First-author preprint · cs.CR · Sep 2026
Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
Tree-Ring hides a watermark in the starting noise of an image diffusion model. Earlier work showed that an attacker without the key can forge it, producing images the real detector accepts. We reproduced that forgery attack against Tree-Ring on Stable Diffusion XL with the original authors’ code, on free-tier GPUs with far less memory than the original study, and instrumented the detector along the way.
Method
- Reproduced the Reprompt forgery attack of Müller et al. against Tree-Ring on Stable Diffusion XL using the authors’ released code.
- Ran it on free-tier dual NVIDIA T4 GPUs (14.6 GB usable per device) instead of the A40 hardware used originally, patching the pipeline’s direct autoencoder calls to run SDXL in half precision and confirming with a controlled probe that the detector statistic is unchanged.
- Recovered the non-central χ² statistic that the released detector discards (it returns only the CDF); the recovery matches the released detector exactly.
Key results
- The attack reproduces: across six trials of three arms, genuine images were detected 6/6, clean images 0/6 and forged images 5/6, at 325–332 s per attack.
- Two scores built from the recovered statistic separate forged from clean images at AUC 0.861 and 0.972 on the same 18 observations.
- A prediction made from reading the detector source was contradicted by the measurements, and the paper reports it.
Limitations
This reproduces an existing attack rather than proposing a new one. It covers one model (Stable Diffusion XL) and one watermark (Tree-Ring), with six trials per arm, so the AUC figures rest on 18 observations.
Reproducibility
The notebook, the pinned fork and every measurement artifact are released with the paper so each number can be checked.
BibTeX
@misc{tamim2026forging,
title = {Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery},
author = {Tamim, Saifur Rahman and Toufique, Md Taslimul Hasan and Islam, A. M. Tayeful},
year = {2026},
eprint = {2609.12909},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
doi = {10.48550/arXiv.2609.12909},
url = {https://arxiv.org/abs/2609.12909}
}