Watermarking & Deepfake Detection
Black-Box and Model-Agnostic Deepfake and Watermark Verification for Closed-Source Generative Models
Generated automatically from the limitations stated in 4 papers (ICML, ICLR, CVPR), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.
The problem
Current watermark verification and deepfake detection methods require white-box access to target model parameters, intermediate layer activations, or gradient information. Because leading generative models and vision-language systems are served exclusively behind closed commercial APIs, internal inspection methods cannot be executed by downstream verifiers or auditors. Consequently, defenders cannot detect deepfakes or verify watermarks when the generating model is proprietary, unknown, or inaccessible. Removing the precondition of internal weight and activation access is necessary for auditing real-world deployed models.
Why it matters
Auditing, watermark verification, and synthetic media provenance tracking become possible on commercial API-only models without requiring provider cooperation or access to internal network states.
Ways to approach it
Prior-work checks are free with an account. Results someone already ran are shown to everyone.
- 1
Output-only statistical fingerprinting: Construct an evaluation harness querying proprietary generation APIs (e.g., text and vision-language models) across fixed probe prompts to identify output distributional anomalies or residual statistical watermarks without extracting internal activations. Measure detection AUROC and false positive rate under varying query budgets.
- 2
Surrogate-based black-box transfer verification: Train detection and verification heads on open-source surrogate models and evaluate cross-model transferability against closed target models where weights and internal representations are unknown. Measure transfer attack/detection success rates and calibration error across disparate architectures.
- 3
Decision-based query auditing: Formulate watermark extraction and verification as a black-box query-response game that optimizes test-time prompts to provoke detectable output signatures. Measure verification accuracy, API query cost, and sample efficiency against rate-limited endpoints.
Have a different approach?
Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.
Why it might fail
Commercial APIs may apply aggressive output filtering or stochastic decoding perturbations that wash out all input-output statistical signatures without access to hidden state logits. Additionally, black-box query budgets might prove prohibitively expensive for low-latency verification pipelines.
Evidence
Each paper's own statement of the limitation, verbatim.
- LLM Self-Recognition: Steering and Retrieving Activation SignaturesICML 2026
Requires white-box access to the model and a forward pass for detection (activation extraction costs 21% of generation time), so it cannot be applied to closed models or text whose source model is unknown
- Image Can Bring Your Memory Back: A Novel Multi-Modal Guided Attack against Image Generation Model UnlearningICLR 2026
Requires white-box access to the unlearned model's weights and gradients, so it cannot attack API-only or closed models; black-box/transfer attacks are left as future work
- Do Vision-Language Models Leak What They Learn? Adaptive Token-Weighted Model Inversion AttacksCVPR 2026
Requires a strong white-box attacker with full access to model parameters and attention maps, which is unrealistic for most deployed closed models
- Privacy-Shielded Image Compression: Defending Against Exploitation from Vision-Language Pretrained ModelsICML 2025
Requires access to the target VLP model and its feature space during training (white-box attack objective), so it cannot be applied when the attacker/defender model is unknown or inaccessible
Nearest existing work
- Where's the Liability in the Generative Era? Recovery-based Black-Box Detection of AI-Generated ContentCVPR 2025
- Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark RemovalCVPR 2025
- Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training DataICCV 2021
- Finding a needle in a haystack: A Black-Box Approach to Invisible Watermark DetectionECCV 2024
- Training Data Provenance Verification: Did Your Model Use Synthetic Data from My Generative Model for Training?CVPR 2025
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion ModelsCVPR 2025
- RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable GuaranteesNeurIPS 2024
- Where Am I From? Identifying Origin of LLM-generated ContentEMNLP 2024
- CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image ModelsCVPR 2026
- A Transfer Attack to Image WatermarksICLR 2025
- Protecting Language Generation Models via Invisible WatermarkingICML 2023
- Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion PerspectiveICML 2026
- The Stable Signature: Rooting Watermarks in Latent Diffusion ModelsICCV 2023
- Evading Data Provenance in Deep Neural NetworksICCV 2025
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language ModelsICML 2024
Related open problems
Watermarking & Deepfake Detection
Black-Box Verification and Trigger Generation for Model Watermarking and Detection
Current watermarking and deepfake detection methods require full white-box access to target model parameters and gradients during trigger construction or verification. When proprietary models are deployed solely behind inference APIs or distributed as encrypted binaries, these techniques cannot be applied at all. This leaves model owners and auditors unable to verify intellectual property theft, track provenance, or detect misuse across commercial black-box deployments.
Watermarking & Deepfake Detection
Black-Box and Architecture-Agnostic Watermarking and Defense for Diffusion Models
Current proactive watermarking, attribution, and anti-customization defenses structurally assume white-box access to target latent diffusion models, requiring direct inspection of latent spaces, VAE fine-tuning, or gradient backpropagation through internal U-Net attention layers. In practical deployment scenarios, defenders and copyright holders must protect content against proprietary black-box APIs, pixel-space diffusion models, or non-VAE architectures where internal activations and weights are inaccessible. Because existing methods are tethered to specific LDM preconditions, there is currently no verified mechanism to provide provenance or anti-fine-tuning protection across arbitrary or black-box diffusion pipelines.
Watermarking & Deepfake Detection
Cross-Family Generalization and Robustness of Text Watermarking Attacks and Defenses
Existing evaluations of text watermark attacks, detection, and removal methods have almost exclusively tested narrow subsets of logit-based schemes (e.g., KGW and SIR) evaluated on fixed base models like OPT-1.3B. Because no single study has evaluated these attack and defense methods across fundamentally different watermark families—including sampling-based, dynamic-hash, content-adaptive, and error-correction-augmented schemes—practitioners cannot determine whether reported evasion and detection results reflect general properties or family-specific artifacts. Consequently, deployment decisions for provenance tracking in production language models rely on unverified theoretical compatibility claims rather than measured empirical robustness.
Watermarking & Deepfake Detection
Benchmarking Watermarking and Deepfake Detection Across Non-Latent and Flow-Matching Generative Architectures
Current watermarking and detection methods in generative media are almost exclusively developed and evaluated on standard latent diffusion models relying on Gaussian noise sampling. Consequently, it is unknown whether these techniques transfer, degrade, or fail entirely when applied to pixel-space diffusion, non-iterative architectures, or modern rectified-flow and flow-matching models such as SD3 and FLUX. As production generative pipelines shift away from standard latent diffusion, safety and provenance mechanisms risk operating under untested assumptions. A systematic evaluation across these architectural families is necessary to establish the empirical boundary of existing detection and watermarking schemes.