Metraipolis › archive › dc_87f37e3882cc

Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery — arXiv:2609.12909

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.12909
License (as archived): CC0-1.0
Archived: 2026-10-16T03:14:35.771Z
SHA-256 of the archived text: 41ab239749d422623c40c446e8baa0c29324cf21a61d7b5324b173d1f32a0051
Stable URL of this page: https://metraipolis.com/documento/dc_87f37e3882cc

How to cite

Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery — arXiv:2609.12909 — arXiv (en), https://arxiv.org/abs/2609.12909 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_87f37e3882cc (Metraipolis archive dc_87f37e3882cc, sha256 41ab239749d422623c40c446e8baa0c29324cf21a61d7b5324b173d1f32a0051)

BibTeX

@misc{dc87f37e3882cc,
  title = {Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery — arXiv:2609.12909},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.12909},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_87f37e3882cc; sha256 41ab239749d422623c40c446e8baa0c29324cf21a61d7b5324b173d1f32a0051},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.12909. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Semantic watermarking schemes such as Tree-Ring hide a detectable pattern in the initial noise latent of a diffusion model. Recent work shows these watermarks are not only removable but forgeable: an attacker who never sees the watermarking key can still produce images the genuine detector accepts. We reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring on Stable Diffusion XL, using the authors' released code, on free-tier dual T4 GPUs with 14.6 GB of usable memory per device, substantially less per-GPU memory than the A40 hardware used in the original study. The attack reproduces. Over six trials of three arms we detect genuine images 6/6, clean images 0/6, and forged images 5/6, at 325-332 s per attack. Three further results came out of running it under constraint. The released detector computes a non-central $\chi^2$ statistic and hands back only its CDF, so we recovered the discarded statistic; our recovery matches the released detector exactly, and two natural scores built from it separate the forged arm from the clean null at AUC 0.861 and 0.972 on the same eighteen observations. Running SDXL in half precision requires patching the pipeline's direct autoencoder calls, and a controlled probe confirms the patched path leaves the detector statistic unchanged. Finally, we report a prediction we made from reading the detector source that our measurements then contradicted. The notebook, the pinned fork and every measurement artifact are released with the paper.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-14 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.12909 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T03:05:08.074Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-14?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).