💻 computer science

Robust Watermarks Meet Backdoored Models: Evading Diffusion Semantic Watermarks via Stealthy Backdoor

This paper introduces GhostVAE, a stealthy backdoor attack that compromises the encoder of Variational Autoencoders to reliably evade semantic watermarks in Latent Diffusion Models while maintaining high detection accuracy on benign images, thereby exposing critical vulnerabilities in the end-to-end security of current watermarking systems.

Original authors: Jinyuan Liu, Tianshuo Cong, Pei Li, Tianrui Wang, Xinlei He, Anyu Wang, Xiaoyun Wang

Published 2026-08-04

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jinyuan Liu, Tianshuo Cong, Pei Li, Tianrui Wang, Xinlei He, Anyu Wang, Xiaoyun Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are in a world where computers can dream up photorealistic images from a simple sentence, like "a cat wearing a space helmet." These machines, called Latent Diffusion Models, are incredibly powerful, but they come with a catch: how do we know if an image was made by a robot or a human? To solve this, scientists invented "digital watermarks." Think of these not as visible logos, but as invisible, microscopic fingerprints hidden inside the image's code. Just like a banknote has a special thread woven into the paper that you can't see unless you know where to look, these watermarks are hidden in the mathematical "latent space" where the image is built. If you try to copy or alter the image, the fingerprint should stay intact, proving its origin. This is crucial for stopping fake news and deepfakes. But what if the person who built the machine that creates the images also built a secret backdoor into the tool used to check for those fingerprints?

This is exactly what the paper "Robust Watermarks Meet Backdoored Models" explores. The researchers, led by Jinyuan Liu and Tianshuo Cong, discovered a sneaky way to trick the system. They created a method called GhostVAE. Imagine the image generator as a factory, and the watermark detector as a security guard at the exit. Usually, the guard checks every box (image) to see if it has the secret thread. The researchers found that they could secretly modify the factory's internal conveyor belt (the VAE encoder) so that it only trips the alarm for normal boxes, but lets boxes with a specific, tiny, invisible sticker (a "trigger") slip right past the guard.

Here is how the magic trick works. The attackers plant a "backdoor" into the encoder, which is the part of the computer that translates the digital blueprint into a picture. They train this encoder to behave normally 99% of the time, so it passes all the standard security checks. However, they also teach it a secret handshake. If an image has a specific, almost invisible pattern added to it (the trigger), the encoder performs a "sign flip." It's like the encoder suddenly decides to turn every "yes" into a "no" and every "up" into "down" for that specific image. Because the watermark detection relies on reading those specific "yes/no" directions to find the fingerprint, flipping them scrambles the message. The guard looks at the image, sees the scrambled code, and thinks, "No watermark here!" even though the image is actually full of them.

The team tested this GhostVAE trick on three different types of image generators and three different types of watermarking systems. The results were startlingly effective. When the secret trigger was used, the attack succeeded in hiding the watermark 94.6% of the time on average. In some cases, like with the PRCMark system on the SD-2.1 model, it worked 100% of the time. This means the bad guys could generate a fake image, slap a tiny, invisible trigger on it, and the system would completely fail to flag it as AI-generated.

But here is the really scary part: the attackers didn't just break the system; they hid their tracks perfectly. The researchers tried to catch GhostVAE using seventeen different security defenses, including checking for weird patterns in the code, looking at the mathematical distributions, and even trying to "clean" the images with other AI tools. GhostVAE slipped through almost all of them. The trigger was so subtle that it didn't ruin the picture quality (the images still looked great), and the modified encoder looked almost identical to a normal one. Even when the researchers tried to "prune" (cut out) the suspicious parts of the code, the backdoor stayed alive, while the normal watermark detection started to fail.

The paper concludes that relying on watermarks alone isn't enough if the tools used to check them can be secretly compromised. It's like having a perfect lock on a door, but the person who installed the lock also kept a spare key hidden under the mat. The researchers suggest that to truly trust these systems, we need to secure the entire pipeline, not just the watermark itself. They warn that without end-to-end security, malicious suppliers could quietly distribute these "Trojan" models, allowing bad actors to spread harmful, untraceable content while the rest of the world thinks everything is safe. The study doesn't say this is a solved problem, but rather a massive wake-up call that the security of AI-generated content is far more fragile than we thought.

Technical Summary: GhostVAE – Evading Diffusion Semantic Watermarks via Stealthy Backdoor

Problem Statement

Semantic watermarking has emerged as a primary technical solution for establishing the provenance of images generated by Latent Diffusion Models (LDMs). These schemes, such as Tree-Ring, Gaussian Shading, and PRCMark, embed information into the initial latent noise of the generation process, relying on the preservation of the latent Gaussian distribution to maintain image fidelity. A critical assumption in these systems is that the detection pipeline, which typically involves a Variational Autoencoder (VAE) to map images back to latent space, is trustworthy.

This paper identifies a fundamental vulnerability in this assumption: the reliance on neural networks for detection introduces a backdoor attack surface. The authors posit a threat model where a malicious model supplier, while outwardly complying with regulatory requirements by deploying a "provably secure" watermarking scheme, secretly plants a backdoor into the VAE encoder. This allows the supplier to distribute a universal trigger to colluding users. When an image containing this trigger is processed by the backdoored encoder, the watermark detection is selectively disabled, enabling the generation of untraceable, harmful content that bypasses regulatory auditing.

Methodology: GhostVAE

The authors propose GhostVAE, a two-stage backdoor attack framework designed to plant a stealthy backdoor into the VAE encoder of LDMs. The attack is designed to be selective (evading detection only when triggered), stealthy (undetectable by white-box auditors), and generalizable across different LDM architectures and watermarking schemes.

Stage 1: Universal Trigger Generation

The first stage focuses on constructing a robust, imperceptible trigger ( $\delta$ ) that can be applied to any image.

Objective: The trigger must induce a consistent "sign-flip" effect in the latent space of the encoded image while remaining robust against common corruptions and purification techniques.
Optimization: The trigger is optimized via Projected Gradient Descent (PGD) to minimize a loss function combining two terms:
1. Flipping Loss ( $L_{flip}$ ): Encourages the latent representation of the triggered image ( $E_{bd}(x+\delta)$ ) to be the negative of the clean image's latent ( $E_{cl}(x)$ ). This disrupts watermark schemes that rely on the sign of the latent (e.g., Gaussian Shading, PRCMark) or the Fourier structure (Tree-Ring).
2. Robustness Loss ( $L_{robust}$ ): Utilizes power spectrum regularization (adapted from BlurGuard) to align the power spectrum of the triggered image with the original. This is achieved by applying a learnable Gaussian blur to the trigger during optimization, ensuring the trigger avoids high-frequency signatures that purification defenses (like DiffPure) might suppress.

Stage 2: Backdoored Encoder Training

The second stage fine-tunes the VAE encoder ( $E_{bd}$ ) to reliably respond to the trigger while maintaining normal functionality on benign inputs.

Multi-Task Learning: The encoder is trained to minimize a composite loss function:
1. Functionality Loss ( $L_{func}$ ): Ensures the encoder's output on clean images matches the benign reference encoder ( $E_{cl}$ ), preserving generation fidelity and benign detection rates.
2. Backdoor Loss ( $L_{bd}$ ): Enforces the sign-flip behavior specifically for triggered inputs.
3. Stealth Loss ( $L_{stealth}$ ): To prevent detection in the parameter space, the authors employ a Maximum Mean Discrepancy (MMD) regularizer. This aligns the channel-wise weight distributions of the backdoored encoder with the benign reference, preventing the concentration of backdoor behavior in specific neurons that might be flagged by pruning or activation clustering defenses.

Key Contributions

Threat Model Formalization: The paper identifies and formalizes a new threat vector where the integrity of the VAE encoder is compromised, undermining the trustworthiness of semantic watermarking systems even if the watermark embedding itself is cryptographically sound.
GhostVAE Attack Framework: The authors propose a practical, stealthy attack that achieves high evasion rates without degrading image quality or requiring per-image optimization at inference time.
Comprehensive Defense Evaluation: The work provides a rigorous evaluation of 17 representative defenses across input-space, parameter-space, and latent-space dimensions, demonstrating the limitations of current mitigation strategies against this specific threat.

Experimental Results

The authors evaluated GhostVAE on three state-of-the-art LDMs (SD-2.1, SD-XL, FLUX-1.0) and three semantic watermarking schemes (Tree-Ring, Gaussian Shading, PRCMark).

Attack Success Rate (ASR): GhostVAE achieved an average ASR of 94.6% across all settings. Notably, it reached 100% ASR on SD-2.1 under the PRCMark scheme.
Benign Performance: The attack preserved the detection of benign watermarked images, maintaining an average True Positive Rate (TPR) of 94.4% with a near-zero False Positive Rate (FPR).
Image Quality: The trigger was imperceptible, with minimal impact on visual fidelity (e.g., PSNR remained high, and LPIPS scores indicated negligible perceptual degradation).
Comparison to Removal Attacks: Unlike existing watermark removal attacks (e.g., Embedding, Imprint, Regeneration) which require significant computational cost, iterative optimization, or diffusion sampling, GhostVAE operates with negligible latency (approx. $5 \times 10^{-5}$ s per image) and no diffusion sampling at test time.

Defense Evasion

GhostVAE demonstrated robustness against a wide array of defenses:

Input-Space: The trigger remained effective against image corruptions (JPEG, noise, rotation), purification techniques (DiffPure), and social media pipelines (X/Twitter).
Parameter-Space: Pruning-based defenses (CLP, ANP, structured pruning) and fine-tuning defenses (FT, FT-SAM, I-BAU) failed to remove the backdoor without significantly degrading the model's benign functionality or watermark detection capabilities.
Latent-Space: The attack evaded meta-classifier detectors (Jumbo MNTD), activation clustering, and Kolmogorov-Smirnov tests, as the backdoored encoder's latent distributions and activation patterns remained statistically indistinguishable from benign encoders.

Significance and Claims

The paper concludes that the security of semantic watermarking systems cannot be guaranteed solely by robust embedding algorithms; the underlying neural network components, specifically the VAE encoder, must also be secured. The authors claim that:

Fundamental Vulnerability: The reliance on neural networks for detection creates a critical, underexplored attack surface that can fundamentally undermine the traceability of AI-generated content.
End-to-End Security: Secure deployment requires end-to-end security considerations, including oversight of the model training pipeline and the integrity of the VAE components.
Regulatory Implications: Current regulatory frameworks focusing on watermark presence may be insufficient if the detection pipeline itself is compromised. The authors suggest that trusted third-party training of VAEs and cryptographic integrity checks for model components are necessary mitigations.

The work highlights a gap between the theoretical robustness of watermarking schemes and their practical security in the presence of compromised model components, urging the community to address the security of the entire generative model pipeline.