Hidden in the Noise: Two-Stage Robust Watermarking for Images
Authors: Kasra Arabi
Benjamin Feuer
R. Teal Witter
Chinmay Hegde
Niv Cohen
Venue: ICLR 2025 Poster (2025)
Keywords: Watermarking
Primary area: generative models

Abstract: As the quality of image generators continues to improve, deepfakes become a topic of considerable societal debate. Image watermarking allows responsible model owners to detect and label their AI-generated content, which can mitigate the harm. Yet, current state-of-the-art methods in image watermarking remain vulnerable to forgery and removal attacks. 
This vulnerability occurs in part because watermarks distort the distribution of generated images, unintentionally revealing information about the watermarking techniques.

In this work, we first demonstrate a distortion-free watermarking method for images, based on a diffusion model's initial noise.
However, detecting the watermark requires comparing the initial noise reconstructed for an image to all previously used initial noises. 
To mitigate these issues, we propose a two-stage watermarking framework for efficient detection. During generation, we augment the initial noise with generated Fourier patterns to embed information about the group of initial noises we used. For detection, we (i) retrieve the relevant group of noises, and (ii) search within the given group for an initial noise that might match our image. This watermarking approach achieves state-of-the-art robustness to forgery and removal against a large battery of attacks. The project code is available at https://github.com/Kasraarabi/Hidden-in-the-Noise.

Published conference paper at ICLR 2025
HIDDEN IN THE NOISE: TWO-STAGE ROBUST WATERMARKING FOR IMAGES
Kasra Arabi, Benjamin Feucr, R. Teal Witter, Chinmay Hegde, Niv Cohen New York University
ABSTRACT
As the quality of image generators continues to improve, deepfakes become a topic of considerable societal debate. Image watermarking allows responsible model own- ers to detect and label their Al-generated content, which can mitigate the harm. Yet, current toate-of-thh-art methods in image watermarking remain vulnerable to forgery and removal attacks. This vulnerability occurs in part because watermarks distort the distribution of generated images, unintentionally revcaling information about the watermarking techniques.
In this work, we first demonstrate distortion-free watermarking method for im- ages, based on a diffusion model's initial noise. However, detecting the watermark requires comparing the initial noise reconstructed for an image to all previously used initial noises. To mitigate these issues, we propose a two-stage watermark- ing framework for efficient detection. During generation, we augment the initial noise with generated Fourier patterns to embed information about the group of initial noises we used. For detection, we (i) retrieve the relevant group of noises, and (ii) search within the given group for an initial noise that might match our image. This watermarking approach achieves state-of-the-art robustness to forgery and removal against large battery of attacks. The project code is available at https://githhb. com /a///Kaaaaabbb/Hdderr -ineeee---i--eee ientne--eeee the--oise
1 INTRODUCTION
Generative AT is capable of hesiziinnng high-quality images indistinguishable from real ones. This capability can be used to deliberately deceive. Fake image generation have the potential to cause severe societal harms through the spread of confusion and misinformation (Peebles & Xie 2022 Esser et al. 2024 Chen et al. 2024 Ramesh et al. 2021]. In addition, owners of different models and images may want to control the spread of their derivatives for copyright reasons and to safeguard their intellectual property. One way to mitigate these harms is model watermarking. The study of watermarking has a rich history and has recently been adopted for Al-generated content (Pun) let al. 1997 Langelaar et al. 2000 Craver el. al. 1998). For au extended discussion of recent work in this area, we direct the reader to Appendix B Unfortunaelly, most current image watermarking methods are not robust to watermark removal attacks utilizing image diffusion generative models
(Zhao et al. 2023a
Recently, now watermarking methods utilize the inversion property DDIM achieve more ro- bust watermarking (Wen et al. 2023 Ci ct al. 2024 Yang et al. 2024b). These methods embed patterns in a diffusion model's iniiial noise and then detect them in the noise pattern reconstructed from the generated image. This lechnique provides strong robustness against various allacks, mak- ing it ellective al resisting watermark removal attempls. Yet, these prior methods are themsel ves vulnerable to new types of attacks. Tree- Rine-Ring Wen et al. (2023) adds pattern to the initial noise, making it distinct from a random Gaussian initial noise in a way that an attacker can detect Yang et al. 2024a). This may enable forgery attacks, aimed at applying the watermark without the owner's ' permission. Such attacks are often even more concerning than removal attacks, as they can cause severe damage to model owners if their watermark is associated with illegal content.

---

Published a conference paper at ICLR 2025
Store Hemifuble Inttal nohr
seeds ieitel roloe
Use sandom by generste Intill
1'- Un_ MD)
notte: store bey group te
O
8 == 1" %.
TreeRing
Gaussian Shading
WIND
Figure 1: Related walermarking methods. Tree-Ring embeds an identifiable pattern into the initial noise Wen et al. 22023) Gaussian Shading uses user-specific key to seed the initial noise Yang et al. 2024b). Our method, WIND, samples a random key from N options to seed the initial noise. In order to speed up detection time, the key's group is then embedded into the initial noise.
Therefore, there is need for image watermarking methods that generate images that are not distinct from non-waterarrked images (to anyone but the model owner). As suggested by previous works, since the model already takes random noise as initialization, we may initialize it with a pseudo-random noise pattern that we can detect later (Yang et al.) 2024b) Kuditipudi et al. 2023 Namely, reconstructing an approximation of the initial noise used in the diffusion process from a given image allows the detection of the noise pattern used by the model. Although this reconstructed noise is not completely identical to the initial noise, it is much more similar to the initial noise than it is to other randomly distributed noise patterns. Thus, it can serve as a watermark that can be identified in the generated images. A comparison of these watermarking approaches is illustrated in Figure I (see also Appendix for similar ideas used in previous works).
While using a pseudo-random initial noise does not distort the distribution of individual generated images, it may carry information about the watermark when groups of images are examined to- gether. Specifically, works such as Yang et al. (2024b) embeds the watermark in an initial noise such that the resulting generated image comes from the same distribution as non-watermarked images. Yet, when many images generated from the same noise pattern are examined together, the correlation between them may expose that they are not distortion-free as a set. E.g., the average of many Similaly-wwatermarke
images may differ from the average of non non-watermarked ones (Yang el al.] 2024a)). natural solution to this distortion of sets is to use many different. initial noises for each watermark we deploy.
Yet, given a sufficiently small set of initial noises (denoted as N) and an enormous number of images generated by model, an attacker could potentially still collect many images sharing the same initial noise in order to perform removal and forgery attacks as was applied to previous methods (Yang let al. 2024a). Using many initial noises (a large value of N) will make such attacks much more difficul,, if not infeasible. Surprisingly, we find that a very large number of random initial noises remain distinguishable from one another, even after reconstructing the noise from generated image. However, a large value of N might incur a negative effect on the runtime of our approach. In order to lower the effective quantity of noises we need to scan at detection while retaining strong robustness, we propose a two-stage efficient watermarking framework. We supplement our N initial noise samples with M Fourier patterns used as a group identifiers unique identifiers of the subset of initial noises we might have used for generating a given image (Figure 2). During detection, we may first recover the group identifier (stage 1) and use it to find an exact match (stage 2). Thus, we reduce our search space to the number of initial noises per group (N/M). Our key contributions are as follows:
1. We demonstrate that the initial noise used in the diffussio process is itself a distortion-free watermarking method for images (Section 3).
2. We present WIND, our two-stage method for effectively using the initial noise as a water- mark (Section 4
3. We demonstrate that WIND achieves state-of-the-art results for its robustness to removal
and forgery attempts (Section 5
2

---

Published conference paper at ICLR 2025
Watermark Generation
Use random to generate initial noise; store key group noise
Generate image from
Uni .N)
watermarked noise
g
M
N(O.))
Diffusion
Watermarked Image
Watermark Detection
Reconstruct noise
Extract closest key group Ø
Identify closest key in
Inverse Diffusion
Suspect Image
Output "watermarked" iff key i is close to reconstructed noise
Figure 2: Illustration of the WIND Method for Robust Image Watermarking. The method is designed to use possible initial noises partitioned into M groups. Generation: Using a secret salt and an index i", we securely and reproducibly generate initial noise z;- We then embed a group index g" of that noise to make easier retrieval possible using a Fourier pattern. Finally, we run diffusion with the embedded latent noise to produce a watermarked image. Detection: We reconstruct the initial noise ž. Next, we search over the possible group indices for the closest Fourier pattern the one embedded in å. We then look over initial noises in group 9 to find the match.
2
PRELIMINARIES
2.1 THREAT MODEL
In a watermarking scheme we usually consider the owner, trying to mark images as an output their model; and an attacker, trying remove forge the watermark on unrelated images.
The Owner releases a private model (diffusion model in our case) that clients can access through API, allowing them to generate images that contain watermark. The watermark is designed to have a nogligible impact on the quality of the generated images. There are a few settings regarding the watermark delection, including public information and private information watermarking (Cox et al.] 20077 Wong & Memon 2001 We focus on the setting where the watermark is detectable only by the owner, enabling them to verify whether given image was generated by their model using private information.
The Attacker uses the API to generate one image or more and subsequently attempts launch malicious attack aimed at either removing the watermark or forging the embedded watermark into unrelated images, with the intention of using the image or watermark for unauthorized purposes.
2.2 DIFFUSION MODELS INVERSION
Diffusion model inversion aims to find the reconstructed noise representation of given data point, effectively reversing the generative process. Let be the number of diffusion steps both the generation and inversion processes. In the standard generation process, start with noise Xy drawn from an appropriately scaled Gaussian and iteratively apply X, = x + ce where ce is trained model that predicts the noise to be removed and t [T] the time step describing how
3

---

Published conference paper at ICLR 2025
Reconstructed Noise
0.20
Reconstruction Attack
Fraction of Samples
Random Noise
0.15
0.10
0.05
0.00
0.0
0.2
0.4
0.6
0.8
1.0
Cosine Similarity
Figure 3: Cosine similarity distribution between initial noise, and: (i) noise reconstructed from watermarked image generated with the same noise (reconstructed noise) (ii) a noise reconstructed from forged image using a public model to imitate watermarked image (reconstruction attack, described in Section 3). (iii) Random noise. These results are reliant on the approximate inversion of DDIM without the ground-truth prompt.
much noise should be removed in each stage, Conversely, the inversion process begins with data point &o and moves towards its reconstructed noise representation by applying & = &, (X,
This process relies on the assumption that (x(++1) z (Xx)), allowing us to approximately invert
the diffusion process by adding the predicted noise (Ho et al.] 2020 Song et al. 2022). DDIM's
efficient sampling allows this technique to be particularly usetul. (Son et al. 2022
2.3 TREE-RING AND RINGTD WATERMARKS
In order to watermark images in a human- iimpreiiperreptible and robust way, previous works have encoded specific patterns the Fourier space of the initial noise. Tree-Ring (Wen et al. 2023) first. transforms the initial noise into the Fourier space. A key pattern is then embedded into the center of the transformed noise. The noise is subsequently transformed back into the spatial domain. During the detection phase, the diffusion process is inverted, and the Fourier domain is examined to verify the presence of the imprinted pattern. RinglD (Ci et al. 2024] shows that Tree- Tree-Ring struggles to distinguish between different keys. Therefore, the number of unique keys (distinguishable from one another) that can be embedded with Tree- Ring is low. They increase the possible number of unique keys that can be encoded by modifying the patterns embedded in the Fourier domain.
Systematic Distribution Shifts in Generated Images Enable Attacks. Systematic dis- tribution shifts in the generated content make it easier to verify the existence of watermark. However, in the case of Tree-Ring and other watermarking techniques, it also opens up an avenue of attack (Wen et al.] 2023 Yang al.) 20224b Xian et al. 2024 Bui al. 2023). Emblematic the method of Yang et al. 2024a), whose attack approximates the difference between watermarked and non-wan watermarked images by estimating the difference between their averages in pixel space. Increasing the number of images with the watermark can improve the accuracy of the approxima- Lion. Removal altacks typically rely on paired images, but the forgery attack remains effective even when watermarked and non-aalernarked images are unpaired.
4

---

Published conference paper at ICLR 2025
A Algorithm 1 Generation Algorithm
1: Input: N: number of initial noises, M: number of groups, secret salt, p: prompt, O private
model weights
2: Sample initial noise index i" Uni
3: Compute group identifier 9* = i*
> Modulus of initial noise index
4: Calculate embedding of the group identifier (emb(g")
5: Securely generate seed = bash(?".
Apply cryptographic hash function
6: Sample z,- ~ (), from a pseudorandom generator with seed
7: Add the identifier embedding gemb(g") to 2,- to get Zi .mmb
8: return image = Gz(z:- (ea=>_))mb,)))) _emb,
b Diffusion process G with weights θ
Algorithm 2 Detection Algorithm (WIND-fase fast)
1: Input: image:
(possibly) watermarked image, N: number initial noises, M: number groups, secret salt, θ: private model weights, 7: threshold for detection
2: Recover roconstructed noise á = G (image)
b Inverse diffusion with private weights 3: Extract closest group identifier 9 from group identifier embedding in ž
4: for i E [N] such that i%.M = 7 do
A Search over subset of initial noise indices 5: Build initial noise z, using secret salt s and hash
> As in Algorithm
6: Compare to Ž after removing Fourier embedding
7: end for
8: if any noises are closer than threshold then
9: Declare "watermarked"
10: else
11: Declare "not watermarked"
12: end if
3 INITIAL NOISE IS A DISTORTION-FRER WATERMARK
Watermarks that systematically perturb the distribution image generations are vulnerable to removal and forgery attacks. A distortion-free watermarking method, by contrast, may be more robust (Yang et al.) 2024a). Our first finding is that the initial noise already in standard use in diffusion models can be such watermark.
Let N be the number of initial noises we can generate. We will secure our watermarking process with long, secret salt We begin by sampling psuedo-random (reprodueible) initial noise. Let 1 ~ Unif([[N] be the index of the initial noise. We will use a hash function to get seed hash(i", ()) Plugging the seed into a pseudo-random generator, we generate a reproducible initial noise vector z;- ~ (0, I) drawn from centered Gaussian distribution. When we generate fewer than N images, we can use each initial noise most once, and the noise appears distortion-free. We discuss the case when the number of images exceeds N in Appendix F
Empirical validation of initial noise watermarking. To empirically validate our claim that the initial noise can serve as walermark, we will compute the cosine similarity between the initial noise 2,- and (i) random noise z ~ (O, I). (ii) reconstructed noise à when we have access to the private model weights, and (iii) the reconstructed noise gattack from an image imitating our noise pattern without access to the private model weights (we used another checkpoint Stable Diffusion-v2 (Rombach al. 2022). it is the most similar model to the Stable Diffusion 2.1 model we use). We provide the results in Figure g and Table 13 and find that the pattern reconstructed with the private model is indeed significantly more corrciated with the initial noise compared to
5

---

Published conference paper at ICLR 2025
100
100
Accuracy
75
Accuracy
75
Tree-Ring
RineRRnng
50
50
WIND
WIND
25
25
0
5
2000 Number of Images Averaged
5000
2000 Number of Images Averaged
5000
(a) Forgery Performance
(b) Removal Performance
Figure 4: Detection accuracy for forgery and removal attacks using Yang et al. (2024a). A value of 0% represents watermark failure (the attacker successfully removed the watermark or forged it onto another image), while 100% indicates a perfect defense (no watermark removal or forgery occurred).
both a random pattern and a paltern reconstructed with another model. We analyze the resulting probabilistic guarantee under reconstruction attack below.
Watermarking Process. During the watermarking process, we create an image image through diffusion with the private model weights θ conditioned on private text prompt p. Formally, image -Ge(z; Zi- p). We obtain the reconstructed noise that we use for detection via an inverse diffusion process G Formally, غ = Gg (image). If the cosine similarity ~ (ze-, 2) is below a threshold т, we declare the image watermarked.
Reconstruction Attack. An attacker trying to forge the watermarked image will not have access to our private weights, instead, they will have some other weights O' (Keles & Hegde (023) demonstrates that inverting a generative model is a challenging task). Yet, they may attempt to recover the initial noise using a public watermarked image and a public model. Let ž' = GGy (image). Then, with this initial noise, they will generate forged image with (possibly offensive) text prompt y', producing image' = Ger (ø', p'). Finally, the model owner will almemp to detect whether the forged image is watermarked by applying the inverse diffusion process with the private model weights to the forged image. Let gattack = Gg (image'). As an upper bound on the capability of this attack, we perform the adversarial generation with the same prompt.
Strikingly, we find that the similarity between the true noise and the noise reconstructed with the model weights almost always greater than a relatively large threshold 5 0.5 (p value < 10-3 Figure Bh. At the same time, the reconstructed similarity from the image made by an attacker using the reconstruction allack sim(z,, gattac- along with the similarity to random vectors sim(z,,, 2) are both much smaller. Namely, they are respectively below the threshold (Table 13). Taken together, these results mean that the probability p a non- watermarked image mistakenly labeled as watermarked is very low in both cases. For random
5.3 and
9.4 standard deviations
unrelated noise, the probability to confuse it is as the initial noise is p < e < 10-19, allowing for practically perfect detection the correct pattern among a very large number of initial noise instances.
Runtime considerations. Our method requires searching over all N watermarks, leading to a naive runtime complexity of O(N). However, more efficient algorithms for similarity-based search, such as HNSW (Malkov & Yashunin, 2018), can reduce this complexity to Ollog N), at the expense of additional memory usage. For large enough values of N, this cost. may eventually become undesirable. Along with our goal of maintaining high robustness as the number of keys increases, this motivates a more efficient method, which we present in the next section.
6

---

Published conference paper at ICLR 2025
4 METHOD
4.1 WIND: TWO-STAGE EFFICIENT WATERMARKING
While always using the same initial noise for our model might imply good robustness properties against removal, to make forgery and removal more difficult, it is generally preferable to main- tain a large set of N initial noises to be used by the model. Morcover, using a large number of different noises N may serve as different keys, encoding some meladata about each image. This metadata might include information about the specific model that generated it, as well as additional information about the generation for further validation of the image source, once detected.
In order to make the search over a large number of noises more efficient, we introduce a two- stage efficient watermarking approach we name WIND (Watermarking with Indistinguishable and Robust Noise for Diffusion Models). First, we initialize M groups of initial noise, each group associated with its own partier-patten key. In contrast to prior work, we employ these Fourier patterns not as walermark, but as a group identifier to reduce the search space. Blonde onime with blue eyes
Enchanted
Minimalist bonsai acacia
For each image generation, we randomly se- lect an index for the initial noise, denoted as i" E [V]] We use a group identifier g" = iMM, where % denotes the modulus operation. We embed g* in the Fourier space of the latent noise (similar to Wen et al. (2023)). During detection, we reconstruct the latent noise and find the group identifier ğ that is closest to the Fourier pattern embedded in the image. We account for possible rotations and crops in our search (see Appendix H). We then search over all indices such that g = i%MM In this way, the scarch space has size N/M rather than N. We include an algorithm box for generation (Al- gorithm I and detection (Algorithm 2).
Village
WAV W
Tree-Ring
In the following part, we refer to two variants of our method: (i) WINDjast where assume the used initial noise belongs to the identified group I and check similarity only to noise pat- terns in this group. (ii) WINDful where we chock all N possible initial noises if we can't find a match within the detected group (the gap between the similarity of the correct noise and random noises, as shown in Figure 3 allows us to still determine whether the correct noise has been identified). The WIND method is slower but more robust to removal attacks that might interfere with the Fourier pattern. Empirical validation can be found in Section 5 Additional abla- tions and results can be found in Appendix D. We provide empirical runtime analysis of our method Appendix G
RingID
Figure 5:
Qualitative results of watermarked images generated using WIND, Tree-Ring, and RingID. See Appendix D for quantitative results. See Appendix [ for additional qualitative results.
4.2 RESILIENCE TO FORGERY
In addition empirical evaluations of specific attacks as in Figures and discuss below the attacker's ability to infer knowledge about the used noise pattern across different watermarkod images. Even if the attacker is able to obtain information about a specific initial noise z; for an
7

---

Published conference paper at ICLR 2025
Table 1: Comparison of correct watermark detection accuracy between WIND and previous image watermarking approaches under various image translormation atfacks. WIND denotes the of M groups, with the total number of noises (N) specified in the "Keys" column. A broader
comparison with additional methods can be found Table 14
Method
Keys
Clean
Rotate
JPEG
C&S
Blur
Noise
Bright
Avg
32
0.790
0.020
0.420
0.040
0.610
0.530
0.420
0.404
Tree-Ring
128
0.450
0.010
0.120
0.020
0.280
0.230
0.170
0.183
2048
0.200
0.000
0.040
0.000
0.090
0.070
0.060
0.066
32
1.000
1.000
1.000
0.530
0.990
1.000
0.960
0.926
RingID
128
1.000
0.980
1.000
0.280
0.980
1.000
0.940
0.883
2048
1.000
0.860
1.000
0.080
0.970
0.950
0.870
0.819
WIND Fast 28
100000
1.000
0.780
1.000
0.470
1.000
1.000
0.960
0.887
WIND Fastanis
100000
1.000
0.870
0.960
0.060
0.960
0.950
0.900
0.814
WIND Wulllulls fulls2s
100000
1.000
0.780
1.000
0.850
1.000
1.000
1.000
0.947
WIND fullanass
100000
1.000
0.880
1.000
0.930
1.000
0.990
0.980
0.969
index i, the other noise voctors for j * are still safd This is because we use a cryptographic hash function and a secret salt. Formally, Theorem 4.1 shows that, as long as the cryptographic hash function remains unbroken and the secret salt kept private, the watermarking algorithm maintains its security properties against even very powerful adversaries.
Theorem 4.1. /Cryptogrophic Securityl Let hash: 0, 0, be an unbroken cryptographic hash function used in our watermarking algorithm, with imputs i E [N] and secret salt s. Assume s is sufficiently long and randomly generated. Then, even if an adversary obtains: the group number g"; the initial noise inder i", the initial noise Zi,, and even the corresponding output of the hash function seed, the adversary canmot:
1. Recover the secret salt 8,
2. Generale valid reconstrucled noise zj for any other invitall noise inder j #
We defer the proof to Appendix
4.3 WATERMARKING NON-SYNTHETIC IMAGES.
Until now, we have addressed watermarking only for Al-generated synthetic images. Yet, protecting copyrights (or preventing the spread of misinformation) may also apply to (modified) natural images. Most previons approaches to watermark diffusion models overlook attempting to expand their method to non-synthetic images. To allow using our framework for non-synthetic images, we expand our framework. By using diffusion inpainting, our watermark can be applied to a natural image. Later, by inverting the inpainted image, we can verify the presence of the watermark.
As demonstrated in Figure D our inpainting method injects a watermark with minimal visual impact, preserving the original image's integrity. See Appendix for additional results.
5
EXPERIMENTS
5.1 WATERMARK ROBUSTNESS
Setting. For fair comparison with previous methods (Ci el al. 2024 Wen et al. 2023 we employed Stable Diffusion-v2 (Rombach al.) (022), with 50 interence sleps for both generation
and inversion. Other iiteemennaaiinndttaall can be found in Appendix H
We note that obtaining single noise pattern might not be enough to effectively forge the watermark, the model owner may encode this pattern with additional metadata described in Section 1.1
8

---

Published a conference paper at ICLR 2025
Cosine similarity between the initial noise and the inversed noise be- fore and after the regencration attack. Also see Appendix D
Table 2:
Table 3: FID scores of WIND compared
to previous watermarking approaches.
Method
FID
Condition
Mean
STD
DwtDetSvd
25.01
RivaGAN
24.51
Original Image
0.888
0.053
Treo-Ring
25.93
Attacked Image
0.824
0.062
RingID
26.13
Unrelated Image
0.000
0.008
WIND
24.33
Image Transformation Attacks. Following previous methods (Wen et al., 2023 Ci et al. 2024]
we applied these image transformations to the generated images: 75" rotation, 25% JPEG compres- sion, 75% random cropping and scaling (C & S), Gaussian blur with an x 8 filter size, Gaussian 0.1, and color jitter with a brightness factor uniformly sampled between 0 and 6. In Table I we compare our methods to both Troe-Ring and RingID. As the results demonstrate, using multiple keys with RingID (Ci et al. 2024) is possible. Yet, it remains vulnerable to cropping and scaling allacks. In contrast, WIND ellectively addresses this challenge. It enables accurale watermark detection under all image transformation allacks.
noise with
Steganalysis Attack. We assess the robustness of our method against the attack proposed by Yang et al. (2024a), which is capable of forging and removing the Tree-Ring and RingID keys. As discussed in Section 2.3] this attack attempts to approximate the watermark by subtracting watermarked images from non wooeraarrrd images. The results, presented in Figure indicate that the attack can be used to forge or remove our RingID group identifier. Yet, it is unable to forge or remove our full watermark (initial noises). Even when the Fourier pattern type key is removed, our method remains robust in identifying the correct initial noise through an exhaustive search.
Regeneration Attacks. Recently, Zhao et al. [2023a) introduced a two-stage regeneration attack: (i) adding noise to the representation of watermarked image, and (ii) reconstructing the image from this noisy representation. To assess the resilience of our approach to regeneration attacks, we applied the attack from Zhao et al. (2023a) to watermarked images generated by our model. As shown in Table 2 the attack has a minimal impact on the distribution of the cosine similaritics between the initial noise and the inverted noise. The attacked noise similarity still maintains significant gap compared to random noise.
Image Quality. To examine the performance of our inpainting method, we report the Fréchet Inception Distance (FID) (Heusel et al., 2018) on the MS-COCO-2011 (Lin et al. (015) training dataset in Table Notably, our method achieves the lowest FID among the compared methods, indicating a closer aligmment with real images. While the image quality of our generated images can be understood analytically no distortion for the initial noise methods (Section 3) and similar distortion to RingID for the two-stage method (Section we also include some images generated by our framework in Figure
6 DISCUSSION AND LIMITATIONS
Editing a Given Image vs. Forging. While forging our walermark by obtaining the initial noise hard (Section 3) an easier path to obtaining harmful watermarked images might be to apply a slight edit to an already watermarked image. A harmful image in this context might include the addition of a copy-right infringing material, NSFW materials, or any other content the model owner wishes to avoid being associated with. Naturally, there is trade-off between the severity of the applied edit and the edit's ability to preserve the initial watermark. We present one solution mitigating this issue in the next discussion point.
9

---

Published conference paper at ICLR 2025
Before
After
Before
After
Figure 6: Comparison of COCO images before and after watermarking via inpainting.
Storing Database of Generations. Model owners wishing protect themselves from an attacker modifying a watermark image may keep a database of the past generations by their model. For these extreme cases, the model owner might only save the used prompts and initial noise seeds and use the reconstructed noise to retrieve the entire set of prompts used with that specific seed (Huang& & Wan 2024). While this process may be resource-int inneee,,, it only required in the rare event that attacker intentionally modifies benign image into harmful one while preserving the watermark.
Private Model. Our watermark robustness is based to a large extent the inability of an attacker to invert a model, which empirically validated only for some attacks. Yet, as discussed in Section 2.2 the ability successfully invert model may be nearly equivalent to the ability to steal the forward diffusion process, effectively stealing the model (in which case, any watermarking attempt might be deemed quite useless anyhow). Still, better framing of the mathematical assumptions behind this claim is a limitation of this work, as an attacker might be able to learn something about the noise without full access to the model.
Attacker's Advantage. Thore exists a large set diverse attacks aimod at watermark removal (Zhang al. 2023 Yang et al. 2024a] Zhao et al. 2023a), along with image transformations such as rolation and crops that also achieve some limited success against our walermark. As in many security applications, we suspect that an attacker capable enough will still be able remove the watermark using new techniques we might not expect. However, more robust watermark may nevertheless help decrease the spread of false information.
Additional discussion and limitations can be found in Appendix
7 CONCLUSION
In this work, present robust watermarking method that leverages the initial noises employed diffusion models for image generation. By integrating existing techniques, we enhanced the approach to achieve improved efficiency while maintaining our robustness against various types of attacks. Furthermore, we outlined a stratogy for applying our method to non-generated images through inpainting.
10

---

Published conference paper at ICLR 2025
ACKNOWLEDGMENTS
The authors were partially supported by the AT Research Institutes Program supported by NSF and USDA-NIFA under grant no. 2021-67021-35329, NSF SaTC grant 2154119, and a Cyber NYC gift from Google Research.
REFERENCES
Ali Al-Haj Combined dwt-det digital image watermarking. Journal of computer science, 3(9): 740-746, 2007.
Bang An, Mucong Ding. Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. Waves: Benchmarking the robustness of image watermarks, 2024. URL htttt::///aaate httpa/////axvv.o//aabsessse 08573.
Alexandr Andoni, Piotr Indyk, and Ilya Razenshteyn. Approximate nearest neighbor search in high dimensions. In Proceedings of the International Congress of Mothematicians: Rio de Janeiro 2018, pp. 3287-3318. World Scientific, 2018.
Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety- aligned iims with simple adaptive attacks. arXiv preprint 0rX:::2404.02151, 2024.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomossc. Rostcals: Robust steganography using autoencoder latent space, 2023. URL https://aaxii..orrrg /a////bbb/2/0//. 220040340033
Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallaco. Extracting training data from diffusion models, 2023a. URL
wwtp:/ooggg/bbb/////eeese ab3// 13188
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253-5270, 2023b.
Chin-Chen Chang, Piyu Tsai, and Chia-Chen Lin. Svd-based digital image watermarking scheme. Pattern Recogrétion Letters, 26(10):1577 1586, 2005.
Junsong Chen, Chongjian Ge, Enze Xie, Yue Wu, Lewei Yao, Xiaozhe Ren, Zhongdao Wang, Ping Luo. Huchuan Lu, and Zhenguo Li. Pixart-o: Weak-to-strong training of diffusion transformer for 4k text-to-image generation, 2024.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv preprint arX1v:2444.1055, 2024.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermork ing and sleganography. Morgan kaufmann, 2007.
Scott Craver, Nasir Memon, B-I. Yeo, and Minerva M Yeung. Resolving rightful ownerships with invisible watermarking techniques: Limitations, attacks, and implications. IEEE Journal on Selected areas in Communications, 16(4):573 586, 1998.
Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. Diffusionshield: watermark for copyright protection against generative diffusion models. arXiv preprint or Xixx:2306. 0464,, 2023.
11

---

Published conference paper at ICLR 2025
Matthijs Douze, Alexandr Guzhva, Chengqi Deng, Jeff Johnson, Gergely Szilvasy, Pierre-Emmantee Mazaré, Maria Lomeli, Lucas Hosscini, and Hervé Jégon. The faiss library. orXiv preprint arXiv:2401.008 088888 2024.
Noureddine El Karoui. Concentration of measure and spectra of random matricos: Applications to correlation matrices, clliptical distributions and beyond. 2009.
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, Dustin Podell, Tim Dockhorn, Zion English, Kyle Lacey, Alex Goodwin, Yannik Marek, and Robin Rombach. Scaling rectified flow transformers for high-resolution image synthesis, 2024. URL https: /ttp:v//axxvv.ooo arraii..rg/ab///433333 03206.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466-2222222 22467, 2023a.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent, diffussio models, 2023b. URL https://arxti::
arg/abs/2303..0 23435
Xiangming Gu, Chao Du, Tianyu Pang, Chongxuan Li, Min Lin, and Ye Wang. On memorization in diffusion models, 2023. URL https://arxiv..tt wwtp://w..rrgg////1000// 02664
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models, 2024. URL https://arxiv.orgg hwwggbb//410.073000000
Gustavosta. Stable Propsost kernel description. https://hugginffacc..o/aattstss futtawoottt/Saabb----fffaaaaarrr 2024. Accessed: 2024-11-20.
Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference- free evaluation metric for image captioning. arXiv preprint arXic:2104.08718, 2021.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter.
Gans trained by two time-scale update rule converge to a local nash equilibrium, 2018. URL https://arxivv. wwteeivvvorrg/ee
wrw//oo////////o..o.ooooos abs/ 1706. 08500
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in
neural information processing systems, 13:6840-6851. 2020.
Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Gong. A transfer attack to image water- marks. ai preprint Xrx::22403. 15365, 2024.
Baizhou Huang and Xiaojun Wan. Waterpool: A watermark mitigating trade-offs among imper- ceptibility, efficacy and robustness. arXiv preprint ar 135117 2024.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International conference machine learning, pp. 2137 2146. PMLR, 2018
Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai-generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 1168-1188 2023.
12

---

Published conference paper at ICLR 2025
Feyza Duman Keles and Chinmay Hegde. On the Sne-grained hardness of inverting generative models, 2023. URL https://arxiv..rrt wwwpaiiiv.orggbbaeee www.orggggggg.ooo.//o//
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint ar arXiv:2307. 15593, 2023.
Gerhard C Langelaar, Twan Setyawan, and Reginald I. Lagendijk. Watermarking digital image and video data, a state-oftthe-at overview. IEEE Signal processing magazine, 17(5):20 46, 2000.
Tsung- Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Dollár, Microsoft coco: Common objects in context, 2015. URL https://arxiv http::///rxvvvooog/o/// org/abgg 140// 0312
Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking diffusion model. Xix preprind ar Xiv: Stw:2335.12502, 2023.
Nils Lukas and Florian Kerschbaum. Ptw: Pivotal tuning watermarking for pre-trained image generators, 2023. URL
07361
Yu. A. Malkov and D. A. Yashunin. Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs, 2018. URL http::://axxvv.rg///a/// 09320
William Peobles and Saining Xic. Scalable diffusion models with transformers. arXiv preprint arXiv:2212.0971 097448, 2022.
Vidyasagar M Potdar, Song Han, and Elizabeth Chang, A survey of digital image watermarking techniques. In INDIN'SS 2005 3rd IEEE International Conference Industrial Informalics, 2005., pp. 709 716. IEEE, 2005.
T Pun et al. Rotation, translation and scale invariant digital image watermarking. In icip, pp. 536. IEEE, 1997.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Πlya Sutskever. Zero-shot Lext-lo-image generation, 2021. URL https: org abs/ 2102. 12092
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models, 2022. URL https:// ptops://aaxii...o //aaaiivor//abaa........ abg/abs/ 2112.10752
Claude Elwood Shannon. Communication in the presence of noise. Proceedings of the IRE, 37(1): 10-21, 1949.
Himanshu Kumar Singh and Amit Kumar Singh. Comprehensive review of watermarking techniques in deep-learning environments. Journal of Flectronic Imaging, 000:000-1111111110 2023.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibriun thermodynamics. In International conference machine learning, pp. 2256 2265. PMLR, 2015.
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Under- standing and mitigating copying in diffusion models. Advances in Neural Information Processing Systems,
2023a.
13

---

Published conference paper at ICLR 2025
Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Under- standing and mitigating copying in diffusion models, 2023b. URL http:///axxiv..rr/aaba 2305.20088
Jiaming Song, Chenlin Meng, and Stelano Ermon. Denoising diffusion implicit models, 2022. URL
https:/ //ap:i//////i//////a wwrxiiv.rg//ae hetg/0b/2200.... 2a0bb//2000020022
Jiuqi Wei, Botao Peng, Xiaodong Lee, and Themis Palpanas. Det-lsh: A locality-sensitive hashing scheme with dynamic encoding tree for approximate nearest noighbor search. arXiv preprint arXiv:2406. 10938, 2024.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust. arXiv preprint Xii:23355200300 2023.
Raymond B Wolfgang and Edward Delp. A watermark for digital images. In Proceedings of 3rd IEEE International Conference Image Processing, volume 3, pp. 219 222. IEEE, 1996.
Ping Wah Wong and Nasir Memon. Secret and public key image watermarking schemes for image authentication and ownership verification. IEEE transactions on image processing, 10(10):1593
1601, 2001.
Xun Xian, Ganghua Wang, Xuan Bi, Jayanth Srinivasa, Ashish Kundu, Mingyi Hong, and Jie Ding, Raw: A robust and agile plug-aud-play watermark framework for ai-generated images with provable guarantees. arXio preprint orXw:2203.1188
2024.
Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proceedings of the 31st ACM International Conference on Multimedia, pp. 1668 1676, 2023.
Pei Yang, Hai Ci, Yiren Song, and Mike Zhong Shou. Steganalysis on digital watermarking: Is your defense truly impervious?, 2024a. URL ptttpp:://axxivoor//aaa.
09026
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossles image watermarking for diffusion models. In Proceedings of the LEEE/CVF Conference on Computer Vision and Pottern Recognition, pp. 12162 12171, 2024b.
Hanlin Zhang, Benjamin L Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks the sand: Inpoossibility of strong watermarking for generative models. arXi preprint arXiv:2311.04376 2023.
Kevin Alex Zhang, Lei Xu, Alfredo Cucsta-Infante, and Kalyan Veoramachaneni. Robust invisible video watermarking with attention, 2019. URL http::////wwxxw.oo//bb/////
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai, 2023a. URL httph::// //atpi://arxi.... org/ ab0//306....//.////// 01953
Xuandong Zhao, Kexun Zhang, Yu-Xiang Wang, and Lei Li. Generative autoencoders as watermark attackers: Analyses of vulncrabilities and threats. 2023b.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXi preprint 2xXiv:2303.10193 2023c.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks, 2018. URL https://arxiv org/ wrggabs///iieg.ee abs//b00..999959
14

---

Appendices
Contents
Introduction
2
Preliminaries
3
2.1
Threat Model
2.2
Diffusion Models Inversion
3
2.3
Tree-RRnng and RingID Watermarks
3
Intial Noise is a Distortion Free Watermark
4
Method
4.1
WIND: Twwo-stage Elficient Watermarking
7
4.2
Resilience to Forgery
7
4.3
Walermarking Non-Synthetic Images.
8
5
Experiments
Watermark Robustness
6
Discussion and Limitations
7
Conclusion
10
Appendices
15
A
Notation
17
B Related Works
17
Additional Discussion and Limitations
18
Additional Results
20
D.1
Applicability to Other Types of Models
20
D.2
Non-Synthetic Images Watermark Detection
20
DJ.3
Further Exploration of the Regeneration Attack Perturbation Strength
20
D.4
Quantitative Analysis of the Effect on Image Quality
20
D.5
Robustness Comparison Different Number of Inference Steps
22
D.6
True Positive and AUC
22
D.7
Evaluation Against Additional Allacks
22
D.8
Attack With a Public Model
23
D.9
Additional Watermarking Methods
23
Proof of Resilience Forgery
Further Discussion on Distortion
24
Empirical Runtime Analysis
25
15

---

Published conference paper at ICLR 2025
H Implementation Details
25
Additional Qualitative Results
27
16

---

Published conference paper at ICLR 2025
A NOTATION
Table 4: Notations used in the paper.
N Number of initial noises
M
Number groups
Secret salt for cryptographic security
i
Index initial noise: i [N]
Index of group: g = 1%M
hash A cryptographic hash function
z
Initial noise
Threshold for declaring an image is watermarked
T
Number of diffusion steps
Weights of a diffusion model Text prompt for diffusion Ge Diffusion model with weights θ
θ
Go Inverse diffusion model with weights
B RELATED WORKS
Memorization in Diffusion Models. Diffusion models (Ho et al., 2020 Sohl-Dickstein al. 2015) have demonstrated a capacity not only lo generalize but also to memorize training data. This lead to the reproduction of specific patterns or, in some cases, exact content from the training set, including sensitive proprietary information. This memorization poses significant risks of unintended intellectual property leakage, particularly in large-scale generative models. Several studics have shown that information from training data can be extracted from diffusion models (Carliii al., 2023b (ooopalli et al.) 2023b Carlini al., 2023a Gu al., 2023 Somepalli et al., 2023a The risk of memorization in diftusion models underscores the need for accountability among model owners.
Image Watermarking. Image watermarking is essential for protecting intellectual property, ver- ifying content authenticity, and maintaining the integrity of digital media. The field ranges from traditional signal processing techniques to recent deep learning methods (Potdar et al. 2005 Singh
& Singh 2023).
Among Early watermarking strategies, one of the classical methods is Least Significant Bit (LSB) embedding. which modifies the least significant bits of image pixels to imperceptibly embed wa- termarks (Wolfgang & Delp 1996). Another classical approach utilizes frequency-domain transfor-
mations and Singular ala Value Decomposition (SVD) to hide watermarks within image coefficients.
Chang et al. 2005 Al-Haj
2007).
Recent developments leverage deep learning for watermarking. For instance, HiDDeN (Zhu et al. 2018 introduced end-to-end trainable framework for data hiding. RivaGAN Zhang al. 2019
17

---

Published conference paper at ICLR 2025
utilizes adversarial training to embed watermarks, while Lukas & Kerschbaum (2023) proposed an embedding technique that optimizes efficiency by avoiding full generator retraining.
Watermarking for Diffusion Models. Existing watermark methods for diffusion models can be divided into three categories:
(i) Post- processionss methods which adjust image features to embed watermarks (Zhao et al. 2023c Fernandez et al. 2023bb. This approach alters the generated image distribution. However, recent work by IZhao et al. (2023b) shows that pixel-level perturbations are removable by regeneration attacks makes. To date, this approach is not robust.
(ii)
Fine-Luning-based approaches combine the watermark within the generation process Zhao
el al.
2023c Xiong et al. 2023 Liu el. al. 2023 Fernandez et al. 2023a Cui el al. 2023 To date,
These methods have robustness issues as well IZhao el al. 2023a
(iii) Tree-Ring introduced an approach to proposing method to imprint tree-ring pattern into the initial noise of a diffusion model (Wen et al. 2023). Each pattern is used as a key, which is added in the Fourier space of the noise. The verification of the presence of the key involves recovering the initial noise from the generated image and chocking if the koy is still detectable in Fourier space. This approach makes Tree- Ring and its follow-up works the most robust approach against regenration allacks (Zhao el al. 2023a An et al. 2024 Gunn et al. 2024
Recently, Yang et al. (024a) took advantage of the distribution shift present in Tree-Ring that occurs with impainting keys and arranged the first successful black box attack against it, as we detailed in Section 233
C ADDITIONAL DISCUSSION AND LIMITATIONS
Relation to Other Initial Noise Watermarking Methods. The seminal work by Wen et al. (2023) innovated the use of initial noise in DDIM for watermarking. Most related to our work, Yang el al. (2024b) also embeds & watermark in the initial noise already used by DDIM diffusion model. Yet, while Yang et al. (2024b) proposes watermark that is distortion-fret for a single image, it is not distortion-free when examining sets of images; therefore it is vulnerable to attacks such as Yang et al. (2024a). We aim to be robust to attacks even when many images are examined together.
There are additional technical differences between our approach and Yang et al. (024b)). Most notably: (i) Our work also studies applying our watermark non-synthetic (natural) images, or images coming from other generative models. (ii) While Yang et al. (2024b) design a function to embed specific bits into the initial noise, we Lake another approach. Namely, we view the entire initial noise (with generation and inversion)
noisy channel. Inspired by Shannon 1949 we use a random encoding of the watermark identities into the channel.
Computational Requiremenss As discussed in Section 3 our similarity search can be accel- crated given well-known mothods. Yet, the computational requirements of our method might be limiting when trying to use our method edge devices. However, similarly to Tree-Ring and Ring-ID (Wen et al. 2023 Ci et al.) 2024) our method assumes a privale model, which is usually not deployed on edge devices anyhow.
Trade- Offs Between the Watermarking Overhead, and Detection Accuracy. We suggest the following variants of our mothod for different possible requirements of runtime scaling, detection robustness, and case of adaptation.
18

---

Published conference paper at ICLR 2025
Figure 7: Image sequence from 0 to 50 regeneration attack iterations.
This operation takes a search of ((M), but is vulnerable to both removal and forgery attempts, as we use more vulnerable watermark for group identifiers.
A. Detection of the group identifier alone:
B. Detection of the Fourier pattern, followed by validation of the exact initial noise (WIND within the group. This operation takes ((N/M) search. It is vulnerable to removal attempts (sce Table 1 but more resilient to forgery attempts.
C. An exhaustive search of the initial noise, also outside the identified group (WINDrat): This operation takes O(N) search. It is more resilient to both removal and forgery allempts (see Figure 4 and Table []. This method, while slower is also easier to adapt. A user who wishes to use fast version of this variant may apply a similar algorithm to the one described above using only a few possible random noises. This would replace the distortion-free property when considering many different images with the ability to rapidly and simply detect the watermarked images.
be accelerated using many methods, and can be scaled to tens of millions without significantly affecting the detection time (Wei et al. 2024 Douze et al. 2024 Malkov & Yashunin 2018 Andoni et al. 2018
Practically,
NN search
Image Quality Considerations. Our method relies on using an initial random noise, drawn from the same distribution of initial noises already used by the model. Therefore, the core of our method (the initial noise stage) is not compromising the visual quality of the generated images at all.
The only effect on visual quality comes from the group identifier, where we use existing off-the-shelf watermarking images. In our implementation, we used the RingID (Ci et al. 2024) method that
adds the Fourier pattern to the initial noise.
When model owner wishes to preserve image quality even better, they may use any other existing watermarking method for the group identifier stage. This will still not compromise the sccurity provided by the random noise scoding stage.
Inversion Attack. As discussed in Section 2.2 in our paper, accurately inverting the model is as difficult as copying the forward process of the model (image generation). While hard, an attacker able to do so is effectively also capable of generating novel images using the same diffusion process. Therefore, At this stage, the model itself effectively compromised (and not only the watermark signature). We believe that being as hard to forge the model itself, is a reasonable level of security for almost all use cases.
Yet, method does not eliminate the concern that noise could be forged without inverting the model. Approximately inverting the model might also be a threat. While even approximately inverting model is also hard, it might be easier than stealing the model. Still, we would like to emphasize that our method more secure than other biffrsioon-rroess-basdd watermarking techniques, where image distortion themsclves may allow casier forging (Yang et al. 2024a).
19

---

Published conference paper at ICLR 2025
Table Inpainting correct watermark detection accuracy.
Clean
Rotate
JPEG
C&S
Blur
Noise
Bright
Avg
1.000
1.000
1.000
0.880
1.000
0.950
0.950
0.969
D ADDITIONAL. RESULTS
D.1 APPLICABILITY TO OTHER TYPES OF MODELS
We expect our watermark to be effective directly for any model for which some inversion the original noise is possible. Namely, as the correlation between random noises in very high dimension very much concentrated around 0, even a very slight success the inversion process is enough to make watermarked images detectable. When considering models with higher generation resolutions, the dimensionality of the noise even higher, and therefore, we expect the separation would be even better [El Karoui 2009).
Empirically, to validate the gencrality of our method, we also report results for the SD 1.4 model (Rombach et al. 2022). Using N 10000 noises and M 2048 group identifiers, our method achieved a detection accuracy 97% to identify the correct watermark (initial noise).
Our method for watermarking the reported SD 2.1 model can also be applied to images obtained from other sources (see Section 4.3 Appendix D.2
D.2 NON-SYNTHETIC IMAGES WATERMARK DETECTION
Our inpainting method allows to watermark both images generated by any model and synthetic images. To evaluate the robustness of the impainting watermarking approach for non- synthetic images, we present results similar to those Table ] for this method, utilizing N 100 initial noises. Results are shown in Table 5
D.3 FURTHER EXPLORATION THE REGENERATION ATTACK PERTURBATION STRENGTH
discussed the robust of WIND against regeneration allacks. However, using it iteratively might still be a stronger attack against our watermark. We applied the regeneration attack proposed by Zhao et al. (2023a). up to 50 times. We see that iterative regeneration indeed decreases the similarity between the original initial noise and the reconstructed one. This happens the image becomes less and less correlated to the original generation Figure 7
In Section
Yet, the detection rate of our algorithm remains very high (see Table 6 Figure this to the fact that even slight remaining correlation between the attacked image and the initial noise remains significant with respect to the correlation expected from non-walermarked images. This happens because of the very low correlation between random initial noises (Figure 3
We attribute
D.4 QUANTIIATIVE ANALYSIS OF THE EFFECT ON IMAGE QUALITY
We reported the FID of our model on Table To further assess the effect WIND watermark image quality, report the CLIP score Hessel et al. (2021) before and after watermarking Table 7 Our results indicate that adding the watermark has a negligible effect on the CLIP score for generated images.
20

---

Published conference paper at ICLR 2025
Table 6: Correct watermark detection among 10, 000 options after iterative regeneration attack.
Iteration
Cosine Similarity
Detection Rate
10
0.493
100%
20
0.342
100%
30
0.243
100%
40
0.170
100%
50
0.121
100%
Cosine Similarity vs Attack Iterations
0.7
0.6
Cosine Similarity
0.3
Attack Iteration
Figure 8: Cosine Similarity from 0 50 regeneration attack iterations.
To further quantify the distortion introduced by each model, we report pixel-base matrices, SSIM and PSNR in the two settings we study:
Images Generated by the Diffusion Model. WIND's distortion arises from using group iden- tifiers, enabling faster detection. To disentangle this effect, we also evaluate WINDw/os which omits group identifiers. As can be seen in Table g the image quality generated using our full method comparable that of previous techniques. Users who wish generate distortion-free images, without affecting image quality, can do so by omitting the group identifier (at the cost of a slower detection phase for very large values of N).
Watermarking Non-Synthetic Images. Additionally, present results for WIND WIND impainting: inpainting-based approach capable of watermarking both non-synthetic images and outputs from other generative models (Table g) Although other watermarking methods may better preserve image quality, our image quality remains high. Importantly, to the best of our knowledge, our approach is the only against the regencration attack (Zhao et al. 2023a). Therefore, it is preferable when an adversary may try to remove the watermark.
capable of watermarking non-synthetic images while remaining robust
21

---

Published conference paper at ICLR 2025
Table 7: Effect of WIND on CLIP score.
CLIP Before Watermark CLIP After Watermark 0.366
0.360
In addition, the impainting technique be applicd selectively to specific parts of the image if the copyright owner wishes to perfectly preserve fine details in certain areas.
Table 8: SSIM and PSNR values of initial noise-based watermarking approaches. WIND w/o refers the method without group identifiers.
Method
SSIM
PSNR t
WINDw
1.000
WIND
0.494
14.647
RinglD
0.454
13.560
Tree-Ring 0.545
15.251
D.5 ROBUSTNESS COMPARISON TO DIFFERENT NUMBER OF INFERENCE STEPS
We evaluate the impact of inference steps on detection accuracy, as shown in Table 10 The results indicate that our method is robust to varying the number of inference steps used.
D.6 TRUE POSITIVE AND AUC
Expanding on the delection assessment settings discussed in Section we reported additional metrics for WIND's ability to detect if an image is watermarked. AUC and True Positive (TPR01%FPR) results are available on Table [I demonstrating WIND's strong performance, and emphasizing its robustness and reliability.
D.7 EVALUATION AGAINST ADDITIONAL ATTACKS
We evaluate WIND against a diverse set of attacks, including transfer-based, query- based, and white-box attack methods. Specifically, we employ the WeVade white-box at- tack [Jiang et al. 2023), the transfer attack described in Hu et al. (0024), a black-box at-
Table SSIM and PSNR values for non-synthetic image walermarking approaches.
Method
SSIM t
PSNR t
WIND WiNDiipaintingg
0.768
26.806
DwtDetSvd
0.983
39.381
RivaGAN
0.978
40.550
SSL
0.984
41.795
StegaStamp
0.911
28.503
22

---

Published conference paper at ICLR 2025
Table 10: Effect of different numbers of inference steps on detection accuracy.
Steps
Clean
Rotate
JPEG
C&S
Blur
Noise
Bright
Avg
20
1.000
0.780
1.000
0.880
0.920
1.000
0.960
0.934
50
1.000
0.930
1.000
0.940
1.000
0.980
0.980
0.976
100
1.000
0.930
1.000
0.940
1.000
1.000
0.990
0.980
200
1.000
0.850
1.000
0.940
1.000
1.000
1.000
0.970
Table 11: Additional watermark detection results of WIND.
AUC
TP@1%
0.971
1.000
tack utilizing NES queries Andriushchenko et al. (2024). adopted to attempl watermark removal. The success rates of these attacks are detailed Table 12 Notably, none of these methods succeed against. WIND, as the correct watermark remains detectable in over 97% of cases even after applying these attacks.
(lyas al. 2018 and random search approach discussed in
D.8 ATTACK WITH A PUBLIC MODEL.
We report results to noise reconstruction attack with public model in Table 13
D.9 ADDITIONAL WATERMARKING METHODS
We provide a comparison to additional watermarking methods in Table 14
E PROOF OF RESILIENCE TO FORGERY
The WIND method is an approach for generating multiple watermarked images. Theorem tells that compromising one more watermarked images does not give away any information about any other watermarked images. E.g., the adversary cannot "generate valid reconstructed noise for any other initial noise index j + 1". That said, Theorem 4.1 does leave open the possibility that an adversary can take a watermarked image, reconstruct the initial noise only for that image, and it attack the method.
Cryptographic Background Consider cryptographic hash function hash: {0, 13 + {0, 1) with output bits. E.g., 256 for SHA-256. We will describe properties of the hash function in terms of 'difficulty:; we say task is 'difficult" if, as far as know, finding solution is almost cortainly beyond the computational capabilities any reasonable adversary. An unbroken cryptographic hash function satisfies the following properties: Pre-image resistance requires that given a hashed value v, it is difficult to find any message m such that v = hash(m). Second pre- image resislance requires that. given inpul. mi, it is difficult to find different input my such that hash(m1) hash(mz). Collision resistance requires that it is difficult to find two different messages my and m2 such that hash(m1) hash(m2).
Theorem 4.1. /Cryptogrophic Security] Let hash: 0, - 0, 1. be an unbroken cryptographic hash function used in our watermarking algorithm, with inputs i" E [N] and secret salt s. Assume
23

---

Published conference paper at ICLR 2025
Table 12: Success rate of detecting the correct noise among 10, 000 options while withstanding additional attacks.
Wedade Random Search
Transfer Attack
NES Query
1%
2%
3%
2%
Table 13: Cosine similarity between the initial noise used for generation and the inversed noise obtained through three inversion approaches. "Private" refers to models owner's model, while "Public" denotes external model.
Approach
Mean
Std
Gen (private) + Rev (private)
0.888
0.053
Gen (private) Rev (public) Gen (public) - Rev (private)
0.166
0.063
Random Noise
0.000
0.053
sufficiently long and randomly generated. Then, even if an adversory obtains: the group number g", the initial noise inder i", the initial noise Zi,, and even the corresponding output of the hash function seed, the adversary cannot:
1. Recover the secrel sall 8;
2. Generate valid reconstructed noise 2j for any other initial noise inder j #
Proof of Theorem 4.1 We will prove each part of the theorem separately:
1. The adversary cannot recover the secret salt Given the output seed = hash(i", s) and partial input 1 the adversary aims to find s. This is equivalent to finding a pre-image given partial information about the input. By the pre-image resistance properly of cryplographic hash functions, this task is computationally infeasible. Even if the ad adversary knows the value of i, the space of possible secret salts is too large search exhaussively (as s is sufficiently long random string). Therefore, the adversary cannot recover
The adversary cannot generate valid reconstructed noise for any other initial noise index This security guarantee is ensured by two properties of hash: a) Second pre-image resistance: Given (i",s), it's computationally infeasible find (i', where + i" such that hash(i", s) hash(i', s). b) Collision resistance: It's computationally infeasible to find any two distinct imputs that hash to the same output. These properties ensure that the adversary cannot find alternative inputs that produce the same hash output, and thus cannot generate valid reconst noise for different index numbers j.
Theorem 4.1 leaves open the possibility that an adversary can recover the noise from a watermarked image and that noise to forge watermarked image. We empirically show that specific implementation this attack fails without access to the weights the private diffusion model.
F FURTHER DISCUSSION ON DISTORTION
Using the same initial noise for multiple generations is not distortion-free when examining groups of images. For example, all images with the same prompt p and the same initial noise will
24

---

Published conference paper at ICLR 2025
Table 14: Comparison correct watermark detection accuracy between WIND and previous image watermarking approaches under various image transformation attacks. WINDM denotes the use of M groups, with the total number of noises (N) specified in the "Keys" column.
Method
Keys
Clean
Rotate
JPEG
C&S
Blur
Noise
Bright
Avg
Dwt
1
0.974
0.596
0.492
0.640
0.503
0.293
0.519
0.574
DwtDetSvd
1
1.000
0.431
0.753
0.511
0.979
0.706
0.517
0.702
RivaGan
1
0.999
0.173
0.981
0.999
0.974
0.888
0.963
0.854
32
0.790
0.020
0.420
0.040
0.610
0.530
0.420
0.404
Tree-Ring
128
0.450
0.010
0.120
0.020
0.280
0.230
0.170
0.183
2048
0.200
0.000
0.040
0.000
0.090
0.070
0.060
0.066
32
1.000
1.000
1.000
0.530
0.990
1.000
0.960
0.926
Ri
128
1.000
0.980
1.000
0.280
0.980
1.000
0.940
0.883
2048
1.000
0.860
1.000
0.080
0.970
0.950
0.870
0.819
WIND
pasttis Fastias
100000
1.000
0.780
1.000
0.470
1.000
1.000
0.960
0.887
WIND WINDristaa Fistt204
100000
1.000
0.870
0.960
0.060
0.960
0.950
0.900
0.814
WIND Fullsss
100000
1.000
0.780
1.000
0.850
1.000
1.000
1.000
0.947
WiNDiullanas
100000
1.000
0.880
1.000
0.930
1.000
0.990
0.980
0.969
be identical, distorted away from the distribution of groups of images generated with i.i.d noises. Luckily, the huge gap between the similarities distribution of (i) reconstructed vs. used noise, and (ii) reconstructed vs. unrelated noise, allows keeping the noise we used more similar to the reconstructed noises compared to unrelated ones. Therefore, limiting the level of distortion in practice.
use as many different noise patterns, while still
Table 15: Delection time (second)
WIND
Tree-Ring
RingID
22
20
G EMPIRICAL RUNTIME ANALYSIS
The runtime of our method highly sensitive the available computational resources. To provide a practical estimate, we measured the detection time using single NVIDIA GeForce RTX 3090. Specifically, we divided 100,000 initial noise samples into 32 groups and reported the detection time. Under these conditions, without special optimizations, the detection phase for 100,000 noise samples lakes approximately seconds per detection. We include a comparison with of other methods in Table 15
H IMPLEMENTATION DETAILS
Diffusion Model. We use Stable Diffusion 2.1
(Rombach et al. 2022
Prompts. used the set of prompts from Gustavosta 2024
25

---

Published conference paper at ICLR 2025
Threshold for Detection. For the first variant WINDfost (see Section we use threshold of min l2 norm > 160 in the first stage and select the best-matching noise in the second stage. The sccond variant (WINDJat) does not use a threshold, but rather chooses the noise pattern within the group that has the lowest &g as our candidates for the identified noise. The ability to identify the correct noise among candidates can be interpreted as achieving a p value of at least 1/N in cases where detection was successful.
Retrieval Details During Detection. We included simple rotation (using intervals of 2 degrees) and sliding window (window size of 32, stride of 8) scarches part of the retricval procoss. These searches do not involve directly optimizing for the specific degrecs of rotation or cropping used as atlacks.
26

---

Published conference paper at ICLR 2025
I ADDITIONAL QUALITATIVE RESULTS
Figure More watermarked images generated with WIND.
27

---

Published conference paper at ICLR 2025
Figure 10: More watermarked images generated with WIND.
28

---

Published conference paper at ICLR 2025
Before
After
Before
After
Wiis
Wiise
Figure 11: More comparisons of COCO images before and after watermarking with WIND.
29

---

Published conference paper at ICLR 2025
WIND
Tree-Ring
RingID ID
Figure 12: More qualitative results watermarked images generated using WIND, Treo-Ring, and RingID.
30

---

Published conference paper at ICLR 2025
WIND
Tree-Ring
RingID ID
Figure 13: More qualitative results watermarked images generated using WIND, Treo-Ring, and RingID.
31

---

Published conference paper at ICLR 2025
WIND
Tree-Ring
Ring ID
Figure 14: More qualitative results watermarked images generated using WIND, Treo-Ring, and RingID.
32

---

Published conference paper at ICLR 2025
WIND
Tree-Ring
RingID ID
Figure 15: More qualitative results watermarked images generated using WIND, Treo-Ring, and RingID.
33

---

Published conference paper at ICLR 2025
WIND
Tree-Ring
Ring ID
Figure 16: More qualitative results of watermarked images generated using WIND, Tree-Ring, and RingID.
34


Reviews:
[{"review_id": "QdYYdDPyFo", "reviewer": "Reviewer_YVZd", "summary": "This paper investigates reverse vulnerabilities in diffusion watermarking methods to forgery and removal attacks. Specifically, the authors propose WIND, a two-stage watermarking framework that first embeds a unique group identifier within the initial noise of a diffusion model using Fourier patterns and then searches the reconstructed noise within the noise group to identify the match. Empirical results show that WIND can achieve better detection performance and robustness against various attacks.", "questions": "(1) The authors only evaluate the method on Stable Diffusion v2. The generalization is unknown to other diffusion models, such as Stable Diffusion XL, consistency models and transformer-based diffusion architectures. Moreover, it is unclear how detection would perform at higher generation resolutions. And what is the prompt template for the generation? \n\n(2) Can WIND be adapted to GAN-based generative models when DDIM inversion is replaced by other reconstruction approaches?\n\n(3) The inversion step could affect both reconstruction speed and performance. The trade-off between the inversion step, watermarking overhead, and detection accuracy is not discussed.\n\n(4) It could be better to include group index embedding in Algorithm 1.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "(1) The paper is organized by some theoretical analysis and empirical evaluations. Furthermore, the motivations and methodology are clearly stated overall.\n\n(2) The work leverages the inherent initial noise of diffusion models as a watermark without external watermarking processes that might degrade image quality. It is innovative that grouped noise patterns are used with Fourier-based group identifiers, which is effective and robust. \n\n(3) The search efficiency is heavily relied on the number of watermarks N and noise group M, which is partially solved by proposing a faster detection variant.\n\n(4) The effectiveness of the proposed watermarking generalized to inpainting task.", "weaknesses": "(1) The evaluations of the proposed approach are limited, where only one diffusion model is investigated. Moreover, some experimental settings are missing.\n\n(2) Proof of Theorem 4.1 seems not entirely convincing. Although it is stated as a mathematical result, the actual evidence is more empirical rather than rigorous. For example, the paper’s results show low false positives, but the proof does not provide a probability bound for these occurrences.\n\nMore details can be seen in Questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AZsFHZZHrq", "reviewer": "Reviewer_QcSJ", "summary": "This paper presents an innovative watermarking method that uses the initial noise in diffusion models as a distortion-free watermark, showcasing its potential application in addressing societal challenges such as deepfakes. The two-stage watermarking framework proposed by the authors incorporates Fourier patterns during the generation process to enhance the robustness of the initial noise and effectively retrieves relevant noise groups during detection.\nDespite the significant contributions, this paper has several shortcomings. Firstly, the structure and logical flow of the paper could be improved, particularly in the abstract section. Additionally, some technical terms and concepts should be explained in more detail to aid reader comprehension. Furthermore, the depth of the results analysis could be enhanced, suggesting an exploration of the potential reasons for changes in results and their impact on the overall robustness of the method.", "questions": "See weakness.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "Strengths：\n1.\tThe two-stage framework proposed in this paper addresses the vulnerabilities of current watermarking techniques, effectively demonstrating the combination of deep learning and traditional watermarking methods. This innovation offers a fresh perspective in the watermarking field.\n2.\tThe research provides specific solutions, emphasizing the robustness of the method against various attacks. This contribution not only enhances the practical applicability of the paper but also lays a valuable foundation for future research in the area.", "weaknesses": "Weakness:\n1. The research motivation is unclear. In the Abstract section, the structure could be further optimized. There is a lack of smooth logical connection between the two paragraphs of the abstract. The first paragraph primarily discusses deepfakes and the limitations of current watermarking methods, but there is no clear transition when moving to the new framework in the second paragraph. This makes it difficult for readers to understand why the new method is necessary and how it relates to the issues discussed earlier.\n2. The interpretation of the experimental results is insufficient. Descriptions of the tables and figures are very clear, but a deeper analysis of these results could enhance the paper. For example, in Table 2, while the changes in similarity are displayed, it would be beneficial to explore the potential reasons behind these changes and how they impact the overall robustness of the method.\n3. In the experimental section, while images generated by your framework are presented, there is a lack of quantitative analysis of image quality. \n4. There is a lack of the performance across a broader range of inference steps beyond the 50-step setting currently used. Testing various inference step counts (e.g., 20, 50, 100, and 200 steps) can help determine how the step count affects model performance in terms of robustness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rkjvePVS4H", "reviewer": "Reviewer_7vcU", "summary": "1. This paper introduces a novel distortion free diffusion model based watermarking method for images. The method is distortion free as it employs initial random noise that is already used by the model versus previous methods/models that distort the distribution of generated images which negatively affects the robustness of those models. \n2. The method tackles both watermark removal attacks and forgery attacks.\n3. To make the watermark detection process more efficient, during generation grouped noises are augmented with distinct fourier patterns/identifiers. Therefore during detection, first the group identifier is recovered and then the exact match within it is found making the detection much faster versus comparing the noise to all previously used initial noises.", "questions": "Please see the weaknesses section above.\n\nQuestions:\n1. In Section 5.2 Watermarking non-synthetic images: It does not seem like the image quality is actually close to the non-watermarked images - In images which contain text in Fig 5 and Fig 9, the watermarked images are not able to retain the text seen in the original non-watermarked image (ex: last row of images with traffic text directions and text on the aircraft). Are there ways in which this problem can be resolved/handled?\n2. It seems like this method relies on the (approximate) invertibility property of DDIM. Is so, please mention this in section 2.2. Fig 1 mentions it but it would be nice to also add it in 2.2 for clarity if this is the case.   \n3. Is there any other diffusion model besides SD v2 that this method was tried with?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "originality and significance: \n- The method presented by the paper is able to tackle both forgery and removal attacks unlike previous works.\n- Shows that initial noise used by diffusion models can be a watermark and improves robustness.\n\nquality and clarity: The paper is generally well written - maintains a good flow of ideas, very few typos and explains concepts and background where necessary", "weaknesses": "1. Qualitative results only cover Watermark Detection Accuracy in Table 1 but it is important to add other detection metrics such as TP/AUC etc for a stronger evaluation and to be more convincing. \n- Also, no ablation on perturbation strenghts vs detection accuracy\n\n2. Section 5.2 Watermarking non-synthetic images: Issues with this section\n- Quantative Evaluation - Only evaluates FID, but does not touch upon more image similarity and quality metrics of watermarked images like CLIP score, SSIM and PSNR. \n- Qualitative: Lacks side by side comparison of watermarked images results from different models\n3. Experiments: Details of how the experiments were performed are lacking. Ex: how was the detection threshold (picked?\n4. Supplementary (nit, optional): Would be good to see side by side comparisons of competing methods on runtime or atleast approximate numbers that demonstrate the factor by which this method is slower.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6c4NQImYY1", "reviewer": "Reviewer_XGAj", "summary": "The paper introduces a watermarking method using initial noise in diffusion processes as a robust, distortion-free way to mark AI-generated images. The authors propose a two-stage framework called WIND, which employs initial noise and Fourier patterns to facilitate efficient watermark detection and withstand forgery and removal attacks.", "questions": "1. The organization of the paper appears somewhat disorganized. For example, Section 5.2 and the Algorithms section should be relocated to precede Section 5, which discusses the experiments. This adjustment would provide better coherence, as watermarking non-synthetic images is an integral part of the methodology.\n\n2. The evaluation of different watermarking methods is somewhat limited. The focus of this work is primarily on watermarks that involve selecting initial noise for the diffusion process, while other watermarking techniques, such as HiDDeN, are excluded. The authors should provide an explanation for this choice to give context to the scope of their evaluation.\n\n3. While the paper makes significant claims regarding robustness, the robustness evaluation itself is not comprehensive. Beyond image transformations and regeneration attacks, there are numerous adaptive attacks where the adversary possesses greater capability. Examples include transfer-based, query-based, and white-box attacks such as WEvade. These types of evaluations should be considered to strengthen the robustness analysis.\n\n4. How is threshold $\\tau$ determined in the experiments?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The methodology is easy to follow.\n\n2. Evaluates several settings.\n\n3. The two-stage approach efficiently narrows down the search space by using Fourier pattern group identifiers, significantly improving detection runtime and scalability", "weaknesses": "1. The idea of picking the initial noise for diffusion is not new. And this method changes initial noise a lot compared to Tree-Ring watermark.\n\n2. The evaluation of robustness if not comprehensive.\n\n3. Potential vulnerability to more advanced attacks", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nTHc3xbzU4", "reviewer": "Reviewer_jnGF", "summary": "The paper introduces the WIND framework for embedding watermarks in AI-generated images. WIND leverages the initial noise of the diffusion process as a distortion-free watermark, embedding group-specific Fourier patterns in the noise to enable efficient watermark verification. The proposed two-stage approach aims to reduce search complexity, improve robustness against various attacks, and optimize verification accuracy.", "questions": "Please see Weaknesses.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The two-stage approach employed in WIND is similar to a multi-level indexing mechanism. Initially, group-specific Fourier patterns narrow down the search scope (Tier-1), and subsequently, an exact matching process with the original noise ensures precise verification (Tier-2). This hierarchical structure not only enhances efficiency but also serves as a novel adaptation of multi-level indexing in watermarking, supporting scalable, high-speed identification in large datasets.\n2. The framework demonstrates robustness against several attacks, including forgery, removal, and distortive transformations. The two-tiered verification and Fourier embedding make WIND resilient to various manipulations, ensuring watermark persistence even under adversarial conditions.", "weaknesses": "1. While WIND presents a promising adaptation of existing noise-based watermarking techniques, it does not fundamentally diverge from the concepts established in Tree-Ring and RingID. The addition of a two-stage detection process is a novel enhancement but builds on the same theoretical foundation of Fourier-based watermarking in noise. The primary innovation lies in the grouping and search-space reduction, which increases efficiency and robustness but does not introduce a fundamentally new approach to noise-based watermarking.\n2. The multi-stage approach, while innovative, introduces complexity that may hinder ease of adoption. Managing group identifiers and applying Fourier-based transformations within the initial noise may pose challenges for large-scale implementations. Additionally, as the number of watermarked images grows, the demand for managing extensive initial noise records could impact computational scalability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qN7Xkg9Ej4", "reviewer": "Reviewer_hApF", "summary": "The paper presents a novel two-stage watermarking framework, named WIND, for images generated by diffusion models. It leverages the initial noise used in the diffusion process as a distortion-free watermarking method. The approach aims to enhance the robustness of watermark detection against both removal and forgery attacks by embedding group identifiers through Fourier patterns, thereby improving the efficiency of watermark retrieval.", "questions": "How does the performance of the WIND framework compare with existing state-of-the-art watermarking techniques when applied to diverse generative models beyond diffusion models?\n\nWhat specific measures have been taken to ensure that the watermarking process does not compromise the visual quality of the generated images?\n\nCould the authors elaborate on the potential implications of attackers successfully inverting the model and how that might affect the watermarking effectiveness?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "The paper presents a novel two-stage watermarking framework, named WIND, for images generated by diffusion models. It leverages the initial noise used in the diffusion process as a distortion-free watermarking method. The approach aims to enhance the robustness of watermark detection against removal and forgery attacks by embedding group identifiers through Fourier patterns, thereby improving the efficiency of watermark retrieval.", "weaknesses": "(-)  Some parts of the paper are overclaimed. For example, in Lines # 78-84, these contents are already addressed in Tree-ring [1], yet the author seems to want to claim it as their contribution. The introduced method is built upon Tree-ring [1] and [2]. However, the introduction does not discuss these works [1-2].  \n\n(-)  The problem of the previous method and the motivation of this work are not clearly delivered. The relationship between the third and fourth paragraphs is confusing and lacks logic. \n\n(-)  The effectiveness of the proposed method may be limited to specific types of diffusion models, and its performance on other diffusion models remains untested.\n\n(-)  Although the paper suggests methods to reduce runtime, the need for searching through a large number of initial noises could still pose challenges in real-time applications, particularly on resource-constrained devices.\n\nSome typos:\n\nFor example, in lines 88 and 137, add ( ) for the citations.\n\n[1] Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust. In NeurIPS 2023.\n\n[2] Steganalysis on Digital Watermarking: Is Your Defense Truly Impervious? In NeurIPS 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)