Research map / Image generation / Autoregressive and latent generation
ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ROBIN, a diffusion watermarking method that implants a robust frequency-domain watermark at an intermediate diffusion step and then uses an adversarially optimized hiding prompt embedding to actively conceal it in the final image, verifiable by DDIM inversion.
Problem
Existing diffusion watermarking methods trade off robustness against invisibility: watermark strength is limited to keep images concealed, which reduces robustness to image manipulations.
Approach
Embed a strong watermark at an intermediate diffusion state, then guide the remaining denoising with an optimized prompt embedding that actively hides the watermark; the watermark and hiding embedding are optimized adversarially (alternating), so no model retraining is needed.
Key results
- On Stable Diffusion under six attacks, ROBIN reaches average AUC 0.983 versus 0.975 for Tree-Ring and 0.854 for RivaGAN.
- On ImageNet diffusion, ROBIN reaches average AUC 0.988 versus 0.966 for Tree-Ring.
- Image quality vs. Tree-Ring on Stable Diffusion: PSNR 24.03 vs 15.37 and SSIM 0.768 vs 0.568, but FID slightly worse (26.86 vs 25.93).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use ROBIN instead of Tree-Ring | Stable Diffusion watermark verification · Stable Diffusion, attacks (Avg) | AUC: 0.975 -> 0.983 | Helped |
| use ROBIN instead of Tree-Ring | ImageNet Diffusion watermark verification · ImageNet Diffusion, attacks (Avg) | AUC: 0.966 -> 0.988 | Helped |
| add an optimized prompt signal for watermark hiding (ablation) | ROBIN with random watermark · Stable Diffusion | PSNR: 20.11 -> 21.70 | Helped |
| add an optimized prompt signal for watermark hiding (ablation) | ROBIN with random watermark · Stable Diffusion | FID: 29.21 -> 27.77 | Helped |
| add the image-retaining loss ℓ_ret (ablation) | ROBIN watermark optimization · Stable Diffusion | PSNR: 18.95 -> 24.03 | Helped |
| add the consistency loss ℓ_cons (ablation) | ROBIN watermark and prompt optimization · Stable Diffusion | Adversarial AUC: 0.970 -> 0.983 | Helped |
| add the watermark-strength objective (ablation) | ROBIN watermark optimization · Stable Diffusion | Adversarial AUC: 0.966 -> 0.983 | Helped |
| use pixel-level rather than latent-level alignment (ablation) | ROBIN optimization · Stable Diffusion, attacks (Avg) | AUC: 0.972 -> 0.983 | Helped |
| implant the watermark later in the diffusion process (ablation) | ROBIN · Diffusion watermark implantation | verification accuracy | Helped |
| increase watermark strength (ablation) | ROBIN · Diffusion watermark implantation | verification accuracy | Helped |
| increase watermark strength (ablation) | ROBIN · Diffusion watermark implantation | PSNR | Hurt |
Surprising findings
- Introducing the optimized hiding prompt signal during inversion hinders watermark recovery, which the authors leave to future work.
- Verification time is 0.531s for Stable Diffusion and 0.986s for ImageNet diffusion, versus 2.599s and 3.963s for Tree-Ring.
Limitations
- Verification depends on a reversible sampler (DDIM-style); not compatible with all samplers.
- Information loss during DDIM inversion remains; exact reversible trajectories suggested as a fix.
- The optimized hiding prompt degrades watermark recovery when used during inversion.
Experimental setup
Datasets: stable-diffusion-prompts (Gustavosta) ImageNet MS-COCO-2017
Benchmarks: MS-COCO-2017 (FID) ImageNet-1K (FID)
Metrics: AUC-ROC PSNR SSIM MSSIM FID CLIP score verification time
Baselines: DwtDct DwtDctSvd RivaGAN Stable Signature Tree-Ring
Builds on: Tree-Ring watermarks DDIM classifier-free guidance Stable Signature
Closest papers by meaning
- Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.91)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.90)
- On the Robustness of Watermarking for Autoregressive Image Generation (NeurIPS 2026 · similarity 0.90)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.90)
- Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles (NeurIPS 2026 · similarity 0.89)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.