Research map / Image generation / Autoregressive and latent generation
An Undetectable Watermark for Generative Image Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes the PRC watermark, which samples diffusion initial latents whose signs follow a pseudorandom error-correcting code, giving undetectable, quality-preserving, robust watermarks for Stable Diffusion 2.1 with optional long-message encoding.
Problem
Existing image watermarks for generative models degrade image quality or distribution diversity, and are detectable by learned classifiers; the paper targets watermarks that are undetectable and quality-preserving under efficiently computable metrics while remaining robust.
Approach
Select initial diffusion latents by taking the signs from a pseudorandom error-correcting code (PRC) codeword and magnitudes from a standard Gaussian, so the latent is computationally indistinguishable from Gaussian; detection inverts the diffusion process (DDIM/exact inversion) and checks the PRC parity checks with a soft-decision detector.
Key results
- PRC watermark achieves TPR=1.0 at FPR=0.01 without attacks and preserves FID, CLIP and Inception Score on COCO and SDP, while Gaussian Shading raises FID from 76.4 to 77.9 (COCO) and 63.5 to 69.9 (SDP).
- A ResNet18 trained to detect the PRC watermark stays at 50% validation accuracy while it perfectly detects all other tested schemes.
- The 512-bit message can be robustly encoded, and up to 2500 bits are recoverable when images are not attacked.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · MS-COCO | FID: 76.3987 -> 76.5979 | No clear effect |
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · MS-COCO | CLIP Score: 0.4792 -> 0.4773 | No clear effect |
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · MS-COCO | Inception Score: 17.5430 -> 17.4734 | No clear effect |
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · Stable Diffusion Prompts | FID: 63.4625 -> 63.7350 | No clear effect |
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · Stable Diffusion Prompts | CLIP Score: 0.6119 -> 0.6146 | No clear effect |
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · Stable Diffusion Prompts | Inception Score: 7.4969 -> 7.5000 | No clear effect |
| Use the PRC watermark instead of no watermark | Stable Diffusion 2.1 · Perceptual variability | LPIPS: 0.7570 -> 0.7589 | No clear effect |
| Apply JPEG compression with quality factor 20 | PRC watermark · Robustness under JPEG attack | TPR: 1.0 -> 0.94 | Hurt |
| Set PRC sparsity t=2 instead of t=3 (ablation) | PRC watermark · Watermark removal attacks | robustness | Helped |
| Encode 512-bit messages in the PRC watermark | PRC watermark · 512-bit message decoding | decoder robustness | Mixed |
| Increase message capacity to 2500 bits without removal attacks | PRC watermark · Images without removal attacks | message capacity: at least 2500 bits | Helped |
| Train a keyless ResNet18 classifier to detect the watermark | PRC watermark · Watermark detectability, validation set | accuracy: 50% | No clear effect |
Surprising findings
- Gaussian Shading, which claims lossless performance, significantly degrades FID and Inception Score when the same key is used across images.
- Under the tested removal attacks, no method kept TPR below 0.99 while FID stayed under 70 for the PRC watermark; however, the embedding attack with strength 2 still noticeably degrades quality.
Limitations
- Experiments do not strictly satisfy the parameter bounds of the PRC pseudorandomness proof, so undetectability is heuristic at the chosen finite parameters.
- Decoder is less robust than the detector and belief propagation only works at low error rates (small sparsity t).
- Detection requires diffusion inversion, and the scheme relies on Recover producing an accurate latent estimate.
Experimental setup
Datasets: MS-COCO Stable Diffusion Prompts (SDP) MS-COCO-2017 training set
Benchmarks: MS-COCO Stable Diffusion Prompts
Metrics: TPR@FPR=0.01 FID CLIP score Inception Score LPIPS PSNR SSIM bit recovery rate
Baselines: DwtDct DwtDctSvd RivaGAN StegaStamp SSL watermark Stable Signature Tree-Ring Gaussian Shading
Builds on: pseudorandom codes (Christ and Gunn, 2024) Tree-Ring watermark Gaussian Shading DDIM inversion DPM-Solver
Closest papers by meaning
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.90)
- Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles (NeurIPS 2026 · similarity 0.90)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.90)
- BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.89)
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.89)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.