Loading
Life sciences · Preprint
arXiv · September 8, 2026
Posted before peer review. The findings may change or fail to hold.
This preprint describes DRIFT, a black-box computational attack that combines partial forward diffusion with stochastic reverse resampling to remove watermarks embedded in diffusion model outputs. The work is entirely theoretical and algorithmic, with no relevance to clinical practice, medical research, or human health outcomes.
Preprint.
DRIFT achieves 98-100% attack success across nine watermarks spanning three paradigms Attack generates images without requiring secret keys, verifier internals, or per-image gradient optimization Best image quality reported among compared attacks at fixed computational depth
Safety was not reported in the material analysed. Check the source before drawing any conclusion about harm.
The source did not state who this applies to in practice.
This is an unrefereed arXiv preprint describing a computational attack method on diffusion model watermarks, with no peer review status reported and no clinical or human outcomes data.
Quoted from the source exactly as published.
Graded across the dimensions that decide whether you should act, each from what the source actually supports. There is no single score, and where a dimension was not assessed it says so.
Diffusion watermarking embeds verifiable signals into the generative process and commonly verifies them by recovering trajectory-dependent evidence, making the marks robust to conventional pixel-space distortions. Existing removal attacks either regenerate along deterministic trajectories, which often preserve the watermark-bearing latent structure, or optimize every image separately. We identify the reliance on a recoverable generative trajectory as a common attack surface among the schemes we study. Based on this observation, we propose DRIFT, a black-box attack that combines partial forward diffusion with stochastic reverse resampling. Forward re-noising limits source information available to a fixed-depth recovery pipeline, while stochastic reversal supplies alternative noise-driven paths whose removal benefit we isolate through matched sampler comparisons. Adaptive DRIFT searches a selected ladder for each image's first verifier-rejected rung and refines fidelity while retaining only updates rejected by the same verifier. At fixed depth, we derive information-theoretic and Wasserstein source-dependence bounds; under realized-ladder monotonicity, the first rejected rung is least distorted among rejected rungs on that ladder, and verifier-gated refinement preserves rejection. Across nine watermarks spanning three paradigms, DRIFT achieves 98-100% attack success and the best image quality among the compared attacks, without secret keys, verifier internals, or per-image gradient optimization.
Taken from the source record, never inferred. Follow any of these and new work involving them reaches your briefing.