Ambiguity attack against text-to-image diffusion model watermarking.

• The proposed scheme is the first work for ambiguity attack of SDM watermarking. • The implementation of the scheme only requires a small cost. • Our method does not need the original training data. • The proposed method is effective to various SDM watermarking. In recent years, the text-to-image diffusion models have achieved excellent performance. Among them, stable diffusion models (SDMs) have become one of the most widely used models because of their excellent performance. Scholars have proposed many model watermarking techniques to protect the copyright of the text-to-image diffusion models. In order to measure the security and potential risks of the existing text-to-image diffusion model watermarking techniques, an ambiguity attack against the text-to-image diffusion model watermarking is proposed for the first time in this paper. Specifically, we take the SDMs as an example, take advantage of the reversibility of the model watermarking and combine the ideas of adversarial examples and discrete prompt optimization to re-embed a forged watermark in the watermarked SDMs, thus confounding the watermark containing copyright information. A large number of experiments show that our ambiguity attack is effective and can make the original watermark lose its uniqueness without changing the watermarked text-to-image diffusion models. [ABSTRACT FROM AUTHOR]