Search papers, labs, and topics across Lattice.
This paper investigates the vulnerabilities of semantic watermarks in latent diffusion models (LDMs) to black-box forgery attacks, providing a theoretical framework to understand the conditions that lead to successful attacks. By analyzing the problem through the lens of rate-distortion theory, the authors identify a fundamental distortion floor caused by structural mismatches between proxy and target models, which limits the effectiveness of forged watermarks. Their proposed detection method effectively distinguishes forged samples prior to watermark verification, demonstrating robustness across various black-box scenarios.
Forged watermarks in latent diffusion models are fundamentally limited by an irreducible distortion floor, revealing critical vulnerabilities in black-box settings.
Recent studies have shown that semantic watermarks, which embed information into the initial noise of latent diffusion models (LDMs), are vulnerable to black-box forgery attacks. However, existing methods primarily rely on empirical evidence and lack a rigorous theoretical understanding of the conditions under which such attacks succeed or fail. To bridge this gap, we rethink the nature of such attacks through the lens of rate-distortion in the latent space. Our analysis identifies an irreducible distortion floor due to structural mismatches between proxy and target models, which fundamentally limits the fidelity of forged watermarks. We further characterize this distortion as structured geometric deviations on the latent manifold, in the form of global drift and local deformation rather than stochastic noise. Leveraging these insights, we propose a scheme-agnostic detection method that distinguishes forged samples before watermark verification. Extensive experiments demonstrate the effectiveness of our method across diverse black-box scenarios, while preserving robustness to common distortions.
