SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks

Abstract

Latent-based watermarks, embedded during the generation process of latent diffusion models (LDMs), facilitate detection and attribution of generated images. However, recent black-box forgery attacks can implant a provider's watermark into images not generated by that provider, using at least one watermarked image and black-box access to the model, thereby undermining provenance and trust. We propose SemBind, the first defense framework for latent-based watermarks against black-box forgery, which binds latent watermark signals to image semantics through a contrastively trained semantic masker. The masker produces near-invariant codes for semantically matched prompts and near-orthogonal codes across different prompts, enabling SemBind to modulate the target latent before applying standard latent-based watermarking schemes. Across four mainstream latent-based watermarking methods, SemBind substantially reduces false acceptance under black-box forgery while preserving image quality and offering a tunable robustness--security trade-off via a simple mask-ratio parameter. Code is available at https://github.com/XinZhang1999/SemBind.