A Crack in the Bark: Leveraging Public Knowledge to Remove Tree-Ring Watermarks
Junhua Lin
34th USENIX Security Symposium (USENIX Security '25) · Day 3 · ML and AI Security 4: Robustness
The rapid advancement of generative artificial intelligence (AI), particularly in image generation, has ushered in an era where distinguishing between authentic and AI-generated content is increasingly challenging. This technological leap, while impressive, carries significant risks, ranging from the spread of misinformation and deepfake hoaxes to personal harassment and election manipulation. To counter these threats, security researchers have explored various methods, with watermarking emerging as a promising approach to embed an identifiable signal directly into AI-generated images.
AI review
Solid, well-scoped academic security research that identifies a real and underappreciated attack surface: the persistence of Tree-Ring watermark signals through publicly available VAEs into the intermediate latent space. The attack is technically coherent, the results are credible, and the precision/base-rate critique is a genuinely useful corrective to how the field evaluates these schemes.