Research map / Image generation / Autoregressive and latent generation
StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes StableGuard, which embeds a holistic binary watermark into latent diffusion decoding via a togglable VAE adapter and jointly trains a mixture-of-experts forensic network for watermark extraction and tampering localization.
Problem
Copyright protection and tampering localization for latent diffusion model outputs are handled by separate post-hoc pipelines, which add overhead, degrade image quality, and optimize forensics independently of watermark embedding.
Approach
A diffusion-native watermark is injected through lightweight latent residual adapters in the pretrained VAE decoder, allowing paired watermarked and clean outputs from the same latent for self-supervised training of a MoE forensic network (watermark, tampering, boundary experts with a dynamic soft router), trained jointly end-to-end.
Key results
- On COCO with 32-bit watermarks, StableGuard reports PSNR 40.50, SSIM 0.970, and Bit Acc 99.97%, versus WAM at 38.20 PSNR and 98.17% Bit Acc.
- On the AIGC tampering dataset, StableGuard reaches F1 0.980 and IoU 0.962 on SD Inpainting, versus EditGuard at 0.937 F1 and 0.911 IoU.
- Under JPEG (Q=30), StableGuard keeps 98.87% bit accuracy, while EditGuard drops to 62.30% and WAM to 80.96%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use StableGuard instead of EditGuard | Watermarking · COCO Dataset | Bit Acc: 99.77 -> 99.97 | Helped |
| Use StableGuard instead of EditGuard | Watermarking · T2I-Dataset | Bit Acc: 99.78 -> 99.98 | Helped |
| Use StableGuard instead of EditGuard | Tampering localization · AIGC tampering dataset, SD Inpainting | F1: 0.937 -> 0.980 | Helped |
| Use StableGuard instead of EditGuard | Tampering localization · AIGC tampering dataset, SD XL | F1: 0.938 -> 0.981 | Helped |
| replace MPW-VAE with MPW-VAE rather than WOUAF watermarking (ablation) | StableGuard · AIGC tampering dataset | F1: 0.811 -> 0.980 | Helped |
| add the MoFE block instead of a plain UNet (ablation) | StableGuard · AIGC tampering dataset | F1: 0.931 -> 0.980 | Helped |
| add Watermark Extraction Expert (ablation) | StableGuard · AIGC tampering dataset | F1: 0.969 -> 0.980 | Helped |
| add Tampering Localization Expert (ablation) | StableGuard · AIGC tampering dataset | F1: 0.952 -> 0.980 | Helped |
| add Boundary Enhancement Expert (ablation) | StableGuard · AIGC tampering dataset | F1: 0.962 -> 0.980 | Helped |
| use Dynamic Soft Router rather than simple feature summation (ablation) | StableGuard · AIGC tampering dataset | F1: 0.966 -> 0.980 | Helped |
| jointly optimize watermark embedding and forensics rather than train separately (ablation) | StableGuard · AIGC tampering dataset | F1: 0.921 -> 0.980 | Helped |
| place MoFE in the decoder rather than the encoder (ablation) | StableGuard · AIGC tampering dataset | F1: 0.974 -> 0.980 | Helped |
Surprising findings
- Baseline EditGuard's watermark bit accuracy falls to 41.77% under resale-style downsampling, showing post-hoc watermark fragility.
- StableGuard's F1 drops sharply on the HEIC (Q=50) and WebP (Q=50) degradations (0.703 and 0.748), indicating localization remains sensitive to compression artifacts.
Limitations
- Forensic accuracy declines under image degradations such as compression and resampling, as stated by the authors.
- Watermarking applies only through the VAE decoder, so it is tied to latent diffusion models; video extension is untested.
- Clean images without a watermark are treated as fully tampered, so the system only applies to watermarked content.
Experimental setup
Datasets: COCO T2I dataset (10,000 images from 1,000 ChatGPT prompts) AIGC tampering dataset (35,000 images)
Benchmarks: COCO T2I dataset AIGC tampering dataset CASIA1.0 NIST16 Columbia Coverage IMD20
Metrics: PSNR SSIM LPIPS FID Bit Accuracy F1 AUC IoU FPR
Baselines: HiDDeN SepMark WOUAF Stable Signature WaDiff EditGuard OmniGuard WAM MVSS-Net IML-ViT PSCC-Net ObjectFormer
Builds on: Stable Diffusion EditGuard WAM OmniGuard
Closest papers by meaning
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.89)
- WMAdapter: Adding WaterMark Control to Latent Diffusion Models (ICML 2025 · similarity 0.89)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.88)
- AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA (ICML 2024 · similarity 0.88)
- EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection (CVPR 2024 · similarity 0.88)
- Attack-Resilient Image Watermarking Using Stable Diffusion (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.