Research map / Image generation / Autoregressive and latent generation

Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances

ICLR 2025 · Image generation › Autoregressive and latent generation · approach: Robust diffusion watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces W-Bench, a benchmark evaluating eleven watermarking methods against image regeneration, global/local editing, and image-to-video generation, and proposes VINE, a robust watermarking model built on SDXL-Turbo with blur-based surrogate attacks.

Problem

Existing image watermarks are vulnerable to text-to-image-based image editing, regeneration, and image-to-video generation, which can erase embedded watermarks and threaten copyright protection.

Approach

Frequency analysis shows that T2I editing removes mid/high-frequency watermark patterns, so blurring distortions are used as differentiable surrogate attacks during training; the watermark encoder is built from the one-step SDXL-Turbo diffusion model with a condition adaptor, skip connections and zero-convolution layers, and optionally fine-tuned with a straight-through estimator through Instruct-

Key results

• VINE-Robust achieves 99.66% TPR@0.1%FPR under stochastic regeneration and 99.98% under deterministic regeneration, versus 91.09% and 92.13% for the strongest baselines reported, while keeping PSNR 37.34 dB.
• VINE-Base attains the best image quality (PSNR 40.51, SSIM 0.9954, LPIPS 0.0029, FID 0.08) among the compared methods.
• On image-to-video generation, VINE-Robust reaches 36.33% TPR@0.1%FPR, behind TrustMark's 39.60%, and the authors state I2V remains a limitation.

Measured effects reported in the paper

Surprising findings

• Bit accuracy and AUROC alone are insufficient: SSL shows higher bit accuracy than TrustMark but lower TPR@0.1%FPR because of a high false positive rate.
• Methods that perform well on local editing with UltraEdit do not transfer to global editing with the same model, indicating global editing degrades watermarks more.

Limitations

• Limited effectiveness against image-to-video generation (I2V), where TPR@0.1%FPR is low.
• Larger model than baselines, causing higher memory requirements and slower inference.
• Fine-tuning with Instruct-Pix2Pix in the straight-through estimator is needed to reach strong robustness, adding training cost.

Experimental setup

Datasets: OpenImage UltraEdit Instruct-Pix2Pix dataset

Benchmarks: W-Bench

Metrics: TPR@0.1%FPR TPR@1%FPR PSNR SSIM LPIPS FID bit accuracy AUROC

Baselines: MBRS CIN PIMoG RivaGAN SepMark DWTDCT DWTDCTSVD SSL StegaStamp TrustMark EditGuard

Builds on: SDXL-Turbo ControlNet Instruct-Pix2Pix StegaStamp WAVES

Closest papers by meaning

• An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.88)
• Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.88)
• Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.88)
• BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.87)
• Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking (NeurIPS 2025 · similarity 0.87)
• A Locally Tokenized Generative Model for Robust Time-Series Watermarking (NeurIPS 2026 · similarity 0.87)