Research map / Image generation / Autoregressive and latent generation
ProMark: Proactive Diffusion Watermarking for Causal Attribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ProMark, which embeds imperceptible RoSteALS-based watermarks into concept-grouped training images and trains latent diffusion models with an added BCE loss so generated images carry the watermark for causal concept attribution.
Problem
Attributing generated images to the training-data concepts that causally influenced them, since existing passive methods rely on visual correlation rather than causation.
Approach
Proactively watermark training images with orthogonal, per-concept RoSteALS bit-secret watermarks and add a BCE supervision term so the diffusion model reproduces the watermark in outputs; attribution then decodes the secret and matches it to the concept bit-sequence. Supports multiple watermarks per image by splitting the image into halves.
Key results
- ProMark reaches 100% attribution accuracy on Stock, LSUN, WikiArt, and ImageNet at 100% watermark strength, and 91.07% on ImageNet at 30% strength versus 38.00% for EKILA.
- With two watermarks per image on BAM, combined attribution accuracy is 90.12% versus 46.23% for AbC-CLIP.
- Accuracy declines from 100% at 10 concepts to 82% at 216 concepts; the conditional ImageNet model reaches 91.24% on held-out and 87.30% on new images at 30% strength.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use proactive watermarks and BCE supervision for attribution | ProMark vs. the strongest passive baseline · Adobe Stock, LSUN, Wiki-A, Wiki-S, and ImageNet | attribution accuracy (%): Stock: 99.86 -> 100; LSUN: 87.39 -> 95.12; Wiki-A: 69.51 -> 97.45; Wiki-S: 60.43 -> 98.12; ImageNet: 62.83 -> 83.06 | Helped |
| Use two separate watermarks for media and content rather than one watermark per paired concept (ablation) | ProMark · BAM, combined attribution | attribution accuracy (%): 97.73 -> 90.12 | Hurt |
| Increase watermark strength (ablation) | ProMark · Stock | attribution accuracy (%) | Helped |
| Increase watermark strength (ablation) | ProMark · Stock, generated image quality | PSNR | Hurt |
| Increase watermark strength from 30% to 100% (ablation) | ProMark · ImageNet conditional model, generated images | FID: 13.28 and 17.63 | Hurt |
| Increase the number of concepts from 10 to 216 (ablation) | ProMark · Adobe Stock | attribution accuracy (%): 100% -> 82% | Hurt |
| Reduce images per concept from 700 to 10 (ablation) | ProMark · Stock, 500 concepts | attribution accuracy (%): 2.5% | Hurt |
| Remove BCE loss supervision (ablation) | ProMark · Stock | attribution accuracy (%): 100% -> 2% | Hurt |
| Replace the pretrained secret decoder with a decoder trained alongside the LDM (ablation) | ProMark · Stock | attribution accuracy (%): 100% -> 80.56% | Hurt |
Surprising findings
- Removing the BCE loss drops attribution accuracy to about 2%, and replacing the pretrained secret decoder with an end-to-end decoder drops it to 80.56%.
- Watermark strength trades off image quality: FID rises from 13.28 to 17.63 when training with the watermark.
Limitations
- Trade-off between image quality and attribution accuracy due to watermark strength.
- Model is trained with predefined concepts; new concepts require further training paradigms.
- Results shown only for LDM; generalization to other generative models untested.
Experimental setup
Datasets: Adobe Stock LSUN WikiArt ImageNet BAM
Benchmarks: Adobe Stock LSUN WikiArt ImageNet BAM
Metrics: attribution accuracy bit-secret accuracy PSNR FID
Baselines: ALADIN CLIP AbC-CLIP SSCD EKILA
Builds on: RoSteALS Latent Diffusion Models EKILA Attribution by Customization
Closest papers by meaning
- WMAdapter: Adding WaterMark Control to Latent Diffusion Models (ICML 2025 · similarity 0.86)
- Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.86)
- How to Trace Latent Generative Model Generated Images without Artificial Watermark? (ICML 2024 · similarity 0.85)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.85)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.85)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.