An Undetectable Watermark for Generative Image Models
Authors: Sam Gunn
Xuandong Zhao
Dawn Song
Venue: ICLR 2025 Poster (2025)
Keywords: Watermarking
AI Safety
Diffusion Models
Generative AI
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We present a robust image watermarking scheme that is provably quality-preserving, and demonstrate that all prior schemes degrade quality.

Abstract: We present the first undetectable watermarking scheme for generative image models.
_Undetectability_ ensures that no efficient adversary can distinguish between watermarked and un-watermarked images, even after making many adaptive queries.
In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric.
Our scheme works by selecting the initial latents of a diffusion model using a pseudorandom error-correcting code (Christ and Gunn, 2024), a strategy which guarantees undetectability and robustness. We experimentally demonstrate that our watermarks are quality-preserving and robust using Stable Diffusion 2.1.
Our experiments verify that, in contrast to _every prior scheme_ we tested, our watermark does not degrade image quality.
Our experiments also demonstrate robustness: existing watermark removal attacks fail to remove our watermark from images without significantly degrading the quality of the images.
Finally, we find that we can robustly encode 512 bits in our watermark, and up to 2500 bits when the images are not subjected to watermark removal attacks.
Our code is available at https://github.com/XuandongZhao/PRC-Watermark.

Published as a conference paper at ICLR 2025
AN UNDETECTABLE WATERMARK FOR GENERATIVE IMAGE MODELS
Sam Gunn" UC Berkeley
Xuandong Zhao" UC Berkeley xunndngghhaa@berrkkeee....
Dawn Song
UC Berkeley dawn reebberkeeeeee edu
junn@berkeley.ee
ABSTRACT
We present the first undetectable watermarking scheme for generative image models. Undetectability ensures that no efficient adversary can distinguish be- tween watermarked and un-watermarked images, even after making many adap- tive queries. In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric. Our scheme works by select- ing the initial latents of diffusion model using pseudorandom error-correcting code (Christ and Gunn, 2024), a strategy which guarantees undetectability and robustness. We experimentally demonstrate that watermarks quality- preserving and robust using Stable Diffusion 2.1. Our experiments verify that, in contrast every prior scheme tested, our watermark does degrade image quality. Our experiments also demonstrate robustness: existing water- mark removal attacks fail to remove our watermark from images without sig- nificantly degrading the quality of the images. Finally, we find that we can robustly encode 512 bits our watermark, and up to 2500 bits when the im- ages are not subjected to watermark removal attacks. Our code is available at https: thtbb.....uuu..uo/.. com /ww.a//ggnanaa/aaaaa hwtp:///te--Wattaaeeeea
INTRODUCTION
As Al-generated content grows increasingly realistic, does the threat of Al- Al-generated disinfor- mation. Al-generated images have already appeared online in attempts to influence politics (Ryan- Mosley, 2023). Watermarking has the potential mitigate this issue: If Al providers embed water- marks in generated content, then that content can be flagged using the watermarking key. Recogniz- ing this, governments have begun putting pressure on companies to implement watermarks (Biden, 2023; California State Legislature, 2024; European Union, 2024). However, despite an abundance of available watermarking schemes in the literature, adoption has remained limited (Seetharaman & Barnum, 2023). There are at least few potential explanations for this.
First, some clients are willing to pay premium for un- watermarked content. For instance, a student using generative AI for class might find watermark problematic. Any company implementing watermark could therefore put itself at competitive disadvantage.
Second, existing watermarking schemes noticeably degrade the quality of generated content. Some schemes guarantee that the distribution of single response is unchanged, but introduce correlations across generations.' While this might be acceptable for small models, it is questionable whether anyone would be willing to use such a watermark for a model that cost over $100 million just to train (Knight, 2023). In other words, given the vast effort put into optimizing models, any observable change in the model's 's behavior probably unacceptable.
Undetectable watermarks. Undetectability, originally defined in the context of watermarking by Christ et al. (2024), addresses both of these issues. For an undetectable watermark, it is compu- tationally infeasible for anyone who doesn't 't hold the detection key distinguish generations with the watermark from generations without - even if one is allowed to make many adaptive queries.
Equual contribution.
One method with this guarantee is fix the randomness of the sampling algorithm, so that the model can only generate one unique response for each prompt.

---

Published as a conference paper at ICLR 2025
Crucially, undetectable watermark provably preserves quality under any metrie, including quality metries that are measured across many generations (such as FID (Heusel et al., 2017), CLIP (Radford et al., 2021) and Inception Score (Salimans et al., 2016) for images). Therefore one can confidently use an undetectable watermark without any concern that the quality might degrade. And if the detection key is kept sufficiently private, then the competitive disad- vantage to using the watermark can be minimized: One can give the detection key only to mass distributors of information (like Meta and X), so that broad dissemination of Al-generated disinfor- mation can be filtered without interfering in users' personal affairs. Since only the mass information distributors would be able detect the watermark, it would not harm the value of the content except to bad actors.
The PRC watermark. In this paper, we introduce the first undetectable' watermarking scheme for image generation models. Our scheme works for latent diffusion models (Rombach et al., 2022), with which we generate watermarked images by progressively de-noising initial watermarked noise within the latent space. The key component in scheme is pseudorandom error-correcting code, or pseudorandom code (PRC), a cryptographic object introduced by Christ & Gunn (2024). We therefore refer to scheme as the PRC watermark in this work.
At a high level, a PRC allows us to embed a cryptographically pseudorandom pattern that is robustly distributed across the entire latent space, ensuring that the watermark operates at semantic level. The fact that our watermark is embedded at the semantic level, combined with the PRC's erro- correcting properties, makes our watermark highly robust especially pixel-level watermark removal attacks (Zhao et al., 2023).
Additionally, since the PRC from Christ & Gunn (2024) can be used to encode and decode messages, we can robustly embed large messages within the PRC watermark. While the decoder is somewhat less robust than the detector, the detector can still be effectively used in cases where the decoder fails.
Finally, the PRC watermark is highly flexible, requiring no additional model training or fine-tuning, and can be seamlessly incorporated into existing diffusion model APIs. It allows the user to inde- pendently set the message length and desired upper bound on the false positive rate (FPR) the time of watermark key generation. The false positive rate is rigorous, rather than empirical: If the user sets the desired upper bound on the false positive rate to F, then we prove in Theorem 2 that the false positive rate will not exceed F.
Results. Experiments on quality and detectability are presented Section 4.2. We emphasize that undetectability thcoretically ensures quality preservation, and our scheme is undetectable by the results of Christ & Gunn (2024). Therefore we perform experiments on quality and detectability only to ensure that our scheme is secure enough with finite choice of parameters.
We demonstrate the undetectability of our scheme in three key ways:
We show in Table that the quality, measured by the FID, CLIP, and Inception Score, are all preserved by the PRC watermark. This is in contrast to every other scheme we tested.
We show in Table 2 that the perceptual variability of responses, as measured by the LPIPS score (Zhang et al., 2019), is preserved under the PRC watermark. This in contrast to every other comparable scheme we tested.
We show in Figure 2 that an image classifier fails to learn detect the PRC watermark. The same image classifier quickly learns to detect every other scheme we tested.
We demonstrate the robustness of our scheme in Section 4.3. We find that watermark removal attacks fail to remove the PRC watermark without significantly degrading the quality of the image. We test the robustness under ten different types of watermark removal attacks with varying strengths and compare PRC watermark to eight different tfateoof-hee-at watermarking schemes. Among the three watermarking schemes with the lowest impact on image quality, the PRC watermark is the most robust all attacks.
"See Appendix C.3 for a discussion the extent to which our scheme is cryptographically undetectable for various choices of parameters. 'These are the DwiDet, DwtDetSvd, and PRC watermarks.
2

---

Published as a conference paper at ICLR 2025
Finally, we show in Section 4.4 that the PRC watermark be used to encode and decode long messages in generated images. The encoding algorithm is exactly the same, except that the user passes it a message, and the scheme remains heuristically undetectable. These messages could be used to encode, for instance, timestamps, user IDs, digital signatures, or model specifications. We find in Figure 10 that the robustness of the decoder for 512-bit messages is comparable to, although slightly less than, the robustness of the detector. For non-attacked images, we show in Figure 14 that we can increase the message capacity to at least 2500 bits.
RELATED WORK
There is a rich history of digital watermarking techniques, ranging from conventional steganogra- phy to modern methods based on generative models. Following the taxonomy in An et al. (2024), watermarking methods are categorized into two types: post- protessoc and in in-processing schemes.
Post-processing schemes embed the watermark after image generation and have been used for decades due to their broad applicability.
In-processing schemes modify the generative model or sampling process to embed the watermark directly in the generated content.
Our PRC watermark falls under the in in-processing category. Note that post-processing watermarks cannot be made undetectable without introducing extra modeling assumptions: One can always distinguish between a fixed image and any modification it. We refer the reader to surveys (Cox et al., 2008; Wan et al., 2022; An et al., 2024) for more on post-processing methods. Below, focus on two popular in-processing techniques: Tree-Ring and Gaussian Shading watermarks.
Tree-Ring watermark. Wen et al. (2023) introduced Tree-Ring watermark, the first in in-processing watermark that modifies the latent sampling distribution and employs an inverse diffusion process for detection. Our PRC watermark builds on this framework but adopts a different latent distri- bution. The Tree-Ring watermark works by fixing concentric rings in the Fourier domain of the latent space to be O. To detect the watermark, one uses DDIM inversion (Song et al., 2021) to esti- mate the initial latent, and the watermark is considered present if the latent estimate has unusually small values in the watermarked rings. Follow-up works have extended this approach by refining the heuristic latent pattern in the watermarking process (Zhang et al., 2024; Ci et al., 2024; Arabi et al.. 2024). However, under Tree-Ring's 's strategy, the initial latent significantly deviates from the Gaussian latent distribution, leading reduced image quality and variability, shown in Tables and 2. Furthermore, the Tree-Ring watermark is zero-bit bit scheme and cannot encode messages. While the Tree-Ring watermark is robust to several attacks, it highly susceptible to the adversarial surrogate attack since the latent pattern is easy to learn with neural network. In Figure 5, we find that this attack removes the Tree-Ring watermark with minimal effect on image quality.
Gaussian Shading watermark. The basic Gaussian Shading watermark (Yang et al., 2024) works by choosing a fixed quadrant of latent space as the watermarking key, and only generating images from latents in that quadrant. Detection involves recovering the latent and determining if it lies unusually close to the watermarked quadrant. In their paper, Yang et al. (2024) include a proof that Gaussian Shading has "lossless performance." However, this proof only shows that the distribution of single watermarked image is the same as that of a single un- an-watermarked image. Crucially, even standard quality metrics such as the FID (Heusel et al., 2017), CLIP Score (Radford al., 2021). and Inception Score (Salimans et al., 2016) account for correlations between generated images, so their proof of lossless performance does not guarantee perfect quality under these metrics. Indeed, we find in Table 1 that the Gaussian Shading watermark significantly degrades the FID and Inception Score.4 4 We expand on this further by measuring the "variability" of watermarked images. Since images under the Gaussian Shading watermark all come from the same quadrant in latent space, expect that the variability should be reduced. We use the LPIPS perceptual similarity score (Zhang et al., 2018) to measure the diversity among different watermarked images for fixed prompt. As
* 'Table of Yang et al. (2024) appears to show that the FID against the COCO dataset is preserved under Gaussian Shading. However, from their code repository it appears that this table is generated by re-sampling the watermarking key for every generation. To be consistent with the intended use case, in this work we use the same random watermarking key generate many images and compute the quality score.
3

---

Published as a conference paper at ICLR 2025
shown in Table 2, the perceptual similarity between images is significantly higher with the Gaussian Shading watermark, confirming the diminished variability. The diminished variability turns out to be easily observable the human eye we show example of this in Figure 13.
Undetectability. Undetectable watermarks were initially defined by Christ et al. (2024) in the context of language models. Subsequent to Christ & Gunn (2024), alternative constructions of PRCs have been given by Golowich & Moitra (2024) and Ghentiyala & Guruswami (2024). It would be interesting to see if these PRCs yield improved image watermarks, but we did not investigate this.
METHOD
3.1
THREAT MODEL
We consider setting where users make queries to provider, and the provider responds to these queries with images produced by some image generation model. In watermarking, the provider holds watermarking key that is used sample from modified, watermarked distribution over images. Anyone holding the watermarking key can, with high probability, distinguish between samples from the un-watermarked distribution and the watermarked distribution.
Since the watermark may be undesirable to some users, some them may attempt to remove the watermark. We are therefore interested in robust watermarks, for which watermark detection still functions even when the image is subjected to a watermark removal attack. We assume that the adversary performing such removal attack is restricted in two ways. First, the adversary should have weaker capabilities than the provider. If the adversary can generate their own images of equal quality to the provider, then they don't need to engage in watermark removal attacks, Second, we are only interested in adversaries that produce high-quality images after the removal attack. If removal attacks require significantly degrading the quality of the image, then there is incentive leave the watermark.
We are also interested in spoofing attacks, whereby an adversary who doesn't know the watermark- ing key attempts to add a watermark to an un un-watermarked image. We only perform limited experi- ments on spoofing attacks, so we do not discuss the adversarial capabilities here. However, we note that our techniques, together with the ideas unforgeable public attribution from Christ & Gunn (2024), immediately yield scheme that is provably resilient to spoofing attacks.
3.2 OVERVIEW OF THE PRC WATERMARK
Image generation and randomness recovery. Before describing our watermarking scheme, let establish some notation. Let Generate be randomized algorithm that takes as input (1) prompt string æ E Σx over some alphabet Σ and (2) a standard Gaussian in RP, and produces an output in gd Our method applies any such algorithm, but this work, we are interested in the case that Generate is generative image model taking prompts in M' and initial (random) latents in IR" to images Rdd
Some of the most popular generative image models today are latent diffusion models (Rombach al.. 2022), which consist of diffusion model specified by de-noising neural network e, (possibly-randomizze function f. depending on e, number of diffusion iterations T. and an au- toencoder (E, D). For a latent diffusion model, Generate works as follows.
Algorithm Generate(T: (T x27));
(1) For i = 7 down to 1:
(2) 21111) =
(3) x + (1))
(4) Output
In words. Generate works by starting with normally distributed latent and iteratively de- de-noising
it. The de-noised latent is then decoded by the autoencoder. In order to produce an image for the prompt using Generate, Sample defined as follows.
4

---

Published as a conference paper at ICLR 2025
Algorithm Sample(
(1) Sample z(T) (O I..)
(2) Compute a + Generate N 27))
(3) Output
Detection of the watermark will rely separate algorithm. Recover, that recovers approxima- tion the latent I" from a given image æ E Rd. For latent diffusion models, the key component in Recover an inverse diffusion process 5 that attempts invert without knowledge of the text prompt π. There is also some (posibly-randomized) function Jo that determines how is used to perform each update.
Algorithm Recover(a:)
(1) Compute an initial estimate z0() +- E(x)) of the de-noised latent."
(2) For i 0 T 1:
(3) (++1) ())
(4) Output z(²)
There has been increasing interest in tracing the diffusion model generative process back (Recover). Diffusion inversion has been important for various applications such image editing (Hertz al., 2022) and style transfer (Zhang et al., 2023). A commonly used method for reversing the diffusion process is Denoising Diffusion Implicit Models (DDIM) (Song et al., 2021) inversion, which lever- ages the formulation of the denoising process in diffusion models as an ordinary differential equation (ODE). However, the result of DDIM inversion, x xT)) is an approximation even when the input text known. For our implementation of Generate, we employ Stable Diffusion with DPM-solvers (Lu et al., 2022) for sampling. In our implementation of Recover, we adopt the exact inversion method proposed in Hong al. (2023) for more accurate inversion.
Embedding and detecting the watermark. Our watermarking scheme works by passing to Generate a vector 2(T) which is computationally indistinguishable from sample from NO In). To sample s(T), we rely cryptographic object called pseudorandom code (PRC), introduced by Christ & Gunn (2024). A PRC keyed error-correction scheme with the property that any polynomial number of encoded messages are jointly indistinguishable from random strings. For watermarking, it suffices to use a zero-bit PRC which only encodes the message '1.' If one wishes to encode long messages in the watermark, can do this well; see Appendix C for details on how this is accomplished. For simplicity we focus on the zero-bit case in this section.
Our PRC consists of four algorithms, given in Appendix B:
PRC.KeyGen(u, F, samples a PRC key which will also serve as the watermarking key. The parameter is the block length, which in our case is the dimension of the latent space; J' is the de- sired false positive rate; and a parameter which may be increased for improved undetectability at the cost of robustness.
PRC. PRCoEnc samples a PRC codeword.
PRC.Detecty (c) tests whether the given string came from the PRC.
PRC.Decode, (c) decodes the message from the given string if it exists. The decoder is slower and less robust than the detector.
As our PRC, we use the LDPC construction from Christ & Gunn (2024), modified to handle soft decisions. Essentially, this PRC works by sampling random t-sparse parity checks and using noisy solutions to the parity checks as PRC codewords. For appropriate choices of parameters, Christ & Gunn (2024) prove that this distribution is cryptographically pseudorandom. We describe how the PRC works in detail in Appendix B, and we describe our watermarking algorithms detail in Appendix C.
'In fact, the algorithm of Hong et al. (2023) further uses gradient descent (0) minimize || D((2())) ærI. initializing with (0)) E(r). They call this "decoder inversion," and it significantly reduces the recovery
5

---

Published as a conference paper at ICLR 2025
To set up our robust and undetectable watermark, simply sample a key k using PRC.KeyGen. To
sample a watermarked image, we choose g(²) to be sample from (0, In) conditioned on having signs chosen according to the PRC and then apply Generate. In more detail, we sample 2(7) using following algorithm.
Algorithm PRCWat.Sampley (T))
(1) Sample PRC codeword e E 11 using PRC.Encode(k)
(2) Sample y ~ I.)
(3) Let = E _ be the vector defined by x(() ci 1yal for all i E [n]]
(4) Compute æ f- Generate 2)))
(5) Output æ
For full description of the algorithm, see Algorithm 6.
Since the signs of 2(²) NO0, I,)) are uniformly random, the pseudorandomness the PRC implies that any polynomial number of samples s(²) in PRCWat.Sampl are indistinguishable from samples (T) ~ (0, I,). As Generate is an efficient algorithm, this yields Theorem which says that our watermarking scheme is undetectable against poly(n)-ting) adversaries for latent space of dimension n, long the underlying PRC
Theorem (Undetectability). Let PRC be any PRC, and let Sampl be as defined above.
Then for any efficient algorithm and any >
Pr Ke-.RR.KeeGen
LA Sample, (1*) 1 Pr P Sample (1") = =1] - 5((
The notation .4 (1") means that A is allowed to run in any time that is polynomial in n, making an arbitrary number of queries O. For our experiments, we do not strictly adhere the parameter bounds required for the pscudorandomness proof of Christ & Gunn (2024) to hold; this and the fact that we use small finite choices of parameters, our scheme should not used for andetectability-criiiie applications. See Appendix C.3 for discussion this point.
result of
To detect the watermark with the watermarking key, we use (roughly) the following algorithm. As long Recover reproduces good enough approximation to the latent that was originally used to generate an image, PRCWat.Detect will recognize the watermark.
Algorithm PRCWat. (a:)
(1) Compute z <- Recover
(2) Let e be the vector signs (T")
(3) Compute result +- PRC.Detect,(c)
Output result
For our actual detector, use slightly more complicated algorithm that accounts for the fact that coordinates of z(T) with larger magnitude are more reliable. The complete algorithm is given in Algorithm 7.
It turns out that, for low error rates, the PRC from Christ & Gunn (2024) can be used to encode and decode long messages using an algorithm called belief propagation. We can therefore in- clude long messages in watermark. Our algorithm for decoding the message from an image BRCWat.Decode described in Algorithm PeCWat.Detect, but find that it still achieves interesting level of robustness.
BRCWat.Decod. is slower and less robust than
Finally, our PRC watermark allows the user to set desired false positive rate, F. We prove The- orem which says that our PRC watermark detector has false positive rate at most F, in Ap- pendix C.2.
Theorem (False positive rate). n,, N and F > 0. For any image æ. Pr
[PeeWat. = True] S F krPRCWaatKeyGennn..t
and
Pr k--RCWaat.KyGmm(n.fy
(eodeet. * None] <

---

Published as a conference paper at ICLR 2025
without Watermark
DonDet WM
DeltDetSud WM
RivaGAN VM
StepaStamp
Signature Ring
Shading
Figure 1: Examples different watermarks applied to the image generated with the prompt: "red dead redemption& cinematic view, epic sky, detailed, concept art, low angle, high detail, lighting, volumetric, godrays, vivid, beautiful, trending on artstation, by jordan grimmer, huge scene, grass, art greg rutkowski", For post-processing watermark methods, the watermarks directly perturb the un-watermarked image. Notably, the StegaStamp watermark introduces visible blurring artifacts.
In words, Theorem 2 says that any image generated independently of the watermarking key has at most probability of F' of being identified as "watermarked" by our watermark detector decoder.
4 EXPERIMENTS
4.1 EXPERIMENT SETUP
In our primary experiments, we focus text-to-image latent diffusion models, utilizing the widely adopted Stable Diffusion framework (Rombach al., 2022). Specifically, we evaluate the perfor- mance of various watermarking schemes using the Stable Di fiffusi on-v2 ..1 16 model, state- of-the-art generative model for high-fidelity image generation. Additionally, we explore applying PRC watermarking to other generative models, demonstrated with VAE (Kingma & Welling, 2013) models Appendix D. All images are generated at a resolution of 512x512 with latent space of 4x 64 x 64. During inference, we apply a classifier-free guidance scale of 3.0 and sample over 50 steps using DPMSolver (Lu et al., 2022). As described in Section 3, we perform diffusion inversion using the exact inversion method from Hong et al. (2023) obtain the latent variable z(T) In particular, we use 50 inversion steps and an inverse order of 0 to expedite detection, balancing accuracy and computational efficiency. All experiments are conducted on NVIDIA H100 GPUs.
Watermark baselines. We conduct comparative evaluations against various watermarking schemes, including in-, and post-processing techniques, defined in Section 2. For post- processing methods, we compare with DwtDet (Al-Haj. 2007), DwtDetSvd (Navas et al., 2008), RivaGAN (Zhang et al., 2019), StegaStamp (Tancik al., 2020), and SSL Watermark (Fernandez et al., 2022). For in in-processing methods, we include comparison with Stable Signature (Fernan- dez et al., 2023), Tree-Ring (Wen al., 2023) and Gaussian Shading (Yang et al., 2024). Most baseline methods are designed to embed bit strings within image. Specifically, we set 32 bits for DwtDetSvd, RivaGAN, and SSL. Watermark: 96 bits for StegaStamp: and 48 bits for Sta- ble Signature. We employ publicly available code for each method, using the default inference and fine-tuning parameters specified in original respective papers for post- and in un-prccessing methods. For Tree-Ring and Gaussian Shading watermarks, parameter settings as those used in PRC. We encode 512 random bits in the PRC watermark. the decoder is successful, then with high probability, the bits are recovered correctly. Figure 1 illus- trates examples of different watermarking schemes applied to a specific text prompt, highlighting the visual impact of each approach.
use the same diffusion model and inference
http:///nggnnfieccccoaaaiiiiiiid 2-1--a

---

Published as a conference paper at ICLR 2025
Table 1: FID, CLIP and Inception Score (meddd Emoor for different watermarks in both COCO and Stable Diffusion Prompts datasets. The PRC watermark is the only one that preserves quality across all three metrics in both datasets. Scores outside of standard errors are highlighted in red.
COCO Dataset
Stable Diffusion Prompts Dataset
Watermark
FID 4
CLIP Score
Inception Score 1
FID 4
CLIP Score t Inception Score
Original
76.3987o.3128
0.47924.002
17.5430p.1r 1218
63.4625m.2sm
0.61196.0016
7.4969p
DwtDet
76.5676..221
0.4761
17.46866.122
63.6912, 20.20ss
0.6047o.001s
7.13460.0m
DwiDerSvd
76.33226.270 2739
0.4727g.0022
o7.42244..3334
64.4768p.2147
0.594
7.1 7.12533.0000
RivaGAN
77.7440p.2494
20.01s
17.26690.1208
65.71444.2a0
0.60640.0017
7.1828p.00er
StegaStamp
79.8856
0.46930.0023
16.88320.1307
66,88533,2613
0.6103o.0015
6.3343p.100s
SSL
77.93466
0.4707a.co1s
17. 17.1920n.1z0 1277
65,0303p.2434
0.6061o.000s
7.09236.5eg
Stable Signature
78.2577
0.47744..o0
16.8753p.1a17
70.1263g.2539
0.594lo.m013
6.81130.1220
Tree-Ring
77.3445o. 1733
0.4795
17.3989..
68.7192a.177
0.59644.mm
7.41730.
Gaussian Shading
77.9279p.ar
0.4 0.47666.0025
17.0658p.0762
69.9333p.1237
0.6132o.n013
7.30350.0727
PRC
76.5979
0.4773g.0080
17.4734p.
63.7350p.ssi
0.6146p.0014
7.5000p.0er
Datasets and evaluation. We evaluate watermarking methods on two datasets: MS-COCK (Lin al., 2014) and the Stable Diffusion Prompt (SDP) dataset.? We generate 500 un-watermarked images using MS-COCO captions or SDP prompts, and apply post-processing watermark methods to generate watermarked images. In-processing methods directly generate watermarked images from prompts. To assess the performance of the different watermarking schemes, we primarily examine four aspects: effectiveness, image quality, robustness, and detectability. For effectiveness, which involves performing binary classification between watermarked and un- un-watermarked images, we calculate the true positive rate (TPR) at a fixed false positive rate (FPR). Specifically, we report TPR @ @PR==0001. Without any attacks, the PRC watermark achieves TPR=1.0 1PR=1.0@FFR-0001. FPR=0.01. Note that for PRC watermarking, the FPR is set at 1%, though it can be easily made smaller depending on the use case (see long message experiments in Section 4.4).
4.2 QUALITY AND DETECTABILITY
To evaluate the image quality of watermarked images, we compute the Frechet Inception Distance (FID) (Heusel et al., 2017). CLIP Score (Radford et al., 2021), and Inception Score (Salimans et al., 2016) to measure the distance between generated watermarked and un- watermarked images, and between watermarked and real images. For our comparison to real images, we use the MS-COCO-2017 training set; for the comparison to un- watermarked images, we use 8,000 images generated by the un- wa-waatrmarked diffusion model using prompts from the SDP dataset. We calculate FID and CLIP Scores over five-fold cross-validation and report the mean and stan- dard error. To assess perceptual variability (diversity), select 10 diverse prompts from the PromptHero web- S and use different in-processing watermark methods
Table 2: LPIPS scores (Zhang et al., 2018) for in-processing schemes. Smaller scores mean generated images were more similar according to the LPIPS perceptual metric.
Watermark
Variability
Original
0.7570g.
Stahle Signature
00200
Tree-Ring
0.7413g.u021
Gaussian Shading
0.6503g.0021
PRC
0.7589g.u019
to generate 100 images for each prompt. We calculate perceptual similarity for all image pairs using the LPIPS (Zhang et al., 2019) score, averaging the results over the 10 prompts and reporting the standard error. Higher LPIPS scores indicate better variability for given prompt. This evaluation is essential since, for image generation tasks, users typically generate multiple images from a single prompt and then select the best one (e.g.. Midjourney).
Table presents the empirical results for FID, CLIP, and Inception Scores for different watermark- ing schemes on both the COCO and SDP datasets. The table compares original image quality, post- processing watermark quality, and in-processing watermark quality (separated by dashed lines). We
"httss//huggingfacccco httt:///hhggingaac....oattttttts www.atsccs//nnaaaooss/ttaaaaaaae Diwpaaahie-Diffssiso-ooooo
hhups:/prompphher..cmm
8

---

Published as a conference paper at ICLR 2025
'Iwiring
Training Accurary Epochs
Vaidation Accuracy Spachs
Treerhn
Goussiaan Stackig
Necumey (5)
60
Accurer (56)
PRC
0.4
Treering
Gausilan Shad
0.2
70
Thesr ng
StegeSiamp
Gaussann Shalin)
StapuStamp
0.0
50
3
6
20
2
20
10
Spech
Ccoch
Spach
Triiring Loss Oeerr Fiocct
Training Accurary Dver Epochs
Validtion Accuracy Dver Epachs
PSC
0.6
Gasasian Shad ng key
Treeing dilkkey
Accursty (52)
30
0.4
Strir dtl cny
15
Accurssy
Teeting d
PBC lifley
Goursann Shattnn d key
0.2
PM2 cit key
Treating SP kay
StoguStamp de kcy
10
Epoch
Figure 2: Top: Training model to detect the watermark without the key. Bottom: Training a model to distinguish between watermarked images generated with different watermarking keys.
observe that StegaStamp results in the most significant quality degradation among post-processing watermark schemes, and the PRC watermark is the only method that consistently preserves im- age quality across all three metrics both datasets. Table 2 presents the results of the variability analysis. Since post-procsssing methods are expected to have minimal impact on image variabil- ity, they are excluded from this table. The PRC watermark demonstrates variability comparable to un un-watermarked images, outperforming the other in- in-processing schemes in this regard.
ResNet18 (He et al., 2016) as the backbone model and train it on 7,500 un- un-watermarked images and 7,500 watermarked images (or 7,500 images watermarked with key 1 and 7,500 with key 2) to perform binary classification. Each experiment tests different wa- termarking schemes, with results shown in Figure 2. For the PRC watermark, the neural network slowly converges to perfect detection on the training set but achieves only 50% accuracy (random guess) on the validation set, indicating that the network is memorizing the training samples rather than learning the watermark pattern. In contrast, for all other schemes, the network performs per- fectly on the validation set, demonstrating that the watermark is learnable.
To evaluate detectability,
4.3 ROBUSTNESS OF THE DETECTOR
To comprehensively evaluate the robustness of the PRC watermark and compare it to baseline wa- termarking methods, we tested nine distinct watermarking techniques against ten different types of attacks. Detailed descriptions of the attack configurations can be found in Appendix A.
The robustness of the various watermarking methods under these attacks is shown in Figure 5. We evaluated the quality of the attacked images using PSNR, SSIM, and FID metrics, comparing them to the original watermarked images. Notably, the PRC watermark demonstrates high resilience to most attacks. Even under sophisticated attacks, no method successfully reduced the true positive rate (TPR) below 0.99 while keeping the FID score under 70. This demonstrates that current watermark removal techniques struggle to erase our watermark without significantly degrading image quality. For instance, as shown in Figure 5, a JPEG compression attack with a quality factor of 20 only reduced the TPR from 1.0 to 0.94, but the resulting images displayed noticeable blurriness and loss of detail (see Figure 4). Finally, in Figure 9 we demonstrate increased robustness for = 2. However, for t = 2 there exist fast attacks on the undetectability of the PRC watermark, so do not explore this choice further.
4.4 ENCODING LONG MESSAGES IN THE WATERMARK
The use of PRC allows us to embed long messages in our watermarks, as described in Appendix C. We find in Figure 10 that the decoder is highly robust for 512-bit messages, although the detector is slightly more robust in this case. We find in Figure 14 that the decoder can reliably recover up to 2500 bits of information if the images are not subjected to removal attacks.
For our other experiments we set t See Appendix B for details the meaning of the parameter t.

---

Published as a conference paper at ICLR 2025
TPR.8 PP.
Shading
TP P0.-0.0 01
Thos Yang WI
St00 y Sip arraaum VN
(jusdan Shading
PRC WM
Lher
The Poo-BrrWWW
Stog3 StArTD
70.0 15.0
71.5
00.0
02.5
12.5
75.0
77.
30.0
FID
FID
Figure 3: Robustness under the strongest attacks, excluding the embedding attack. We show all points from the corresponding plot in Figure 5 for which there is other point with higher FID and TPR. In the figure on the right, we only include the in- in-orssssin watermarks. The TPR for the PRC watermark drops after the FID reaches 75; this corresponds to the JPEG 20 attack, of which we give an example in Figure 4.
Non-Attacked
JPEG Attacked
Figure 4: Example images under the JPEG 20 attack with PSNR of 28.39. Notice the blurriness and lack detail in the attacked image.
4.5 SECURITY OF THE PRC WATERMARK UNDER SPOOFING ATTACKS
To test the spoofing robustness of different watermarks, we followed the approach Saberi et al. (2023), aiming to classify non-watermarked images watermarked (increasing the false positive rate). Spoofing attacks can damage the reputation of generative model developers by falsely attribut- ing watermarks images. We used PGD-based (Madry al., 2018) method similar that of the surrogate model adversarial attacks, flipping the surrogate model's prediction from un-watermarked watermarked. Just with the adversarial surrogate attack, this attack cannot work against any undetectable watermark such as PRC watermark. We present our results in Figure 11.
4.6 POSSIBILITY OF EXTENSION
The PRC watermark can also be applied to other generative models, particularly those sampling from Gaussian distributions. We have set up demo experiment working for traditional VAE models, as detailed in Appendix D. We would also be interested to see the PRC watermark applied to emerging generative models such Flow matching (Lipman et al., 2022); whether not this is possible hinges only on the existence of a suitable Recover algorithm.
5 CONCLUSION
We give a new approach to watermarking for generative image models that incurs no observable shift in the generated image distribution and encodes long messages. We show that these strong guarantees do not preclude strong robustness: Our watermarks achieve robustness that competitive with state-of-the-ar schemes that ineur large, observable shifts in the generated image distribution.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Ali Al-Haj. Combined dwt-det digital image watermarking. Journal of computer science, 3(9): 740-746, 2007.
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. WAVES: Benchmarking the robustness image watermarks. In Forty-fors International Conference on Machine Learning, 2024.
Kasra Arabi, Benjamin Feuer, R Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two-stage robust watermarking for images. arXiv preprint arXiv:2412.04655. 2024.
Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compression with a scale hyperprior. arXiv preprint vrXXiv:802.0// 2018.
Joseph R. Biden. Executive order on the safe, secure, and trustworthy develop- ment and use of artificial intelligence, October 2023. URL https://www //www. whi whitehouse, gtw/booieiiiggge executive-order on the-teeeeee safe- sacer-eeuure-eee ott.aa/wwwa...ta.taaata..aaeeeaa
Accessed: 2024-09-24.
California State Legislature. California Assembly Bill AB-3211 California Digital Content Prove- nance Standards, February 2024. URL https: /tapss:/legiscan.. wwwc Cttp/////ttttteeeeeeeeeeeeeeeett http///tex////11////// 1d/29841 95. Accessed: 2024-09-24.
Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized Gaussian mixture likelihoods and attention modules. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 7939-7948, 2020.
Miranda Christ and Sam Gunn. Pseudorandom emrrr codes. IACR Cryptol. ePrint Arch., pp. 235, 2024. URL https: :
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In Shipra Agrawal and Aaron Roth (eds.), The Thirty Seventh Anmual Conference on Learning Theory, June 30 July 3, 2023, Edmonton, Canada, volume 247 of Proceeulings of Machine Learning Re- search, pp. 1125-1139. PMLR, 2024. URL http::::/tttceeeeeeeeeeee wtt.eedd.....m.....sss////7 press/v247/ christ24a, html.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. RingID: Rethinking Tree-Ring Ring watermarking for enhanced multi-key identification. arXiv preprint arXiv:2404. 14055, 2024.
Ingemar J. Cox, Matthew L. Miller, Jeffrey A. Bloom, Jessica Fridrich, and Ton Kalker. Digital Watermarking and Steganography. The Morgan Kaufmann Series in Mul- timedia Information and Systems. Morgan Kaufmann, Burlington, second edition, doi: http::/doi.org// http://d....r/0..00166//777/700 12--09999777811-7-27------- X5001-3. URL https: /wwww sct scissceieeee.. encedi rect. com www/book/ccocccccccccooooooccooo hamm//bokk//70112225555 and-
2008. ISBN 978-0-12-372585-1
seggital-wateearrkke wtt.:iiiinnnndddsggnnageeeeeeeee steganography.
European Union. Artificial Intelligence Act: Regulation (FU) 2024/1 689 and of the Council, June 2024. URL https: //er:////rrreeee lex. europa. eu/ hal/egall-- contalccooeen///// EX/TXT// / ?uri i Serri-CLLn CELEX: 3202 4R1 689. Accessed: 2024-09-24.
of the European Parliament
Xiequan Fan, Ion Grama, and Quansheng Liu. Exponential incqualities for martingales with appli- cations. Electronic Journal of Probability, 20, 01 2015. doi: 10.1214/EJRPv0- 3496.
Pierre Fermandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Wa- termarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 9054-3058 IEFF, 2022.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 22466-22477 2023.

---

Published as a conference paper at ICLR 2025
Surendra Ghentiyala and Venkatesan Guruswami. New constructions of pseudorandom codes. Cryp- tology ePrint Archive, Paper 2024/1425, 2024. URL https://eprritt: wwwp:priiiiiiit....o.m.mmoom...t waa...i....... (tw.a...or//22/ 1425.
Noah Golowich and Ankur Moitra. Edit distance robust watermarks for language models. IACR Cryptol. ePrint Arch. pp. 898, 2024. URL https: /epprrrnn.... iicrr org/ 22/2422248..
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompt image editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. GANs trained by two time-scale update rule converge local nash equilibrium. Advances in neural information processing systems, 30, 2017.
William Holt and Duy Nguyen. Essential aspects to Bayesian data imputation. SSRN Elec- tronic Journal, June 28 2023. Available at SSRN: http://ssm.commaastttt-44444 or
Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of DPM-solvers. CoRR, abs/2311. 2023. doi: 1048850/ARXW2211...3377. URL httpt:tt//ooooo wttp://o..............//.//1.../ www.w//ww00.0..... http:/aawwvv......11... 2311.18387.
Matt Hostetter. Galois: A performant NumPy extension for Galois fields, 11 2020. URL https:
//github. wwc.uu.ccommne www.m//moostttte/gg....o
Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. CoRR, abs/1312.6114,
2013.
Will Knight. ready over. openai-ceo- www-aammmaaa...mm ala--aaamaanttta age- -t--ggann-----dll---------------
OpenAl's CEO says
the age of giant Al models is al-
Wired, 2023. URL https: //t:://wwww www. wid com/story/
Tsung-Yr Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft COCO: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740-755, Springer, 2014.
Yaron Lipman, Ricky TQ Chen, Heli Ben Ben-Hamu, Maximilian Nickel, and Matt Lc. Flow matching for generative modeling. arXiv preprint 21100:2210002747, 2022.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Large-scale celebfaces attributes (celeba) dataset. Retrieved August, 15(201 8): 2018.
Cheng LU, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. DPM-solver: A fast ODE solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-5787. 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-det-svd based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE'OO 08), pp. 271-274. IEEE, 2008
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp- PMLR, 2021.
12

---

Published as a conference paper at ICLR 2025
Joschka Roffe. LDPC: Python tools for low density parity check codes, 2022. URL https:
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Tate Ryan-Mosley. How generative AI is boosting the spread of disinformation and propaganda. MIT Technology Review, 2023. URL
wow.eeneeeoyreeeeeee.o..e com/2023/ 2023/
rmntiion...i.nniioi In new report, Freedom House documents the ways governments are now using the tech to amplify censorship.
10/04/100 1ee00//ggeeatiiin ai
Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of Al-image detectors: Fundamental limits and practical attacks. In The Twelfth International Conference on Learning Representations, 2023.
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training GANs. Advances in neural information processing systems, 29, 2016.
Deepa Seetharaman and Matt Barnum. There's tool to catch students cheating with ChatGPT. OpenAl hasn't released it. The Wall Street Journal, 2023, URL https: /wwww wsj. com/ aachh/ii/peennn too--oooooociioooo www.-hhtttthhhheecceeee -tw.iiiii---i...--11101101
Jaaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representations, 2021.
Matthew Tancik, Ben Mildenhall, and Ren Ng. StegaStamp: Invisible hyperlinks in physical pho- tographs. Proceedings of the IEEF/CVF conference on computer vision and pattern recogni- fion, pp. 21 17-212,,, 2020.
Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226-22 226,62277222 2022.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-Rings watermarks: In- visible fingerprints for diffusion images. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine (eds.), Advances in Neural Information Processing Sys- tems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 16, 2023, 2023.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Wei Ming Zhang, and Nenghai Yu. Gaus- sian shading: Provable performance-lossleer image watermarking for diffusion models. CoRR, abs/2404.04956, 2024. doi: 10.88550ARXXV.2204.05555 URL httpps://dl org/10. 4 48550/arxiv 2404 4. 04956.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint 11Xiv:1909.01285. 2019.
Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Robust image watermarking using stable diffusion. arXiv preprint arXiv:2401.04227, 2024.
Richard Zhang, Phillip Isola, Alexci A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018 pp- 586-595. Computer Vision Foundation / IEEE Computer Society, 2018
Yuxin Zhang, Nisha Huang, Fan Tang, Haibin Huang, Chongyang Ma. Weiming Dong, and Chang- sheng Xu. Inversion- based style transfer with diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10146-10156, 2023.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Li. Li. Invisible image watermarks are provably removable using generative AI. arXiv preprint 1.X.v:2300601953.. 2023.
13

---

Published as a conference paper at ICLR 2025
Figure 5: Robustness of various watermarking schemes. PSNR and SSIM are used to measure the similarity between a single original image and attacked image. FID is used to measure distance between the distribution of un- watermarked images and attacked images. The vertical dotted red line in the FID plots is the FID for un pertturredd watermarked images. Note that the strange behavior of the FID for certain watermarks under the Degge-DDffuusin attack can be explained by the attack simply correcting its own errors.
Trairing
Training Accuracy Over Epochs
Acouracy Over Epochs
100
0.5
50
Sanhett02
Accuracy (72)
Akcehid
3
VUGIS
Reshed50
70
0.2-
(nstvet)))
Alohht
VG616
0.0
Spach
E1001
Spach
Figure 6: Training various models to detect the PRC watermark without the key.
Training
Training Epochs
Validation Over Epocts
1912
0.5
Fecring koys
0.4
Caur in Stacing 2 leys
StegaStamp 2 keys
Aetuieyy (50
Accurnyy (80)
PAC
Teesiig kay
PAC
Caumter Stadro? kays 510ja50am
0.2
Their na? keys
60
shol by keys
StepsStamp3
Spach
Tairing Loss Over Epachs
Training Accuraty Over Epochs
Validation Accuracy Dver Epochs
PRC
200
0.5-
Tearig keys
Caussian Shating 10 keya
0.4-
Stey keys
Dccuenty
0.3
Prepsita 12
StagsSttime
Figure 7: Detecting other watermarks with two (top) and ten (bottom) keys used at random, using ResNet18. Even with ten keys, ResNet18 8 quickly learns to detect the watermark for all schemes except ours with significant advantage.
A ADDITIONAL EXPERIMENT RESULTS AND DETAILS ON ROBUSTNESS
A.1 ADDITIONAL EXPERIMENT RESULTS
The figures included in this section are:
14

---

Published as a conference paper at ICLR 2025
Figure 5, a comprehensive evaluation of watermarking schemes under the attacks described in Appendix A.2.
Figure 6, testing the ability of various models to detect the presence of our PRC watermark without knowing the key.
Figure 7, testing the ability of ResNet18 detect other watermarks when 2 keys 10 keys are used - ie., each sample is generated by first choosing a random key and then generating watermarked image according that key.
Figure 8, the performance of the emhedding attack on in-processing watermarks.
Figure 9, brief evaluation of the robustness of our PRC watermark with 2.
Figure 10, a brief evaluation of the robustness of our PRC watermark decoder for 512 bits.
Figure 11, the performance of the spoofing attack against in processing watermarks.
Figure 12, example images under the embedding attack.
Figure 13, example images for the variability results.
Figure 14, the length messages which can be reliably encoded and decoded with out PRC watermark when there is no watermark removal attack.
Embeddinng Attack
10
TPR 01
0.4
StagaStamp WM Gaussian Shading WM Tree: Ring WM
02
PRC WM
Figure 8: Embedding attack for different watermarks. Only the PRC watermark can attain FID below a certain threshold. Above this threshold, StegaStamp is the strongest scheme we tested against the embedding attack. The embedding attack is quite powerful, as assumes the attacker knows the VAE used in the diffusion model for embedding latents. However, its effectiveness could be mitigated by employing an adversarially robust VAE encoder keeping the VAE component of the diffusion model private.
R
Regen
1.0
1.0
1.0
0.8
0.8
0.7
0.7
0.7
0.6
1-2
0.5
1-2
0.6
0.5
0.5
Pottrbation
Perturbation
Figure We observe improved robustness for
15

---

Published as a conference paper at ICLR 2025
Decode Detect for Regen/llE-S Attack
Detect for Regen-AE-- Miaak
Decode Detect for Attck
1.0
1.0
1.0
0.9
0,9
0.9
0.6-
Detect
Dotect
0.5
0.5
0.5
Perturaation
Perturbation
Perfurtastion
Figure 10: Comparison between robustness of the decoder for 512 bits and the detector. The detector is faster and consistently more robust than the decoder, but the detector does not recover messages the watermark. The TPR for the decoder is the rate which the message correctly decoded.
Spoofing Attack
StegaStamp WM Adv
StegaStamp WM Adv-Dif--Key
Gaussian Shading WM Adv
FPR
Gaussian Shading WM Adv-DiffKey
Tree-Ring WM Adv
0.
Tree-Ring WM Adv- Diff-Key
PRC WM Adv
PRC WM Adv Keyf
100
110
FID
Figure 11: Spoofing attack results. Tree-Ring and StegaStamp are vulnerable to spoofing attacks. Even with the target FPR set to 0.01, adversaries can significantly raise the FPR, causing the water- mark detector to misclassify unwatermarked images as watermarked, which can damage the water- mark owner's 's reputation. The spoofing attack does not affect undetectable watermarks like the PRC watermark.
16

---

Published as a conference paper at ICLR 2025
(a) Original image
(b) Strength
(c) Strength 4
(d) Strength 6
(e) Strength 8
Figure 12: Example images under the embedding attack. Even the strength-2 embedding attack, for which the PRC attains detection rate of over 95%, noticeably deteriorates the image quality on close inspection.
17

---

Published as a conference paper at ICLR 2025
Image without Watermark
Gaussian Shading WM
PRC WM
Figure 13: Images for the prompt "close-up up photo of a beautiful red rose breaking through cube made of ice, splintered cracked ice surface, frosted colors, blood dripping from rose, melting ice, Valentine's 's Day vibes, cinematic, sharp focus, intricate, cinematic, dramatic light". Notice that the flower is always in the same place under the Gaussian Shading watermark.
Decoding Messages Embedded in the Watermark
1.0
Decoding Success Rate
0.8
0.6
0.4
0.2
0.0
1500
2000
2500
3000
3500
4000
Message Length
Figure 14: Testing the decoder for large message lengths with no adversarial perturbations. The PRC watermark parameters we used for this experiment are
4, F 1e-9, and a 0.
18

---

Published as a conference paper at ICLR 2025
A.2 DETAILS ON ROBUSTNESS
We applied a range of attacks, categorized into photometric distortions, degradation distortions, regeneration attacks, adversarial attacks, and spoofing attacks. Each type described in detail below.
Photometric distortions. We applied two photometric distortion attacks: brightness and contrast adjustments. For brightness, we tested enhancement factors of [2, 4, 6, 8, 12). where factor of 0.0 results in a completely black image, and 1.0 retains the original image. Similarly, for contrast, we used enhancement factors of [2,3, 4, 5, 6, 7]. where factor of 0.0 produces a solid gray image, and 1.0 preserves the original image.
Degradation distortions. Three types of degradation distortions were applied: Gaussian blur, Gaussian noise, and JPEG compression. Specifically:
Gaussian Blur: We varied the radius from [2, 4, 6, 8, 10, 12].
Gaussian Noise: Noise was introduced with a mean of 0 and standard deviations of [5, 10, 15, 20, 30).
JPEG Compression: Compression quality was [10, 20, 20, 40, 50, 60), with lower quality
levels leading to higher degradation.
Regeneration attacks. Regeneration attacks (Zhao et al., 2023) alter an image's latent represen- tation by first introducing noise and then applying denoising process. We implemented two forms of regeneration attacks: diffusion model-based and VAE-based approaches.
1base model as the back- bone and conducted [10, 20, 30, 50, 80, 100, 150, 200) diffusion steps attack the image. As the number of steps increased, the image diverged further from the original, often causing a perfor- mance drop. Interestingly, for the FID metric, we observed that more diffusion steps sometimes improved the FID score, as the diffusion model's inherent purification process preserved a natural appearance while altering textures and styles.
Diffusion Model Regeneration: We employed the
VAE-Based Regeneration: We used two pre-trained image compression models from the Com- pressAl library "0 Bmshj2018 Ballé al. (2018) and Cheng2020 Cheng et al. (2020), referred to as Regen- Begen-VAE-B VAE-B and Regen-VAE-C, respectively. Compression factors were set to [1, 2, 3, 4, 5, 6). where lower compression factors resulted in more heavily degraded images.
Ad Adversarial attacks. We also explored adversarial attacks, focusing on surrogate detector-based and embedding- adversarial methods.
Surrogate Detector Attacks: Following (Saberi et al., 2023), trained ResNet18 model (He et al., 2016) on watermarked and watemmaerdd images to act as a surrogate classifier. Specifi- cally, train the model for 10 epochs with batch size of 128 and learning rate of le-4. Using this model, we applied Projected Gradient Descent (PGD) adversarial attacks (Madry et al., 2018) on test images, simulating an adversary who knows either un-watermarked images and water- marked images (Adversarial-Clss, or watermarked images with two different keys (Adversarial- Cls-Diff- Key). The goal was perturb the images with key such that the detector misclassifies them as being associated with the other key. The attack was tested on four watermarking methods: Tree-Ring, Gaussian Shading, PRC, and StegaStamp watermark, with epsilon values of [4, 8, 12). Since the PRC watermark is undetectable, we find in Figure that the surrogate classifier cannot even be trained!
Embedding Based Adversarial Attacks: Adversarial perturbations were also applied to the im- age embedding space. Given encoder X' 2 that maps images to latent features, crafted adversarial images Tadv to diverge from the original watermarked image I, constrained within an Lo perturbation limit. This was solved using the PGD algorithm (Madry et al., 2018). The VAE model for the original diffusion model stabilis witiiliiil///iii teteaaa/ddvaaee sd-vae-aaeee ft-mse was as- sumed be known for this attack.
Phttps: :// thub. com/ Interbigiiinn tal tal
Ine/CompressA
19

---

Published as a conference paper at ICLR 2025
B THE PSEUDORANDOM CODE
We use the construction of a PRC from Christ & Gunn (2024), which is secure under the certain- subexponential hardness of LPN. The proof of pscudorandomness, assuming the 2-(vA) hardness of LPN, from the technical overview of Christ & Gunn (2024) applies identically here. The PRC works by essentially embedding random parity checks in codewords. The key generation and encoding algorithms are given in Algorithms and
Algorithm 1: PRC. KeyGen
Input: message length, F.t
Output:
PRC key
/* Set parameters
A - [log2 (3)]:
4 1 1-12111-,
num test bits + flog2 (1/F)];
+- message length + À + num_tes bits;
n X;
max_bp-iter + logg nl::
Sample randomness to ensure low false-positive rate +/
Sample uniformly random vectors otp E F2 and testbits (F2)ttnttss,,
/* Sample generator matrix and parity-check matrix
Sample a uniformly random matrix Go E F F
for r)) do
Sample random (1 1)-sparse vector wy F2 1n-rt-11
G
G
w Go
w/ + w 1, "]
13 Let P be the matrix whose are wi...., wr and let G + G
G 14 Sample random permutation II F2X" and let P +- P IIG
15 <- (n, message_ lengt,, F, 7,4,,, X, v, bits, k, max_ maxier_i otp, testbits, G, P);
16 Output
Algorithm 2: PRRC.
Input: k, m
Output: PRC codeword c
Parse
(n, message__engee length, F, 7, X, 1,, num_test_bite k, max_bp_iter, otp, testbits, G, P) + k;
Sample uniformly random vector E BA;
y + (testbits, r, m);
Sample e ~ Ber(n,
f- Gy @ e ( otp;
Output
Since the work of Christ & Gunn (2024), at least two new constructions of PRCs have been intro- duced using different assumptions (Golowich & Moitra (2024); Ghentiyala Guruswami (2024)). would be interesting see if any of these new constructions yield image watermarks with improved robustness.
The main difference between the PRC used here and the one from the technical overview of Christ & Gumn (2024) is that ours is optimized for our setting by allowing soft decisions on the recovered bits. That is, PRC.Detect takes in not bit-string but vector of values in the interval [-1, 1]. If the PRC codeword is c, then s; should be the expected value (-1)5 conditioned on the user's ob- servation. We present PRC.Detect in Algorithm 3 and explain how designed it in Appendix C.1.
20

---

Published as a conference paper at ICLR 2025
Algorithm 3: PRC.Detect
Input:
Output: Detection result True or False
Parse
(n, gressagelengthi F, X, 7,, num_test.biss, max. max.b..iter, otp, testbits, G. P) k; For E [n]], let 8; + (-1)osp: (1- (1--2)) 27) 3,5
For each parity check E P. let Sw I. 81
C Ewep log"
1+8 1-8.
if
1 + Su
S
Σ log
V'llo(1/E)))
Σ log 4
2
then
Output True;
else
Output False;
Christ & Gunn (2024) show that any zero-bit PRC (i.e., PRC with Detect algorithm but Decode) can be generically converted to one that encodes information at linear rate. However, that construction requires increasing the block-length of the PRC, which could harm the practical performance of our watermark. Instead, we use belief propagation with ordered statistics decoding directly decode the message. Note that belief propagation cannot handle constant rate of errors if the sparsity is greater than constant; therefore, this only works when Recover produces an accurate approximation
the initial latent. Still, since our robustness experiments use small sparsity of = 3, we find that our decoder functions even when the image is subjected to significant perturbation.
Algorithm 4: Decode
Input:
Output:
Decoded message m E 1) None
Parse
(n, Eaassage_lnngthe F,t, f, X, 7,, teitt_ttst_bitt... k, max.bp.iter, otp, testbits, G, P) k; For E [n]], let 8; + (-1)otp:
2n) s5
y +
s);
Parse (testbits', r, m) y:
if testbits' testbits then
L
Output m;;
else
Output None;
The only parameters that need to be set in PeC.KeyGen are:
n, the block length, which the dimension of the image latents in the PRC watermark. Holding the other parameters constant, larger n will yield more robust PRC.
message.enngth, the length of messages that be encoded by PRC..nc Mossage_lengthe yields less robust PRC.
Increasing
F, the desired false positive rate. We prove in Theorem 2 that the scheme will always have a false positive rate of most F. as long as the string being tested does not depend on the PRC key.
I, the sparsity of parity checks. Larger yields undetectability against more-powerful adversaries, but decreased robustness.
For watermark detection and decoding, we allow the user to set an estimated error a. This should be the standard deviation of the error z' that the user expects. In cases where the watermark does
21

---

Published as a conference paper at ICLR 2025
not need be robust to perturbations of the image, default of /3/2 which found to be effective for robust watermarking.
set 0. a is not set by the user,
use the Galois package of Hostetter (2020) for conveniently handling linear algebra over F2. We the belief propagation implementation of Roffe (2022) to decode messages in the watermark.
C DETAILS ON THE PRC WATERMARK
Watermark key generation, Algorithm 5, exactly the same as PRC key generation.
Algorithm 5: PRCWat.KeyGen
Input: message,_ength, F,
Output: Watermarking key k
< PRR. message__engee F,t);
(n, message length, F,t, X, num ttst.ttsssts.......... k max bp-iter otp, testbits, G, P) t k;
Output
Watermarked image generation works by sampling the initial latents to have signs chosen according to PRC codeword. If message is to be encoded in the watermark, the message is simply encoded into the PRC.
Algorithm 6: TRCWat.Sample
Input: Watermarking key and message m
Output: Generated image
PRC. Encoeek, m); f
Sample Σ ~ No0 I,);
for [n] do
L Σ
x < Generate( π., 2);
Output æ;;
Our detection algorithm PRC.Detect is given in Algorithm 3, In Appendix C.I we will explain how we designed the detector, and Appendix C.2 we will prove Theorem which says that PRC.Detect and PRC.Decode have false positive rates of at most F. Note that PRC.Decode is guaranteed to have a false positive rate at most F simply because of testbits.
Algorithm 7: FRCCWat.Dtter
Input: Watermarking key k, image æ. and estimated error Detection result True or False <- Recover(2:);
Output:
for i E [n] do
S; erf (1
result <- DRC.Detect(k, 8);
Output result;
C.I DESIGNING THE WATERMARK DETECTOR
Let z the initial latent and z' be the recovered latent. We will compute the probability that a given parity check w is satisfied by sign(z) x) (after accounting for the noise and one-time pad), conditioned on the observation of z'. In order for this to be possible, we need to model the distributions of z and z': We (0, In) and z' ~ A(2, II,) for some > 0.
22

---

Published as a conference paper at ICLR 2025
Algorithm 8: FRRCWatDecode
Input:
Watermarking key k, image æ, and estimated error o
Output: Decoded message m E {0, 1 ) or None
< Recover(2:); for i [n] do
8i erf (202
result < PRC. (RC.Dec 8);
Output result;
Crucially, when bound the false positive rate in Appendix C.2, will do it in way that does not depend on the distribution of z'; we only use the facts that z ~ (0, I,) and z' ~N I²I,)) inform the design of our detector. In other words, Theorem holds unconditionally, even though our detector is designed to have the highest true positive rate for particular distribution of z'.
Our first step is compute the posterior distribution on sign(2) conditioned the observation z'.
Fact 1. If 2 NNO 1) and z' (2z then
E[sign(2) | 2'7 = crf
22 [1 02)
Proof. The joint distribution (2,
( )~~~ N (
1 1=
Using the formula for the conditional multivariate normal distribution," !! the distribution condi- tioned on z' is
z' σ²
N~N N
1+ 1+
Therefore
Pr[a 2 0 0 where & is the cumulative distribution function of the standard normal distribution,
B[sign(2) x²] = 2 Pr[z
2'1 -1
24h
avv + 0²
= erf
12 02)
where we have used the fact that 4(x) = (1 + erf(x/ 22))/2.
Recall from Algorithm 2 that, in the PRC case, generate the ith bit of the PRC codeword sign by XORing the vth bit of a vector satisfying the parity checks with random e; ~ Ber(1) variable and the ith bit of the one-time pad otp,. Therefore we have
2f (10 02)
(tt, Ocg sign(z:) = = (-1)otp: (1- 11-211 22)) erf
Let
z (1 +2)
$; E[(11) sign(2:) | = (1 27) erf
See,, for instance, (Holt & Nguyen, 2023, Theorem 3).
23

---

Published as a conference paper at ICLR 2025
for each i [n]] Let aw = [ v ( (-1) and Sw [[ 8, for P. Then (1+
the probability that (-1)otpébe sign(z) satisfies w.
Our detector simply checks whether
log II WEP
+ Sw
Σ
log
aw Sw
2
WEP
is greater than some threshold. We set the threshold by computing a bound on the false positive rate.
C.2 BOUNDING THE FALSE POSITIVE RATE: PROOF OF THEOREM 2
To compute a bound on the false positive rate of the detector, we use a "bounded from above" version of Hoeffding's 's inequality due to Fan et al. (2015);
Fact 2 (Corollary 2.7 from Fan et al. (2015)), Let XI...., Xx E IR be independent random variables such that EX;; = 0, X; S bú, and EX? 2 bg. Then
72
Pr
$ exp
2 EX?
We ready prove Theorem 2. We state the theorem for the PRC detector and decoder; note that this immediately implies the same result for the PRC watermark detector and decoder.
Theorem 2. Let n, E N and F O. For any string $ E [-1,1]]
Pr k--PPR..Keyeemnnnn tn, (PRC.Detect(k, 8) True] S F
and
Pr k~>RC KeyGe..KeGennntt.FF
PRC.Decode(k, 8) + None] S
Proof. Observe that the use of testbits immediately implies that Detect has false positive rate of at most F, i.e.
Pr PRC.R.eeGGenff
PRC.Decode(k, s) * None] <
We therefore turn to analyzing the false positive rate of PRC.Detect. We adopt the notation from Appendix C.I. with
Oaw [-1)00 and &
II
85
jEW
jEw
for each w P.
By construction of the parity check matrix, the parity checks E are linearly independent. Since otp is uniformly random, it follows that the values ow are independent and uniformly random from (-1,1). Therefore by Fact it suffices show that
Pr a 1-111
Σ log LWEP
2 (Clog(L/F)+
1 Σ log
1
52
<
F
WEP
where r is the number of parity checks in P and C' = Ewe log²
1+8m 1-8w
Let
fw (aw) 1 + &w for each w P. Since a is random, each faw is uniformly random from (1 + S 1/2.
Let
log fio (uw) log fw [1) + log fao (-1)
X
2
24

---

Published as a conference paper at ICLR 2025
and
log fw + log fao (-1)
Dw
max vE(-1,1)
log (v()
log fw log fool (wo(-1)
2
Then Xw I bw and
EX
E [ 2
log foo(1) log fw (-1)
2
8
Applying Fact 2, we find that
log (1) + log ful (wo
Σ
log fw (aw) 2
Σ
S exp (-72/0)
2
WEP
WEP
where C = 2
EX2 By the definition of Sw.
log Lw (1) + log (-n(-1)
1
1
8
log
2
and
+ Sw
EX2
log"
1 8.
Therefore
1 52
]
Pr
Σ
log f fun(er))
2 2T
log
< exp (-72/C)
where C = log²
1 I-
The claim follows by setting -= /Clog(1/F).
C.3 PRACTICAL UNDETECTABILITY
We have not yet discussed the extent to which our scheme is undetectable for practical image sizes. As observed by Christ et al. (2024), the undetectability of any watermarking scheme can be broken with enough samples and computational resources: Undetectability just means that the resources required detect the watermark without the key scale super- polper--olyomillly with the resources quired to detect the watermark with the key. And under the same assumptions as in Christ & Gunn (2024), scheme is asymptotically undetectable for the right scaling of parameters. We refer to scheme as "undetectable" because of this, and because our experiments on quality and detectability demonstrate that it undetectable enough for the main practical applications. However, for the specific, concrete choices of parameters used in our experiments, undetectability is not guaranteed against motivated adversaries.
For the PRC watermark, there exists a brute-force attack on undetectability that runs in time O(n'-1), counting queries the generative model as (1), where the dimension of the im- age latents and / is the sparsity of parity checks which can be set by the user (larger / decreases the robustness). This attack works by simply iterating over I-sparse parity checks until one used by the watermark is found. We did not attempt to optimize the attack. so it is possible that faster attacks could be found.
In experiments have 24 dimensional image latents, and we set = 3 for most of our experiments demonstrating robustness. To ensure cryptographic undetectability. a better choice would be t log, (n)/2 7. The watermark detector still works with t for non-perturbed for most experiments because of the improved robustness. Note that
images, but we choose Onn²) is far greater than the O(1) time required detect prior watermarks without the key, but
25

---

Published as a conference paper at ICLR 2025
Images without Watermark
Images with PRC Watermark
Figure 15: Comparison of unwatermark and PRC watermark images on VAE.
motivated adversary can still break the undetectabilityy of our scheme. We therefore stress that our scheme, in its current form, should not used for undetectabilty--ritiiaa applications such as steganography.
The reason there exists a relatively fast brute-force distinguishing attack against our scheme that there exist quasi-poly polyyomial time attacks against the PRC of Christ & Gunn (2024). The alternative constructions of PRCs due to Golowich & Moitra (2024) and Ghentiyala & Guruswami (2024) also suffer from quasi-polynomial time attacks. It is interesting open question construct PRCs time attacks; using our transformation, any such PRC would
that do not have generically yield watermarking scheme with improved undetectabilitty We hope that generative image model watermarks with improved undetectability can be built in the future.
D DEMO: PRC WATERMARK FOR VAES
The PRC watermark can be applied to VAEs (Kingma & Welling, 2013) as well. Using the same gradient descent technique Hong et al. (2023), we optimize the latent obtain the decoder inver- sion result for watermark detection. We test the PRC watermark on VAE with a 256-dimensional latent space, trained on the CelebA dataset (Liu al., 2018). By setting we achieve over 90% TPR when embedding a zero-bit bit PRC watermark in the images. We show example generated images Figure 15. We did not investigate the robustness or quality the PRC watermark for VAEs in-depth, this section is only to demonstrate the generality of our technique.
2 and FPR 0.05,
26


Reviews:
[{"review_id": "iBnI38xNoL", "reviewer": "Reviewer_EiMf", "summary": "This paper presents an undetectable watermarking method for generative image models. The proposed PRC watermark aims to embed a cryptographically pseudorandom pattern that is robust, quality-preserving, and indistinguishable from adversaries without the detection key. Additionally, the PRC watermark can encode long messages, such as timestamps or IDs, without compromising image quality. Experimental results demonstrate that the PRC watermark maintains image quality and is difficult to detect or remove without significant quality degradation, making it a promising solution for embedding undetectable, robust watermarks in AI-generated images.", "questions": "Please see above.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. This paper provides an undetectable image watermark method, which is novel.\n2. This paper provides sufficient theoretical and empirical support.", "weaknesses": "1. For Figure 2, this paper evaluates the undetectability of different watermarking methods. Could authors specify how many different keys other watermarking methods use? And if increasing the key numbers will increase the undetectability?\n\n2. PRC.Encode_k is interesting, but it would be good for authors to explain how to sample a PRC codeword using PRC.Encode_k  in more detail. It should be an important part of this paper, but only Algorithms 1 and 2 in the Appendix are not enough for the reader to understand it.\n\n3. Section 4.5 describes the security of PRC watermark under spoofing attack. The experimental results are in the Appendix; it would be good for the authors to specify where the corresponding experimental results are in Section 4.5. Moreover, the number of keys used for other watermarking methods in Figure 8 is also not specified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rybatNzgvd", "reviewer": "Reviewer_zDzs", "summary": "The paper introduces an undetectable watermarking scheme for generative image models, which ensures that no adversary can distinguish between watermarked and un-watermarked images while preserving image quality. It utilizes a pseudorandom error-correcting code to embed watermarks at the semantic level, making the scheme robust against various removal attacks and capable of encoding long messages.", "questions": "1. I understand the key idea of this work is quite similar to Tree-Ring watermark, i.e., selecting the initial noises of a diffusion model so that them can be later detected. However, a point of concern arises regarding the feasibility of completely altering the signs of the initial noise. Based on the provided examples, images without any watermark and those embedded with the PRC watermark exhibit significant differences, including distinct content variations. This raises the question of whether such discrepancies would be acceptable to companies and end-users in practical applications.\n\n2. Is the implementation of Stable Signature correct in this work? As far as I know, images watemarked by Stable Signature should not display substantial differences from unwatermarked images because Stable Signature does not modify the initial latents.\n\n3. The definition of ‘undetectable’ used in this study requires clarification. Based on the data presented in Table 1, the PRC watermark appears marginally more effective than prior watermarking methods concerning metrics such as FID, CLIP score, and Inception Score; however, the observed improvements are not pronounced. If the PRC watermark is claimed to be the first undetectable watermark, an explanation is needed as to why previous watermarking techniques are deemed detectable, given their competitive metric performance.\n\n4. For robustness part, do you consider some transfer-based or query-based attack? The results illustrated in Figures 5 and 6 indicate that PRC watermarks demonstrate lower robustness compared to methods such as StegaStamp and Gaussian shading watermarks, especially when heavier perturbations are applied. Also note that your metric is TPR@FPR=0.01, and FPR=0.01 is already a very high false positive rate.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. This paper is well-written and easy to follow.\n\n2. The proposed method maintains image quality by embedding watermarks without degrading metrics like FID, CLIP, and Inception Score.\n\n3. The watermarking method can be seamlessly integrated into existing diffusion model frameworks.", "weaknesses": "1. The idea of modifying the initial noise for diffusion is not new. And this method changes initial noise a lot compared to Tree-Ring watermark.\n\n2. This watermark is not as robust as current watermarks such as StegaStamp and Gaussian shading.\n\n3. No significant improvements on metrics.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XdUYn1IeUc", "reviewer": "Reviewer_xnWy", "summary": "The paper uses the pseudorandom code technique to create an pseudorandom initial noise for latent diffusion model. With this noise, the image generated from it is encoded with watermark signal. When reversing a image back to the initial Gaussian noise, the model provider can determine whether this image is waatermarked or not according to the codeword. Since the pseudorandom initial noise is indistinguishable to the real Gaussian noise, this watermark is undetectable compared with existing methods.", "questions": "1. The values of the metrics shown in Table 1 are close for different methods, can you actually say that the proposed method is better than the existing ones? I think a significance test is needed to support this conclusion.\n2. I don't think 500 images are enough for the computation of FID score. Referring to previous work like Stable Signature, at least 1,000 images are needed for getting a reliable results.\n3. The results and image samples for Stable Signature is weird. According to the results of its original paper, Stable Signature should be a watermark that introduces minimal perturbations onto the original image. Therefore, the watermarked image should be highly similar to the original image. However, in the paper, the image samples and results of Stable Signature indicate that the watermarked image is completely different from the original images.\n4. The robustness of the PRC method is not satisfied. From Figure 5, the TPR starts to drop when the PSNR is still larger than 30, which is much worse than StegaStamp and Gaussian Shading.\n5. From the image samples in Figure 1, the image of the PRC method changes the original image a lot.\n6. The evaluation for undetectability is not convincing. The author only uses ResNet-18 to show it can distinguish the watermarked and original images from other method but not the PRC method. However, is it possible that this results only hold for ResNet-18? It means that it is only undetectable for ResNet-18 and it may be detectable for other classifiers.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper introduces the first undetectable watermark.\n2. The authors compare the proposed method with several watermarking baselines.\n3. The robustness of the proposed method is evaluated with several perturbations.", "weaknesses": "1. The experiments are not adequate for supporting that the image quality of the proposed method outperforms existing ones.\n2. The robuseness of the propsed method is not that good from the results.\n3. The proposed watermarking method hugely change the image compared with the original one without watermark.\n4. The evaluation for undetectability is not convincing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MZV6plqYci", "reviewer": "Reviewer_d3g5", "summary": "The paper presents a scheme to embed digital watermarks into the latent space of a diffusion model. The method is based on pseudorandom error-correcting code (PRC): the watermarked image is sampled from the latent vector conditioned on having signs chosen according to the corresponding PRC. In the paper, the guarantees on undetectability and low detection FPR rate are provided, along with the comparison against concurrent watermarking methods both in terms of robustness to removal attacks and quality of generated images.", "questions": "Please see the weakness section.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The paper adapts PRC to the domain of image watermarking and build a robust watermarking scheme with provable FPR upon it. Authors compare their approach against a variety of watermarking schemes both in terms of robustness to different removal attacks as well as of the quality of watermarked images.  \n\nThe method implies provable guarantees on the FPR of the watermark extraction. The method is robust to attack on surrogate classifiers due to experimentally shown undetectability of the watermark. According to the evaluation protocol, PRC watermark retains the decent quality of the generated image, compared to the one of the sota methods.\n\nThe paper is well written, besides minor misprints.", "weaknesses": "1) In Theorem 1, an upper bound for the difference of probabilities is loose. To make a conclusion about undetectability, one has to demonstrate the negligible difference between the detection probabilities on watermarked and non-watermark samples. An upper bound which is close to ½ is unsatisfactory in this case. How one can be improved? \n\n2) The robustness of the watermarks yielded by the method to removal attacks (both synthetic and based on diffusion models) is inferior to the ones of Gaussian Shading, Tree-Ring, StegaStamp approaches. Since the robustness is one of the major requirements of the watermark, it is important to improve it in practice. Namely, one may will to improve the robustness at the cost of the quality metric (for example, by embedding longer messages).   \n\n\nI am willing to increase my score if the authors provide a correction for theorem 1 and additional experiments on robustness to removal attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)