Forging Image Watermarks by Reversing Watermark Removal Attacks

ICLR 2026 Conference Submission14302 Authors

Keywords: Image Watermark, Watermark Forgery, Watermark Removal, Imge Generative Model

TL;DR: In this work, we introduce WForge, a no-box, query-free forgery attack on image watermarks.

Abstract: Image generative models have accelerated the need for robust image watermarking to track and verify AI-generated images. While watermark removal attacks have been extensively studied, the threat of watermark forgery, where benign images are maliciously modified to appear watermarked, remains underexplored, especially in the no-box setting. In this work, we introduce WForge, a no-box and query-free forgery attack that reframes forgery as the inverse of removal. Our key insight is that residual perturbations from removal attacks approximate watermark signals and can be repurposed to forge watermarks. Concretely, we train a forger network to learn the pattern of residuals and apply it to unwatermarked images, making them falsely detected as watermarked. We evaluate WForge across three datasets and four state-of-the-art watermarking methods, demonstrating that it consistently outperforms existing forgery baselines. Our results further reveal a critical vulnerability: the existence of a successful removal attack implies the feasibility of forgery for the same watermarking method.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 14302