Deep Watermarks for Attributing Generative Models
Authors: Guangyu Nie
Changhoon Kim
Yezhou Yang
Yi Ren
Venue: Submitted to ICLR 2023 (2023)
Keywords: Model Attribution
Watermarking
Generative Models

Abstract: Generative models have enabled the creation of contents that are indistinguishable from those taken from the Nature. Open-source development of such models raised concerns about the risks in their misuse for malicious purposes. One potential risk mitigation strategy is to attribute generative models via watermarking. Current watermarking methods exhibit significant tradeoff between robust attribution accuracy and generation quality, and also lack principles for designing watermarks to improve this tradeoff. This paper investigates the use of latent semantic dimensions as watermarks, from where we can analyze the effects of design variables, including the choice of watermarking dimensions, watermarking strength, and the capacity of watermarks, on the accuracy-quality tradeoff. Compared with previous SOTA, our method requires minimum computation and is more applicable to large-scale models. We use StyleGAN2 and the latent diffusion model to demonstrate the efficacy of our method.

Under review as a conference paper at ICLR 2023
DEEP WATERMARKS FOR ATTRIBUTING GENERATIVE MODELS
Anonymous authors Paper under double-blind review
ABSTRACT
Generative models have enabled the creation of contents that are indistinguish- able from those taken from the Nature. Open-source development of such models raised concerns about the risks in their misuse for malicious purposes. One po- attribute generative models via watermarking. Current watermarking methods exhibit significant tradeoff between robust attribu- tion accuracy and generation quality, and also lack principles for designing water- marks to improve this tradeoff. This paper investigates the use of latent semantic dimensions as watermarks, from where we can analyze the effects design vari- ables, including the choice of watermarking dimensions, watermarking strength, and the capacity of watermarks, on the iccuracy-quality tradeoff. Compared with previous SOTA, method requires minimum compute and is more applicable large-scale models. We use StyleGAN2 and the latent diffusion model to demon- strate the efficacy of our method.
tential risk mitigation strategy
INTRODUCTION
Generative models can now create synthetic contents such as images and audios that are indistin- guishable from those taken from the Nature (Karras al., 2020, Rombach et al., 2022 Ramesh et al., 2022; Hawthorne et al. 2022). This pose serious threat when used as malicious attempt, such disinformation (Breland] 2019) and malicious impersonation (Satter, 2019). Such potential threats delays the industralization process of the generative model, as conservative model inven-
tors hesitate release their source code (Yu et al. (2200). For example in 2020, OpenAl refused to release the source code of their GPT-2 (Radford et al. (019)) model due to concerns over poten- tial malicious attempts Brockman et al. (2020), additionally, the source codes DALL-E Ramesh ctt al. [202I) and DALL-E E 2 (Ramesh et 2022) are also not released for the same reason Mishkin & Ahmad (2022).
One of the potential means of solution is model attribution YYu et al. 2018 Kim et al. 2020 Yu cct al., 2020), where a model distributor tweaks each user-end model so that they generate contents with model-specific watermarks. In practice, or regulator maintain a database of user specific keys which corresponds to each users' downloaded model. When malicious attempts has been made, the regulator will be able to identify the user that's responsible for such attempts by attribution. Additionally, we assume the distributed model white-box, which potentially makes separate watermarking module appended on top of the generator trivial, as malicious user can simply remove such module from the network. Instead, we propose deep watermarking method that is free from this limitation by embedding the watermarking module directly into the generative model itself.
consider the scenario where the model distributor
Formally, let a set of n generative models be 9 = (-)(-) where gi(-) Rdd. - dR is a mapping from an -asyleo distribution P= to watermarked data distribution Pr.; in the content space,
and is parameterized by binary-coder key &; E + := {0, 1344 Let f(-) : Rd= - + be mapping that attributes contents to their source models. We consider four performance metrics of watermarking mechanism: The attribution accuracy of y; is defined as
A(g:) = Ez-p. (f) = =+)+]
(1)
The generation quality of g. measures the difference between Pv.; and the data distribution used for learning G, e.g., the Fréchet Inception Distance (FID) score (Heusel et al. 2017) for images.

---

Under review as a conference paper at ICLR 2023
Watermarked latent var.
W O
Φ1
Original
Bascline
Our Method
g
Φ
+0
Shared
Watermark estimation
generator
(a)
Difference from Original
(b)
Figure I: (a) Visual comparison between deep watermarking (our method) and shallow watermark- ing (Kim et al. 2020). Our method uses subtle semantic changes, rather than strong noises, to maintain attribution accuracy against image postprocesses. (b) Schematic of deep watermarking: The same generator and watermark estimator f are used for all watermarked models. Our method thus requires minimal compute and is scalable to large latent diffusion models.
Inception score (IS) Salimans al. (2016) also measured for Pa,s as additional generation quality metrics. Watermark secrecy IS measured by the mean peak comnalltt-noise ratio (PSNR) of individual images drawn from Pr.i- Compared with generation quality, this metric focuses on how obvious watermarks are rather than how well two content distributions match. Lastly, the watermark capacity 24e
Existing watermarking methods exhibit significant tradeoff' between attribution accuracy and gener- ation quality (and watermark secrecy), particularly when countermeasures against dewatermarking attempts, e.g., image postprocesses, are taken into consideration. For example, Kim et al. (2020) use shallow watermarks for image generators the form of gx()) = go(2) + o, where (o is an unwatermarked model, and show that ois have to significantly alter the original contents achieve
good attribution accuracy against image blurring, causing unfavorable drop in generation quality and watermark secrecy (Fig. (a)).
To improve this tradeoff, we investigate in this paper deep watermarks in the form of (1(((2) + (.) - -g)((())), where :- (=) Rdw contains disentangled semantic dimensions that allow smoother mapping to the content space (Fig. Tp. Such ve has been incorporated in popular models such StyleGAN (SG) (Karras al.) 2019 2020), where
the style vector, and latent diffusion models(LDM) (Rombach et al. 2022), where w comes from a diffusion process. Existing stud- ies on semantic editing showed that dh consists of linear semantic dimensions (Härkönen et al., 2020 Zhu et al. 2021). Inspired by this, we hypothesize that using subtle yet semantic changes as watermarks will improve the robustness of attribution accuracy against image postprocesses, and thus investigate the performance of deep watermarks that are generated by perturbations along latent dimensions dd.... Specifically, we consider latent dimensions as eigenvectors of the covariance matrix of the latent distribution Pw, denoted by Σ..
Contributions. (1) We propose a novel intrinsic watermarking strategy that directly embed the wa- termarking module into the generative model, as distribution (2) We prove and empirically verify that there exists an intrinsic tradeoff between attri- bution accuracy and generation quality. This tradeoff is affected by watermark variables including the choice of the watermarking space, the watermark strength, and its capacity. Parametric stud- ies these variables for StyleGAN2 (SG2) and Latent Diffusion Model(LDM) lead to improved accuracy-qualits tradeoff from previous SOTA. In addition, our method requires negligible compute compared with previous SOTA, rendering it more applicable to popular large-scat scale models, includ- ing latent diffusion ones. (3) We show that using a cirtprocess-speciff LPIPS metric for model attribution leads further improved attribution accuracy against image postprocesses.
to achieve responsible white-box model
RELATED WORK
Model attribution through watermark encoding and decoding. Yu et al. (2000) propose to en- code binery-coded keys into images through (=(2) go[[2, Φt)) and decode them via another learnalle function. This requires joint training the encoder and decoder over Rd x to em- pirically balance attribution accuracy and generation quality. Since watermark capacity is usually
2

---

Under review as a conference paper at ICLR 2023
high (i.e., 2d,), training is made tractable by sampling only small subset of watermarks. Thus this method is computationally expensive and lacks a principled understanding of how the watermarking mechanism affects the aceuracy-qualit tradeoff. In contrast, method does not require any addi- tional training and mainly relies on simple principle component analysis of the latent distribution.
Certifiable model attribution through shallow watermarks, Kim al. (2020) propose shallow (2) = 9o(2) + d; and linear classifiers for attribution. These simplifications allow the derivation of sufficient conditions of & achieve certifiable attribution of G. Since the watermarks are added as noises rather than semantic changes coherent with the generated contents, high water- mark strength becomes necessary to maintain attribution accuracy under postprocesses. While this paper does not provide attribution certification for deep watermarks, we discuss technical feasibility and challenges achieving this goal.
watermarks
StyleGAN and low-rank subspace. Our study focuses on popular image generation models which share an architecture rooted from SG: A uniform distribution is first transformed into a latent distri- bution (Pw). samples from which are then decoded into images. HHärkönen et al. (2020) apply prin- cipal component analysis on pn: distribution and found semantically meaningful editing directions. Zhu et al. (202T) use local Jacobian (Vwgg) to derive perturbations that enable local semantic editing of generated images, and show that such semantic dimensions are shared across the latent space. In this study, we show that the mean of the Gram matrix for local editing (Ew-~p [V gl)))
and the covariance of w (Ew) are qualitatively similar in that both reveal major to minor semantic dimensions through their eigenvectors.
GAN inversion. The model attribution problem can be formulated as GAN inversion problem. A learning based inversion (Perarnau et al. 2016 Bau al. 2019) optimizes parameters of encoder network which map a image to latent code z. On the other hand, optimization based inversion (Abdal al. 2019 Huh et al., 2020) solve for latent code v that minimizes distance metric between a given image and generated image g(2). The learning based method is computationally more efficient in the inference stage comparing to optimization based method. However, optimization based GAN inversion achieves superior quality of latent interpretation, which can be referred to as the quality- time trade-off (Xia et al.] 2022). In our method, we utilized the optimization based inversion, as faithful latent interpretation is critical in our application. To further enforce faithful latent interpre- tation, we incorporate existing techniques, e.g., parallel search, to solve this non-convex problem, but uniquely exploit the fact that watermarks small latent perturbations to enable analysis on the eecuracy-quality tradeoff.
3 METHODS
3.1 NOTATIONS AND PRELIMINARIES
Notations. For x E TR and A E Raxm denote by proj z the projection of x to span( (A), and by Al the pseudo inverse of A. For parameter a, we denote by à its estimate and e, = â a the error. v. f is the gradient of f with respect to x. Eg [-] is an expectation over Px. and tr Br(B) (resp. det( B)) is the trace (resp. determinant) of B E R"*" dAag(A) E Rax= diagonalizes À E R".
Deep watermarks. All contemporary generative models, e.g., SG2 and LDM, consist of a disen- tanglement mapping to R.d. -> Rd from an easy-to-sample distribution p= to a latent distribution pw: followed by generator g : R.d. -> Rdd that maps w to the content space. In particular, s) is multilayer perception network in SG, and a diffusion process in diffusion model. Existing studies showed that linear perturbations along principal components of V w enables semantic edit- ing, and such perturbation directions are often applicable over ~ Pu. (Härkönen et al. 2020 Zhu et al. 2021). Indeed, instead of local analysis on the Jacobian, Härkönen et al. (2020) showed that principal component analysis directly Pa also reveals semantic dimensions. This paper follows these existing findings and uses a subset of semantic dimensions as watermarks. Specifically, let
U E Rd (d... da) and V E idd be orthonormal and complementary. Given random seed dRd. user-specific key è E 1Rdo and strength E R, let U U'projy E d do the
watermarked latent variable is
wa(a)= Ua oVa,
(2)
3

---

Under review as a conference paper at ICLR 2023
where Pa: and Pa is induced by Pw- Then, user can generate watermarked images, (())(a)). The choice of (U, V) and a affects the attribution accuracy and generalization performance, which analyze in Sec. 3.2
Attribution. To decode user-specific key from the image g( (a)), we formulate an optimization problem:
min (o(laa())),owaa) 6.
s.t. à₃ E au,ll Vi 11 dg-
Through experiments, we discovered that attribution accuracy can be improved by constraining a. Here the upper and lower bounds of a are chosen based on the empirical limits observed from Pa- While l2 norm is used for analysis in See 3.2 here we minimize LPIPS (Zhang et al. 2018) which measures the perceptual difference between two images. In practice, we introduce a penalty on & with large enough Lagrange multipliers and solve the resulting unconstrained problem. To avoid convergence to unfavorable local solutions, we also employ parallel search with n initial guesses of drawn through Latin hypercube sampling (LHS).
3.2 ACCURACY-QUALITTY TRADEOFF
Attribution accuracy. Define Ju Vg(w). H = JT Let H = Eurp.. [Hu] be the mean Gram matrix, and He = Earp. [Hw, be its watermarked version. Let L Rd x Rd + R be distance metric between two images, (å, ②) the estimates. To analyze how (V.U) affects the attribution accuracy, we use the following simplifications and assumptions: (A1) I(:,)) is the l2 norm. (A2) Both ||ca:]| and a are small. In practice we achieve small ||<a|| through parallel search (see Appendix BB. (A3) Since our focus is on cg. we further assume that the estimation of a, denoted by á()), is independent from 6, and ca is constant. This allows us to ignore the subroutine for computing (())) and turns the estimation problem Formally, we have the following proposition (see Appendix[A.]]il proof):
optimization with respect only ca-
Proposition 1. 3e O such that if S c and ||ca|12 c, the watermark estimation problem
min 3
Eampa (l((z(((()))) g(ws(a))11
has an error c== = (ATTHAV--VVI - HgUC.
reduce ||Ep|| by maximizing det(V' H. V), which sets columns of V as the eigenvectors associated with the largest dø eigen- values of Ha. However, He is neither computable because & is unknown during the estimation, nor it tractable because (a)(a) is large in practice. To this end, we propose to use the covariance of Pw. denoted by Ew, to replace H& in experiments. In Appendix C we support this approximation empirically by showing that E.,. and H., (the non-watermarked mean Gram matrix) are qualitatively similar in that the principal components of both matrices offer disentangled semantic dimensions.
Remarks: (1) Similar to classic design of experiment,
(2) Let the kth largest eigenvalue of H. be Tkk By setting columns V as the eigenvectors of H. associated with the largest dg eigenvalues, and by noting that & is accurate only when all of its elements match with & (equation D. the worst-case estimation error is governed by Ti, This means that higher key capacity, i.e., larger dg. leads to worse attribution accuracy. (3) From the proposi- tion, = 0 if V and U are complementary sets of eigenvectors of Hg. In practice this decoupling between eg and ca cannot be achieved due to the assumptions and approximations we made.
Generation quality. For analysis purpose, we approximate the original latent distribution Pw by ((, diag(>u:) 3 (N diag(Av)), and f E Ennpp [w].
14 Ua V where Au Rd -d and λy E RRds are calibrated match Pw- Denote λv.maz max, max,{dv.sk A latent vVo. With mild abuse
distribution watermarked by Ø is similarly approximated as ws of notation, let g be the mapping from the latent space to a feature space (usually defined by an Inception network in FID) and is continuously differentiable. Let the mean and covariance matrix of we be 14, and E,, respectively. Denote by Hy = Fa JutUal the mean Gram matrix in the subspace of U, and let mam be the largest eigenvalue of Hr. We have the following proposition to upper bound I| 1nl 112 and [tr(En) tr(2) (E,)]. both of which are related to the FID score for measuring the generation quality (see Appendix A.2 for proof):
4

---

Under review as a conference paper at ICLR 2023
Original Image
Watermarked Image
Differences
Original Image
Watemmarked Image
Differences
StyleGAN2
LDM
(a) Watermarking along Minor PCs
(b) Watermarking along Major PCs
Visualization of watermarks along minor and major principal components of the covari- ance of the latent distribution. (Top) StyleGAN2. (Bottom) Latent Diffusion Model (LDM).
Figure 2:
Proposition 2. For any 0 and v) (0, and dv, S cTT, 1) ()) for all i = 1,..,,,...,.....,, dæ. then l|mo - n41 12 S o ". dØ + v and [ur(E - En) AVmax ds + 2vo V + with probability at least
3 3c(T, 0 and O, such that if c(T,
Remarks: Recall that for improving attribution accuracy, practical approach is choose as eigenvectors associated with the largest eigenvalues of Ew. Notices that with the approximated distribution with a ~ NN(0, diag(Au) and B NN0 diag(Ay)). En diag([X] X On the other hand, from Proposition 2, generation quality improves if we minimize AVmaz by choosing V according to smallest eigenvalues Enp. In addition, smaller key capacity (dæ) and lower strength (o) also improve the generation quality. Propositions I and 2 together reveal the intrinsic qucuricy-quality tradeoff.
Watermark secrecy. Lastly, the analysis watermark secrecy is straight forward using the same proof techniques: note that PSNR is a monotonically decreasing function of the MSE [[ + Ua) - +Ua VV and therefore of watermark variables on secrecy (proof in Appendix A.3):
the following proposition to analyze the effect
Proposition 3. For any 0, 3 e(T) such that if c(T).
Earpa [[g(H + Ua) - g(p
Ua + oV) S 0² U. + T.
EXPERIMENTS
In this section, we present empirical evidence of the accuracy-qualit tradeoff and show improved tradcoff from previous SOTA by using deep watermarks. Experiments are conducted for both with and without combination of postprocesses including (image noising, blurring, and JPEG compres- sion transformation, and their combination).
4.1 EXPERIMENT SETTINGS
Models, data, and metrics. We conduct experiments on SG2 (Karras et al. (020) and LDM (Rom- bach al. 2022) models trained on various datasets including FFHQ (Karras al. 2019), AFHQ- Cat, and A AFHQ-Dog (Choi et al., 2020). Generation quality is measured by the Frechet Inception distance (FID) (Heusel et al.) 2017) and inception score (IS) (Salimans et al.. 2016), attribution accuracy by equation and watermark secrecy by PSNR.
Deep watermark dimensions. The dimensions the semantic latent spaces of SG2 and LDM are 512 and 12.288, respectively. For both models we approximate En using 10K samples drawn from Pw. We define watermark dimensions V as a subset eigenvectors of Ew associated with consecutive eigenvalues: V := PC(i 5), where PC is the full set of principal components of Σ,, sorted by their variances in the descending order, and and j represent the starting and ending indices of the subset.
Attribution. To compute the empirical accuracy, we use IK samples drawn from Pz for each wa- termark o, and use 1K watermarks where each bit is drawn independently from Bernoulli distri-
5

---

Under review as a conference paper at ICLR 2023
bution with p 0.5. In Table we show that both constraints on å and parallel search with 20 initial guesses improve the empirical attribution accuracy across models and datasets. Notably, con- strained estimation is essential for successful attribution of LDMs. In these experiments, V is chosen as the eigenvectors associated with the 64 smallest eigenvalues of En as a worst-case scenario for attribution accuracy.
Table I: Attribution accuracy and generation quality of the proposed method. FID-BL is the baseline FID score. t (4) indicates higher (lower) desired. Standard deviation in parenthesis.
Model
Dataset
Attribution Accuracy
Image Quality
Ours
w/o a-reg
w/o LHS
FID-BL.
FID
IS 1
PSNR 1
SG2
FFHQ
0.983
0,877
0.711
7.24
8.59
4.96
32.5 (1.65)
SG2
AFHQ Cat
0.993
0.991
0.972
6.35
7.87
12.39
38.14 (1.79)
SG2
AFHQ Dog
0.999
0.998
0.981
3.80
5.36
12.39
37.7 (1.91)
LDM
FFHQ
0.996
0.364
0.872
12.34
13.63
4.35
31.22 (1.90)
4.2 ATTRIBUTION PERFORMANCE WITHOUT POSTPROCESSING
We present generation quality results in Table Since the least variant principal components are used as watermarks, generation quality (FID) and watermark secrecy (PSNR) are preserved. We note that PSNR value 2 30 db is conventionally considered as acceptable for watermarks (Mahto & Singh 2021). The results suggest that when image postprocesses are not considered as a potential threat model, the attribution accuracy, generation quality, capacity (2%4), and watermark secrecy all acceptable using the proposed method. Fig. 2 visualizes and compares deep watermarks gener- ated from small vs. large eigenvalues of E Watermarks corresponding small eigenvalues non-semantic, while those to large eigenvalues create semantic changes. We will later show that semantic yet subtle (perceptually insignificant) watermarks are necessary counter image postpro- cesses.
Accuracy-quality tradeoff. Table 2 summarizes the tradeoff when we vary the choice of V and the strength a, while fixing the watermark length dg to 64. Then in Table 3 we sweep de while keeping V as PCs associated with smallest eigenvalues of Enr and conducted on SG2 and LDM on the FFHQ dataset. The empirical results in Table [ are consistent with our analysis: Accuracy decreases while generation quality improves when V is moved from major to minor principal components. For watermark strength, however, we observe that the positive effect of strength on the accuracy, as predicted by Proposition] [ is only limited to small a. This because larger causes pixel values to go out of bound, causing loss of information. In Table 3 we summarize the attribution accuracy, FID, and PSNR score under 32- to 128-bit keys. Accuracy and generation quality, in particular the latter, both affected by dø predicted.
The experiments are
4.3
WATERMARK PERFORMANCE WITH POSTPROCESSING
We now consider more realistic scenarios where generated images are postprocessed, either mali- ciously attempt remove the watermarks unintentionally, before they attributed. Under this setting, our method achieves better accuracy-quality tradeoff than shallow watermarking under two realistic settings: (1) when noising JPEG compression are used as unknown postprocesses, and (2) when the set of postprocesses, rather than the ones that are actually chosen, is known.
Postprocesses. To keep our solution realistic, we solve the attribution problem by assuming that the potential postprocesses are unknown:
min à.
s.t. âg E (aa,,, Vi= I,.,,, dg.
where T Rd -> Rd a postprocess function, and ([g(wa(a)) is a given image from which the watermark is be estimated. We assume that T does not change the image in semantically meaningful way, because otherwise the value of the image for either an attacker or benign user will be lost. Since method adds semantically meaningful perturbations to the images, we expect such

---

Under review as a conference paper at ICLR 2023
Table Tradeoff between attribution accuracy (Att.) and generation quality (FID, IS) under differ- ent watermarking directions (PC) and strength (o))
StyleGAN2
σ = 0.6
J = 1.0
0 6.0
Att. f
FID 4
IS 1
Att. 1
FID 4
IS
Att.
FID
IS 1
PC[0:64]
0.99
129.0
1.23
0.99
110.8
1.59
0.99
101.3
4.31
PC[128:192]
0.98
8.5
4.93
0.99
8.7
4.92
0.99
39.2
3.94
PC[256:320]
0.98
8.6
4.96
0.99
9.1
4.87
0.96
31.1
3.90
PC[448:512]
0.97
8.1
4.99
0.98
8.5
4.96
0.90
26.3
4.75
LDM
σ
1.0
2.0
O
3.0
Att. t
FID 4
IS 1
Att. f
FID 4
IS f
Att. 1
FID 4
IS f
PC[0:64]
0.99
33.62
3.84
0.99
33.17
3.70
0.99
34.07
3.82
PC[1000:1066
0.77
13.32
4.37
0.99
13.75
4.40
0.99
16.03
4.35
PC[2000:2064]
0.32
13.17
4.45
0.99
13.63
4.35
0.99
15.74
4.34
PC[3000:3064]
0.12
12.98
4.43
0.97
13.61
4.45
0.99
15.44
4.48
PC[4000:4064]
0.00
12.77
4.35
0.96
13.61
4.42
0.99
15.41
4.41
Table 3: Attribution accuracy and generation quality for different watermark lengths. FID-BL is baseline FID score. Standard deviation is in parenthesis. t (L) indicates higher (lower) is desired. Standard deviation parenthesis.
Key Length
Accuracy
FID-BL
FID 4
PSNR +
IS t
32
0.982
7.24
8.49
36.3 (1.94)
4.90
64
0.983
7.24
8.59
32.5 (1.65)
4.96
96
0.981
7.24
9.50
29.2 (1.95)
4.93
128
0.973
7.24
9.61
27.07 (1.80)
4.91
deep watermarks to be more robust postprocesses than shallow ones added directly images, and will lead to improved attribution accuracy. To test this hypothesis, we consider four types of postprocesses: Noising, Blurring, JPEG and Combo. Noising adds Gaussian white noise of standard deviation randomly sample from U(O,, 0.1]. Blurring uses randomly selected Gaussian kernel size from [3, 16, 25] and standard deviation of [0.5, 1.0, 1.5, 2.0]. We randomly sample the JPEG quality from [80, 70, 60, 50]. These parameters are chosen to be mild so that images do not lose their semantic contents. And Combo randomly chooses a subset of the three through a binomial distribution with 0.5 and uses the same postprocess parameters.
Modified LPIPS metric. In addition to testing the worst-case scenario where postprocesses are completely unknown, we also consider cases where they are known. While this is unrealistic for individual postprocesses, it is worth investigating when we assume that the set postprocesses, rather than the ones that are actually chosen, is known. Within this scenario. show that modi- fying LPIPS according to the postprocess improves the attribution accuracy. To explain, LPIPS is originally trained so-called "two alternative forced choice" (2AFC) dataset. Each data point of 2AFC contains three images: a reference, Po. and Pl, where po and pı are distorted in different ways based the reference. A human evaluator then ranks pn and pi by their similarity the reference. Here we propose the following modification to the dataset for training a postprocess-specine met- rics: Similar 2AFC, for each data point, we draw a reference image r from the default generative model to be watermarked, and define Po as the watermarked version of x. is then a postprocessed version of given specific T (or random combinations for Cembo). To match with the setting of 2AFC, we sample 64 x 64 patches from I, Po. and P1 as training samples. We then rank patches from P1 as being more similar to those r than po- With this setting, the resulting LPIPS metric becomes more sensitive to watermarks than mild postprocesses. The detailed training of the modi- fied LPIPS follows the vgg-lin configuration in Zhang et al. (2018). It should be noted that unlike previous SOTA where watermarks Kim et al. (2020) mecoderddecoder models Yu et al. (2020) retrained based on the known attacks, our watermarking mechanism, and therefore generalization performance, agnostic to postprocesses.
7

---

Under review as a conference paper at ICLR 2023
Blar
JPRG
Combiration
Neoo
Combination
Original
Wotemmatedd
For procested
Diffoenss
(a) Our Method
(b) SG2-BL
Figure 3: Comparison on generation quality between our method and the baseline with sim- ilar attribution accuracy The first row shows original images generated without watermarking. Each images in the second row represents robustly watermarked images against corresponding post- processes. The next row illustrates post-processed images. The last row depicts the differences between original (the first row) and watermarked images (the second row) using heatmap. Even if our method shows large pixel value changes, the watermarks are not perceptible comparing with baseline method (see second row).
Accuracy-quality tradeoff. We summarize watermark performance metrics SG2 and FFHQ in Table 4 The attribution accuracy reported here are estimated using the strongest parameters of each attack. For Combo,
as deter- ministic worst-case attack. To estimate attribution accuracy, we solved the estimation problem in equation 4.3 where postprocesses are applied. The proposed method: We choose V subset of 32 consecutive cigenvectors of Ew starting from the 1th, 17th, and 33th eigenvectors, denoted respectively by PC[0:32], PC[16:48], and PC[32:64] in the table. Watermarking strength set to 3. Attribution results from both standard and a postprocess-speccffi I.PPSS metric are reported in the UK (unknown) and KN (known) columns, respectively. Accuracies for our method are com- puted based on 100 random watermark samples from 232, each with 100 random generations. The baseline: We compare with a shallow watermarking method from Kim et al. (200 (denoted by BL). When the postprocesses are known, BL performs postprocess-specite computation to derive shallow watermarks that are optimally robust against the known postprocess. Results in UK and KN columns for BL respectively without and with the postprocess-spechie watermark computation. BL accuracies are computed based on 10 watermarks, each with 100 random generations.
sequentially apply BwlurringtNosiinneee
It is worth noting that the shallow watermarking method is not scalable ours, and increasing the key capacity decreases the overall attribution accuracy (see (Kim et al.] 2020)). Also recall that the key length affects attribution accuracy (Proposition 1). Therefore, we conduct fairer comparison to highlight the advantage of our method. Here we choose subset of watermarks PC|32 40] (256 watermarks) and report performance in Table where accuracies are computed using the same settings as before. Visual comparisons between our method (PC 40)) and the baseline can be found in Fig. To maintain attribution accuracy, high strength shallow watermarks, in the form of color patches, are needed around eyes and noses, and significantly lower the generation quality. In comparison, our method uses semantic changes that are robust to postprocesses. The choice of the semantic dimensions, however, need to be carefully chosen for the watermark to be perceptually subtle.
Watermark secrecy. In all experiments, method has worse watermark secrecy than the baseline according to PSNR. This is because PSNR measures pisel-wise differences, and thus does not favor semantic changes in our method. Nonetheless, when compared with the baseline, because subtle semantic changes across images are harder to be recognized (and thus removed) than common artifacts brought by shallow watermarking (see Fig. 3
argue that our method have better secrecy
8

---

Under review as a conference paper at ICLR 2023
Table 4: Comparison on accuracy-quality tradeoff between proposed and baseline methods under image postprocesses. StyleGAN2 and FFHQ. Watermarking strength a = 3. The FID score of
baseline method 96.24. KN (UK) stands for when attributability measured with (without) the knowledge of attack. Standard deviation is in parenthesis.
Metric
Model
Blurring UK
Noising UK
JPEG
Combo
KN
KN
UK
KN
UK
KN
BL
0.85
0.88
0.85
0.87
0.87
0.89
0.83
0.88
Att.
PC[0:32]
0.79
0.99
0.99
0.99
0.98
0.99
0.82
0.99
PC[16:48]
0.56
0.92
0.95
0.99
0.98
0.99
0.42
0.88
PC[32:64]
0.32
0.83
0.93
0.98
0.98
0.99
0.26
0.79
BL
21.36 (1.51)
21.57 (1.88)
21.44 (1.64)
22.49 (1.57)
PSNR
PC[0:32]
10.70 (0.56)
10.70 (0.56)
10.70 (0.56)
10.70 (0.56)
PC[16:48]
13.56 (1.81)
13.56 (1.81)
13.56 (1.81)
13.56 (1.81)
PC[32:64]
14.52 (1.31)
14.52 (1.31)
14.52 (1.31)
14.52 (1.31)
BL
2.86
3.02
2.91
2.90
IS f
PC[0:32]
2.93
2.93
2.93
2.93
PC[16:48]
4.35
4.35
4.35
4.35
PC[32:64]
4.50
4.50
4.50
4.50
BL
99.05
93.04
97.70
100.15
FID 4
PC[0:32]
102.26
102.26
102.26
102.26
PC[16:48]
31.25
31.25
31.25
31.25
PC[32:64]
27.50
27.50
27.50
27.50
Table Accuracy-quality tradeoff under Combo attack. V defined as the 8, 16, and 32 eigenvectors of Er starting from the 33th eigenvectors. measured with (without) knowledge of attack. Standard deviation is in parenthesis.
KN (UK) stands for When attributability is
Model
Key length
UK
KN
FID.
PSNR 1
IS 1
BL
N/A
0.83
0.88
100.15
22.49 (1.57)
2.90
PC[32:40]
0.65
0.89
12.35
21.11 (2.07)
4.75
PC[32:48]
16
0.45
0.85
13.25
18.56 (1.91)
4.86
PC[32:64]
32
0.26
0.79
27.50
10.70 (0.56)
4.50
CONCLUSION
This paper investigated deep watermark as a solution to enable the attribution of generative mod- els. Our solution achieved better tradeoff between attribution accuracy and generation quality than the previous SOTA that uses shallow watermarks, and also has extremely low computational cost compared to SOTA methods that require encoder-decoder training with high data complexity, dering our method more scalable to attributing large models with high-dimensional latent spaces. Limitations and future directions: (1) There is currently lack of certification on the attribu- tion accuracy due to the nonlinear nature of both the watermarking and the watermark estimation processes. Formally, by considering both the generation and estimation processes as discrete-tima dynamics, such certification would require forward reachability analysis of watermarked contents and backward reachability analysis of the watermark, e.g., convex approximation of the support of Pz.; and ø. is worth investigating whether existing neural net certification methods can be applied. (2) Our method extracts watermarks from the training data. Even with feature decomposition, the tradeoff
amount features that can be used as watermarks limited. Thus the accuracy-qualle governed by the data. It would be interesting to see if auxiliary datasets can help to learn novel and perceptually insignificant watermarks that are robust against postprocesses, e.g., background patterns.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Rameen Ahdal, Yipeng Qin, and Peter Wonka. Image2stylegan: How to embed images into the stylegan latent space? In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4432-4441, 2019.
David Bau, Jun- Yan Zhu, Jonas Wulff, William Peebles, Hendrik Strobelt, Bolei Zhou, and Antonio Torralba. Inverting layers of large generator. ICLR Workshop, volume 2, pp. 4, 2019.
Ali Breland. The bizarre and terrifying case of the "deepfake" video that helped bring an african nation to the brink. motherjones, Mar 2019. Fitics//019/// hetpe///eo0//////eaaaa-eeeeeeee wwwaabon-aii--onn -tt--aaaaaaaaa-boooooooooooooooo
com /poo
Andrew Brock, Jeff Donahue, and Karen Simonyan. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv: /096, 2018.
Greg Brockman, Mira Murati, Peter Welinder, and OpenAl. Openai api, 2020. URL https:
Yunjey Choi, Youngjung Uh Jaejun Yoo, and Jung-Wor Ha. Stargan v2: Diverse image synthesis for multiple domains. In Proceedings the IEEE/CVF conference on computer vision and pattern recognition, pp. 8188-8197, 2020.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei. Imagenet: A large-scate scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255. leee, 2009.
Erik Härkönen, Aaron Hertzmann, Jaakko Lehtinen, and Sylvain Paris. Ganspace: Discovering interpretable gan controls. Advances in Neural Information Processing Systems, 33:9841-9850, 2020.
Curtis Hawthorne, Ian Simon, Adam Roberts, Neil Zeghidour, Josh Gardner, Ethan Manilow, and Jesse Engel. Multi-instrument music synthesis with spectrogram diffusion. arXiv preprint -XXi:22066005005 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge local nash equilibrium. In Advances in Neural Information Processing Systems, pp. 6626-6637, 2017.
Minyoung Huh, Richard Zhang, Jun- Yan Zhu, Sylvain Paris, and Aaron Hertzmann. Transforming and projecting images into class-conditional generative networks. In European Conference Computer Vision, pp. 17-34. Springer, 2020.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 4401-4410, 2019.
Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyz- ing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference computer vision and pattrrn recognition, pp. 8110-81 2020.
Changhoon Kim, Yi Ren, and Yezhou Yang. Decentralized attribution of generative models. arXiv preprint arXiv:2010.1399 2020.
Dhiran Kumar Mahto and Amit Kumar Singh. A survey of color image watermarking: State-of-the- art and research directions. Computers & Electrical Engineering, 93: 107255, 2021.
Pamela Mishkin and Lama Ahmad, Dall-e preview risks and limitationss, 2022. URL https: md
Guim Peramau, Joost Van De Weijer, Bogdan Raducanu, and Jose M Álvarez. Invertible conditional gans for image editing. arXiv preprint arXiv: 1.06555, 2016.
Alec Radford, Jeff Wu. Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models unsupervised multitask learners. 2019.
10

---

Under review as a conference paper at ICLR 2023
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and llya Sutskever. Zero-shot sext-to-image generation. In International Conference on Machine Learning. pp. 8821-8831 PMLR, 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06123 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Con- ference Computer Vision and Patlern Recognition (CVPR), pp. 10684-10695, June 2022.
Tim Salimans, Ian Goodfellow, Wojeiech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. In Advances in neural information processing systems, pp. 2234-2242, 2016.
Raphael Satter. Experts: Spy used ai-generated face connect with targets. Experts: Spy used Al-gemerated face to connect with targets, Jun 2019. URL https:t/apnewss: cttp///ppwws.cc//c2222///c com/bc2f]
9097a4c4fffaa00655 6770000
Weihao Xia, Yulun Zhang, Yujiu Yang, Jing-Hao Xue, Bolei Zhou, and Ming-Hsuan Yang. Gan
inversion: A survey. IEEE Transactions Pattern Analysis and Machine Intelligence, 2022.
Ning Yu, Larry Davis, and Mario Fritz. Attributing fake images to gans: Analyzing fingerprints in generated images. arXiv preprint arXiv: / 08, 2018.
Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting. arXiv preprint arXiv:2012.08726. 2020.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 586-595, 2018.
Jiapeng Zhu, Ruili Feng, Yujun Shen, Deli Zhao, Zheng-Jun Zha, Jingren Zhou, and Qifeng Chen. Low-rank subspaces in gans. Advances in Neural Information Processing Systems, 14:16648- 16658, 2021.

---

Under review as a conference paper at ICLR 2023
A PROOF OF PROPOSITIONS
A.1 PROPOSITION
Define Ju Vg(w). Hu = J and H6 Earp, [ou where Pa is induced by Pw: Let Ta(a) be a content parameterized by (a, o). Denote by 6a = â - a the estimation error from the ground truth parameter Assume that the estimate â(a)) is computed independent from o and ca constant. Proposition states:
Proposition 1. 3c 0 such that i candd ||call2 I c, the watermark estimation problem [I9(Uá(()) + oVo) - Is (a))
min
Bampa
(3)
has an estimation error
E/ -
Proof. Let := g(Uá,(()))))) + +VV)) we have
$ g + Vv)) =(( +a) co)).
With Taylor's expansion, we have f = a + + + +ove))
= =x)(a)= (U <Vee)) + olU + +Vea).
Ignoring higher-order terms and, we then have
| 2 = Ju (Uca + oV())) + oUoc + oV
= W +oVe + oluea + oVe)) Jw +oVee).
For any r > 0, there exists c, such that if I and |lall2 Sc.
( 1 < (U'ea +oVe +T
o² Ves + STVTHHUG + TTTTHH +T.
Removing terms independent from es to reformulate equation] 3
min Eg
o² V HoVes +2 V HaUca.
the solution of which
Es = V
A.2 PROPOSITION 2
Consider two distributions: The first is wa = + Ua + V where μ E Rd= a ~ diag(ia (y and | ~ (0, diag(Av)). dAag(A) is diagonal matrix where diagonal elements follow X. The second distribution is wi = + Ua oV ó where a >> and & E {0. 1),,, Let y Rdv + Rdd C². Let the mean and covariance matrix of w; be μ4 and E. Denote by HG = [R Paluptuaattta the mean Gram matrix, and let Y,maa be the largest eigenvalue of Hy. Proposition 2 states:
Proposition 2. For any > 0 and E (0, 1), there exists e(T, > and v > O, such that < c(T, m) and \v, S c(r, n) for all 1,.... dg. || #1l12 112 S o oa Itr(En Σi) < A.meerUU,
and
2vo / dd with probability least 17.
Proof. We start with I|:0 - M1 m11l3. From Taylor's expansion and using the independence between a and B, we have
Ex,, [g(p + Ua V3)]
n0
E. [g(u + Ua]] + E.,g UutUa VB+ o(J +
E, [g(u Ua)) + E., (JJuuta V.3)],
(4)
14 = E., [g(u + Ua + oVΦ)]
-E, [g(u Ua) oaaJutua V x)] + oEn [J Vol
=40 + oE, [Jp+Ua V + Ea, [o(Jutua ( B))]
12

---

Under review as a conference paper at ICLR 2023
Let Vg. With orthonormal V and binary-coded o, we have
||e|2 x² V || ds.
(5)
For the residual term ||Ea, (o(Jutura ((r - 8]]] 11 and any 0 and v E (0, 1), there exists e(T, .n) > such that if I c(T, and Xv, S c(T. 7)) for all i = 1,... dø. we have
Pr (I
V(a B)) 1 S <T)
(6)
Lastly, we have
Ea
J Ua o 112 S [ Ju Ju JatuaauUUU u+Ua
- H S U.max ||0|
Then combining equation
equation
equation 6
equation
we have with probability least
1
|lo (41 112 S 2 W,mandd +T.
(8)
For covariances, let Eu = Cov(o(u Ua)). We have
Eo :Ru, [Co(M + Ua VB) no) Ua VB) vo)
=Ev + Ba Vintta/Vdoog(Ah))))"" Ua+
Ea,s [o(JutuaV Vlluuuaaaa v3) - -mo
E :a [(o(H + + /V Ua =1)
=Eu + Coo 20 + UU)), Jatua o(JutuaVo))
(9)
For tr(Eo). using the treatment for the residual, we have for any 0 and n E (0, 1), there exists c(T, 7) > O, such that if Λy. I e(T,n) for all =1...,de the following upper bound applies with at least probability 7
tr(En) < tr(Ex) (T. [Jutua ( VT ff JptUal) +
S str(Ev) + Av Av [Jutua VVT JT (ttUa)) +
tt(EEv) + >v, (En [V" Jr JutuaNutal V) +
(10)
S ttrEEv)= + Av Y mantr (tntttvVVV)V) V)++
I tr(Ev) + Y. do +
For the lower bound, we have tr(Eo) 2 tr(Ev).
For tr(E)), first denote by J.. the ith row of JutUas E,, its covariance matrix, and of the maximum eigenvalue of ET, Then with binary-coded o, we have
Var(J = o Cor
(11)
Then let 9s (resp. 12) be the ith element of g(u+Ua) (resp. JutUa Vd), and oi be the ith diagonal element of Σy. Using equation IT] we have the following bound on the trace of the covariance between g(1 + Uai) and JutUa
|tr(Covlguu+ Uo), Jatua Vo)) Σ Covlgi, vz) S
ousoo dg.
(12)
Lastly, by ignoring 2 terms and borrowing the same r. 7, and c(T, 17), we have with probability least 1 - n7.
tr(E,)) < tr(EE) 2 + Un)) Jatua Vo)) +r
dz
(13)
I tr((E)) + 20
ou.o,
1=1
and
ds
tr(E,) 2 tr(EE) 20
ouro, /d..
(14)
13

---

Under review as a conference paper at ICLR 2023
V=
V-7C[08
V-K]j(
Orignal
Average percentage error rate on 8
FF+Q
Σx
0
3
3
3
3
3
AFHO-DOG
AFHQ CAT
0
3
3
3
3
2.5
H
.05
2.0
1.0
9
3
3
3
3
3
0.3
H
9
3
3
3
3
0 = .2
Steps
(a)
(b)
Figure 4: (a) Average percentage error rate on a (b) Comparison between watermarks guided by Σ.. and H. The editing strength for top two rows and bottom two rows are 0.05 and 0.2 respectively.
Therefore, with probability least 1 17
d ou ds +T,
tr(Co) tr(En) S max U, da 20
(15)
and
tr(Eo)) - tr(En) 2 -2 d
oU Su -
(16)
A.3 PROPOSITION
Proposition 3. For any 7 0, 3c(T) > 0 such that if S c(T).
Earpa [lg(( + Uo:) g(p Uo + vo) o man +
(17)
Proof. We can reuse the same techniques as in the previous proofs. For some r > 0, there exists e(T) > so that when < c(T), the bound on MSE can be derived as follows:
Earpa []ls(u= + Ua) g(p + Ua + oV ②) [
JutUa = En-pa [lloJwtua V + olo(u Jata [o)
< Barpo [lloJ Vølle] +
o Bamp
VT Jt Jh Jutua Vo) +
S a mm +
(18)
B CONVERGENCE ON a
In the proofs, we assume that ||ca|/2 small and constant. Here we show empirical estimation results on SG2 and FFHQ, AFHQ-DOG, AFHQ-CAT datasets. The results in Fig. 4 a) are averaged over 100 random a and 100 random Φ, and uses parallel search on a during the estimation.
C QUALITATIVE SIMILARITY BETWEEN H., AND Σ.r
Since computing H., for large models is intractable, here we train a SG2 on MNIST to estimate H... Fig. 4(b) summarizes perturbed images from randomly chosen reference along principal
14

---

Under review as a conference paper at ICLR 2023
components of H. and Ew Note that both have quickly diminishing eigenvalues. Therefore most components other than the few major ones lead to imperceptible changes in the image space.
D ABLATION STUDY
In this section, estimated attribution accuracy based various attack parameters with multiple editing directions (see 6 8
The image quality evaluation available in Tab TO and more
visualizations can be found Fig
Table 6: Attributability Table of Blurring attack. refers standard deviation of Gaussian Blur filter size 25. When attributability is measured with (without) knowledge attack, we put results under KN (UK).
Metric
Model
0=0.5
0=1.0
0=1.5
0=2.0 0
UK
KN
UK
KN
UK
KN
UK
KN
BL
0.88
0.89
0.87
0.89
0.87
0.88
0.85
0.88
PC[32:40]
0.99
0.99
0.95
0.99
0.90
0.99
0.53
0.92
Att. f
PC[32:48]
0.99
0.99
0.97
0.99
0.72
0.92
0.38
0.88
PC[32:64]
0.99
0.99
0.73
0.94
0.51
0.90
0.32
0.83
Table 7: Attributability Table of Noise attack. a refers standard deviation of Gaussian normal distribution. When attributability is measured with (without) knowledge of attack, we put results under KN (UK).
Metric
Model
0=0.
025 KN
Ø=0
05
a=0.
075
0=0.
UK
UK
KN
UK
KN
UK
KN
BL
0.87
0.88
0.86
0.88
0.86
0.87
0.85
0.87
Att. f
PC[32:40]
0.99
0.99
0.99
0.99
0.99
0.99
0.99
0.99
PC[32:48]
0.99
0.99
0.97
0.99
0.94
0.99
0.95
0.99
PC[32:64]
0.98
0.99
0.95
0.99
0.92
0.98
0.93
0.98
Table 8: Atributability Table of JPEG attack. Q refers quality metric of JEPG compression. When attributability is measured with (without) knowledge of attack, put results under KN (UK).
Metric
Model
Q=B0
Q=70
Q=60
C=50
UK
KN
UK
KN
UK
KN
UK
KN
BL
0.88
0.89
0.87
0.89
0.87
0.89
0.87
0.89
Att. t
PC[32:40]
0.99
0.99
0.99
0.99
0.99
0.99
0.99
0.99
PC[]2:48]
0.99
0.99
0.99
0.99
0.99
0.99
0.99
0.99
PC[]2:64]
0.99
0.99
0.99
0.99
0.99
0.99
0.98
0.99
E SIMPLE WATERMARKING STRATEGY OF GENERATIVE MODELS
In the main paper, we studied deep watermarking methodology using SG2 and LDM. Both models have multi-layer network that maps Gaussian distribution to disentangled latent distribution. This well-trained latent distribution enables the generative models to create realistic images and embed watermarks without quality degradation as we discussed. Therefore, introducing disentanglement mapping network has become the main-stream design generative models. However, would also like to test the effectiveness for generative models without a disentanglement mapping by proposing naive deep watermarking strategy. To test this, employed BigGAN (Brock al. 2018).
15

---

Under review as a conference paper at ICLR 2023
Original
PC[32:40]
PC[32:48]
PC[32:64]
Figure 5: Qualitative Comparison of Watermarked Samples. The first column shows original images
(w)). Deep watermarked images are in the second to the last column.
16

---

Under review as a conference paper at ICLR 2023
Table 9: Attributability Table of combination attack. From TI to T4, the attack parameters are composed of the weakest to the strongest attack parameters of each attack (e.g., T4 is [abtur 2.0, noise 0.2, 50)) When attributability is measured with (without) knowledge of attack, we put results under KN (UK).
Metric
Model
T1
T2
T3
T4
UK
KN
UK
KN
UK
KN
UK
KN
BL
0.86
0.88
0.86
0.87
0.85
0.86
0.83
0.88
Att. t
PC[32:40]
0.99
0.99
0.94
0.99
0.81
0.95
0.65
0.89
PC[32:48]
0.99
0.99
0.74
0.92
0.52
0.88
0.45
0.85
PC[32:64]
0.99
0.99
0.63
0.90
0.41
0.82
0.26
0.79
Table 10: Quality Comparison Table. Standard deviation are in parentheses. The baseline score is in the parentheses.
Model
FID (7.24)4
IS (4.95)1
PSNR
BL
99.05
2.86 (0.35)
21.36 (1.51)
Noise
93.04
3.02 (0.27)
21.57 (1.88)
BJJPEG
97.70
2.91 (0.26)
21.44 (1.64)
B Comba
100.15
2.90 (0.23)
22.49 (1.57)
PC[32:40]
12.35
4.75 (0.05)
21.11 (2.07)
PC[32:48]
13.25
4.86 (0.08)
18.56 (1.81)
PC[32:64]
27.50
4.50 (0.07)
10.70 (0.56)
E.1 METHODS
Different from SG2 and LDM, BigGAN generates images Rd using vectors 2 that sampled from Gaussian distribution Nd,, Instead of simply picking random dimensions and perturbing those ele- ments of z, we applied the deep watermarking method 3 Since z E A/dd does not have disentangled properties, this method semantically changes generated image. However, this approach also achieves high performance attribution accuracy and FID scores.
E.2 EXPERIMENTS
The BigGAN's imput is in 128 and dg = 32 for the following experiments, We tested this ap- proach on randomly selected Imagenet Deng al. (2009) classes including cheeseburger, fountain, golden retriever, husky, Persian cat, and white wolf. For each of the classes, we generated 1,000 im- [ and generation quality (FID). shown
ages for experiments. We measured attribution accuracy in the table 11 and figure this approach also keeps quantitative and qualitative performances of pretrained BigGAN.
Table 11: Quality changes and accuracy of the proposed method. FID-BL baseline FID score of each class. ? (L) indicates higher (lower) is desired.
Imagenet Class
FID-BL
FID
Accuracy
White Wolf
28.14
26.79
0.99
Persian Cat
67.25
65.78
0.98
Golden Retriever
42.16
40.92
0.94
Husky
55.55
49.78
0.97
Fountain
70.30
65,27
0.99
Cheese Burger
44.07
42.38
0.99
17

---

Under review as a conference paper at ICLR 2023
Original
Watermarked
Original
Watermarked
Figure 6: Watermarking Results of BigGAN: Watermarking semantically changed original images (Left) to watermarked images (Right).
18


Reviews:
[{"review_id": "rhNu0NRzKc", "reviewer": "Reviewer_tdgU", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a method to produce watermarks on the content of generative models for the purpose of source tracking. The watermarks are added to the latent representations to produce outputs that are identifiable while preserving the quality of the distribution when compared to the original generative model. \n\n", "summary_of_the_review": "Overall I think the paper proposes an interesting idea, and experiment results show some promise of the proposed approach. But given the major concerns over the evaluation, I do not think the paper is ready for ICLR. ", "strength_and_weaknesses": "Strengths: \n* The problem of source tracking the generated content of various generative models is very important.\n* The proposed method is novel and conceptually interesting. \n\nWeakness: \n\nMy main concern of this method is in the paper's evaluation setup and goals. In the paper, the authors only considered the following scenarios: (1) no post-process, (2) simple post-processing such as JPEG, noise blur etc.  Both (1) and (2) can be achieved easily by appending a blind image watermarking algorithm on top of the generated content. E.g. output = BlindWatermark(G(z), identifier). I believe the proposed baseline would actually outperform the suggested method on the simple distortions measured in this paper (See works such as [1] and [2]). \n\nI do believe there to be advantages in encoding in the latent semantic space that the baselines [1] and [2] cannot solve. Namely, if the \"distortion\" itself is a \"deep learning based\" attack. E.g., some conditional generative model which distorts the image far in the pixel space, but retains the semantic meaning.  But this is not measured at all in the paper and defeats the purpose of encoding information in the latent space. \n\nOther minor suggestions:\n* More visual samples, and human rating results on the generated samples would help. FID alone isn't enough to determine visual sample quality. \n* The structure of the paper could be improved. Proposition statements should be moved to the appendix and Section 3 should contain clearly the step-by-step explanation of the watermark encoding and decoding algorithms. This would help the less experienced reader quickly understand the proposed method.\nE.g. Encoding: Find d_phi principle component vectors of matrix H ....\nDecoding: Solve Equation (Sec 4.3) to estimate the watermark signal phi. \n\n\n[1] Zhu, Jiren, et al. \"Hidden: Hiding data with deep networks.\" Proceedings of the European conference on computer vision (ECCV). 2018.\n[2] Luo, Xiyang, et al. \"Distortion agnostic deep watermarking.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "eEpTawr0IDv", "reviewer": "Reviewer_X6TA", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper presents a new method to improve watermarks for generative models, particularly investigating the trade-off between attribution accuracy and generation quality. The proposed method explores latent semantic space as watermark, by mean of principal components and eigenvectors. The paper also explores how the design parameters of the method can be used to establish a practical and computationally inexpensive trade-off. Experiments show that the method outperforms the SOTA that uses shallow watermarking.", "summary_of_the_review": "The paper is interesting and presents a convincing method for watermarking. However, the paper would benefit of comparing its results against more difficult scenarios (printer-camera) and alternative methods.\n", "strength_and_weaknesses": "\nStrengths:\n\n1) the paper is well written and well organised, presenting convincing evidence that it outperforms the SOTA\n2) the theoretical derivations are thorough and seem also convincing\n\nWeaknesses:\n1) this authors only compare their method with the method of Kim et al. (2020). The method should be compared against more methods that explore different properties of watermarking. For instance:\n\nMatthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs.\nIn Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition\n(CVPR), pp. 2117–2126, 2020. [exploring printer-proof watermarking]\n\nShadmand, Farhad, Iurii Medvedev, and Nuno Gonc̗alves. \"CodeFace: A Deep Learning Printer-Proof Steganography for Face Portraits.\" IEEE Access 9 (2021): 167282-167291. [exploring printer-proof watermarking]\n\nRuowei Wang, Chenguo Lin, Qijun Zhao, and Feiyu Zhu. Watermark faker: towards forgery of\ndigital image watermarking. In 2021 IEEE International Conference on Multimedia and Expo\n(ICME), pp. 1–6. IEEE, 2021. [exploring resistance to watermark attack]\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "VCN2mV3UMA7", "reviewer": "Reviewer_Dm6b", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a novel approach for watermarking generative models (GANs + latent diffusion models). While previous approaches focused on adding watermarks in the image space, the paper's approach adds watermarks in the latent space to induce subtle semantic changes to the generated images. The latent directions of change are selected as the principal components but with small variances to avoid strong semantic changes. By using these latent directions to watermark the images, the procedure promises to be computationally efficient since it needs to only compute the directions once. The paper further provides a theoretical analysis of the accuracy-quality tradeoff and empirically evaluates the approach on StyleGAN2 and Latent Diffusion models.", "summary_of_the_review": "In summary, I like the proposed idea and direction of the paper, as well as the empirical evaluation, and think that it will benefit the community if the paper would get accepted. It tackles an important problem of generative models that becomes even more important with increasing model quality and recent advances in text-to-image synthesis. However, the quality of the writing should be improved, and details for reproduction should be added, in the best case together with the source code.", "strength_and_weaknesses": "Strengths:\n+ Tackles an important problem of generative models: watermarking the generative models (and their generated images) to allow attribution of contents to their source models.\n+ Most parts of the paper are clearly written and easy to follow. Particularly the introduction section states a good entry into the problem.\n+ The proposed solution of adding watermarks in the latent space instead of the image space offers an interesting avenue.\n+ The empirical results promise that the model indeed beats previous approaches in terms of accuracy-quality tradeoff and induces less noticeable changes to the images.\n+ The formal analysis of the accuracy-quality tradeoff provides interesting insights into the problem.\n\nWeaknesses:\n- Parts of section 3 are partially imprecise and difficult to read. Rewriting some parts of it and adding some intuition would make following it easier. Also, a list of symbols in the appendix might be worth considering.\n- I expect the approach to only work for generative models with disentangled latent spaces. So for other types of GANs without using, e.g., a mapping network to entangle the dimensions, the approach is not applicable. Similarly, I am not sure if the approach works (in principle) with other diffusion models, e.g., imagen or DALL-E 2.\n- I also miss some information on the computation needed to perform the attribution step. Since it needs to solve an optimization that involves forward passes through the generator, it might take some time. So I think approaches with watermarking in the image space need to train separate attribution networks, which is costly at training but fast at inference. And the proposed approach is fast at watermarking (does not need to train a separate attribution model) but the attribution process might be slow / computation costly. If this is true, the trade-off should at least be stated in the paper.\n- Unfortunately, no source code is provided to reproduce the results", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "8PJ6NejZ2it", "reviewer": "Reviewer_h68J", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a method to attribute generative models using digital watermarking. The paper explores the use of latent semantic dimensions as watermarks. Experiments are presented using StyleGAN2 and Latent diffusion models, which show that the approach is promising.The paper further showed that there is a tradeoff between generation quality and attribution accuracy. ", "summary_of_the_review": "Though some aspects of the paper are interesting, many parts are still not clear. \n\nIt is not clear how this approach will be useful in a practical scenario. Since watermarking is applicable in practical use cases, the authors should explain how the approach can be used practically. For example, are the authors suggesting to use a StyleGAN algorithm which also includes the deep watermarking method, and use this algorithm for generation?\n\nIt is not clear what the watermark actually is. Usually a watermark has some message or pattern embedded. \n\nOnly StyleGAN2 and Latent diffusion models have been attributed. To be practically useful, more GANs or generative methods need to be experimented. \n\nIn the post processing experiments, the post processing parameters are done for a fixed setting (example Guassian noise of -.1 standard deviation). It is also not clear what JPEG quality factor was used. Usually for post processing experiments, a range of values are considered and the analysis is then performed. \n", "strength_and_weaknesses": "The paper showed that there is a tradeoff between generation quality and attribution accuracy. \n\nThough some aspects of the paper are interesting, many parts are still not clear. Practical use case is missing. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject