Research map / Image generation / Text-to-image diffusion

Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models

CVPR 2025 · Image generation › Text-to-image diffusion · approach: Text-driven synthesis and semantic guidance · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows diffusion models preserve training-data spectral statistics and proposes CoprGuard, a frequency-domain (DWT + HiNet) watermarking framework that detects unauthorized training or fine-tuning of diffusion models even when watermarked images are a small fraction of the data.

Problem

Detecting whether protected images were used to train or fine-tune diffusion models, especially when watermarked images are only a small part of a mixed-source training set and the model is black-box.

Approach

Diffusion-generated images inherit the spectral statistics of their training data, so embedding a watermark into the DWT high-frequency sub-bands of training images (via HiNet with a customized enhancement module against autoencoder degradation) lets the watermark appear in generated outputs, detectable by statistical hypothesis testing.

Key results

• CoprGuard achieves 100% detection accuracy for DDIM, Classifier-Free Guidance and Stable Diffusion models across watermark injection ratios from 10% to 100%, with zero FP and FN.
• At R=25% with SD+LoRA on Pokemon, the baseline Yu et al. reaches only 50% accuracy while CoprGuard detects all infringing models.
• At R=20% under LoRA fine-tuning, watermark detection ratio Pu is 28.7% for CoprGuard versus 14% for DIAGNOSIS; watermarked-image PSNR improves by about 5 dB on average over DIAGNOSIS.

Measured effects reported in the paper

Surprising findings

• Diffusion-generated images match training-data DFT/DCT/DWT spectra with cosine similarity above 0.95 except high-frequency DWT components, while GAN outputs retain model-specific spectra.
• Even with only 5 sampling steps, extracted watermark similarity to the original remains about 0.98.

Limitations

• Generalization to text-to-image models is not fully established because models were not trained from scratch.
• The customized HiNet still suffers watermark degradation through the autoencoder in Stable Diffusion.
• Watermark detection ratio Pu drops substantially at low injection rates, e.g. 1.2% at R=1% for DDIM on FFHQ.

Experimental setup

Datasets: FFHQ ImageNet 1K Pokemon LSUN CUB-200

Benchmarks: FFHQ ImageNet 1K Pokemon

Metrics: detection accuracy watermark detection ratio FID PSNR SSIM cosine similarity

Baselines: DIAGNOSIS Yu et al. watermarking

Builds on: HiNet DIAGNOSIS LoRA Stable Diffusion

Closest papers by meaning

• SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.91)
• Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.90)
• WMAdapter: Adding WaterMark Control to Latent Diffusion Models (ICML 2025 · similarity 0.90)
• AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA (ICML 2024 · similarity 0.90)
• CGI-DM: Digital Copyright Authentication for Diffusion Models via Contrasting Gradient Inversion (CVPR 2024 · similarity 0.89)
• StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.88)