Search papers, labs, and topics across Lattice.
This paper analyzes the fragility of robust watermarks under diffusion-based image editing, showing that diffusion processes effectively "unsign" images by attenuating watermark payloads during the forward diffusion step. They formalize this degradation information-theoretically, proving that mutual information between the watermark and edited output diminishes with editing strength, leading to decoding failure. Empirical results validate the theory across various watermarking and diffusion editing methods, highlighting the vulnerability of existing watermarking schemes.
Diffusion-based image editing can effectively erase robust watermarks, turning them into random noise even when those watermarks were designed to survive conventional distortions.
Robust invisible watermarking systems aim to embed imperceptible payloads that remain decodable after common post-processing such as JPEG compression, cropping, and additive noise. In parallel, diffusion-based image editing has rapidly matured into a default transformation layer for modern content pipelines, enabling instruction-based editing, object insertion and composition, and interactive geometric manipulation. This paper studies a subtle but increasingly consequential interaction between these trends: diffusion-based editing procedures may unintentionally compromise, and in extreme cases practically bypass, robust watermarking mechanisms that were explicitly engineered to survive conventional distortions. We develop a unified view of diffusion editors that (i) inject substantial Gaussian noise in a latent space and (ii) project back to the natural image manifold via learned denoising dynamics. Under this view, watermark payloads behave as low-energy, high-frequency signals that are systematically attenuated by the forward diffusion step and then treated as nuisance variation by the reverse generative process. We formalize this degradation using information-theoretic tools, proving that for broad classes of pixel-level watermark encoders/decoders the mutual information between the watermark payload and the edited output decays toward zero as the editing strength increases, yielding decoding error close to random guessing. We complement the theory with a realistic hypothetical experimental protocol and tables spanning representative watermarking methods and representative diffusion editors. Finally, we discuss ethical implications, responsible disclosure norms, and concrete design guidelines for watermarking schemes that remain meaningful in the era of generative transformations.
