SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks

Latent-based watermarks, embedded during the generation process of latent diffusion models (LDMs), facilitate detection and attribution of generated images. However, recent black-box forgery attacks can implant a provider's watermark into images not generated by that provider, using at least one watermarked image and black-box access to the model, thereby undermining provenance and trust. We propose SemBind, the first defense framework for latent-based watermarks against black-box forgery, which binds latent watermark signals to image semantics through a contrastively trained semantic masker. The masker produces near-invariant codes for semantically matched prompts and near-orthogonal codes across different prompts, enabling SemBind to modulate the target latent before applying standard latent-based watermarking schemes. Across four mainstream latent-based watermarking methods, SemBind substantially reduces false acceptance under black-box forgery while preserving image quality and offering a tunable robustness--security trade-off via a simple mask-ratio parameter. Code is available at https://github.com/XinZhang1999/SemBind.

AI image generators can add hidden watermarks to their outputs so that people can later check whether an image was made by a particular provider. However, recent attacks show that an adversary may copy such a watermark from a genuine AI-generated image and make an unrelated image appear as if it also came from the same provider. This can undermine trust in watermark-based provenance systems. We propose SemBind, a defense that ties the hidden watermark to the actual content of the image. The main idea is that a watermark should only be valid when it matches the image semantics with which it was originally generated. If an attacker tries to transfer the watermark to a different image, this semantic mismatch makes verification fail. Our experiments show that SemBind can be applied to several existing watermarking methods, greatly reduces successful forgery, and preserves image quality.