Research map / Image generation / Autoregressive and latent generation
FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Space
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FreqMark, a training-free-style invisible watermark that optimizes a perturbation in the FFT-transformed VAE latent of an image and decodes bits via DINOv2 feature signs, achieving robustness to regeneration attacks.
Problem
Invisible image watermarks are fragile against regeneration attacks (VAE and diffusion-based), while existing pixel-space, latent-space, and frequency-space methods trade off robustness, image quality, and flexibility in payload size.
Approach
Optimize an additive perturbation in the frequency domain of the Stable Diffusion KL-VAE latent (with all networks frozen), and decode bits by sign of dot products between DINOv2 features and predefined direction vectors, so the watermark is distributed globally across the latent and survives regeneration.
Key results
- Average bit accuracy 0.973 on ImageNet and 0.967 on DiffusionDB across 10 attacks at about 31 dB PSNR, versus 0.914 for SSL and 0.809 for Stable Signature on ImageNet.
- Diffusion regeneration attack bit accuracy 0.969 on ImageNet (60 denoising steps), versus 0.743 for SSL and 0.534 for Stable Signature.
- Under 128-bit encoding the lowest bit accuracy stays above 0.75 even under regeneration attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use latent frequency optimization rather than pixel, pixel-frequency, or latent-space optimization (ablation) | FreqMark · DiffusionDB | average bit accuracy: 0.813; 0.895; 0.885 -> 0.967 | Helped |
| Use FreqMark instead of SSL Watermark | ImageNet · ImageNet | average bit accuracy: 0.914 -> 0.973 | Helped |
| Use FreqMark instead of SSL Watermark | DiffusionDB · DiffusionDB | average bit accuracy: 0.903 -> 0.967 | Helped |
| Add spatial augmentations during training (ablation) | FreqMark · Resize 0.3, Rotate 90, Crop 0.7 | bit accuracy: 0.961 -> 0.968; 0.621 -> 0.927; 0.721 -> 0.921 | Helped |
| Train with moderate latent and pixel noise (latent noise 0.25, pixel noise 0.06) (ablation) | FreqMark · Gaussian noise and regeneration attacks | average bit accuracy: 0.706 -> 0.926 | Helped |
| Increase diffusion attack steps from 60 to 200 | FreqMark · Diffusion regeneration attack | bit accuracy: 0.945 -> 0.637 | Hurt |
| Increase latent-FFT VAE attack strength | FreqMark · VAE attack (latent FFT) | bit accuracy: 1.000 -> 0.975 | Hurt |
| Increase adversarial attack strength from 2/255 to 8/255 | FreqMark · Adversarial attack | bit accuracy: 1.000 -> 0.893 | Hurt |
Surprising findings
- Optimizing in the latent frequency domain is more robust to regeneration than either pixel-space or latent-space optimization alone, and the synergy is larger than either component.
Limitations
- Image quality is bounded by VAE reconstruction loss, causing visible artifacts or semantic changes in some images.
- Spatial transformations such as rotation and cropping substantially reduce bit accuracy unless specifically augmented during training.
- Per-image optimization takes minutes per image, which is costly compared with feed-forward methods.
Experimental setup
Datasets: ImageNet DiffusionDB
Benchmarks: ImageNet validation subset DiffusionDB prompts
Metrics: bit accuracy PSNR SSIM TPR@FPR CLIP-FID L2
Baselines: DwtDctSvd SSL Watermark Stable Signature StegaStamp Tree-Ring
Builds on: SSL watermark Stable Diffusion DINOv2 Tree-Ring
Closest papers by meaning
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.87)
- Hidden in the Noise: Two-Stage Robust Watermarking for Images (ICLR 2025 · similarity 0.86)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.85)
- Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.85)
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.85)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.