Research map / Image generation / Autoregressive and latent generation
CoSDA: Enhancing the Robustness of Inversion-based Generative Image Watermarking Framework
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CoSDA, which reduces inversion error in inversion-based diffusion watermarking via compensation sampling (weighting in an unconditional-noise estimate) and a trained drift-alignment network that restores distorted latents, boosting robustness of Tree-Rings and Gaussian Shading.
Problem
Inversion-based generative image watermarking for diffusion models loses robustness because DDIM inversion errors, both internal (condition/guidance mismatch between forward and backward sampling) and external (image distortions such as JPEG), corrupt the recovered watermarked latent.
Approach
Compensation sampling modifies forward DDIM sampling to blend the conditional noise estimate with an unconditional estimate computed on a temporary latent, shrinking the mismatch with the empty-prompt, no-guidance inversion; a small conv/residual network is adversarially-free trained (MSE loss) to map distorted inverted latents back to the original watermarked starting latent.
Key results
- Tree-Rings-CoSDA raises TPR under distortion from 0.642 to 1.000 versus Tree-Rings on SD-v1.4.
- GS-CoSDA improves distorted bit accuracy from 0.918 to 0.952 (SD-v2.1) over Gaussian Shading while keeping FID near 25.
- Ablation on GS shows average distorted bit accuracy rising from 0.881 (base) to 0.941 with both compensation sampling and drift alignment.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add CoSDA to Tree-Rings | Tree-Rings with Stable Diffusion · 9 tested distortions | TPR: 0.642/0.639 -> 1.000/1.000; overall TPR of distorted images by 36% | Helped |
| Add CoSDA to Gaussian Shading | GS with Stable Diffusion · 9 tested distortions | bit accuracy: 0.918/0.912 -> 0.952/0.952; 3% | Helped |
| Add compensation sampling without drift alignment (ablation) | GS watermarking · SD-v2.1, average across Gaussian noise, median filtering, and JPEG compression | bit accuracy: 0.881 -> 0.901 | Helped |
| Add drift alignment without compensation sampling (ablation) | GS watermarking · SD-v2.1, average across Gaussian noise, median filtering, and JPEG compression | bit accuracy: 0.881 -> 0.925 | Helped |
| Add both compensation sampling and drift alignment (ablation) | GS watermarking · SD-v2.1, average across Gaussian noise, median filtering, and JPEG compression | bit accuracy: 0.881 -> 0.941 | Helped |
| Decrease compensation-sampling weight p from 1 | CoSDA · Generated images and inversion | inversion error | Helped |
| Decrease compensation-sampling weight p | CoSDA · Generated images | visual quality | Hurt |
Surprising findings
- Purification attack with noise strength 0.5 lowers PSNR to about 18 dB while bit accuracy falls to 0.850, so attack-induced degradation is substantial.
Limitations
- Extraction still depends on DDIM inversion, requiring ODE-based continuous-time samplers.
- Modifying forward sampling means generated images are not guaranteed to be lossless in quality.
- Evaluation uses only 50 watermarked images for quality and a limited set of baselines.
Experimental setup
Datasets: Stable-Diffusion Prompt (Gustavosta)
Benchmarks: Stable-Diffusion Prompt
Metrics: TPR at FPR 1e-10 bit accuracy FID CLIP-Score PSNR
Baselines: DwtDctSvd RivaGAN FIN Stable Signature Tree-Rings Gaussian Shading
Builds on: DDIM Tree-Rings Gaussian Shading Stable Diffusion
Closest papers by meaning
- PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection (NeurIPS 2026 · similarity 0.89)
- How to Trace Latent Generative Model Generated Images without Artificial Watermark? (ICML 2024 · similarity 0.87)
- WMAdapter: Adding WaterMark Control to Latent Diffusion Models (ICML 2025 · similarity 0.87)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.87)
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.87)
- ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.