paperSeptember 2026Unreviewed

Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery

Saifur Rahman Tamim, Md Taslimul Hasan Toufique, A. M. Tayeful Islam

Abstract

Semantic watermarking schemes such as Tree-Ring hide a detectable pattern in the initial noise latent of a diffusion model. Recent work shows these watermarks are not only removable but forgeable: an attacker who never sees the watermarking key can still produce images the genuine detector accepts. We reproduce the Reprompt forgery attack of Müller et al. against Tree-Ring on Stable Diffusion XL, using the authors' released code, on free-tier dual T4 GPUs with 14.6 GB of usable memory per device

Cite

@misc{tamim2026forging,
  title = {{Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery}},
  author = {Saifur Rahman Tamim and Md Taslimul Hasan Toufique and A. M. Tayeful Islam},
  year = {2026},
  month = sep,
  eprint = {2609.12909},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.12909}
}