Metraipolis › archive › dc_5ccfc560552e

DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory — arXiv:2609.08213

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.08213
License (as archived): CC0-1.0
Archived: 2026-10-16T13:40:35.652Z
SHA-256 of the archived text: 64f3134aab13663fe3fb590be05dc61da23cc92f726d82ad81c854e1eaa287ca
Stable URL of this page: https://metraipolis.com/documento/dc_5ccfc560552e

How to cite

DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory — arXiv:2609.08213 — arXiv (en), https://arxiv.org/abs/2609.08213 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_5ccfc560552e (Metraipolis archive dc_5ccfc560552e, sha256 64f3134aab13663fe3fb590be05dc61da23cc92f726d82ad81c854e1eaa287ca)

BibTeX

@misc{dc5ccfc560552e,
  title = {DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory — arXiv:2609.08213},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.08213},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_5ccfc560552e; sha256 64f3134aab13663fe3fb590be05dc61da23cc92f726d82ad81c854e1eaa287ca},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.08213. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Diffusion watermarking embeds verifiable signals into the generative process and commonly verifies them by recovering trajectory-dependent evidence, making the marks robust to conventional pixel-space distortions. Existing removal attacks either regenerate along deterministic trajectories, which often preserve the watermark-bearing latent structure, or optimize every image separately. We identify the reliance on a recoverable generative trajectory as a common attack surface among the schemes we study. Based on this observation, we propose DRIFT, a black-box attack that combines partial forward diffusion with stochastic reverse resampling. Forward re-noising limits source information available to a fixed-depth recovery pipeline, while stochastic reversal supplies alternative noise-driven paths whose removal benefit we isolate through matched sampler comparisons. Adaptive DRIFT searches a selected ladder for each image's first verifier-rejected rung and refines fidelity while retaining only updates rejected by the same verifier. At fixed depth, we derive information-theoretic and Wasserstein source-dependence bounds; under realized-ladder monotonicity, the first rejected rung is least distorted among rejected rungs on that ladder, and verifier-gated refinement preserves rejection. Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success and the best image quality among the compared attacks, without secret keys, verifier internals, or per-image gradient optimization.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-09 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.08213 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T13:09:48.497Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-09?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).