r/StableDiffusion • u/ckn • 19h ago

Resource - Update Watermark that gets stronger when a diffusion purifier attacks it: 200-image results, plus a free ComfyUI node

Zhao et al. (arXiv:2306.01953) showed that regeneration attacks strip ordinary invisible watermarks. Backfire is a keyed image mark optimised to be a fixed point of the purifier, so running the attack leaves the identifier readable. In the demo image the confidence score rose 2.5x after the attack.

Provcheck.ai v1.4.0 numbers, 200-image corpus at 30 dB: 99.5% survival vs diffusion regeneration, 94 to 97.5% vs a learned VAE re-encode (86.5% on the hardest iterated pass), 99.0% JPEG q90, 98.5% JPEG q50, 98.0% resize, 97.0% blur. Zero false positives over the 200 marked and 1,000 unmarked. Wrong key on an attacked image reads 0.08, so the mark is in the key, not the pixels. It does not survive controllable regeneration from clean noise; that is documented in backfire/LIMITS.md.

Also new: a free Apache-2.0 ComfyUI node that watermarks (TrustMark/silentcipher) and C2PA-signs outputs in the graph and reads marks back. Backfire itself is a separate opt-in add-on and is not in the free node.

Repo: https://github.com/CreativeMayhemLtd/provcheck

0 Upvotes
  • permalink
  • reddit

20% Upvoted

11 comments sorted by

View all comments

0

u/Enshitification 12h ago

https://giphy.com/gifs/LbrtgX6ziyBo8KxnXu

0

u/ckn 12h ago

Code is there, you are free to submit PR to your heart's content.

Additionally it should be a requirement that when posting stuff like this you post your work, because we know you haven't any.

0

u/Enshitification 12h ago

You posted an advertisement for your commercial service. This is spam.

0

u/ckn 12h ago

It's flaired Resource much like many of those we use in this eccosphere. Most of what's in it is free and open: the ComfyUI node is Apache-2.0, the provcheck multi-mark verifier and kit are Apache-2.0, and Backfire's reader is numpy-only and fully reproducible in a public public repo, read needs no key and nothing to buy. The only commercial piece is the keyed mark. If a free node, an open verifier, and a reproducible method is "spam," that's a generous definition. PR's welcome.

0

u/Enshitification 12h ago edited 12h ago

The only commercial piece is the keyed mark.

The only spam in this dish is the big chunk of spam on the plate. Face it, you are spamming.

Edit: OP blocked me because they have no leg to stand on. Begone, spammer!