, G-S means Gaussian-Shading.

Method	Removal( $\uparrow$ )			Forgery( $\downarrow$ )
Method	Imp	Avg	VAE	Imp	Avg	VAE
ISTS	0.8210	0.9900	0.9979	0.6340	0.4737	0.9491
w/o Dyn-Pattern	0.7893	0.9762	0.9969	0.7202	0.6014	0.9625
w/o Dyn-Injection	0.8014	0.9809	0.9973	0.6678	0.4440	0.9515
w/o Two-Sided	0.7129	0.9866	0.9945	0.6412	0.4572	0.9532

Table 4: Detection AUC of components in our ISTS watermarking. “w/o Dyn-Pattern”, “w/o Dyn-Step” and “w/o Two-Sided” represent removing the pattern position selection, removing the injection timestep selection, and removing the two-sided detection back to one-sided, respectively.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Different injection steps.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection
May 10, 2026Minh Quoc Duong, Chun Tong Lei, Chun Pong LauDiffusion Model Inversion Diffusion Model Watermarking
City University of Hong Kong
CSGuard: Toward Forgery-Resistant Watermarking in Diffusion Models via Compressed Sensing Constraint
May 2, 2026Jiewei Lai, Lan Zhang, Chen Tang +4Diffusion Model Watermarking Compressed Sensing
University of Science and Technology of China · Institute of Artificial Intelligence, Hefei Comprehensive National Science Center · Lenovo Research
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Sep 25, 2026Haoyang Li, Ruoxi Sun, Qingqing Ye +4AI-Generated Image Watermarking Diffusion Model Watermarking
The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University

May 10, 2026J/K move · Enter open · S save

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

Minh Quoc Duong, Chun Tong Lei, Chun Pong Lau

City University of Hong Kong

Diffusion Model Inversion Diffusion Model Watermarking Watermark Removal Image Forgery Detection Robust Watermarking Diffusion Models

Open paper AskPDF arXiv

With the proliferation of AI-generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug-and-play, training-free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion-denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.

Abstract

Robust Watermarking

Explore similar work

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

CSGuard: Toward Forgery-Resistant Watermarking in Diffusion Models via Compressed Sensing Constraint

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models