Research map / Image generation / Autoregressive and latent generation

T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models

NeurIPS 2025 · Image generation › Autoregressive and latent generation · approach: Robust diffusion watermarking · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes T2SMark, a two-stage Noise-as-Watermark scheme for diffusion models that embeds bits in tail regions of Gaussian noise (Tail-Truncated Sampling) and uses a random session key to balance robustness and generation diversity.

Problem

Noise-as-Watermark methods for diffusion models trade off watermark robustness against generation diversity: strongly constrained noise sampling hurts diversity, while diversity-preserving methods are too fragile.

Approach

Tail-Truncated Sampling embeds bits only in the reliable tails of the Gaussian (|z| >= tau) while sampling the central zone randomly, and a two-stage scheme encrypts the watermark with a random session key that is itself encoded under a master key, so the full noise vector stays randomized.

Key results

• T2SMark achieves adversarial bit accuracy 0.9754 with clean 1.0000 on SD v2.1, versus 0.9548 for Gaussian Shading, while diversity (LPIPS) is 0.7069 vs 0.6446 for GS and 0.7074 for PRCW.
• On SD v3.5M, T2SMark reaches adversarial bit accuracy 0.9768 and diversity 0.6102, and its undetectability (Det. Acc. 0.518) is close to PRCW (0.516).
• Without TTS, adversarial bit accuracy drops from 0.9754 to 0.9307 (single-stage ablation on SD v2.1).

Measured effects reported in the paper

Surprising findings

• Embedding the session key in the truncated tails introduces distributional anomalies that can be detected, a limitation the authors state explicitly.
• T2SMark is highly vulnerable to Gaussian noise; performance degrades sharply even at noise std 0.1.

Limitations

• Vulnerable to forgery via proxy-model inversion, a risk shared by NaW methods.
• Depends on invertible ODE-based samplers such as DDIM; vulnerable to geometric distortions and Gaussian noise.
• Embedding the session key in tails causes detectable distributional anomalies.

Experimental setup

Datasets: MS-COCO-2017 Stable-Diffusion-Prompts ImageNet2014 validation set

Benchmarks: MS-COCO-2017 Stable-Diffusion-Prompts

Metrics: TPR at FPR 1e-6 bit accuracy LPIPS diversity CLIP score FID ResNet-18 detection accuracy

Baselines: dwtDct dwtDctSvd RivaGAN Stable Signature Tree-Ring Gaussian Shading PRC-Watermark

Builds on: Gaussian Shading PRC-Watermark Tree-Ring DDIM

Closest papers by meaning

• Hidden in the Noise: Two-Stage Robust Watermarking for Images (ICLR 2025 · similarity 0.90)
• SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.90)
• Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.90)
• An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.89)
• GaussMarker: Robust Dual-Domain Watermark for Diffusion Models (ICML 2025 · similarity 0.89)
• Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles (NeurIPS 2026 · similarity 0.89)