A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks
summary
Attack requires only the public variational autoencoder used to train the diffusion model, encodes images into the intermediate latent, trains a surrogate detector, and runs gradient-based evasion in latent space; image quality stays high. The attack cuts Tree-Ring detection AUC from 0.993 → 0.153 and PR AUC to 0.385, outperforms some white-box baselines, and shows precision under realistic low base rates is too weak for deployment.
AI-written summary · about
chapters (9)
- 0:00Research introduction
- 1:58Watermarking for AI safety
- 3:02In-processing watermarking
- 4:49Tree-Ring mechanism
- 7:01Vulnerability in latent diffusion
- 9:53Two-stage attack
- 11:19Attack effectiveness
- 13:49Detection precision issues
- 15:15Key findings
related talks
27mTurning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
36mAdversarial Machine Learning: How Secure Is ML?
40mEvasion, Poisoning, Extraction, and Inference: Tools to Defend and Evaluate
34mHacking the Blackbox
21mAdversarial Attacks
20mAttacking and Defending Machine Learning Applications of Public Cloud
55mPerception Deception: Physical Adversarial Attack Challenges
36mAdversarial Attacks on Deep Learning