Research map / Image generation / Autoregressive and latent generation
Attack-Resilient Image Watermarking Using Stable Diffusion
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ZoDiac, a zero-bit image watermarking method that embeds a Fourier-domain ring watermark into the latent vector of a pre-trained Stable Diffusion model (via DDIM inversion and optimization) and detects it by a statistical test, achieving robustness to diffusion-based regeneration attacks.
Problem
Existing image watermarks are removed by diffusion-based regeneration attacks (e.g., Zhao23), so watermarks for existing real images need to survive generative watermark-removal attacks and composite attacks.
Approach
Use DDIM inversion to get a latent vector for an existing image, inject a ring-shaped complex Gaussian watermark into its Fourier space, and optimize the latent so the frozen pre-trained Stable Diffusion decoder reproduces a visually similar image; detect via DDIM inversion plus a non-central chi-squared test. The diffusion denoising process is hypothesized to strengthen robustness.
Key results
- ZoDiac achieves watermark detection rate above 98% under the Zhao23 diffusion regeneration attack on MS-COCO, DiffusionDB and WikiArt while baselines drop to 0-29% (e.g., StegaStamp 0.286 on MS-COCO).
- Under the composite 'All w/o rotation' attack ZoDiac keeps WDR around 0.51-0.55 while all six baselines fall to near 0 (except SSL at 0.898-0.952 on the attack-only column, which fails under Zhao23).
- With FPR around 0.062 at p*=0.90, ZoDiac achieves PSNR about 29-30 dB and SSIM 0.92 on watermarked images, and rotation robustness reaches above 99% after a rotation-correction step.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Embed the watermark in the diffusion latent space using ZoDiac instead of existing watermarking methods | Image watermarking · MS-COCO, Zhao23 attack | WDR: 0.666 -> 0.986 | Helped |
| Embed the watermark in the diffusion latent space using ZoDiac instead of existing watermarking methods | Image watermarking · DiffusionDB, Zhao23 attack | WDR: 0.660 -> 0.992 | Helped |
| Embed the watermark in the diffusion latent space using ZoDiac instead of existing watermarking methods | Image watermarking · WikiArt, Zhao23 attack | WDR: 0.664 -> 0.994 | Helped |
| Use ZoDiac instead of the best baseline on the combined attack without rotation | Image watermarking · MS-COCO, All w/o rotation | WDR: 0.000 -> 0.510 | Helped |
| Use ZoDiac instead of the best baseline on the combined attack without rotation | Image watermarking · DiffusionDB, All w/o rotation | WDR: 0.000 -> 0.548 | Helped |
| Use ZoDiac instead of the best baseline on the combined attack without rotation | Image watermarking · WikiArt, All w/o rotation | WDR: 0.000 -> 0.530 | Helped |
| Remove the diffusion denoising process (0 steps instead of 50) (ablation) | ZoDiac · MS-COCO, Zhao23 attack | WDR: 0.986 -> 0.7 | Hurt |
| Remove the diffusion denoising process (0 steps instead of 50) (ablation) | ZoDiac · MS-COCO, All w/o rotation | WDR: 0.510 -> 0.002 | Hurt |
| Reduce denoising steps from 50 to 1 (ablation) | ZoDiac · MS-COCO, Zhao23 attack | WDR: 0.986 -> 0.978 | No clear effect |
| Raise detection threshold from 0.90 to 0.99 (ablation) | ZoDiac · MS-COCO, FPR | FPR: 0.062 -> 0.004 | Helped |
| Raise detection threshold from 0.90 to 0.99 (ablation) | ZoDiac · MS-COCO, Zhao23 attack | WDR: 0.986 -> 0.954 | Hurt |
| Initialize the latent vector with DDIM inversion rather than random sampling (ablation) | ZoDiac latent optimization · Image reconstruction | L2 loss: random initialization: L2 = 0.0036 | Helped |
Surprising findings
- Reducing denoising steps to 0 (autoencoder only) sharply drops robustness (e.g., Zhao23 WDR from 0.988 to 0.712), supporting the claim that the diffusion process itself contributes to robustness.
- SSL, which incorporates rotation during training, is the only baseline effective against rotation, while ZoDiac fails on rotation without correction because DDIM inversion is not rotation-invariant.
Limitations
- Not robust to rotation without manual correction, due to non-rotation-invariant DDIM inversion.
- Zero-bit watermark only; cannot encode a message, and the latent must follow a Gaussian distribution.
- Per-image optimization is slow (tens to hundreds of seconds per image) and composite attacks still reduce WDR to about 0.5.
Experimental setup
Datasets: MS-COCO DiffusionDB WikiArt
Benchmarks: MS-COCO DiffusionDB WikiArt
Metrics: PSNR SSIM LPIPS watermark detection rate false positive rate
Baselines: DwtDct DwtDctSvd RivaGAN SSL CIN StegaStamp
Builds on: DDIM Tree-Rings Stable Diffusion
Closest papers by meaning
- AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA (ICML 2024 · similarity 0.89)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.88)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.88)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.88)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.88)
- StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.