Research map / Image generation / Text-to-image diffusion
Disentangled Style Domain for Implicit $z$-Watermark Towards Copyright Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes an implicit zero-watermarking scheme that quantizes a disentangled style domain, anchored by an identifier z and trained with contrastive learning, into watermarks to verify dataset copyright against text-to-image AI mimicry.
Problem
Detecting unauthorized use of personal datasets (styles and contents) to fine-tune or train text-to-image models, where existing perturbation, backdoor and digital watermark methods are removable or fragile and cannot verify from a single generated sample.
Approach
Generate implicit watermarks from a disentangled style domain of protected units: an identifier z biases a style-domain encoder/decoder, and dynamic contrastive learning (self-generalization and mutual exclusivity with a negative queue) delineates copyright boundaries, with a watermark-distribution statistic for hybrid or partial infringement verification.
Key results
- Achieves 99.83% average watermark bit accuracy and 97.7% t@k@100%wd versus at most 66.50% and 7.9% for digital watermarking baselines (Table 2).
- Across black-box models and APIs (SD v2.0, PixArt-α, PG-v2.5, DALL·E 3, Imagen2) reports 98.60% average Avg acc and 94.29% t@k@100%wd, with 100% true positive detection.
- Under robustness attacks (second-stage fine-tuning, mixed clean fine-tuning, latent attack, augmentations), t@k@100%wd stays high, e.g. 93.3% for second-stage fine-tuning, though rotation drops it to 14.8%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the disentangled style domain, self-generalization module ψ1, and mutual exclusivity module ψ2 (ablation) | z-Watermarking · Five benchmark datasets | Avg acc (%) | Helped |
| Add the disentangled style domain (ablation) | z-Watermarking · Five benchmark datasets | t@k@100%wd (%): around 60% to over 90% | Helped |
| Add self-generalization ψ1 and mutual exclusivity ψ2 (ablation) | z-Watermarking with the disentangled style domain · Five benchmark datasets | Avg acc (%): exceeding 99% | Helped |
| Use a 512-bit watermark instead of shorter tested bit lengths (ablation) | z-Watermarking · Five benchmark datasets | Avg acc and t@k@100%wd | Helped |
| Vary training and validation data scale (ablation) | z-Watermarking · Copyright verification | Avg acc (%): above 99% | Mixed |
| Replace z-Watermarking with RoSteALS | Copyright verification · Copyright verification | Avg acc (%): 99.83 -> 66.50 | Hurt |
| Replace z-Watermarking with RoSteALS | Copyright verification · Copyright verification | t@k@100%wd (%): 97.7 -> 7.9 | Hurt |
| Apply second-stage fine-tuning | z-Watermarking · Robustness study | Avg acc (%): 99.87 -> 99.13 | Hurt |
| Apply mixed-clean fine-tuning | z-Watermarking · Robustness study | Avg acc (%): 99.87 -> 99.04 | Hurt |
| Apply latent attack | z-Watermarking · Robustness study | Avg acc (%): 99.87 -> 95.81 | Hurt |
| Apply prompt attack | z-Watermarking · Robustness study | t@k@100%wd (%): 97.9 -> 76.7 | Hurt |
| Apply rotation | z-Watermarking · Robustness study | t@k@100%wd (%): 97.9 -> 14.8 | Hurt |
Surprising findings
- Rotation by 90 degrees reduces t@k@100%wd sharply to 14.8%, the weakest case among the tested attacks.
- Non-mimic models obtain only about 50% average watermark accuracy, showing the watermark signal is specific to mimicry.
Limitations
- Performance may degrade under targeted adversarial attacks such as Glaze, which the authors leave to future work.
- Style-transfer or bias-injection modifications to deep style features are expected to affect performance.
- Surrogate model fine-tuning quality can affect results.
Experimental setup
Datasets: MS COCO CelebA CUB DreamBooth dataset Pokemon 17 artists 10 AI artworks
Benchmarks: CelebA CUB DreamBooth dataset Artists AIs
Metrics: Avg acc t@k@100%wd FID CLIP Score True Positive True Negative
Baselines: DCT-DWT-SVD RivaGan SSL Trustmark RoSteALS
Builds on: Stable Diffusion LoRA DreamBooth MoCo-style momentum contrast
Closest papers by meaning
- Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.86)
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.86)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.86)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.86)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.85)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.