Watermarking method secures AI images against removal attacks
Provably Secure Diffusion Watermarking Against Removal Adversaries with Batched Detector Access
Cryptography and Security
Summary
Creating hidden watermarks in AI-generated images helps prove who made them, but attackers can remove these marks by figuring out how detection works. The authors show that attackers who can test many images can break current watermark protections by learning secret details. To fix this, they designed a new watermark that uses both permanent secrets and single-use secrets, making it much harder to remove without hurting the image. Their approach is proven mathematically secure against strong attackers and works well in real AI image systems.
What this means in practice
- •For ai content platform engineers: Protect AI-generated images with watermarks that resist removal even if attackers can test many samples with the detector.
- •For digital forensics teams: Verify authorship of AI-generated content using watermarks that are mathematically guaranteed to resist removal attacks with batch queries.
Authors
De Zhang Lee, Ee-Chien Chang
Abstract
Recent latent-based watermarking methods can embed undetectable watermarks into AI-generated content. However, these approaches are vulnerable to removal attacks as their watermark detection boundaries are exposed, prompting the use of secret long-term transformations to hide these boundaries. We show that such defenses are insecure under a stronger threat model motivated by publicly reachable detectors: an adversary with batched detector access can reconstruct the transformations, permanently re-exposing the decision boundary. To address this, we propose a watermarking scheme based on a hybrid of long-term and one-time secret transformations, which prevents the reuse of structure across samples and keeps the long-term secret hidden. Besides undetectability, we show that this scheme is provably secure against removal adversaries with batched detector access, in the sense that no probabilistic polynomial-time adversary can achieve a non-negligible advantage over an adversary restricted to adding isotropic white-noise with a $\sqrt{2}\times$ larger perturbation budget, and we show this $\sqrt{2}$ factor to be tight. Evaluations on Stable Diffusion 2.1 and XL demonstrate the attack against the existing defense, and show that our scheme preserves generation quality and withstands common perturbations and targeted removal attacks.