🤖 machine learning

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

This paper proposes PGID, a training-free, plug-and-play framework that defends against watermark removal and forgery attacks on AI-generated images by using progressive guided inversion and denoising to project perturbed latents back to their original regions, thereby restoring robust detection reliability.

Original authors: Minh Quoc Duong, Chun Tong Lei, Chun Pong Lau

Published 2026-05-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Minh Quoc Duong, Chun Tong Lei, Chun Pong Lau

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The Digital Watermark Problem

Imagine AI image generators (like Stable Diffusion) as a magical factory that can create beautiful pictures from thin air. To protect their work, the factory owners (service providers) use digital watermarks. Think of these watermarks not as a visible logo on the photo, but as a secret fingerprint hidden inside the very first spark of electricity that starts the creation process.

To check if a picture belongs to the factory, you have to run the creation process in reverse (like rewinding a movie) to find that original spark. If the spark has the factory's fingerprint, the picture is theirs.

The Problem:
Recently, hackers found a way to break this system. They discovered that if they tweak the picture just right, they can:

Steal the picture: Take a factory image, scrub out the fingerprint, and claim it as their own (The "Removal Attack").
Fake the picture: Take a random image from the internet and inject the factory's fingerprint into it, making it look like the factory made it (The "Forgery Attack").

Current security guards (standard detection methods) are easily fooled by these tricks. They either miss the stolen pictures or get tricked by the fakes.

The Solution: PGID (The "Smart Rewind")

The authors propose a new tool called PGID (Progressive Guided Inversion and Denoising). It's like a super-smart detective that doesn't just rewind the movie; it fixes the movie while rewinding it.

Here is how it works, using an analogy:

1. The "Two Neighborhoods" Concept

Imagine the space where these images live is divided into two neighborhoods:

The Watermarked Neighborhood: Where all the factory's real images live.
The Unwatermarked Neighborhood: Where random, non-factory images live.

The hackers' attacks work by physically moving the images between these neighborhoods:

Removal Attack: They push a real factory image out of the Watermarked Neighborhood and into the Unwatermarked one.
Forgery Attack: They push a random image into the Watermarked Neighborhood.

2. The "Bumpy Road" Problem

When the hackers move these images, they leave a trail of "bumps" and "deflections" in the path. If you try to rewind the image normally (like a standard camera), you get stuck on these bumps and end up in the wrong neighborhood.

3. How PGID Fixes It (The "Progressive Guide")

PGID acts like a guided tour guide that knows the terrain perfectly. Instead of just walking backward, it uses a special technique:

Step 1: The Preview: It first runs a standard rewind to see where the hacker pushed the image.
Step 2: The "Walk Back, Run Forward" Dance: This is the core magic. PGID moves the image backward a few steps (inverting), but then moves it forward (denoising) more steps than it moved backward.
- Analogy: Imagine you are trying to find your way back to your house, but someone has scattered obstacles (the hacker's changes) on the path. If you just walk backward, you trip. But if you take a few steps back, then take a few longer steps forward, you use the "clean air" of the forward path to smooth out the obstacles.
Step 3: The Correction: By doing this "backward-then-more-forward" dance repeatedly, the tool smooths out the hacker's bumps. It effectively pushes the image back to the neighborhood it originally belonged to.

What PGID Achieves

The paper claims that with this new "Smart Rewind" tool:

It recovers stolen goods: If a hacker tries to remove a watermark, PGID can "clean" the image and push it back into the Watermarked Neighborhood, revealing the hidden fingerprint. It's like finding a hidden message that someone tried to erase.
It exposes fakes: If a hacker tries to forge a watermark, PGID pushes that fake image back into the Unwatermarked Neighborhood. The detector then says, "This doesn't belong here," and rejects the fake.

The Results (In Plain English)

The authors tested this on four different types of digital watermarks and two different AI models.

Before PGID: Hackers could successfully steal or fake images about 90-100% of the time. The security system failed.
After PGID: The system became nearly perfect.
- It recovered stolen watermarks almost 100% of the time.
- It rejected forged images almost 100% of the time.
- It worked even if the hacker used a slightly different AI model to create the attack.

The Catch (Limitations)

The paper admits a few things:

It's a bit slower: Because PGID has to do this "dance" of moving back and forth, it takes more computer time than a simple rewind. However, the authors say this is a fair trade for security.
It needs tuning: The "steps" of the dance (how far back and how far forward) need to be adjusted depending on which specific watermark or AI model is being used. There isn't one "perfect setting" for every single situation yet.
It only fights "pushing" attacks: This tool is designed to fix images that have been physically pushed around (perturbed). It might not work against attacks that don't involve pushing the image around (like simply averaging many images together).

Summary

Think of PGID as a self-correcting GPS for digital watermarks. When a hacker tries to reroute a car (the image) to the wrong destination, PGID doesn't just follow the wrong road; it calculates the bumps, smooths them out, and guides the car back to its original, correct destination, ensuring the owner's identity is always recognized.

Technical Summary: PGID (Progressive Guided Inversion and Denoising)

Problem Statement

The proliferation of AI-generated images via diffusion models has necessitated robust digital watermarking for intellectual property protection and provenance tracing. Recent semantic watermarking schemes (e.g., Tree Ring, Gaussian Shading) embed signals into the initial noise of the diffusion process, relying on diffusion inversion (typically DDIM) to retrieve the initial noise for detection.

However, this reliance on accurate inversion creates a critical vulnerability. Recent work by Müller et al. (2025) demonstrated that this paradigm is susceptible to two specific black-box attacks:

Imprint Removal Attacks: Attackers perturb a watermarked image to displace its latent representation from the "watermarked region" into the "unwatermarked region," causing detection failure.
Imprint Forgery Attacks: Attackers perturb a clean (unwatermarked) cover image to guide its latent representation into the "watermarked region," causing false positives.

Current one-stage inversion approaches fail to distinguish between authentic watermarks and these adversarial perturbations, leaving service providers vulnerable to copyright theft and reputational damage.

Methodology: Progressive Guided Inversion and Denoising (PGID)

The authors propose PGID, a plug-and-play, training-free framework designed to defend against both removal and forgery attacks without retraining the underlying diffusion model.

Core Insight

The method is grounded in the observation that the latent space can be partitioned into a watermarked region ( $R_w$ ) and an unwatermarked region ( $R_u$ ) for a specific watermark signal.

Removal attacks shift watermarked latents ( $z_0 \in R_w$ ) into $R_u$ .
Forgery attacks shift unwatermarked latents ( $z_0 \in R_u$ ) into $R_w$ .
These attacks induce cumulative distributional bias at intermediate timesteps during the inversion trajectory.

The PGID Framework

PGID operates in three stages to project perturbed latents back to their original regions:

Trajectory Pre-computation: The standard DDIM inversion is run on the suspect image to obtain the attacked intermediate latent trajectory $\{z^{atk}_t\}$ .
Progressive Latent Refinement (The Core Defense): This stage utilizes asymmetric inversion-denoising cycles to eliminate deflections and mitigate adversarial perturbations.
- The process iterates from $t=1$ to a stopping timestep $k$ .
- In each cycle, the algorithm performs more denoising steps than inversion steps. Specifically, it inverts $i-s$ steps and then denoises $i$ steps.
- Guidance: A guidance term $\gamma(\hat{z} - z^{atk}_t)$ is applied to steer the trajectory away from the precomputed attacked path.
- Mechanism: By denoising more than it inverts, the method treats the adversarial perturbation as additional noise. The diffusion model's inherent ability to denoise effectively filters out these perturbations, projecting the latent back toward the clean manifold (either $R_w$ or $R_u$ ).
Final Inversion: A standard full inversion is performed on the refined latent $z_0$ to retrieve the final noise $z_T$ for detection.

Variants

PGID-R: Configured to defend against removal attacks by projecting attacked latents back into the watermarked region.
PGID-F: Configured to defend against forgery attacks by projecting forged latents back into the unwatermarked region.

Key Contributions

Formalization of Latent Regions: The authors formalize the concepts of watermarked and unwatermarked regions in the latent space and empirically demonstrate (via PCA) that imprint attacks successfully displace latents out of their respective regions to disrupt detection.
Unified Defense Framework: PGID is the first plug-and-play, training-free noise extraction framework that unifies defense against both imprint forgery and removal attacks.
Restoration and Differentiation: The framework successfully recovers obscured watermarks from removal attacks and differentiates forged images from authentic ones, a capability not previously demonstrated in a unified manner.

Experimental Results

The authors evaluated PGID across four semantic watermarking schemes (Tree Ring, Gaussian Shading, PRC, T2SMark) using Stable Diffusion v2.1 and v1.5, as well as the PixArt- $\alpha$ architecture.

Against Removal Attacks:
- Baseline schemes (standard inversion) suffered near-total detection failure (e.g., detection rates dropped to ~0.00–0.25) after removal attacks.
- PGID-R restored detection rates to ~1.00 (100%) and bit accuracy to near-perfect levels across all schemes and attacker models. It achieved AUC scores near 1.0, effectively distinguishing removed images from clean unwatermarked images.
Against Forgery Attacks:
- Baseline schemes were highly susceptible, with forged images almost always detected as watermarked (Detection Rate ~1.00).
- PGID-F suppressed the forged signal, reducing detection rates to near 0.00 and bit accuracy to random-guess levels (~0.5).
- Crucially, PGID-F maintained the integrity of authentic watermarks. When authentic watermarked images were passed through PGID-F, detection rates remained high (>0.93) and bit accuracy was preserved, while forged images were rejected.
Generalizability: The method demonstrated robust performance across different model architectures (SD 2.1, SD 1.5, PixArt- $\alpha$ ) and different attack schedulers (DDIM, DPM).

Significance and Claims

The paper claims that PGID addresses a critical security gap in semantic watermarking by moving beyond simple one-stage inversion. By leveraging the diffusion model's intrinsic denoising capabilities through progressive, asymmetric cycles, PGID effectively "cleans" the latent representation of adversarial perturbations.

The authors emphasize that PGID is training-free and plug-and-play, requiring only the service provider's model to defend against sophisticated black-box attacks. They note that while hyperparameters (stopping timestep $k$ , skip steps $s$ , guidance strength $\gamma$ ) may need tuning for specific schemes (particularly sensitive ones like PRC), the framework provides a robust, unified solution for content provenance. The work establishes that it is possible to recover watermarks from removal attacks and reject forged instances, significantly enhancing the reliability of AI-generated content detection.