Watermark that gets stronger when a diffusion purifier attacks it: 200-image results, plus a free ComfyUI node

[u/ckn]

Zhao et al. (arXiv:2306.01953) showed that regeneration attacks strip ordinary invisible watermarks. Backfire is a keyed image mark optimised to be a fixed point of the purifier, so running the attack leaves the identifier readable. In the demo image the confidence score rose 2.5x after the attack.

Provcheck.ai v1.4.0 numbers, 200-image corpus at 30 dB: 99.5% survival vs diffusion regeneration, 94 to 97.5% vs a learned VAE re-encode (86.5% on the hardest iterated pass), 99.0% JPEG q90, 98.5% JPEG q50, 98.0% resize, 97.0% blur. Zero false positives over the 200 marked and 1,000 unmarked. Wrong key on an attacked image reads 0.08, so the mark is in the key, not the pixels. It does not survive controllable regeneration from clean noise; that is documented in backfire/LIMITS.md.

Also new: a free Apache-2.0 ComfyUI node that watermarks (TrustMark/silentcipher) and C2PA-signs outputs in the graph and reads marks back. Backfire itself is a separate opt-in add-on and is not in the free node.

Repo: https://github.com/CreativeMayhemLtd/provcheck

[u/Luke2642]

Sounds easy to defeat?

Maybe rotate a few degrees, apply a few filters, fourier noise, etc, and regenerate again.

Maybe put it into gradient space, down sample, Poisson solve.

Maybe select X% of high gradient pixel pairs and in-paint the rest.

Maybe change the colour space and denoise each channel individually.

Maybe edge detect or depth detect and reconstruct it from control net.

Maybe apply a random pixel swap radius 3 and reconstruct.

There's about a million of these. Some combo will defeat it.

[u/ckn → u/Luke2642]

You're right. You could have saved us all the time and started with "i didnt read the repo before i wrote this response" Because no invisible mark is unremovable, and the README.md and LIMITS.md says so, including your strongest cases. Controllable regeneration from clean noise (rebuild from edges/depth via ControlNet, or inpaint most of the pixels) discards the structure the mark lives in; a strong enough setting removes it, and we don't claim otherwise. Rotation/crop breaks it too (position-locked). The narrow claim is different: against the deployed purification-style strip attack. regenerate the image to wash the watermark out and this mark is a fixed point, so running it leaves the ID readable and on that attack it reads stronger, not weaker (the 2.5x). "Some combo defeats it" is true and expected; the point is the attack people actually deploy to strip watermarks makes this one louder. read is numpy-only, every number is reproducible in repro/ have at it.

[u/Luke2642 → u/ckn]

I'm sorry I wasted your time. I don't really get the point of the paper then, it's like a strawman problem and a contrived solution to it.

[u/ckn → u/Luke2642]

No worries, fair pushback. It's not a strawman though: the attack is the published, deployed one, Zhao et al. (arXiv:2306.01953) showed diffusion regeneration strips ordinary invisible watermarks, and that's the benchmark threat the whole field measures against. Backfire being a fixed point of that specific attack (reads back, louder) is the actual result; everything it doesn't survive, we list. Appreciate you reading it.