Tree-Ring watermark forgery reproduced on limited GPU hardware
Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
Cryptography and Security
Summary
Some images made by AI models include hidden watermarks to prove they are genuine. This paper shows that attackers can copy these watermarks to fake such proofs without having the secret keys. The authors recreated a known attack to forge watermarks using less powerful computers than previous attempts and examined how the watermark detection works in more detail. They also fixed some technical details needed for their tests and shared all their tools and findings publicly.
What this means in practice
- •For ai security engineers: Detect vulnerabilities in AI-generated content watermarking to improve trustworthiness of image provenance systems.
- •For machine learning platform developers: Adapt watermark detection pipelines to work efficiently on lower-memory GPUs while maintaining accuracy.
Authors
Saifur Rahman Tamim, Md Taslimul Hasan Toufique, A. M. Tayeful Islam
Abstract
Semantic watermarking schemes such as Tree-Ring hide a detectable pattern in the initial noise latent of a diffusion model. Recent work shows these watermarks are not only removable but forgeable: an attacker who never sees the watermarking key can still produce images the genuine detector accepts. We reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring on Stable Diffusion XL, using the authors' released code, on free-tier dual T4 GPUs with 14.6 GB of usable memory per device, substantially less per-GPU memory than the A40 hardware used in the original study. The attack reproduces. Over six trials of three arms we detect genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 s per attack. Three further results came out of running it under constraint. The released detector computes a non-central $χ^2$ statistic and hands back only its CDF, so we recovered the discarded statistic; our recovery matches the released detector exactly, and two natural scores built from it separate the forged arm from the clean null at AUC 0.861 and 0.972 on the same eighteen observations. Running SDXL in half precision requires patching the pipeline's direct autoencoder calls, and a controlled probe confirms the patched path leaves the detector statistic unchanged. Finally, we report a prediction we made from reading the detector source that our measurements then contradicted. The notebook, the pinned fork and every measurement artifact are released with the paper.