Backfire: watermark that strengthens under diffusion purifier attacks, 99.5% survival
ckn · reddit · 2026-09-02
Zhao et al. (arXiv:2306.01953) showed regeneration attacks strip ordinary invisible watermarks. Backfire is a keyed mark optimized as a fixed point of the purifier — running the attack makes the identifier more readable (2.5x confidence in the demo).
Provcheck.ai v1.4.0 results on a 200-image corpus at 30 dB:
- 99.5% survival vs diffusion regeneration; 94–97.5% vs learned VAE re-encode (86.5% on the hardest iterated pass)
- 99.0% JPEG q90, 98.5% q50, 98.0% resize, 97.0% blur
- Zero false positives across 200 marked + 1,000 unmarked images; wrong key reads 0.08, so the mark lives in the key, not the pixels
- Known limit: doesn't survive controllable regeneration from clean noise (see LIMITS.md)
Also released: a free Apache-2.0 ComfyUI node that watermarks (TrustMark/silentcipher) and C2PA-signs outputs in-graph. Backfire itself is a separate opt-in add-on. Repo: github.com/CreativeMayhemLtd/provcheck
More from Apps
- Made by Hand turns game crafting into a real woodworking job, one saw cut at a time — WellsLucasSanto · 2026-10-18
- Dev builds Lex Fridman podcast archive site with 506 episodes and Chinese AI summaries, open-sourcing soon — vista8 · 2026-10-18
- Practitioners say Google AI Overviews is quietly getting very good as an answer engine — ricklamers · 2026-10-18
- Claude skill generates hand-drawn interactive diagrams that teach kids how things work — CatAstro_Piyush · 2026-10-18
- Meta wearables VP runs his AI agent across 3 phones and 23 pairs of glasses — nikola_mr64990 · 2026-10-18
- Indie dev's Qiaomu Obsidian plugin suite tops 20,000 downloads, Agent plugin surging — vista8 · 2026-10-18