PaperlayerView exact revision on arXiv

Source-linked AI summary

Stable Signature is Unstable: Removing Image Watermark from Diffusion Models

Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, Neil Gong

arXiv:2405.07145v1cs.CRcs.CV

TL;DR

Stable Signature embeds watermarks in open-source diffusion-model decoders, but its robustness to model-targeted removal is uncertain. This paper fine-tunes only the decoder using non-watermarked images and shows that the watermark can be removed while preserving image quality, including without encoder access. The findings challenge Stable Signature’s stability and leave robust watermarking for open-source diffusion models as an open challenge.

  • Problem

    Stable Signature was designed to make images from open-source diffusion models inherently watermarked and was claimed to resist removal attacks.

    Source: §1 · p. 1, §3.2 · p. 5

  • Method

    The attack estimates denoised latent vectors from non-watermarked images and fine-tunes the watermarked decoder to reconstruct those images.

    Source: §1 · p. 2

  • Results

    The attack effectively removes the watermark while maintaining image quality and outperforms model purification in its applicable setting.

    Source: §1 · p. 3, §5.2 · p. 11

  • Takeaways & Limitations

    Stable Signature is not as robust as previously thought, and robust watermarking for open-source diffusion models remains an open challenge.

    Source: §1 · p. 3, §6 · p. 13

    The attack assumes access to the open-source watermarked decoder and denoising layers and modifies the decoder rather than the larger denoising layers.

    Source: §3.2 · pp. 5–6

Abstract

from arXiv · show

Watermark has been widely deployed by industry to detect AI-generated images. A recent watermarking framework called \emph{Stable Signature} (proposed by Meta) roots watermark into the parameters of a diffusion model's decoder such that its generated images are inherently watermarked. Stable Signature makes it possible to watermark images generated by \emph{open-source} diffusion models and was claimed to be robust against removal attacks. In this work, we propose a new attack to remove the watermark from a diffusion model by fine-tuning it. Our results show that our attack can effectively remove the watermark from a diffusion model such that its generated images are non-watermarked, while maintaining the visual quality of the generated images. Our results highlight that Stable Signature is not as stable as previously thought.

1 Introduction

The paper introduces a decoder fine-tuning attack that removes Stable Signature watermarks from open-source diffusion models while preserving image quality. Experiments show the attack outperforms model purification, challenging Stable Signature’s claimed robustness.

Motivation

  • Watermarking is widely used to identify AI-generated images, including deployments by OpenAI, Stability AI, and Google.Detection identifies an image as AI-generated when the corresponding watermark can be extracted.Source: §1 · p. 1

Background

  • Stable Signature embeds watermarks in decoder parameters so generated images are inherently watermarked without external watermarking components.This design targets open-source diffusion models, where attackers can otherwise remove separate watermarking components.Source: §1 · pp. 1–2

Comparison

  • Model purification requires encoder access and significantly degrades image quality, whereas the proposed attack retains most image information after watermark removal.Figure 1 uses the same denoised latent vector across decoders and shows detectable watermarking only for the Stable Signature output.Source: §1 · pp. 2–3, Figure 1 · p. 2

Method

  • The proposed two-step attack estimates denoised latent vectors from non-watermarked images, then fine-tunes the watermarked decoder to reconstruct those images.It supports settings both with and without access to the diffusion model’s encoder.Source: §1 · p. 2

Results

  • The attack removes the watermark from Stable Diffusion 2.1 while maintaining image quality, and outperforms model purification in its applicable setting.The results indicate that Stable Signature is less robust than previously thought, leaving robust watermarking for open-source models as an open challenge.Source: §1 · pp. 2–3

2 Related Works

Related work covers latent diffusion components, three watermarking strategies, and two watermark-removal attack families. It highlights the efficiency of model-targeted removal but also the image-quality limitations of existing purification methods.

2.1 Latent Diffusion Model

  • A latent diffusion model encodes images, adds noise in latent space, denoises conditioned representations, and decodes them back into images.Its main components are encoder E, diffusion process DP, denoising layers DN, and decoder D.Source: §2.1 · p. 3

2.2 Image Watermark

  • Post-generation watermarking embeds a watermark after image generation, while pre-generation watermarking embeds it into the initial noisy latent vector.Both approaches are vulnerable in open-source settings because attackers can remove watermarking components or substitute an unwatermarked noisy latent vector.Source: §2.2 · pp. 3–4
  • In-generation watermarking modifies decoder parameters so every generated image inherently contains a predetermined watermark.Stable Signature fine-tunes a decoder using a HiDDeN watermarking decoder, preventing simple removal by discarding separate watermarking components.Source: §2.2 · p. 4

2.3 Watermark Removal Attacks

  • Per-image removal attacks perturb each watermarked image individually and apply broadly, but their individualized processing is inefficient for large image volumes.They may use image processing, watermark-decoder access, or detection-API queries.Source: §2.3 · p. 4
  • Model-targeted attacks modify diffusion-model parameters once so subsequent generated images are non-watermarked, making them efficient for numerous images.Stable Signature’s model purification aims to remove its watermark but struggles to preserve image quality.Source: §2.3 · pp. 4–5

3 Problem Formulation

The threat model gives attackers access to the open-source denoising layers and watermarked decoder, plus non-watermarked images, while varying access to the encoder and diffusion process. The attacker fine-tunes only the decoder to meet watermark-removal and image-quality goals.

3.1 Watermarked Diffusion Model Decoder Dw

  • The watermarked decoder Dw is obtained by fine-tuning a clean decoder Dc so every generated image contains ground-truth watermark wg.Generated images take the form Dw(DN(zT, c)), with zT sampled from a Gaussian distribution and c denoting conditioning.Source: §3.1 · p. 5

3.2 Threat Model

  • The attacker seeks a non-watermarked decoder Dnw whose outputs omit wg while retaining visual quality relative to outputs from Dw.These are defined as the effectiveness and utility goals.Source: §3.2 · p. 5
  • The attacker is assumed to access the open-source denoising layers DN and watermarked decoder Dw, while access to encoder E and diffusion process DP varies by scenario.This separates encoder-aware from encoder-agnostic attacks.Source: §3.2 · p. 5
  • In the encoder-aware setting, E and DP are open-source and available to the attacker.Stable Diffusion is given as an example of this setting.Source: §3.2 · p. 5
  • In the encoder-agnostic setting, E and DP are unavailable because image generation requires only DN and Dw.The attack must therefore operate without access to the encoder and diffusion process.Source: §3.2 · p. 5
  • The attacker has access to a non-watermarked attacking dataset, potentially using benchmark images such as ImageNet.These images are used to remove the watermark from Dw.Source: §3.2 · pp. 5–6
  • The attacker modifies only decoder parameters because the denoising layers are much larger and substantially more expensive to change.In Stable Diffusion 2.1, denoising layers have about 10 times more parameters than the decoder.Source: §3.2 · p. 6

4 Our Attack

The attack fine-tunes a watermarked diffusion decoder using non-watermarked images and estimated denoised latent vectors. It estimates those vectors under encoder-access and encoder-agnostic settings, then optimizes decoder reconstruction to remove watermark signals while preserving visual quality.

4.1 Overview

  • The two-step attack estimates denoised latent vectors for non-watermarked images, then fine-tunes the watermarked decoder to reconstruct those images.The method targets decoder parameters using an attacking dataset of non-watermarked images.Source: §4.1 · p. 6, §4.3 · p. 8

4.2 Step I: Estimate the Denoised Latent Vector z

  • In the encoder-aware setting, the attack estimates each denoised latent vector by using the encoder, diffusion process, and denoising layers, despite lacking the ground-truth conditioning.The denoising layers produce vectors close to encoded images, enabling encoder-based estimation.Source: §4.2 · p. 7
  • In the encoder-agnostic setting, the attack treats each latent vector as trainable because directly inverting the decoder is generally infeasible.It approximates the watermarked image with its known non-watermarked counterpart because the two should be perceptually close.Source: §4.2 · p. 7
  • The encoder-agnostic latent estimation uses two-stage optimization: mean-square-error initialization followed by perceptual-loss refinement for image details.Random initialization is first optimized for rough resemblance, then Watson-VGG perceptual loss captures detailed information.Source: §4.2 · pp. 7–8

4.3 Step II: Fine-tune the Decoder Dw

  • Decoder fine-tuning maps estimated denoised latent vectors to corresponding non-watermarked images, removing watermark signals at the pixel level.The objective is optimized over decoder parameters using the estimated vectors and target images.Source: §4.3 · p. 8
  • Perceptual loss counters the smoothing and detail loss caused by mean square error, while adversarial training uses a discriminator to improve reconstructed-image realism.The discriminator distinguishes reconstructed images from non-watermarked targets, and the decoder is trained to fool it.Source: §4.3 · pp. 8–9

5 Evaluation

The evaluation uses three public attacking datasets and tests watermark-removal effectiveness, image utility, reconstruction variants, and loss-weight sensitivity. Across scenarios, the attack removes watermarks while preserving image quality and generally outperforms MP.

5.1 Experimental Setup

  • The evaluation uses 4,000 non-AI-generated images from each of ImageNet, MS-COCO, and Conceptual Captions, plus 100 generated test images from sampled text prompts.Effectiveness is measured with evasion rate and bitwise accuracy, while utility is measured with FID.Source: §5.1 · pp. 9–10
  • The study compares the attack with MP and five per-image-based removal attacks, noting that MP requires encoder access while the proposed E-agnostic attack does not.Per-image-based methods craft a separate perturbation for each watermarked image.Source: §5.1 · p. 10

5.2 Experimental Results

  • The attack achieves evasion rates above 94%, bitwise accuracy below 66%, and FID below 27.5 in both E-aware and E-agnostic scenarios across three attacking datasets.It outperforms MP with lower FID in both scenarios, while matching or exceeding MP's effectiveness metrics.Source: §5.2 · p. 11
  • After decoder fine-tuning, the attack requires zero removal time per image and becomes more efficient than WEvade-W-II beyond 1 image in E-aware or 809 images in E-agnostic settings.With four NVIDIA A6000 GPUs, E-agnostic fine-tuning takes about 2K minutes; the attack maintains higher utility than most per-image methods.Source: §5.2 · p. 12
  • The two-stage latent-estimation method reconstructs ImageNet images more similarly than alternative variants, achieving lower FID and retaining more original detail.Figure 5 evaluates reconstructions against 100 randomly selected ImageNet images.Source: §5.2 · p. 12, Figure 5 · p. 12
  • Increasing λ reduces effectiveness but initially improves and then slightly worsens utility, whereas increasing µ has scenario-dependent effects on effectiveness and utility.In E-aware settings, larger µ eventually reduces effectiveness without changing utility; in E-agnostic settings, both measures later improve.Source: §5.2 · pp. 12–13, Figure 6 · p. 13, Figure 7 · p. 13

6 Conclusion and Future Work

The work finds that watermarking open-source diffusion models is not robust as previously thought. Fine-tuning the decoder removes the watermark while preserving utility in both E-aware and E-agnostic settings.

6 Conclusion and Future Work

  • Decoder fine-tuning removes watermarks from open-source diffusion models while maintaining image quality in both E-aware and E-agnostic scenarios.Source: §6 · p. 13
  • The proposed attack outperforms the existing model-targeted attack, which is applicable only in the E-aware scenario.Source: §6 · p. 13
  • The results indicate that Stable Signature is less robust than previously thought.Source: §6 · p. 13
  • Future work should develop more robust image-watermarking methods for open-source diffusion models.Source: §6 · p. 13

A Details of the per-image-based removal attacks

The appendix describes common per-image watermark-removal attacks that alter image content or apply optimized perturbations. These methods trade detection difficulty against image quality or require access to the watermarking decoder.

A Details of the per-image-based removal attacks

B Parameter settings for MP

This appendix specifies MP’s decoder fine-tuning configuration and provides visual comparisons among clean, watermarked, attacked, and non-watermarked decoders.

B Parameter settings for MP

  • Following Fernandez et al., the method employs AdamW with learning rate 0.0005, a linear warm-up period of 20 iterations, half-cycle cosine decay, and batch size 4.Source: B Parameter settings for MP · p. 17
  • Figure 8 compares clean, Stable Signature-watermarked, and attacked Stable Diffusion 2.1 decoders using the same denoised latent vector in each column.Source: Figure 8 · p. 18
  • Figure 8 states that the watermark is detectable only in images generated by the Stable Signature-watermarked decoder.Source: Figure 8 · p. 18
  • Figure 9 compares clean, watermarked, transformed, and attacked decoders, reporting detectable watermark only for the watermarked-decoder example.Source: Figure 9 · p. 19

Related papers

Loading 2405.07145v1…