Watermarking & Deepfake Detection
Black-Box Verification and Trigger Generation for Model Watermarking and Detection
Generated automatically from the limitations stated in 8 papers (ICML, CVPR, ICCV), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.
The problem
Current watermarking and deepfake detection methods require full white-box access to target model parameters and gradients during trigger construction or verification. When proprietary models are deployed solely behind inference APIs or distributed as encrypted binaries, these techniques cannot be applied at all. This leaves model owners and auditors unable to verify intellectual property theft, track provenance, or detect misuse across commercial black-box deployments.
Why it matters
Model owners and regulators can audit, verify intellectual property infringement, and detect watermarks in commercial models accessible solely through query APIs without cooperation from model hosting providers.
Ways to approach it
Prior-work checks are free with an account. Results someone already ran are shown to everyone.
- 1
Zeroth-order gradient estimation and query-based optimization: Construct watermarking triggers or verification probes using black-box output scores or generated samples, measuring detection accuracy and query efficiency against commercial API endpoints.
- 2
Black-box surrogate distillation: Train local white-box surrogate models on input-output queries to optimize transferrable verification triggers, measuring trigger transfer success rates across diverse target model architectures.
- 3
Feature-level query-response fingerprinting: Design input perturbations that elicit statistically distinct behavioral signatures from suspect black-box models without parameter access, evaluating false positive rates across independent non-watermarked models.
Have a different approach?
Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.
Why it might fail
Black-box query costs and rate limits on commercial APIs may render query-based trigger optimization intractable, or API output defenses (such as output filtering and noise perturbation) may eliminate watermark signatures without parameter access.
Evidence
Each paper's own statement of the limitation, verbatim.
- RECOVER: Reliable Detection of Unauthorized Data Usage in Text-to-Image Diffusion Models via Inversion RobustnessICML 2026
Requires white-box or gray-box access to the suspect model (parameters and fine-tuned text condition), which may not hold when the model is only served behind an API; black-box adaptation is deferred to a discussion in the appendix
- An In-Depth Study on Deep Learning Model CloningICML 2026
White-box only: requires access to model structure and parameters; not applicable to encrypted models, closed-source weights, or black-box API services
- Tracking the Copyright of Large Vision-Language Models through Parameter Learning Adversarial ImagesICLR 2025
Requires full white-box access to the original model's parameters during the trigger construction phase
- To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For NowECCV 2024
Requires white-box access to the victim model's parameters and gradients, excluding black-box deployed models
- CGI-DM: Digital Copyright Authentication for Diffusion Models via Contrasting Gradient InversionCVPR 2024
Requires white-box access to both the pre-trained and fine-tuned model parameters and their gradients, limiting use against black-box deployments
- Hiding Visual Information via Obfuscating Adversarial PerturbationsICCV 2023
Requires complete white-box access to the service model's parameters/gradients, limiting use where the model is not accessible
- Knowledge-Enriched Distributional Model Inversion AttacksICCV 2021
Requires full white-box access to the target model parameters and gradients for optimization
- The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural NetworksCVPR 2020
Requires full white-box access to the target network's parameters to perform gradient-based optimization
Nearest existing work
- Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark RemovalCVPR 2025
- Neural Honeytrace: Plug&Play Watermarking Framework against Model Extraction AttacksICML 2026
- CSF: Black-box Fingerprinting via Compositional Semantics for Text-to-Image ModelsCVPR 2026
- Margin-based Neural Network WatermarkingICML 2023
- Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural NetworksNeurIPS 2022
- Efficient Model Stealing Defense with Noise Transition MatrixCVPR 2024
- $δ$-STEAL: LLM Stealing Attack with Local Differential PrivacyACML 2025
- Towards Robust Model Watermark via Reducing Parametric VulnerabilityICCV 2023
- Beyond Dataset Watermarking: Model-Level Copyright Protection for Code Summarization ModelsTheWebConference 2025
- Defense against Model Extraction Attack by Bayesian Active WatermarkingICML 2024
- Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data PoisoningICLR 2025
- Towards Data-Free Model Stealing in a Hard Label SettingCVPR 2022
- "Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Data"ECCV 2024
- How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient RedirectionICML 2022
- Safe and Robust Watermark Injection with a Single OoD ImageICLR 2024
Related open problems
Watermarking & Deepfake Detection
Black-Box and Model-Agnostic Deepfake and Watermark Verification for Closed-Source Generative Models
Current watermark verification and deepfake detection methods require white-box access to target model parameters, intermediate layer activations, or gradient information. Because leading generative models and vision-language systems are served exclusively behind closed commercial APIs, internal inspection methods cannot be executed by downstream verifiers or auditors. Consequently, defenders cannot detect deepfakes or verify watermarks when the generating model is proprietary, unknown, or inaccessible. Removing the precondition of internal weight and activation access is necessary for auditing real-world deployed models.
Watermarking & Deepfake Detection
Black-Box and Architecture-Agnostic Watermarking and Defense for Diffusion Models
Current proactive watermarking, attribution, and anti-customization defenses structurally assume white-box access to target latent diffusion models, requiring direct inspection of latent spaces, VAE fine-tuning, or gradient backpropagation through internal U-Net attention layers. In practical deployment scenarios, defenders and copyright holders must protect content against proprietary black-box APIs, pixel-space diffusion models, or non-VAE architectures where internal activations and weights are inaccessible. Because existing methods are tethered to specific LDM preconditions, there is currently no verified mechanism to provide provenance or anti-fine-tuning protection across arbitrary or black-box diffusion pipelines.
Watermarking & Deepfake Detection
Cross-Family Generalization and Robustness of Text Watermarking Attacks and Defenses
Existing evaluations of text watermark attacks, detection, and removal methods have almost exclusively tested narrow subsets of logit-based schemes (e.g., KGW and SIR) evaluated on fixed base models like OPT-1.3B. Because no single study has evaluated these attack and defense methods across fundamentally different watermark families—including sampling-based, dynamic-hash, content-adaptive, and error-correction-augmented schemes—practitioners cannot determine whether reported evasion and detection results reflect general properties or family-specific artifacts. Consequently, deployment decisions for provenance tracking in production language models rely on unverified theoretical compatibility claims rather than measured empirical robustness.
Watermarking & Deepfake Detection
Benchmarking Watermarking and Deepfake Detection Across Non-Latent and Flow-Matching Generative Architectures
Current watermarking and detection methods in generative media are almost exclusively developed and evaluated on standard latent diffusion models relying on Gaussian noise sampling. Consequently, it is unknown whether these techniques transfer, degrade, or fail entirely when applied to pixel-space diffusion, non-iterative architectures, or modern rectified-flow and flow-matching models such as SD3 and FLUX. As production generative pipelines shift away from standard latent diffusion, safety and provenance mechanisms risk operating under untested assumptions. A systematic evaluation across these architectural families is necessary to establish the empirical boundary of existing detection and watermarking schemes.