Research map / Image generation / Autoregressive and latent generation

Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles

NeurIPS 2026 · Image generation › Autoregressive and latent generation · approach: Robust diffusion watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a theory-first framework for evaluating seed-based multi-bit diffusion watermarks (capacity, fidelity as KL, security as PCA-based security ratio) and a lattice-based scheme (SSB) with nested 1D lattices that spans security-robustness-fidelity regimes.

Problem

Empirical evaluations of seed-based in-generation watermarks depend on the specific diffusion model, scheduler, and VAE used for inversion, and security lacks a rigorous definition, so methods cannot be ranked cleanly.

Approach

Decouple the model-dependent projection (inverse diffusion) from the decision mechanism, measure robustness as the noise variance in watermark space, and evaluate watermarks via capacity, KL-based fidelity and a PCA-based security ratio. The proposed SSB scheme embeds codewords with two nested 1D lattices (coarse and fine) using a secret rotation-like key matrix U, generalizing sign-based Gaussian

Key results

• Equivalent latent noise variance from JPEG QF50 is about 1.08 for Z-image and 1.09 for Qwen, while 50% center crop yields the largest variances (up to 2.09 for Qwen).
• Experiments with Sana use 500 images to validate that empirical bit-accuracy matches theoretical channel characteristic for sign-based and (1.6, 0) SSB regimes.
• Theory shows (1.6,0)-SSB can reach perfect security (eta = +infinity) in the PCA attack, while sign-based Gaussian-Shading has security ratio 1/L.

Surprising findings

• Gaussian-Shading and PRC are insecure under the spoofing threat model: a single watermarked sample suffices to attack them (eta = 1/L).
• None of the current seed-based systems can resist a 50% center crop.

Limitations

• Analysis assumes a binary symmetric channel rather than AWGN, causing a small capacity loss.
• Projection (inverse diffusion) is not optimized and is treated as a black box with empirically estimated noise.
• Extension to zero-bit watermarking is left open.

Experimental setup

Datasets: Gustavosta/Stable-Diffusion-Prompts

Benchmarks: Gustavosta/Stable-Diffusion-Prompts

Metrics: equivalent noise variance sigma^2 channel bit-accuracy Shannon capacity KL fidelity security ratio empirical rate at P_e

Baselines: Gaussian-Shading Pseudo-random codes (PRC) Tree-Rings

Builds on: Tree-Rings Gaussian-Shading Pseudo-random codes Voronoi modulation

Closest papers by meaning

• An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.90)
• ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · similarity 0.89)
• T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.89)
• BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.89)
• Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.88)
• Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.88)