Research map / Image generation / Autoregressive and latent generation
Hidden in the Noise: Two-Stage Robust Watermarking for Images
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes WIND, a two-stage image watermark that seeds diffusion initial noise from a large key set and embeds a Fourier group identifier to shrink the detection search, achieving robustness to removal and forgery attacks.
Problem
Existing diffusion watermarks that embed patterns in initial noise (Tree-Ring, RingID) are vulnerable to forgery and removal attacks, and distort the distribution of image sets; naive detection over many initial noises is also costly.
Approach
Use pseudo-random initial noises indexed by a secret salt and hash (distortion-free per image and in sets when N is large), and embed a Fourier group identifier (i mod M) so detection first recovers the group and then searches only N/M candidate noises.
Key results
- WIND_full with 2048 groups reaches 0.969 average detection accuracy under image transformations, versus 0.819 for RingID with 2048 keys and 0.066 for Tree-Ring with 2048 keys.
- WIND achieves the lowest FID (24.33) among compared watermarking methods, versus 25.93 for Tree-Ring and 26.13 for RingID.
- Under WeVade, random search, transfer and NES query attacks, the correct noise remains detectable in over 97% of cases among 10,000 options.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use WIND_full instead of WIND_fast (128 groups) (ablation) | WIND · Image transformations (100000 keys, 128 groups) | average detection accuracy: 0.887 -> 0.947 | Helped |
| Use WIND_full instead of WIND_fast (2048 groups) (ablation) | WIND · Image transformations (100000 keys, 2048 groups) | average detection accuracy: 0.814 -> 0.969 | Helped |
| Add group identifiers (ablation) | WIND_w/o · Generated images | SSIM: 1.000 -> 0.494 | Hurt |
| Add group identifiers (ablation) | WIND_w/o · Generated images | PSNR: \infty -> 14.647 | Hurt |
| Apply watermarking (ablation) | WIND · Generated images | CLIP score: 0.366 -> 0.360 | Hurt |
| Use 20 rather than 50 inference steps (ablation) | WIND · Image transformations | average detection accuracy: 0.976 -> 0.934 | Hurt |
| Use 100 rather than 50 inference steps (ablation) | WIND · Image transformations | average detection accuracy: 0.976 -> 0.980 | Helped |
| Use 200 rather than 50 inference steps (ablation) | WIND · Image transformations | average detection accuracy: 0.976 -> 0.970 | Hurt |
| Increase the number of iterative regeneration attacks (ablation) | WIND · Iterative regeneration (10 to 50 iterations) | cosine similarity: 0.493 -> 0.121 | Hurt |
| Increase the number of iterative regeneration attacks (ablation) | WIND · Iterative regeneration (10 to 50 iterations, 10000 options) | detection rate: 100% -> 100% | No clear effect |
| Use a public model for inversion and regeneration instead of the private model | Initial-noise watermark · Public-model reconstruction attack | cosine similarity: 0.888 -> 0.166 | Hurt |
| Use WIND_full instead of RingID | Watermarking methods · MS-COCO-2017 training | FID: 26.13 -> 24.33 | Helped |
Surprising findings
- The paper reports that the naive initial-noise watermark (no group identifier) keeps SSIM 1.000 and infinite PSNR, while the full method with group identifiers has SSIM 0.494, indicating visible distortion from the Fourier group pattern.
Limitations
- Robustness depends on attacker being unable to invert the private model; approximate inversion without the prompt is not formally guaranteed.
- Cropping/rotation and regeneration attacks still partially reduce detection; WIND_fast is vulnerable to removal of the group Fourier pattern.
- Group identifier uses RingID-style Fourier patterns that introduce visible distortion (SSIM 0.494).
Experimental setup
Datasets: MS-COCO-2017
Benchmarks: MS-COCO-2017
Metrics: detection accuracy FID CLIP score SSIM PSNR AUC TPR@1%FPR cosine similarity
Baselines: Tree-Ring RingID DwtDct DwtDctSvd RivaGAN Gaussian Shading StegaStamp SSL
Builds on: Tree-Ring RingID Gaussian Shading DDIM inversion
Closest papers by meaning
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.90)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.89)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.89)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.88)
- GaussMarker: Robust Dual-Domain Watermark for Diffusion Models (ICML 2025 · similarity 0.88)
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.