SemBind: Binding Diffusion Model Watermarks to Semantics to Counter Black-Box Forgery Attacks

The researchers propose the SemBind framework, which uses a learned semantic masker to bind latent watermark signals to image semantics, defending against black-box forgery attacks on latent diffusion model (LDM) watermarks. In such attacks, an attacker needs only one watermarked image and black-box access to the provider's model to embed the provider's watermark into images it did not generate, threatening image provenance and trust. SemBind uses contrastive learning to train the masker so that encodings of the same prompt are approximately invariant and encodings of different prompts are approximately orthogonal, then modulates the target latent representation via rearrangement and permutation, and can be layered in front of existing latent watermarking schemes; the authors state that this is the first latent watermarking defense framework against such attacks. The method is compatible with four mainstream latent watermarking schemes, with essentially unchanged image quality, and the mask ratio parameter can trade off anti-forgery strength against robustness; experiments show that variants with SemBind enabled significantly reduce false acceptance under black-box forgery.