SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark

View PDF

Abstract:Diffusion-based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose $\underline{\mathbf{S}}$tochastic $\underline{\mathbf{Hi}}$dden-Trajectory De$\underline{\mathbf{f}}$lec$\underline{\mathbf{t}}$ion ($\mathbf{SHIFT}$), a training-free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark-embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise-space, frequency-domain, and optimization-based paradigms show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.

Subjects:

Computer Vision and Pattern Recognition (cs.CV); Cryptography and Security (cs.CR)

Cite as: arXiv:2603.29742 [cs.CV]

(or arXiv:2603.29742v2 [cs.CV] for this version)

https://doi.org/10.48550/arXiv.2603.29742

arXiv-issued DOI via DataCite

Submission history

From: Zheng Gao [view email] [v1] Tue, 31 Mar 2026 13:39:37 UTC (44,558 KB) [v2] Wed, 1 Apr 2026 13:47:16 UTC (44,555 KB)