Latent-based watermarks, integrated into the generation process of latent diffusion models (LDMs), simplify detection and attribution of generated images. However, recent black-box forgery attacks, where an attacker needs at least one watermarked image and black-box access to the provider's model, can embed the provider's watermark into images not produced by the provider, posing outsized risk to provenance and trust. We propose SemBind, the first defense framework for latent-based watermarks that resists black-box forgery by binding latent signals to image semantics via a learned semantic masker. Trained with contrastive learning, the masker yields near-invariant codes for the same prompt and near-orthogonal codes across prompts; these codes are reshaped and permuted to modulate the target latent before any standard latent-based watermark. SemBind is generally compatible with existing latent-based watermarking schemes and keeps image quality essentially unchanged, while a simple mask-ratio parameter offers a tunable trade-off between anti-forgery strength and robustness. Across four mainstream latent-based watermark methods, our SemBind-enabled anti-forgery variants markedly reduce false acceptance under black-box forgery while providing a controllable robustness-security balance.

翻译：基于潜在空间的水印技术通过集成到潜在扩散模型（LDMs）的生成过程中，简化了对生成图像的检测与溯源。然而，最近出现的黑盒伪造攻击——攻击者仅需至少一张带水印图像及对提供商模型的黑盒访问权限——能够将提供商的水印嵌入并非由该提供商生成的图像中，这对来源认证与信任体系构成了巨大风险。本文提出SemBind，首个能够抵抗黑盒伪造的潜在空间水印防御框架。该框架通过学习的语义掩码器将潜在信号与图像语义进行绑定。该掩码器通过对比学习训练，能够为相同提示词生成近似不变的编码，并为不同提示词生成近似正交的编码；这些编码经过重塑与置换处理后，可在任何标准潜在水印嵌入前对目标潜在表示进行调制。SemBind普遍兼容现有潜在水印方案，且基本保持图像质量不变，同时通过简单的掩码比率参数实现抗伪造强度与鲁棒性之间的可调节权衡。在四种主流潜在水印方法上的实验表明，启用SemBind的抗伪造变体在黑盒伪造攻击下显著降低了误接受率，同时提供了可控的鲁棒性-安全性平衡。