Notice: The reproducibility variables underlying each score are classified using an automated LLM-based pipeline, validated against a manually labeled dataset. LLM-based classification introduces uncertainty and potential bias; scores should be interpreted as estimates. Full accuracy metrics and methodology are described in Coakley et alK. L. Coakley, T. Snelleman, H. Hoos, and O. E. Gundersen, "The embrace of open science: An analysis of a decade of AI research and 56 800 conference papers," Under Review, 2026..
WMCopier: Forging Invisible Watermarks on Arbitrary Images
Authors: Ziping Dong, Chao Shuai, Zhongjie Ba, Peng Cheng, Zhan Qin, Qinglong Wang, Kui Ren
NeurIPS 2025 | Venue PDF | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Experimental results demonstrate that WMCopier effectively deceives both open-source and closed-source watermark systems (e.g., Amazon s system), achieving a significantly higher success rate than existing methods. Additionally, we evaluate the robustness of forged samples and discuss the potential defenses against our attack. Code is available at: https://github.com/holdrain/WMCopier. |
| Researcher Affiliation | Academia | 1The State Key Laboratory of Blockchain and Data Security, Zhejiang University 2Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security Hangzhou, Zhejiang, China EMAIL |
| Pseudocode | Yes | A Algorithm Algorithm 1 WMCopier Require: Clean image x; Noise predictor ϵθ of pretrained diffusion model Mθ; Inversion steps TS; Refinement iterations L; Low noise step tl for refinement; Step size η; Trade off coefficient λ. Ensure: Forged watermarked image ˆxf x TS Inversion(x, TS)# Obtain noisy latent at step TS via DDIM inversion x TS x TS # Initial the start point of sampling for t = TS, TS 1, . . . , 1 do # DDIM sampling ϵt ϵθ(x t, t) x t 1 αt 1 x t 1 αt ϵt αt + 1 αt 1 ϵt end for xf x 0 for i = 1 to L do # Refinement Sample z N(0, I) xf(i) tl αtl xf(i) + 1 αtl z # Add noise to a low noise step tl xf(i+1) xf(i) + η xf(i) 1 1 αtl ϵθ(xf(i) tl , tl)) λ xf(i) x 2 end for return ˆxf xf(L) |
| Open Source Code | Yes | Code is available at: https://github.com/holdrain/WMCopier. |
| Open Datasets | Yes | For AI-generated images, we use Diffusion DB [37] that contains a diverse collection of images generated by Stable Diffusion [38]. For real photographs, we adopt three widely-used datasets in computer vision: MS-COCO [39], Image Net [17], and Celeb A-HQ [40]. |
| Dataset Splits | No | The paper mentions using specific datasets (Diffusion DB, MS-COCO, Image Net, Celeb A-HQ) and sizes for auxiliary datasets (e.g., 5,000 watermarked images for training the diffusion model, 100 images for specific attacks). However, it does not explicitly provide train/test/validation splits (e.g., percentages or exact counts for each split) for these datasets in the main experiments, nor does it refer to predefined standard splits for all its evaluation scenarios. |
| Hardware Specification | Yes | The entire training process takes roughly 40 A100 GPU hours. All of the experiments are conducted on an NVIDIA A100 GPU. |
| Software Dependencies | No | The paper mentions adopting a standard DDIM framework and following the official Hugging Face tutorial for training, but it does not specify version numbers for any key software components (e.g., Python, PyTorch, specific libraries used beyond DDIM itself). |
| Experiment Setup | Yes | For the diffusion model, we adopt DDIM sampling with a total step T = 100 and perform inversion up to step TS = 40. For the refinement procedure, we set the trade-off coefficient λ as 100, the number of refinement iterations L as 100, a low-noise step tl in the refinement as 1 and the step size η as 1 × 10−4 by default. The model is trained for 20,000 iterations with a batch size of 256 and a learning rate of 1 × 10−4. |