DRIFT (Deflecting the Generative Trajectory)

Properties

category: watermark-remover
maturity: emerging
approach: Black-box attack against diffusion watermarking that combines partial forward diffusion (re-noising) with stochastic reverse resampling to disrupt the recoverable generative trajectory that watermark verifiers rely on, rather than regenerating along a deterministic trajectory or optimizing per image; an adaptive variant searches a ladder of resampling strengths per image for the first verifier-rejected rung and refines fidelity while preserving rejection.
access: free
owns: An academic research method (arXiv, submitted 2026-09-08) demonstrating a single black-box attack that defeats nine diffusion watermarking schemes across three paradigms (noise-space schemes including Tree-Ring and RingID, latent/frequency-domain schemes including Gaussian Shading, and an optimization-based scheme), without needing secret keys, verifier internals, or per-image gradient optimization.
distinctFrom: The already-tracked noai-watermark and remove-ai-watermarks also claim Tree-Ring-family coverage via diffusion regeneration, and marknull covers initial-noise-based schemes via on-manifold latent decorrelation; DRIFT's distinct contribution is a different mechanism (forward re-noising plus stochastic reverse resampling, with a derived information-theoretic/Wasserstein bound on distortion) validated as a single black-box attack across nine named schemes spanning three paradigms at once, rather than a single-vendor tool or a narrower theoretical result.
source: arXiv:2609.08213, DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory
notes: Submitted 2026-09-08 (within this lens's window), authors Rui Bao, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Yang Song, Jiaojiao Jiang. No public code repository or project page was found despite searching under the authors' names and the paper title; access marked 'free' rather than 'open-source', following the same precedent as the already-tracked marknull entry (paper-only research method with no confirmed code release). The paper does not test SynthID or Stable Signature; the nine schemes are Tree-Ring, RingID, PRC, WIND (noise-space), Gaussian Shading, GaussMarker, SFW, SEAL (latent/frequency-domain), and ROBIN (optimization-based).

Provenance

Source: https://arxiv.org/abs/2609.08213

Properties

category

watermark-remover

maturity

emerging

approach

Black-box attack against diffusion watermarking that combines partial forward diffusion (re-noising) with stochastic reverse resampling to disrupt the recoverable generative trajectory that watermark verifiers rely on, rather than regenerating along a deterministic trajectory or optimizing per image; an adaptive variant searches a ladder of resampling strengths per image for the first verifier-rejected rung and refines fidelity while preserving rejection.

access

free

owns

An academic research method (arXiv, submitted 2026-09-08) demonstrating a single black-box attack that defeats nine diffusion watermarking schemes across three paradigms (noise-space schemes including Tree-Ring and RingID, latent/frequency-domain schemes including Gaussian Shading, and an optimization-based scheme), without needing secret keys, verifier internals, or per-image gradient optimization.

distinctFrom

The already-tracked noai-watermark and remove-ai-watermarks also claim Tree-Ring-family coverage via diffusion regeneration, and marknull covers initial-noise-based schemes via on-manifold latent decorrelation; DRIFT's distinct contribution is a different mechanism (forward re-noising plus stochastic reverse resampling, with a derived information-theoretic/Wasserstein bound on distortion) validated as a single black-box attack across nine named schemes spanning three paradigms at once, rather than a single-vendor tool or a narrower theoretical result.

source

arXiv:2609.08213, DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory

notes

Submitted 2026-09-08 (within this lens's window), authors Rui Bao, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Yang Song, Jiaojiao Jiang. No public code repository or project page was found despite searching under the authors' names and the paper title; access marked 'free' rather than 'open-source', following the same precedent as the already-tracked marknull entry (paper-only research method with no confirmed code release). The paper does not test SynthID or Stable Signature; the nine schemes are Tree-Ring, RingID, PRC, WIND (noise-space), Gaussian Shading, GaussMarker, SFW, SEAL (latent/frequency-domain), and ROBIN (optimization-based).