Optimization-Free Universal Watermark Forgery with Regenerative Diffusion Models

2025-06-06

AI Summary

This work identifies and implements the first optimization-free, universal synthetic-image watermark forgery attack. Unlike prior approaches, it requires no access to either the target generative model or the watermarking algorithm. Leveraging regenerative diffusion models—specifically the Plug-and-Play (PnP) framework—it extracts watermarks directly from latent representations of arbitrary target images and seamlessly injects them into arbitrary cover images via vision-language jointly conditioned sampling. The method establishes the first cross-model, cross-watermark universal forgery paradigm, relying solely on watermark latent variables and multimodal priors while eliminating conventional adversarial optimization. Evaluated across 24 diverse model–dataset–watermark configurations, it achieves 100% watermark detectability and user attribution accuracy, while preserving state-of-the-art visual fidelity. This result fundamentally challenges the security assumptions underlying current image watermarking techniques.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Deep Generative Models & Autoencoders
• Natural Language Processing: Generation

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Watermarking becomes one of the pivotal solutions to trace and verify the origin of synthetic images generated by artificial intelligence models, but it is not free of risks. Recent studies demonstrate the capability to forge watermarks from a target image onto cover images via adversarial optimization without knowledge of the target generative model and watermark schemes. In this paper, we uncover a greater risk of an optimization-free and universal watermark forgery that harnesses existing regenerative diffusion models. Our proposed forgery attack, PnP (Plug-and-Plant), seamlessly extracts and integrates the target watermark via regenerating the image, without needing any additional optimization routine. It allows for universal watermark forgery that works independently of the target image's origin or the watermarking model used. We explore the watermarked latent extracted from the target image and visual-textual context of cover images as priors to guide sampling of the regenerative process. Extensive evaluation on 24 scenarios of model-data-watermark combinations demonstrates that PnP can successfully forge the watermark (up to 100% detectability and user attribution), and maintain the best visual perception. By bypassing model retraining and enabling adaptability to any image, our approach significantly broadens the scope of forgery attacks, presenting a greater challenge to the security of current watermarking techniques for diffusion models and the authority of watermarking schemes in synthetic data generation and governance.

Problem

• Uncovers optimization-free universal watermark forgery risk
• Proposes Plug-and-Plant attack for seamless watermark extraction
• Challenges security of current watermarking techniques

Innovation

• Plug-and-Plant forgery attack without optimization
• Uses regenerative diffusion models for watermark extraction
• Works universally across different watermarking schemes