The BaseResearcharXiv
Provably Secure Diffusion Watermarking Against Removal Adversaries with Batched Detector Access
According to the abstract, De Zhang Lee and Ee-Chien Chang show that existing latent watermarks for AI-generated images can be broken by an attacker who queries a public detector in batches. They propose a scheme combining long-term and one-time secrets and claim a security proof, with tests on Stable Diffusion 2.1 and XL.
Why it matters
The same thing, for different readers.
What it means for you
De Zhang Lee and Ee-Chien Chang say marks that label AI-generated images can be stripped when detectors are public, and propose a sturdier way to mark them.
For lawmakers
De Zhang Lee and Ee-Chien Chang show watermark detectors open to the public can leak how to remove the mark, which matters for rules that rely on watermarking.
For researchers
The authors give an attack under batched detector access and a hybrid scheme with a claimed security bound against removal; the abstract says the factor in the bound is tight.
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- A cryptographic security analysis plus evaluations on Stable Diffusion 2.1 and XL of an attack on existing watermarks and of the proposed hybrid scheme.
- What it found
- Per the abstract, an adversary with batched detector access can reconstruct secret transformations; the proposed scheme is provably secure against removal in a stated sense, with a tight factor of root two on the perturbation budget.
- What it does not show
- Security holds under the authors' threat model and assumptions; the excerpt was truncated before the evaluation results.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice?
- People
- De Zhang Lee (Wrote it) · Ee-Chien Chang (Wrote it)
- What we read
- We have read only the description the publisher gives. No quotations until someone reads the source itself.
- Found by
- The Radar, run of October 30, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “Provably Secure Diffusion Watermarking Against Removal Adversaries with Batched Detector Access”, October 29, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-29-diffusion-watermarking-batched-detector