Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework

2026-04-24

AI Summary

This work addresses the growing imbalance in the arms race between rapidly advancing watermarking defenses for generative AI images and lagging attack methodologies. To this end, we propose FMDiffWA, a novel framework that integrates Frequency-domain Watermark Modulation (FWM) into both the forward and reverse processes of diffusion models. By selectively perturbing watermark-related frequency components, FMDiffWA achieves high-fidelity watermark removal. Our approach is the first to embed frequency-domain modulation directly within the diffusion process and further enhances attack efficacy through an auxiliary refinement constraint that optimizes noise estimation, striking an effective balance between attack performance and visual quality. Extensive experiments demonstrate that FMDiffWA exhibits strong generalization across multiple state-of-the-art invisible watermarking schemes while maintaining superior image fidelity and achieving leading attack performance.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Large Multimodal Models (LMMs)
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Digital image watermarking has advanced rapidly for copyright protection of generative AI, yet the comparatively limited progress in watermark attack techniques has broken the attack-defense balance and hindered further advances in the field. In this paper, we propose FMDiffWA, a frequency-domain modulated diffusion framework for watermark attacks. Specifically, we introduce a frequency-domain watermark modulation (FWM) module and incorporate it into the sampling stages both the forward and reverse diffusion processes. This mechanism enables selective modulation of watermark-related frequency components, thereby allowing FMDiffWA to effectively neutralize the invisible watermark signals while preserving the perceptual quality of the attacked watermarked images. To achieve a better trade-off between attack efficacy and visual fidelity, we reformulate the training strategy of conventional diffusion models by augmenting the canonical noise estimation objective with an auxiliary refinement constraint. Comprehensive experiments demonstrate that FMDiffWA achieves superior visual fidelity compared to existing watermark attacks, while exhibiting strong generalization across diverse watermarking schemes.

Problem

• watermark attack
• generative AI
• copyright protection
• attack-defense balance
• digital image watermarking

Innovation

• frequency-domain modulation
• diffusion-based attack
• watermark removal
• perceptual fidelity
• generalization