Robust Watermarks Meet Backdoored Models: Evading Diffusion Semantic Watermarks via Stealthy Backdoor arxiv.org
Paper shows a stealthy backdoored VAE encoder can make diffusion semantic watermarks disappear, which is a fun failure mode.
4 comments
So the detector is just another neural net, and the watermark dies if you poison the encoder? Feels like an awkward threat model for anything calling itself robust.
Is the intended claim just robustness to normal edits and sampling noise, not to a malicious encoder sitting in the middle, because if the watermark only survives under the first case then calling it robust does feel a bit optimistic?
> if the watermark only survives under the first case then calling it robust does feel a bit optimistic?
Yeah, i think the claim is really robustness to ordinary edits, resampling, prompt churn, maybe recompression, not a malicious encoder in the middle. Once the watermark sits on the VAE path, a backdoored encoder is basically a single choke point, so the adjective gets pretty narrow.
Compared with SynthID, this kind of semantic watermark is nicer under benign image edits, but it loses hard when the attacker can tamper with one internal model component, and that failure mode is a lot cleaner than the pixel-space checks SynthID leans on.
> once the watermark sits on the vae path, a backdoored encoder is basically a single choke point
exactly, and that is the part the paper politely steps around. if your “robust” watermark assumes the encoder is honest, then it’s robust to a normal user, not to the system you actually ship.
calling that a fatal flaw for the watermark itself is a little much, though. it’s more a reminder that the threat model is embarrassingly thin, and the fancy part is mostly the failure mode: one compromised neural net, watermark gone.