Research map / Image generation / Autoregressive and latent generation
Robust diffusion watermarking
Embed and attack watermarks in diffusion-generated images for provenance.
79 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Autoregressive and latent generation, keyword cluster “ai · watermarking · generated”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
16 papers in 2023–24 and 56 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 3.4% to 6.2%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Hiding Images in Plain Sight: Deep Steganography (NeurIPS 2017 · 329 citations)
- 2022 · Image Disentanglement Autoencoder for Steganography Without Embedding (CVPR 2022 · 94 citations)
- 2023 · Tree-Rings Watermarks: Invisible Fingerprints for Diffusion Images (NeurIPS 2023 · 54 citations)
- 2024 · EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection (CVPR 2024 · 91 citations)
- 2025 · OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking (CVPR 2025 · 20 citations)
- 2026 · GenPTW: Latent Image Watermarking for Provenance Tracing and Tamper Localization (AAAI 2026 · 4 citations)
Earliest papers here
- Hiding Images in Plain Sight: Deep Steganography (NeurIPS 2017 · 329 citations)
- On the Effectiveness of Visible Watermarks (CVPR 2017 · 66 citations)
- Deanonymization in the Bitcoin P2P Network (NeurIPS 2017 · 37 citations)
What has been tried
45 papers here report 461 measured changes (a component added, removed or swapped, compared with a baseline): helped 60%, no clear effect 10%, hurt 27%, mixed 3%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add the lightweight feature interaction module (LFIM) | Stable Diffusion Inpaint, clean · IoU | 0.904 -> 0.936 | Helped | EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection (CVPR 2024 · 91 citations) |
| Increase watermark capacity from 256 bits to 4096 bits | Stable Diffusion V2.1, adversarial noise · bit accuracy | 0.9724 -> 0.7302 | Hurt | Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models (CVPR 2024 · 85 citations) |
| increase the diffusion noise level | StegaStamp · watermark removal rate | Helped | Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · 35 citations) | |
| Distribution-preserving secret data modulator (DP-SDM) added to injected noise | CelebA 1282, 1 bpp · Pe (steganalyzer detection error) | Pe 1.0 -> 0.501 | Helped | StegaStyleGAN: Towards Generic and Practical Generative Image Steganography (AAAI 2024 · 32 citations) |
| Use two separate watermarks for media and content rather than one watermark per paired concept | BAM, combined attribution · attribution accuracy (%) | 97.73 -> 90.12 | Hurt | ProMark: Proactive Diffusion Watermarking for Causal Attribution (CVPR 2024 · 23 citations) |
| add an optimized prompt signal for watermark hiding | Stable Diffusion · PSNR | 20.11 -> 21.70 | Helped | ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization (NeurIPS 2024 · 23 citations) |
| Add MER resynchronization | SOIM under MIC · ACC (%) | 54.43 -> 98.25 | Helped | MuST: Robust Image Watermarking for Multi-Source Tracing (AAAI 2024 · 21 citations) |
| use a fixed natural-image watermark instead of a fixed pure-image watermark | COCO test · PSNR (dB) | 39.64 -> 41.09 | Helped | OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking (CVPR 2025 · 20 citations) |
| Remove the diffusion denoising process (0 steps instead of 50) | MS-COCO, Zhao23 attack · WDR | 0.986 -> 0.7 | Hurt | Attack-Resilient Image Watermarking Using Stable Diffusion (NeurIPS 2024 · 15 citations) |
| Train with a progressive distortion layer instead of a static strategy | Training convergence · extraction accuracy | Helped | Watermarking One for All: A Robust Watermarking Scheme Against Partial Image Theft (CVPR 2025 · 8 citations) | |
| use fewer images to estimate the extracted pattern | Watermark removal across image methods · watermark detection performance | Helped | Can Simple Averaging Defeat Modern Watermarks? (NeurIPS 2024 · 6 citations) | |
| Remove transformation layer T during watermark decoder pretraining | Gaussian noise, rotation, scaling, and crop · bit accuracy | With T: 0.93, 0.84, 0.92, 0.91; Without T: 0.64, 0.57, 0.56, 0.89 | Hurt | DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields (AAAI 2025 · 5 citations) |
What reviewers will expect
Datasets and baselines named in the 31 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ImageNet · 5 of 31 papers
- MS-COCO · 5 of 31 papers
- Stable-Diffusion-Prompts · 3 of 31 papers
- MS-COCO-2017 · 3 of 31 papers
- COCO · 2 of 31 papers
- MIRFlickr · 2 of 31 papers
- DIV2K · 2 of 31 papers
- UltraEdit · 2 of 31 papers
Baselines
- DwtDctSvd · 10 of 31 papers
- RivaGAN · 9 of 31 papers
- StegaStamp · 9 of 31 papers
- Gaussian Shading · 8 of 31 papers
- DwtDct · 8 of 31 papers
- Stable Signature · 6 of 31 papers
- Tree-Ring · 6 of 31 papers
- TrustMark · 5 of 31 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 72 papers; from OpenAlex and the papers' affiliations).
- National University of Singapore · 8 papers
- University of Science and Technology of China · 7 papers
- Peking University · 3 papers
- Nanyang Technological University · 3 papers
- Peng Cheng Laboratory · 2 papers
- Sun Yat-sen University · 2 papers
- Adobe · 2 papers
- University of Surrey · 2 papers
- City University of Hong Kong · 2 papers
- University of Massachusetts at Amherst · 2 papers
Use it
Download BibTeX of 29 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Generalizable fake image detection (119 papers)
- Reconstruction-based diffusion image detection (45 papers)
Elsewhere in the topic
- Classical generative image synthesis (147 papers)
- High-resolution diffusion synthesis (140 papers)
- Retrieval and matching with generative features (140 papers)
- Generative latent space tooling (129 papers)
- Latent diffusion with learned tokenizers (114 papers)
- Synthetic training data from generators (111 papers)
- Compositional scene generation (105 papers)
- Next-scale and token autoregressive images (90 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).