Watermarking & Deepfake Detection
Black-Box and Architecture-Agnostic Watermarking and Defense for Diffusion Models
Generated automatically from the limitations stated in 4 papers (ICML, ICCV, NeurIPS), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.
The problem
Current proactive watermarking, attribution, and anti-customization defenses structurally assume white-box access to target latent diffusion models, requiring direct inspection of latent spaces, VAE fine-tuning, or gradient backpropagation through internal U-Net attention layers. In practical deployment scenarios, defenders and copyright holders must protect content against proprietary black-box APIs, pixel-space diffusion models, or non-VAE architectures where internal activations and weights are inaccessible. Because existing methods are tethered to specific LDM preconditions, there is currently no verified mechanism to provide provenance or anti-fine-tuning protection across arbitrary or black-box diffusion pipelines.
Why it matters
Enables copyright protection, model attribution, and deepfake prevention across closed-source generative APIs and emerging non-LDM diffusion architectures.
Ways to approach it
Prior-work checks are free with an account. Results someone already ran are shown to everyone.
- 1
Cross-Architecture Transferability Benchmark: Implement standard surrogate-based watermarking and adversarial perturbation techniques on open-source LDMs and measure their attribution retention and attack success rate when transferred blindly to pixel-space diffusion models and non-VAE generative architectures.
- 2
Purely Pixel-Space Watermarking and Verification: Construct a diffusion-independent, pixel-space watermarking pipeline operating strictly on image inputs and outputs without intervening in latent encodings or attention layers, measuring bit recovery accuracy, visual fidelity (FID/PSNR), and robustness against post-processing across diverse generative backbones.
- 3
Zeroth-Order Query-Based Protection: Formulate black-box anti-customization perturbation generation using score-based or zeroth-order optimization over output queries rather than white-box U-Net attention gradients, measuring protection success against unauthorized fine-tuning under strict query budgets.
Have a different approach?
Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.
Why it might fail
Black-box query costs for generating reliable perturbations without gradient access may prove too high for practical adoption, or cross-architecture perturbation transferability from surrogate models might be fundamentally too weak against modern image-to-image fine-tuning pipelines.
Evidence
Each paper's own statement of the limitation, verbatim.
- WMAdapter: Adding WaterMark Control to Latent Diffusion ModelsICML 2025
Restricted to Latent Diffusion Models that utilize a VAE architecture
- Scalable Dual Fingerprinting for Hierarchical Attribution of Text-to-Image ModelsICCV 2025
The approach is specific to Latent Diffusion Models (LDM) as it relies on fine-tuning the VAE component.
- Breaking Latent Prior Bias in Detectors for Generalizable AIGC Image DetectionNeurIPS 2025
Requires white-box access to the diffusion model's latent space to generate adversarial training samples.
- AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention DisruptionICLR 2025
Requires white-box access to the target diffusion model's U-Net attention layers during perturbation generation.
Nearest existing work
- WMAdapter: Adding WaterMark Control to Latent Diffusion ModelsICML 2025
- CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion ModelsICML 2025
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion ModelsCVPR 2025
- GoodDiffusion: Proactive Copyright Protection for Diffusion Bridge Models via Learnable Sample-specific SignaturesICML 2026
- Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion ModelsCVPR 2025
- SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery AttacksICML 2026
- Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion PerspectiveICML 2026
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion ModelsCVPR 2025
- The Stable Signature: Rooting Watermarks in Latent Diffusion ModelsICCV 2023
- MaxMark: High-Capacity Diffusion-Native Watermarking via Robust and Invertible Latent EmbeddingCVPR 2026
- MOLM: Mixture of LoRA MarkersICLR 2026
- MONTAGE: Monitoring Training for Attribution of Generative Diffusion ModelsECCV 2024
- RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable GuaranteesNeurIPS 2024
- PlugMark: A Plug-in Zero-Watermarking Framework for Diffusion ModelsICCV 2025
- Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion ModelsCVPR 2024
Related open problems
Watermarking & Deepfake Detection
Black-Box Verification and Trigger Generation for Model Watermarking and Detection
Current watermarking and deepfake detection methods require full white-box access to target model parameters and gradients during trigger construction or verification. When proprietary models are deployed solely behind inference APIs or distributed as encrypted binaries, these techniques cannot be applied at all. This leaves model owners and auditors unable to verify intellectual property theft, track provenance, or detect misuse across commercial black-box deployments.
Watermarking & Deepfake Detection
Black-Box and Model-Agnostic Deepfake and Watermark Verification for Closed-Source Generative Models
Current watermark verification and deepfake detection methods require white-box access to target model parameters, intermediate layer activations, or gradient information. Because leading generative models and vision-language systems are served exclusively behind closed commercial APIs, internal inspection methods cannot be executed by downstream verifiers or auditors. Consequently, defenders cannot detect deepfakes or verify watermarks when the generating model is proprietary, unknown, or inaccessible. Removing the precondition of internal weight and activation access is necessary for auditing real-world deployed models.
Watermarking & Deepfake Detection
Cross-Family Generalization and Robustness of Text Watermarking Attacks and Defenses
Existing evaluations of text watermark attacks, detection, and removal methods have almost exclusively tested narrow subsets of logit-based schemes (e.g., KGW and SIR) evaluated on fixed base models like OPT-1.3B. Because no single study has evaluated these attack and defense methods across fundamentally different watermark families—including sampling-based, dynamic-hash, content-adaptive, and error-correction-augmented schemes—practitioners cannot determine whether reported evasion and detection results reflect general properties or family-specific artifacts. Consequently, deployment decisions for provenance tracking in production language models rely on unverified theoretical compatibility claims rather than measured empirical robustness.
Watermarking & Deepfake Detection
Benchmarking Watermarking and Deepfake Detection Across Non-Latent and Flow-Matching Generative Architectures
Current watermarking and detection methods in generative media are almost exclusively developed and evaluated on standard latent diffusion models relying on Gaussian noise sampling. Consequently, it is unknown whether these techniques transfer, degrade, or fail entirely when applied to pixel-space diffusion, non-iterative architectures, or modern rectified-flow and flow-matching models such as SD3 and FLUX. As production generative pipelines shift away from standard latent diffusion, safety and provenance mechanisms risk operating under untested assumptions. A systematic evaluation across these architectural families is necessary to establish the empirical boundary of existing detection and watermarking schemes.