DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory
Rui Bao, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Yang Song, Jiaojiao Jiang
cs.CR · cs.LG
Quick verdict
Proposes a black-box diffusion-watermark removal attack claiming 98-100% success across nine schemes; evidence largely convincing but single-backbone, no significance tests, theory premises unverified.
Summary
DRIFT is a black-box attack that removes diffusion-model watermarks by partially re-noising a watermarked image (forward diffusion) and then resampling the reverse trajectory with fresh stochastic noise, deflecting the trajectory-dependent evidence the verifiers rely on. An adaptive variant blindly predicts the watermark family from an inverted latent (99.3% top-1 accuracy), then climbs a strength ladder to the first verifier rejection; an optional DPPO-trained controller refines fidelity while keeping only updates the verifier still rejects. The paper derives fixed-depth information-theoretic and Wasserstein source-dependence bounds, which explicitly do not extend to the adaptively selected output and rest on unverified Lipschitz and moment premises. On Stable Diffusion v2.1, nine watermarks across three paradigms reach 98-100% attack success (99.8% average), beating two baselines (96.8% and 81.3%); the end-to-end version attains 100% ASR with the best reported quality (LPIPS 0.154, FID 55.414) at ~8 s/image. Matched-sampler experiments show stochastic samplers need ~32% less re-noising strength than deterministic ones. Main limitations: single public backbone, adaptive stages require black-box verifier queries, and no confidence intervals or significance tests are reported.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 4
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Reliance on a recoverable generation/inversion trajectory ('trajectory consistency') is a shared attack surface across nine evaluated diffusion watermarking schemes in three paradigms.
- DRIFT (partial forward diffusion + stochastic reverse resampling) removes all nine evaluated watermarks at 98–100% ASR — averaged 99.8% vs 96.8% (black-box) and 81.3% (removing) — without keys, verifier internals, or per-image gradients.
- Matched-sampler comparisons show stochastic reverse sampling reaches a given watermark-survival level with ~32% less re-noising strength at λ★50 (0.272→0.184) than deterministic sampling.
- Adaptive DRIFT's verify-and-climb returns the least-distorted rejected rung on the realized ladder (Proposition 4.4) and verifier-gated DPPO refinement provably preserves rejection while empirically improving fidelity (LPIPS 0.136→0.114, N=225).
- Fixed-depth source dependence is bounded information-theoretically (Eq. 7) and in W2 (≤2√Δn), though these bounds explicitly do not extend to the adaptively selected output.
Strengths
Broad, consistently high empirical effectiveness
Table 1(a): 98–100% ASR on all nine watermarks across three injection paradigms (avg 99.8%) vs 96.8% for the black-box attack and 81.3% for the removing attack; e.g., GaussMarker/Gaussian Shading 100% vs 55%/4% for the removing attack.
Well-controlled attribution of where the benefit comes from
Section 5.2 holds re-noising depth, images, backbone, and strength grid fixed and swaps only the reverse-sampler condition (3 ODE vs 3 SDE samplers, 3 inversion settings, 100 images/cell): mean λ★50 drops 0.272→0.184 (−32%); Gaussian Shading deterministic never reaches 5% survival by λ=0.70 while SDE does at ~0.542.
Useful per-image adaptation with quantified query cost
Unusually careful claim hygiene
Ablations isolate needed components
Weaknesses
All theoretical guarantees rest on unverified premises
Narrow evaluation surface
Statistical reporting is thin
No verifier-transferability or cross-instance evidence
Informal core premise
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
DRIFT (arXiv 2609.08213; UNSW + Griffith) is a black-box watermark-removal attack evaluated against nine diffusion watermarks in three injection paradigms: noise-space (Tree-Ring, RingID, PRC, WIND), latent/frequency-domain (Gaussian Shading, GaussMarker, SFW, SEAL), and optimization-based (ROBIN). The unifying premise is *trajectory consistency*: all nine evaluated verifiers recover evidence coupled to the generation or DDIM-inversion trajectory, so the attacker targets the path rather than a detector-specific signal. Central claims: (i) partial forward diffusion + stochastic reverse resampling achieves 98–100% ASR (avg 99.8%) without keys, verifier internals, or per-image gradients; (ii) matched-sampler experiments (Sec. 5.2) attribute real benefit to stochasticity; (iii) adaptive ladder search plus verifier-gated DPPO refinement yields the best fidelity among compared attacks (Table 1b: SSIM 0.713, PSNR 24.01, LPIPS 0.154, FID 55.414, 8.12 s/image); (iv) Theorem 4.1 bounds fixed-depth source dependence information-theoretically and in W2.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the DRIFT attack on diffusion watermarks?
DRIFT (arXiv 2609.08213) is a black-box removal attack against watermarks embedded in diffusion-model image generation. It re-noises a watermarked image partway (partial forward diffusion) and then denoises it again with fresh random noise (stochastic reverse resampling), which deflects the trajectory-dependent evidence that watermark verifiers check. An adaptive version searches a small ladder of noise strengths for the first one the verifier rejects, and an optional RL-trained refinement step recovers image quality while keeping the watermark removed.
How effective is DRIFT and against which watermarks?
On Stable Diffusion v2.1, the paper reports 98–100% attack success across nine watermarking schemes spanning three paradigms — noise-space (Tree-Ring, RingID, PRC, WIND), latent/frequency-domain (Gaussian Shading, GaussMarker, SFW, SEAL), and prompt-optimization (ROBIN) — averaging 99.8%, versus 96.8% for a prior black-box attack and 81.3% for a latent-noise removing attack. The full pipeline takes about 8 seconds per image on an H100 GPU and achieves the best reported image quality among the compared attacks (LPIPS 0.154, FID 55.4).
Does DRIFT need the watermark key or access to the watermark verifier's internals?
No keys or verifier internals are needed. The base attack is training-free and query-free. However, the adaptive strength search and the fidelity-refinement stage do require black-box yes/no queries to a working verifier (i.e., the attacker must be able to test whether the watermark is still detected), and the whole attack assumes access to a public latent diffusion model, which need not be the one that generated the image.
What are the main limitations of the DRIFT paper?
The authors themselves flag that the theoretical bounds rest on unverified Lipschitz and moment assumptions and do not apply to the adaptively chosen output; evaluation uses a single public backbone (Stable Diffusion v2.1) and only two prior attacks as baselines; no code release is stated; and the paper reports no confidence intervals or significance tests. All guarantees also hold relative to one fixed verifier instance, so transferability to a re-keyed verifier is untested.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Review is based on a text extraction of the PDF (including appendices A-E); figures are available only via their captions, so qualitative fidelity claims (Figures 2, 5-11) were judged from numbers in the captions and tables, not the images themselves.
- Table 1(a)'s per-watermark ASR row does not state its per-family sample size or exact configuration in the provided text; protocol reconciliations across tables 1(a), 1(b), and 6 are inferred from captions.
- Baseline runtimes are reported as absent ('–') in Table 1(b) by the paper itself; per the paper's protocol, code or data release is not mentioned anywhere in the provided text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.