Research map / Image generation / Autoregressive and latent generation

GaussMarker: Robust Dual-Domain Watermark for Diffusion Models

ICML 2025 · Image generation › Autoregressive and latent generation · approach: Robust diffusion watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes GaussMarker, a tuning-free watermark for latent diffusion models that embeds a multi-bit spatial-domain watermark and a zero-bit ring-shaped frequency-domain watermark into the initial Gaussian noise, and uses a learnable Gaussian Noise Restorer plus score fusion for robust detection.

Problem

Tuning-free diffusion watermarks embedded in initial Gaussian noise are fragile under simple image edits such as rotation and cropping, and existing methods use only one domain (spatial or frequency).

Approach

Embed watermarks in both spatial and frequency domains of the initial noise, then train a model-independent Gaussian Noise Restorer (on noise maps, not on diffusion outputs) to undo geometric transforms and fuse the two detection scores with a learned MLP fuser.

Key results

• Average TPR@1%FPR of 0.998 and bit accuracy of 0.991 across three SD versions under eight distortions, versus 0.956 TPR for Stable Signature (best baseline).
• Under UnMarker, GaussMarker reaches TPR 1.000 on SD V2.1 while Gaussian Shading reaches 0.081; under regeneration attack TPR is 0.667 vs 0.066 for Gaussian Shading on SD V2.1.
• CLIP score 0.3545 average and FID 24.85 average, close to no-watermark baseline (0.3567 and 24.89).

Measured effects reported in the paper

Surprising findings

• Training GNR with rotation transforms in the noise-map domain transfers to cropping robustness even without cropping in the training transform set.
• LatentTracer yields near-zero TPR@1%FPR on SD V1.4 even for unedited images, attributed to high FPR from cross-model reconstruction loss.

Limitations

• Relies on DDIM inversion, so requires ODE-based continuous-time samplers.
• Diffusion model parameters are not watermarked, so model weights cannot be released with the watermark.
• Regeneration attack with diffusion models still substantially degrades performance (TPR 0.667 on SD V2.1).

Experimental setup

Datasets: Stable-Diffusion-Prompts MS-COCO

Benchmarks: Stable-Diffusion-Prompts generations under 8 image distortions advanced attacks (VAE compression, regeneration, UnMarker) MS-COCO FID/CLIP score

Metrics: TPR@1%FPR bit accuracy FID CLIP score ROC-AUC identification accuracy

Baselines: DwtDctSvd Stable Signature Tree-Ring RingID Gaussian Shading PRC LatentTracer

Builds on: Gaussian Shading Tree-Ring RingID DDIM inversion PRC

Closest papers by meaning

• Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models (CVPR 2024 · similarity 0.91)
• T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.89)
• Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.89)
• Hidden in the Noise: Two-Stage Robust Watermarking for Images (ICLR 2025 · similarity 0.88)
• Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.87)
• Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.87)