Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors identify trajectory recoverability as a universal vulnerability in diffusion watermarking and exploit it via DRIFT, an optimization-free, black-box removal attack. By combining partial forward re-noising with stochastic reverse resampling, the attack deflects the generative path away from the verifier's trajectory-dependent evidence while preserving visual fidelity through an adaptive ladder search. Across nine watermarking schemes spanning three paradigms, DRIFT achieves a 98–100% removal success rate and maintains top image quality without requiring secret keys, verifier internals, or per-image gradient updates.
Stochastically deflecting the reverse diffusion trajectory breaks 98–100% of generative watermarks across nine leading schemes without requiring gradient optimization, model internals, or visual quality trade-offs.
Diffusion watermarking embeds verifiable signals into the generative process and commonly verifies them by recovering trajectory-dependent evidence, making the marks robust to conventional pixel-space distortions. Existing removal attacks either regenerate along deterministic trajectories, which often preserve the watermark-bearing latent structure, or optimize every image separately. We identify the reliance on a recoverable generative trajectory as a common attack surface among the schemes we study. Based on this observation, we propose DRIFT, a black-box attack that combines partial forward diffusion with stochastic reverse resampling. Forward re-noising limits source information available to a fixed-depth recovery pipeline, while stochastic reversal supplies alternative noise-driven paths whose removal benefit we isolate through matched sampler comparisons. Adaptive DRIFT searches a selected ladder for each image's first verifier-rejected rung and refines fidelity while retaining only updates rejected by the same verifier. At fixed depth, we derive information-theoretic and Wasserstein source-dependence bounds; under realized-ladder monotonicity, the first rejected rung is least distorted among rejected rungs on that ladder, and verifier-gated refinement preserves rejection. Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success and the best image quality among the compared attacks, without secret keys, verifier internals, or per-image gradient optimization.