Research map / Image generation / Autoregressive and latent generation

BitMark: Watermarking Bitwise Autoregressive Image Generative Models

NeurIPS 2025 · Image generation › Autoregressive and latent generation · approach: Robust diffusion watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes BitMark, a bit-level generation-time watermark for bitwise autoregressive image models (Infinity, Instella) that biases green bit-sequences, detected by z-test on re-encoded images, showing robustness and radioactivity.

Problem

Watermarking images from bitwise autoregressive text-to-image models so model owners can identify their own generated outputs and avoid model collapse, with watermarks that are robust to removal and radioactive (persist when other models are trained on them).

Approach

Adapt KGW-style green/red list soft biasing from language models to the bit level: partition n-bit sequences into green and red lists and add a logit bias to bits that complete green sequences during generation; detection counts green bit sequences in re-encoded images with a z-test. Bit-level watermarking is more stable under decode-re-encode than token-level.

Key results

• Infinity-2B with delta=2 keeps FID near baseline (31.05 vs 33.36 unwatermarked at delta 0 and 2 respectively in the quality table) and watermarked generation adds at most one-tenth extra time.
• Under CtrlRegen+ reconstruction Infinity-2B retains 91.6% TPR@1%FPR and withstands noise, blur, color and JPEG attacks at ~99-100%.
• Radioactivity: a Stable Diffusion 2.1 model fine-tuned on watermarked Infinity-2B outputs keeps 98.9% TPR@1%FPR; same-architecture transfer reaches 99.7%.

Measured effects reported in the paper

Surprising findings

• Rotation by 20-180 degrees sharply reduces detection (TPR 20.1% under rotation for Infinity-2B), and Instella IAR is fragile to rotation and cropping.
• Watermark-in-the-sand attack reduces TPR to 89.0% for Infinity-2B, but the attack takes over 12 minutes per image.

Limitations

• Sensitive to large rotations (TPR drops to 56.8% at plus or minus 50 degrees), requiring rotation correction at detection.
• Bias strength delta must be tuned; delta above 3 degrades image quality (FID 127 at delta 5).
• Instella IAR with only 128 tokens is weakly watermarked by design.

Experimental setup

Datasets: MS-COCO 2014 validation

Benchmarks: MS-COCO 2014 validation

Metrics: TPR@1%FPR FID KID CLIP score z-score AUC accuracy

Baselines: RivaGAN StegaStamp TrustMark

Builds on: KGW watermark Infinity Tree-Ring Unigram-Watermark

Closest papers by meaning

• An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.89)
• Watermarking Autoregressive Image Generation (NeurIPS 2025 · similarity 0.89)
• Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles (NeurIPS 2026 · similarity 0.89)
• On the Robustness of Watermarking for Autoregressive Image Generation (NeurIPS 2026 · similarity 0.88)
• Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.87)
• Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking (NeurIPS 2025 · similarity 0.87)