Hybrid secret transformations make diffusion watermarks provably secure against batched detector attacks

The five-minute version

The paper proves that no PPT adversary can remove the watermark with a non-negligible advantage over an isotropic white-noise attacker that has a √2-times larger perturbation budget, and that this bound is tight. It also shows that batched detector access lets an attacker recover the secret long-term transformation of prior boundary-hiding defenses, fully breaking them. The authors propose a hybrid long-term/one-time transformation scheme that achieves provable REM2 security and empirically matches unwatermarked generation quality on Stable Diffusion 2.1 and XL. Evidence comes from a 10,000-image evaluation, but the attack requires d2 samples, which may be costly in practice.

What they found 1

• Batched detector access enables reconstruction of the secret transformation used in prior boundary-hiding defenses.

  “We showed that an adversary with batched detector access can reconstruct the secret transformation underlying existing boundary-hiding defenses.”

What undercuts it the paper’s own results

• The recovery of the secret transformation requires Ω(d2) samples, which is expensive even though it can be parallelized.

Stated limits 4

• Memory requirements increase by approximately 25% compared to the boundary-hiding baseline due to an additional (d/2)×(d/2) one-time transformation matrix.
• Recovery requires d2 samples, which is expensive but parallelizable efficiently across multiple GPUs.
• We do not claim a cryptographic guarantee against REM3.
• A REM3-secure scheme likely requires eliminating the fixed transformation entirely.

What’s new here 4

• Provable security against removal adversaries with batched detector (REM2) access, unlike prior work limited to passive adversaries.
• Hybrid transformation combining a long-term secret matrix with a per-sample one-time orthonormal matrix to hide the detector boundary.
• A tight √2 factor bound on the advantage of any removal attack compared to isotropic white-noise.
• Empirical validation that the scheme preserves image quality (FID, CLIP) and resists common perturbations and targeted removal attacks.

Artifacts & methods 7

• Hybrid long-term/one-time transformation schemesystem
• Boundary-hiding defense (prior work)system
• REM2 attack (batched detector access)evaluation
• PRC watermark
• Isotropic white-noise baseline
• LDPC error-correcting codesprimitive
• Stable Diffusion 2.1 and SDXL models

Topics