PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

2026-05-10

AI Summary

Existing semantic watermarking methods rely on the reverse diffusion process for detection, rendering them vulnerable to removal and forgery attacks that can either invalidate watermarks or cause false detections. This work proposes a plug-and-play, training-free noise extraction framework that progressively guides an inverse diffusion and denoising loop to project perturbed latent representations back onto their original semantic manifold. By doing so, it effectively eliminates intermediate latent shifts and suppresses adversarial perturbations. Notably, this approach is the first to simultaneously defend against both watermark removal and forgery attacks. It successfully recovers removed watermarks and accurately identifies forged samples across diverse attack scenarios, substantially enhancing the robustness and accuracy of watermark detection.

Abstract

With the proliferation of AI-generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug-and-play, training-free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion-denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.

Problem

• semantic watermarking
• diffusion inversion
• imprint removal
• forgery attacks
• watermark detection

Innovation

• Progressive Guided Inversion
• Denoising
• Semantic Watermarking
• Diffusion Models
• Adversarial Robustness