Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models

AI summary

Overview

Research area: Machine learning security, digital image watermarking, content provenance, and adversarial attacks on post-hoc watermarking systems.

Technical level: Advanced.

Scope: The paper introduces a black-box, one-shot attack that uses an image preference model trained on synthetic artifacts to remove and forge post-hoc image watermarks from only a single watermarked image, without access to the watermarking model, decoder, or paired clean-watermarked data.

What This Paper Is About

Watermarking is increasingly used to label AI-generated content, verify authentic photos, and support content provenance. Most prior security research studies watermark removal, but watermark forging—stealing a watermark from genuine content and applying it to malicious content—is less explored and usually requires many watermarked images or access to the watermark detector. This paper shows that an attacker can forge watermarks for several widely used post-hoc image watermarking methods using only one watermarked image and no knowledge of the watermarking system.

Key Contributions

1. A preference model for watermark likelihood. The authors train a ConvNeXt image model with a ranking loss to score whether an image is clean or corrupted, using only procedurally generated artifacts such as wave, line, and noise patterns. No real watermarked images or watermark decoders are needed for training.

2. One-shot black-box watermark removal and forging. Given a single watermarked image, the method optimizes its pixels by backpropagation to maximize the preference score. The difference between the original watermarked image and the optimized clean image becomes the estimated watermark, which can be subtracted to remove the watermark or added to new images to forge it.

3. A realistic threat model. The attack requires no access to the watermarking algorithm, no paired clean-watermarked data, no decoding API, and only one watermarked example. This is more practical than prior forging attacks that need hundreds or thousands of watermarked images.

4. Comprehensive evaluation and guidance. The method is tested on CIN, MBRS, TrustMark, and Video Seal, showing strong forging and competitive removal performance while preserving image quality. The results identify which watermarking approaches are more vulnerable and recommend making decoders truly content-aware.

Main Findings

• One-shot forging succeeds across several watermarking methods. With only one watermarked image, the method reaches bit accuracies of 1.00 for CIN, 0.83 for MBRS, 0.61 for TrustMark, and 0.83 for Video Seal, with an average PSNR of 31.3.

• It outperforms prior forging methods in practical settings. Image averaging with 100 images is competitive for CIN and MBRS but fails on Video Seal, reaching only 0.59 bit accuracy versus the proposed method’s 0.83. Warfare with 1,000 images also performs worse on Video Seal. The proposed attack needs no per-method training or paired data.

• Watermark removal is competitive and avoids hallucination. The method lowers bit accuracy to 0.82 for CIN, 0.64 for MBRS, 0.60 for TrustMark, and 0.49 for Video Seal, while achieving 31.2 PSNR. Diffusion-based removal methods like DiffPure and CtrlRegen produce lower PSNR and hallucinate new image details.

• Ranking loss and adversarial perturbation are critical. Training with binary cross-entropy or hinge loss fails to produce useful gradients. Adding adversarially perturbed negative samples during training improves watermark removal and yields more interpretable gradients.

• Synthetic artifacts generalize better than real watermarks. A gray-box variant trained on real watermarks from CIN, MBRS, TrustMark, and Video Seal performs worse than the procedural artifact model, for example 0.67 versus 0.83 bit accuracy on MBRS forging. Real watermarks are less diverse, causing overfitting.

• Watermark robustness varies by method. CIN and MBRS are easier to forge because their watermarks are less content-dependent. TrustMark is difficult to forge. Video Seal is vulnerable even though its embedder is content-aware, because its decoder tends to ignore image content.

• Limitations exist. The attack targets post-hoc watermarking and cannot forge semantic watermarks such as Tree-Ring or RingID, which alter image objects. It may also blur natural high-frequency textures such as water surfaces.

Methodology in Plain English

The researchers first train an image preference model to distinguish clean images from corrupted ones. For each real image, they create a corrupted version by adding synthetic artifacts in the Fourier domain—wave-like patterns, line patterns, or noise. The model is trained with a ranking loss to give higher scores to clean images and lower scores to corrupted images. They also perturb the corrupted examples adversarially during training so that the model’s gradients point toward cleaner, less noisy images.

Next, they take one watermarked image and optimize its pixels to maximize the preference score. This produces a cleaner version of the image. Subtracting this clean version from the original watermarked image yields an estimate of the watermark.

That estimated watermark can then be added to any new image to forge a watermark, or subtracted from the original watermarked image to remove it. For high-resolution images, the watermark is estimated at a lower resolution and resized before being applied. The attack uses only the single watermarked image, with no access to the watermarking model or detector.

Why This Matters

This work challenges the security assumptions behind current post-hoc watermarking. It shows that forging is practical in a black-box, data-scarce setting, meaning attackers do not need large datasets or insider access. The results suggest that watermarking systems should be designed so that decoders check whether a watermark is truly tied to the source image content, rather than accepting any matching signal.

Real-world applications include:

• AI content provenance and labeling. Watermarking is proposed in regulations such as the EU AI Act and the U.S. Executive Order on AI to label AI-generated content. Forging could undermine these transparency efforts.

• News agency and camera authenticity verification. Press agencies and camera manufacturers use watermarking to verify authentic photos. A forged watermark could make fake images appear authentic.

• Platform moderation and intellectual property protection. Detection systems could be flooded with false positives, or malicious content could be falsely attributed to a trusted source.

• Misinformation and fraud detection. If watermarks can be forged, provenance signals become less reliable for distinguishing genuine from manipulated media.

Industry relevance is high because companies such as Meta, Google DeepMind, press agencies, and camera makers already deploy post-hoc watermarking. The paper provides both an attack and a clear recommendation: train decoders to reject watermarks that come from a different source image.

Future Directions

• Develop truly content-aware decoders. Watermark detectors should verify that a watermark is consistent with the specific image content, not just that the watermark signal is present.

• Extend attacks and defenses to semantic and video watermarks. The current method cannot forge semantic watermarks like Tree-Ring or RingID, and video watermarking remains an open target.

• Improve the preference model to avoid blurring textures. Adding blur as a synthetic artifact or refining artifact generation could reduce degradation of natural high-frequency regions such as water, grass, and clouds.

• Test robustness under real-world transformations. Future work should evaluate compression, cropping, resizing, social media pipelines, and adaptive attackers who know the defense.

• Create standardized benchmarks for watermark forging. The field needs common threat models and metrics to compare removal, forging, and detection methods fairly.

Target Audience

This paper benefits machine learning and security researchers, watermarking practitioners, content provenance teams, platform trust-and-safety groups, and policy professionals working on AI transparency. Readers need some familiarity with deep learning, adversarial optimization, and digital watermarking; the material is best suited to an advanced technical audience.

Authors’ abstract

Recent years have seen a surge in interest in digital content watermarking techniques, driven by the proliferation of generative models and increased legal pressure. With an ever-growing percentage of AI-generated content available online, watermarking plays an increasingly important role in ensuring content authenticity and attribution at scale. There have been many works assessing the robustness of watermarking to removal attacks, yet, watermark forging, the scenario when a watermark is stolen from genuine content and applied to malicious content, remains underexplored. In this work, we investigate watermark forging in the context of widely used post-hoc image watermarking. Our contributions are as follows. First, we introduce a preference model to assess whether an image is watermarked. The model is trained using a ranking loss on purely procedurally generated images without any need for real watermarks. Second, we demonstrate the model's capability to remove and forge watermarks by optimizing the input image through backpropagation. This technique requires only a single watermarked image and works without knowledge of the watermarking model, making our attack much simpler and more practical than attacks introduced in related work. Third, we evaluate our proposed method on a variety of post-hoc image watermarking models, demonstrating that our approach can effectively forge watermarks, questioning the security of current watermarking approaches. Our code and further resources are publicly available.