Research map / Image generation / Autoregressive and latent generation
Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Gaussian Shading embeds a 256-bit watermark into diffusion initial latents by sampling them from a distribution-preserving, key-encrypted sequence, giving provably performance-lossless, training-free watermarking of Stable Diffusion outputs.
Problem
Watermarking images generated by diffusion models usually degrades generation quality or requires fine-tuning/extra training; the paper asks whether watermarks can be embedded without compromising model performance.
Approach
Encrypt a diffused watermark with a stream cipher (ChaCha20) to get a uniform bit stream, map each l-bit chunk to a quantile interval of N(0,I) so the initial latent stays exactly Gaussian, and extract via DDIM inversion; a proof shows indistinguishability from non-watermarked sampling.
Key results
- Under adversarial noise, Gaussian Shading achieves TPR 0.997/0.998/0.996 and bit accuracy about 0.97 on SD V1.4/V2.0/V2.1 at FPR 1e-6, beating the best baseline by roughly 7% in bit accuracy.
- Gaussian Shading gives FID 25.20 with t-value 0.3567 on SD V2.1, the smallest performance bias among compared methods (Tree-Ring t=2.581, Stable Signature t=2.477).
- With 256-bit capacity, traceability accuracy stays near-perfect for N=10^6 users in seven of nine noise cases.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Gaussian Shading instead of Tree-Ring | Stable Diffusion V1.4/V2.0/V2.1 · Stable Diffusion V1.4/V2.0/V2.1, adversarial noise | TPR: 0.894/0.898/0.906 -> 0.997/0.998/0.996 | Helped |
| Use Gaussian Shading instead of RivaGAN | Stable Diffusion V1.4/V2.0/V2.1 · Stable Diffusion V1.4/V2.0/V2.1, adversarial noise | bit accuracy: 0.8986/0.9124/0.9019 -> 0.9753/0.9749/0.9724 | Helped |
| Use Gaussian Shading instead of Stable Signature | Stable Diffusion V2.1 · Stable Diffusion V2.1 | FID t-value: 2.477 -> 0.3567 | Helped |
| Increase watermark capacity from 256 bits to 4096 bits (ablation) | Gaussian Shading · Stable Diffusion V2.1, adversarial noise | bit accuracy: 0.9724 -> 0.7302 | Hurt |
| Increase watermark capacity from 256 bits to 1024 bits (ablation) | Gaussian Shading · Stable Diffusion V2.1, adversarial noise | bit accuracy: 0.9724 -> 0.8769 | Hurt |
| Reduce watermark capacity from 256 bits to 64 bits (ablation) | Gaussian Shading · Stable Diffusion V2.1, adversarial noise | bit accuracy: 0.9724 -> 0.9959 | Helped |
| Use other continuous-time ODE samplers instead of DPMSolver (ablation) | Gaussian Shading · Stable Diffusion V2.1, adversarial noise | bit accuracy: DPMSolver 0.9724; DDIM 0.9706; UniPC 0.9628; PNDM 0.9721; DEIS 0.9715 | Mixed |
| Vary inference and inversion steps (ablation) | Gaussian Shading · Stable Diffusion V2.1 | bit accuracy: 0.9994 to 1.0000 | No clear effect |
| Vary guidance scale from 2 to 18 (ablation) | Gaussian Shading · Stable Diffusion V2.1 | bit accuracy | No clear effect |
| Increase noise intensity (ablation) | Gaussian Shading · Stable Diffusion V2.1, Random Crop and Gaussian Noise attacks | bit accuracy | Hurt |
| Increase noise intensity (ablation) | Gaussian Shading · Stable Diffusion V2.1, seven other noise attacks | bit accuracy | No clear effect |
| Compress watermarked images with neural auto-encoders (ablation) | Gaussian Shading · Stable Diffusion V2.1, compression attack | TPR and bit accuracy | Helped |
Surprising findings
- Inversion attacks using the same model can produce forgeries that trace to an innocent user, since the watermark is recoverable from any inverted image and can be re-embedded into arbitrary prompts.
Limitations
- Requires DDIM inversion, restricting use to ODE-based continuous-time samplers such as DPM-Solver.
- Vulnerable to forgery attacks via inversion of innocent images; requires protecting model parameters.
- Watermark verification by third parties requires operator cooperation; robustness to brightness and random crop/drop degrades.
Experimental setup
Datasets: Stable-Diffusion-Prompts
Benchmarks: Stable-Diffusion-Prompts (1,000 generated images)
Metrics: TPR at FPR 1e-6 bit accuracy FID CLIP-Score t-test value
Baselines: DwtDct DwtDctSvd RivaGAN Tree-Ring Stable Signature
Builds on: DDIM DPM-Solver Tree-Ring watermark ChaCha20
Closest papers by meaning
- GaussMarker: Robust Dual-Domain Watermark for Diffusion Models (ICML 2025 · similarity 0.91)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.90)
- Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.90)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.88)
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.88)
- WMAdapter: Adding WaterMark Control to Latent Diffusion Models (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.