Research map / Adversarial robustness and security / Attacks on text and graphs
Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Trains a conditional GAN generator that embeds personal watermarks into adversarial examples so that latent diffusion models produce visibly watermarked, distorted outputs, protecting artwork from DM-based imitation.
Problem
Diffusion models can imitate unauthorized creations, raising copyright concerns; prior adversarial-example protections produce chaotic textures that do not clearly indicate copyright violation, are not traceable, and are slow because they optimize per image.
Approach
Train a conditional GAN generator (conditioned on a watermark image) to output perturbations using an adversarial loss on the LDM VAE latent of the adversarial example versus the watermark latent, plus a GAN loss and a watermark-weighted perturbation loss, so that DMs render visible watermarks on imitations and attacks run in 0.2s per image.
Key results
- On WikiArt image-to-image generation, the proposed method reaches NCC 0.31 versus 0.09 for Mist, with generation of adversarial examples taking 0.2s per image versus 32-35s for AdvDM and Mist.
- On ImageNet textual inversion, NCC is 0.40 versus 0.15 for Mist and FID is 412.9 versus 318.4 for Mist.
- A generator trained on 10 samples for one watermark reaches NCC 0.30, close to 0.31 with 100 samples, in about 2 minutes of training.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use watermark-embedded adversarial examples instead of unmodified images | LDM · WikiArt, text-guided image-to-image | NCC: 0 -> 0.31 | Helped |
| Use watermark-embedded adversarial examples instead of unmodified images | LDM · WikiArt, text-guided image-to-image | FID: 120.7 -> 245.5 | Helped |
| Use the trained generator rather than iterative optimization | Adversarial example generation on WikiArt · WikiArt, adversarial example | generation time per image: 32s -> 0.2s; 35s -> 0.2s | Helped |
| Add GAN loss (ablation) | Ours · WikiArt, image-to-image generation | PSNR: 13.1 -> 22.0 | Helped |
| Add perturbation loss (ablation) | Ours · WikiArt, image-to-image generation | PSNR: 13.1 -> 24.2 | Helped |
| Weight the perturbation loss more heavily in the watermark region (ablation) | Ours · WikiArt, image-to-image generation | PSNR: 24.2 -> 27.8 | Helped |
| Increase the perturbation bound from 2/255 to 20/255 (ablation) | Ours · WikiArt, image-to-image generation | PSNR: 40.1 -> 17.5 | Hurt |
| Train the watermark generator using more samples (ablation) | Ours · WikiArt, image-to-image generation | NCC: 0.12 -> 0.31 | Helped |
Surprising findings
- Adding the GAN and perturbation losses lowers attack strength (NCC drops from 0.60 to 0.31) while greatly improving adversarial example quality (PSNR rises from 13.1 to 30.1).
Limitations
- Watermark visibility is weaker in black-box transfer to other models than in the white-box setting.
- Defenses such as JPEG, randomized smoothing and TVM reduce but do not eliminate the watermark effect.
- Perturbation bound trades off image quality against watermark visibility.
Experimental setup
Datasets: WikiArt ImageNet
Benchmarks: WikiArt ImageNet
Metrics: NCC FID precision recall MSE PSNR SSIM run time
Baselines: AdvDM Mist
Builds on: AdvDM Mist AdvGAN textual inversion latent diffusion models
Closest papers by meaning
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.91)
- On the Robustness of Watermarking for Autoregressive Image Generation (NeurIPS 2026 · similarity 0.88)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.88)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.88)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.87)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.