Research map / Image generation / Autoregressive and latent generation
Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shallow Diffuse embeds a frequency-domain ring watermark at timestep 0.3T in the low-rank Jacobian null space of the diffusion posterior mean predictor, giving training-free watermarking that is both consistent and robust in server and user scenarios.
Problem
Existing diffusion watermarks either embed into the initial noise (tightly coupled to sampling, hurting image consistency and requiring the seed) or are post-hoc watermarks that are not robust; no method is both robust and consistent across server and user scenarios.
Approach
Inject the watermark at an intermediate timestep (0.3T) where the posterior mean predictor's Jacobian is low-rank, so most of the watermark lies in its null space and leaves the predicted clean image unchanged, while remaining detectable via DDIM inversion.
Key results
- In the server scenario, Shallow Diffuse achieves average robustness 0.93 TPR@1%FPR, matching Gaussian Shading and above Tree-Ring (0.77), with PSNR 35.49 vs Tree-Ring 16.61.
- In the user scenario on COCO, Shallow Diffuse reaches PSNR 32.11 and average TPR@1%FPR 0.93, while RingID reaches 0.96 but with PSNR 12.21.
- Shallow Diffuse achieves best FID (25.60) and CLIP-Score (0.3669) among diffusion-based methods in the server scenario.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Embed the watermark at an intermediate timestep in a low-dimensional subspace | Shallow Diffuse · Server scenario | PSNR: 35.49 | Helped |
| Embed the watermark at an intermediate timestep in a low-dimensional subspace | Shallow Diffuse · Server scenario | TPR@1%FPR, average attacks: 0.93 | Helped |
| Use Shallow Diffuse instead of RingID | Stable Diffusion 2-1-base · COCO user scenario | PSNR: 12.21 -> 32.11 | Helped |
| Use Shallow Diffuse instead of Gaussian Shading | Stable Diffusion 2-1-base · DiffusionDB user scenario | PSNR: 10.61 -> 33.07 | Helped |
| Select injection timestep t = 0.2T instead of other tested timesteps (ablation) | Shallow Diffuse · User scenario | consistency | Helped |
| Select injection timestep t = 0.3T instead of other tested timesteps (ablation) | Shallow Diffuse · User scenario | robustness | Helped |
| Increase watermark-mask radius (ablation) | Shallow Diffuse · Consistency-robustness trade-off | TPR@1%FPR | Helped |
| Increase watermark-mask radius (ablation) | Shallow Diffuse · Consistency-robustness trade-off | image consistency | Hurt |
| Use high-frequency rather than low-frequency watermark regions (ablation) | Shallow Diffuse · Watermark pattern ablation | image consistency | Helped |
| Use Circle mask with Rotational Rand key rather than other watermark patterns (ablation) | Shallow Diffuse · Watermark pattern ablation | watermark robustness: 0.86/0.35 -> 1.00/1.00 | Helped |
| Increase the number of simultaneous watermark keys beyond 16 (ablation) | Shallow Diffuse · Multi-key server scenario | adversarial robustness | Hurt |
Surprising findings
- Robustness and consistency peak at different timesteps: optimal consistency at 0.2T and optimal robustness at 0.3T, with the authors attributing the gap to DDIM inversion error and the latent-vs-image-space difference.
Limitations
- Multi-key identification degrades under adversarial attacks when the number of watermarks exceeds 16.
- Theoretical guarantees assume exact linearity and a Lipschitz PMP, extended only heuristically to approximate linearity.
- Adversarial-attack robustness is modest (average 0.54 TPR@1%FPR in server scenario).
Experimental setup
Datasets: MS-COCO DiffusionDB
Benchmarks: MS-COCO DiffusionDB
Metrics: PSNR SSIM LPIPS CLIP-Score FID AUC TPR@1%FPR
Baselines: DwtDct DwtDctSvd RivaGAN StegaStamp Stable Signature Tree-Ring Watermarks RingID Gaussian Shading
Builds on: Tree-Ring Watermarks DDIM classifier-free guidance Gaussian Shading
Closest papers by meaning
- Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models (CVPR 2024 · similarity 0.90)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.90)
- WMAdapter: Adding WaterMark Control to Latent Diffusion Models (ICML 2025 · similarity 0.90)
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.90)
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.90)
- AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.