SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Yuxin Wen, John Kirchenbauer, Jonas Geiping, Tom Goldstein
{ywen, jkirchen, jgeiping, tomg} @umd.edu
Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at https://github.com/YuxinWenRick/tree-ring-watermark.
The development of diffusion models has led to a surge in image generation quality. Modern text-to-image diffusion models, like Stable Diffusion and Midjourney, are capable of generating a wide variety of novel images in an innumerable number of styles. These systems are general-purpose image generation tools, able to generate new art just as well as photo-realistic depictions of fake events for malicious purposes.
The potential abuse of text-to-image models motivates the development of watermarks for their outputs. A watermarked image is a generated image containing a signal that is invisible to humans and yet marks the image as machine-generated. Watermarks document the use of image generation systems, enabling social media, news organizations, and the diffusion platforms themselves to mitigate harms or cooperate with law enforcement by identifying the origin of an image [Bender et al., 2021, Grinbaum and Adomaitis, 2022].
Research and applications of watermarking for digital content have a long history, with many approaches being considered over the last decade [O'Ruanaidh and Pun, 1997, Langelaar et al., 2000]. However, so far research has always conceptualized the watermark as a minimal modification imprinted onto an existing image [Solachidis and Pitas, 2001, Chang et al., 2005, Liu et al., 2019, Fei et al., 2022]. For example, the watermark currently deployed in Stable Diffusion [Cox et al., 2007], works by modifying a specific Fourier frequency in the generated image.
The watermarking approach we propose in this work is conceptually different: This is the first watermark that is truly invisible, as no post-hoc modifications are made to the image. Instead,
Generation
Figure 1: Pipeline for Tree-Ring Watermarking. A diffusion model generation is watermarked and later detected through ring-patterns in the Fourier space of the initial noise vector.
the distribution of generated images is imperceptibly modified and an image is drawn from this modified distribution. This way, the actual sample carries no watermark in the classical additive sense, however an algorithmic analysis of the image can detect the watermark with high accuracy. From a more practical perspective, the watermark materializes in minor changes in the potential layouts of generated scenes, that cannot be distinguished from other random samples by human inspection.
This new approach to watermarking, which we call Tree-Ring Watermarking based on the patterns imprinted into the Fourier space of the noise vector of the diffusion model, can be easily incorporated into existing diffusion model APIs and is invisible on a per-sample basis. Most importantly, Tree-Ring Watermarking is far more robust than existing methods against a large battery of common image transformations, such as crops, color jitter, dilation, flips, rotations, or noise. Tree-Ring Watermarking requires no additional training or finetuning to implement, and the watermark can only be detected by parties in control of the image generation model. We validate the watermark in a number of tests, measuring negligible impact on image quality scores, high robustness to transformations, the low false-positive rate in detection, and usability for arbitrary diffusion models both with and without text conditioning.
Diffusion Models Diffusion Models, arising out of the score-based generative models of the formalism of Song and Ermon [2019, 2020], are the currently strongest models for image generation [Ho et al., 2020, Dhariwal and Nichol, 2021]. Diffusion models are capable of sampling new images at inference time by iteratively processing an initial noise map. The most prominent sampling algorithm in deployment is DDIM sampling [Nichol and Dhariwal, 2021] without additional noise, which can generate high-quality images in fewer steps than traditional DDPM sampling. Diffusion models are further accelerated for practical usage by optimizing images only in the latent space of a pre-trained VAE, such as in latent diffusion [Rombach et al., 2022].
Watermarking Digital Content Strategies to imprint watermarks onto digital content, especially images, have a long tradition in computer vision. Approaches such as Boland [1996], Cox et al. [1996], O'Ruanaidh and Pun [1997] describe traditional watermark casting strategies based on imprinting a watermark in a suitable frequency decomposition of the image, constructed through DCT, DWT, Fourier-Mellin, or complex wavelet transformations. These frequency transformations all share the beneficial property that simple image manipulations, such as translations, rotations, and resizing are easily understandable and watermarks can be constructed with robustness to these transformations in mind. A fair evaluation of watermarking approaches appears in Pitas [1998], Kutter and Petitcolas [1999], which highlight the importance of measurement of false-positive rates
for each strategy and ROC-curves under attack through various image manipulations. Work continues on imprinting watermarks, with strategies based on SVD decompositions [Chang et al., 2005], Radon transformations [Seo et al., 2004] and based on multiple decompositions [Al-Haj, 2007].
Fingerprinting and Watermarking Generative Models The development of modern deep neural networks opened up new possibilities for "deep" watermarking. Hayes and Danezis [2017] and Zhu et al. [2018] propose strategies to learn watermarking end-to-end, where both the watermark encoder and the watermark decoder are learned models, optimized via adversarial objectives to maximize transmission and robustness [Zhang et al., 2019]. Notably these approaches still work like a traditional watermark in that the encoder imprints a post-hoc signal onto a given image - however the type of imprint is now learned. We refer to Wan et al. [2022] for an overview. A recent improvement is two-stage processes like Yu et al. [2022], where the trained encoder is used to imprint the watermark onto the training data for a generative model. This leads to a trained generative model where the watermark encoder is "baked in" to the model, making it easier to generate watermarked data. The Stable Signature of Fernandez et al. [2023], applies this idea to latent diffusion models by finetuning the latent decoder based on a pre-trained watermark encoder. Zhao et al. [2023] similarly train on watermarked data for unconditional diffusion models.
Existing image watermarking approaches first learn a watermark signal and then learn to either embed it into generated data or the generating model. This pipeline stands in contrast to watermarking approaches for language models such as Kirchenbauer et al. [2023]. There, no training is necessary to generate watermarked data and the output distribution of the generative model is altered to encode a watermark into generated data in a distributional sense. In the same vein, we propose an approach to alter the output distribution of diffusion models to effectively watermark their outputs. As discussed, this has a number of advantages, in comparison to related work we especially highlight that no training is necessary, that the watermark works with existing models, and that this is the first watermark that does not rely on minor modification of generated images. In this sense, this is the first watermark that is really "invisible", see Appendix Figure 6.
We note in passing that watermarking the output of generative models is not to be confused with the task of watermarking the weights of whole models, such as in Uchida et al. [2017], Zhang et al. [2018], Bansal et al. [2022], who are concerned with identifying and fingerprinting models for intellectual property reasons.
2.1 Diffusion Models and Diffusion Inversion
We first introduce the basic notation for diffusion models and DDIM sampling [Ho et al., 2020, Song and Ermon, 2020, Dhariwal and Nichol, 2021]. A forward diffusion process consists of  $T$  steps of the noise process a predefined amount of Gaussian noise vector to a real data point  $x_0 \in q(x)$ , where  $q(x)$  is the real data distribution, specifically:
$$
q \left(x _ {t} \mid x _ {t - 1}\right) = \mathcal {N} \left(x _ {t}; \sqrt {1 - \beta_ {t}} x _ {t}, \beta_ {t} \mathbf {I}\right), \text {f o r} t \in \{0, 1, \dots , T - 1 \},
$$
where  $\beta_{t} \in (0,1)$  is the scheduled variance at step  $t$ . The closed-form for this sampling is
$$
x _ {t} = \sqrt {\bar {\alpha} _ {t}} x _ {0} + \sqrt {1 - \bar {\alpha} _ {t}} \epsilon , \tag {1}
$$
where,  $\bar{\alpha}_{t} = \prod_{i = 0}^{t}(1 - \beta_{t})$
For the reverse diffusion process, DDIM [Song and Ermon, 2020] is an efficient deterministic sampling strategy, mapping from a Gaussian vector  $x_{T} \sim \mathcal{N}(0,1)$  to an image  $x_0 \in q(x)$ . For each denoising step, a learned noise-predictor  $\epsilon_{\theta}$  estimates the noise  $\epsilon_{\theta}(x_{t})$  added to  $x_0$ . According to Equation (1), we can derive the estimation of  $x_0$  as:
$$
\hat {x} _ {0} ^ {t} = \frac {x _ {t} - \sqrt {1 - \bar {\alpha} _ {t}} \epsilon_ {\theta} (x _ {t})}{\sqrt {\bar {\alpha} _ {t}}}.
$$
Then, we add the estimated noise to  $\hat{x}_0$  to find  $x_{t - 1}$
$$
x _ {t - 1} = \sqrt {\bar {\alpha} _ {t - 1}} \hat {x} _ {0} ^ {t} + \sqrt {1 - \bar {\alpha} _ {t - 1}} \epsilon_ {\theta} (x _ {t}).
$$
We denote such a recursively denoising process from  $x_{T}$  to  $x_0$  as  $x_0 = \mathcal{D}_{\theta}(x_T)$ .
However, given the learned model  $\epsilon_{\theta}(x_t)$ , it is also possible to move in the opposite direction<sup>1</sup>. Starting from an image  $x_0$ , Dhariwal and Nichol [2021] describes an inverse process that retrieves an initial noise vector  $x_T$  which maps to an image  $\hat{x}_0$  close to  $x_0$  through DDIM, where  $\hat{x}_0 = \mathcal{D}_{\theta}(x_T, 0) \approx x_0$ . This inverse process depends on the assumption that  $x_{t-1} - x_t \approx x_{t+1} - x_t$ . Therefore, from  $x_t \to x_{t+1}$ , we follow:
$$
x _ {t + 1} = \sqrt {\bar {\alpha} _ {t + 1}} \hat {x} _ {0} ^ {t} + \sqrt {1 - \bar {\alpha} _ {t + 1}} \epsilon_ {\theta} (x _ {t}).
$$
We denote the whole inversion process from a starting real image  $x_0$  to  $x_{T}$  as  $x_{T} = \mathcal{D}_{\theta}^{\dagger}(x_0)$ .
In this work, we re-purpose DDIM inversion  $\mathcal{D}_{\theta}^{\dagger}$  for watermark detection. Given a generated image  $x_0$  with a starting noise  $x_{T}$ , we apply DDIM inversion to find  $\hat{x}_T$ . We empirically find DDIM's inversion performance to be quite strong, and  $\hat{x}_T \approx x_T$ . While it may not be surprising that inversion is accurate for unconditional diffusion models, inversion also succeeds well-enough for conditional diffusion models, even when the conditioning  $c$  is not provided. This property of inversion will be exploited heavily by our watermark below.
In this section, we provide a detailed description of each layer of Tree-Ring Watermarking.
3.1 Overview of Tree-Ring Watermarking
Diffusion models convert an array of Gaussian noise into a clean image. Tree-Ring Watermarking chooses the initial noise array so that its Fourier transform contains a carefully constructed pattern near its center. This pattern is called the "key." This initial noise vector is then converted into an image using the standard diffusion pipeline with no modifications. To detect the watermark in an image, the diffusion model is inverted using the process described in Section 2.1 to retrieve the original noise array used for generation. This array is then checked to see whether the key is present.
Rather than imprint the key into the Gaussian array directly, which might cause noticeable patterns in the resulting image, we imprint the key into the Fourier transform of the starting noise vector. We choose a binary mask  $M$ , and sample the key  $k^{*} \in \mathbb{C}^{|M|}$ . As such, the initial noise vector  $x_{T} \in \mathbb{R}^{L}$  can be described in Fourier space as
$$
\mathcal {F} \left(x _ {T}\right) _ {i} \sim \left\{ \begin{array}{l l} k _ {i} ^ {*} & \text {i f} i \in M \\ \mathcal {N} (0, 1) & \text {o t h e r w i s e .} \end{array} \right. \tag {2}
$$
For reasons described below, we choose  $M$  as a circular mask with radius  $r$  centered on the low-frequency modes.
At detection time, given an image  $x_0'$ , the model owner can obtain an approximated initial noise vector  $x_T'$  through the DDIM inversion process:  $x_T' = \mathcal{D}_\theta^\dagger(x_0')$ . The final metric is calculated as the L1 distance between the inverted noise vector and the key in the Fourier space of the watermarked area  $M$ , i.e.
$$
d _ {\text {d e t e c t i o n d i s t a n c e}} = \frac {1}{| M |} \sum_ {i \in M} \left| k _ {i} ^ {*} - \mathcal {F} \left(x _ {T} ^ {\prime}\right) _ {i} \right|, \tag {3}
$$
and the watermark is detected if this falls below a tuned threshold  $\tau$ . The process described above is straightforward. However, its success depends strongly on the construction of the "key" pattern, which we discuss below.
3.2 Constructing a Tree-Ring Key
We watermark images by placing a "key" pattern into the Fourier space of the original Gaussian noise array. Our patterns can exploit several classical properties of the Fourier transform for periodic signals that we informally state here.
To reduce confusion we will always describe the generative diffusion process that goes from  $x_{T}$  to  $x_{0}$  as the "reverse process". We use "inverse process" to denote the estimation of the noise vector  $x_{T}$  from the final output  $x_{0}$ .
- A rotation in pixel space corresponds to a rotation in Fourier space.
- A translation in pixel space multiplies all Fourier coefficients by a constant complex number.
- A dilation/compression in pixel space corresponds to a compression/dilation in Fourier space.
- Color jitter in pixel space (adding a constant to all pixels in a channel) corresponds to changing the magnitude of the zero-frequency Fourier mode.
A number of classical watermarking strategies rely on watermarking in Fourier space and exploit similar invariances [Pitas, 1998, Solachidis and Pitas, 2001]. Our watermark departs from classical methods by applying a Fourier watermark to a random noise array before diffusion takes place. Curiously, we will observe below that the invariant properties above are preserved in  $x_{T}$  even when image manipulations are done in pixel space of  $x_0$ .
In addition to exploiting the invariances above, the chosen key should also be statistically similar to Gaussian noise. Note that the Fourier transform of a Gaussian noise array is also distributed as Gaussian noise. For this reason, choosing a highly non-Gaussian key may cause a distribution shift that impacts the diffusion model.
We consider three different types of keys, with the respective benefits of each pattern being demonstrated in subsequent experimental sections. We believe there are numerous other interesting and practical types that can be explored in future work.
Tree-RingZeros: We choose the mask to be a circular region to preserve invariance to rotations in image space. The key is chosen to be an array of zeros, which creates invariance to shifts, crops, and dilations. This key is invariant to manipulations, but at the cost of departing severely from the Gaussian distribution. It also prevents multiple keys from being used to distinguish between models.
Tree-RingRand: We draw the a fixed key  $k^*$  from a Gaussian distribution. The key has the same iid Gaussian nature as the original Fourier modes of the noise array, and so we anticipate this strategy will have the least impact on generation quality. This method also offers the flexibility for the model owner to possess multiple keys. However, it is not invariant to make image manipulations.
Tree-RingRings: We introduce a pattern comprised of multiple rings, and constant value along each ring. This makes the watermark invariant to rotations. We choose the constant ring values from a Gaussian distribution. This provides some invariance to multiple types of image transforms, while also ensuring that the overall distribution is only minimally shifted from an isotropic Gaussian.
3.3 Deriving P-values for Watermark Detection
A key desideratum for a reliable watermark detector is that it provide an interpretable P-value that communicates to the user how likely it is that the observed watermark could have occurred in a natural image by random chance. In addition to making detection results interpretable, P-values can be used to set the threshold of detection, i.e., the watermark is "detected" when  $p$  is below a chosen threshold  $\alpha$ . By doing so, one can explicitly control the false positive rate  $\alpha$ , making false accusations statistically unlikely.
To this end, we construct a statistical test for the presence of the watermark that produces a rigorous P-value. The forward diffusion process is designed to map images onto Gaussian noise, and so we assume a null hypothesis in which the entries in the array  $x_{T}^{\prime}$  obtained for a natural image are Gaussian. We find that this assumption holds quite well in practice, see Figure 7.
For any test image  $x_0'$ , we compute the approximate initial vector  $x_T'$  and then set  $y = \mathcal{F}(x_T')$ . We then define the following null hypothesis
$$
\mathrm {H} _ {0}: y \text {i s d r a w n f r o m a G a u s s i a n d i s t r i b u t i o n} \mathcal {N} (\mathbf {0}, \sigma^ {2} I _ {\mathbb {C}}). \tag {4}
$$
Here,  $\sigma^2$  is an unknown variance, which we estimate for each image using the formula  $\sigma^2 = \frac{1}{M}\sum_{i\in M}|y_i|^2$ . To test this hypothesis, we define the score
$$
\eta = \frac {1}{\sigma^ {2}} \sum_ {i \in M} \left| k _ {i} ^ {*} - y _ {i} \right| ^ {2}. \tag {5}
$$
Our statistical test is only sensitive to Tree-Ring and Tree-Rings. Tree-Rings results in the pathological case that  $\sigma \approx 0$  for watermarked images resulting in overly conservative/large P-values.
P-value  $= 0.27$
No Watermark
Watermarked
3.73e-60
Attacked
"Anime art of a dog in Shenandoah National Park"
7.41e-16
"Synthwave style artwork of a person is kayaking in Acadia National Park"
1.38e-19
1.51e-8
"An astronaut riding a horse in Zion National Park"
0.91
9.91e-51
2.90e-05
"A painting of Yosemite National Park in Van Gogh style"
0.41
Figure 2: The qualitative results show three types of images: non-watermarked, Tree-RingRings watermarked, and attacked watermarked images. A P-value is provided below each image, which corresponds to the probability of the detected watermark structure occurring by random chance. From top to bottom, the watermarked images are attacked by color jitter with a brightness factor of 6, Gaussian blur with an  $8 \times 8$  filter size, Gaussian noise with  $\sigma = 0.1$ , and a  $180^{\circ}$  rotation, respectively.
1.22e-35
9.46e-07
When  $H_0$  is true, the distribution of  $\eta$  is exactly a noncentral  $\chi^2$  distribution [Patnaik, 1949], with  $|M|$  degrees of freedom and non-centrality parameter  $\lambda = \frac{1}{\sigma^2}\sum_i|k_i^*|^2$ .
We declare an image to be watermarked if the value of  $\eta$  is too small to occur by random chance.
The probability of observing a value as small as  $\eta$  is given by the cumulative distribution function  $\Phi_{\chi^2}$  of the noncentral  $\chi^2$  distribution:
$$
p = \Pr \left(\chi_ {| M |, \lambda} ^ {2} \leq \eta \mid H _ {0}\right) = \Phi_ {\chi^ {2}} (z). \tag {6}
$$
$\Phi_{\chi^2}$  is a standard statistical function [Glasserman, 2003], available in scipy and many other statistics libraries.
We show qualitative examples of the proposed watermarking scheme and accompanying P-values in Figure 2. For each prompt, we show the generated image with and without the watermark, and
also a watermarked image subjected to a transformation. For each image, we report a P-value. As expected, these values are large for non-watermarked images, and small (enabling rejection of the null hypothesis) when the watermark is present. Transformations reduce the watermark strength as reflected in the increased P-value.
We perform experiments on two common diffusion models to measure the efficacy and reliability of the Tree-Ring Watermarking technique across diverse attack scenarios. Furthermore, we carry out ablation studies to provide an in-depth exploration of this technique.
We employ Stable Diffusion-v2 [Rombach et al., 2022], an open-source, state-of-the-art latent text-to-image diffusion model, along with a  $256 \times 256$  ImageNet diffusion model [Dhariwal and Nichol, 2021]. In the main experiment, we use 50 inference steps for generation and detection for both models. For Stable Diffusion, we use the default guidance scale of 7.5, and we use an empty prompt for DDIM inversion, emulating that the image prompt would be unknown at detection time. The watermark radius  $r$  we use is 10. Later, we conduct more ablation studies on these important hyperparameters. All experiments are conducted on a single NVIDIA RTX A4000.
In our comparative analysis, we consider four baselines: two training-free methods, DwtDct and DwtDctSvd [Cox et al., 2007]; a pre-trained GAN-based watermarking model, RivaGAN [Zhang et al., 2019, Goodfellow et al., 2014]; and a pre-trained watermarking VAE decoder, used exclusively for Stable Diffusion model experiments, named Stable Signature [Fernandez et al., 2023]. However, these baseline methods are designed for steganography, which conceals a target bit-string within an image. To ensure a fair comparison with our exclusively watermarking method, we employ the distance between the decoded bit-string and the target bit-string (Bit Accuracy) as the measurement metric. The approach of Cox et al. [2007] is currently deployed as a watermark mechanism in Stable Diffusion<sup>4</sup>.
4.2 Benchmarking Watermark Accuracy and Image Quality
To benchmark the effectiveness of the watermark, we primarily report the area under the curve (AUC) of the receiver operating characteristic (ROC) curve, and the True Positive Rate when the False Positive Rate is at  $1\%$ , denoted as  $\mathsf{TPR}@\mathsf{1}\% \mathsf{FPR}$ . To demonstrate the generation quality of the watermarked images, we assess the Frechet Inception Distance (FID) [Heusel et al., 2017] for both models. Additionally, for the Stable Diffusion model, we also evaluate the CLIP score [Radford et al., 2021] between the generated image and the prompt, as measured by OpenCLIP-ViT/G [Cherti et al., 2022]. For AUC and  $\mathsf{TPR}@\mathsf{1}\% \mathsf{FPR}$ , we create 1,000 watermarked and 1,000 unwatermarked images for each run. For FID, we generate 5,000 images for Stable Diffusion and 10,000 images for the ImageNet Model. The FID of Stable Diffusion is evaluated on the MS-COCO-2017 training dataset [Lin et al., 2014], and the FID of the ImageNet Model is gauged on the ImageNet-1k training dataset [Deng et al., 2009]. All reported metrics are averaged across 5 runs using different random seeds following this protocol.