Spherical Watermark: Encryption-Free, Lossless Watermarking for Diffusion Models
Authors: Xiaoxiao Hu
Jiaqi Jin
Sheng Li
Wanli Peng
Xinpeng Zhang
Zhenxing Qian
Venue: ICLR 2026 Oral (2026)
Keywords: AIGC Watermarking; Diffusion Models;
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Employing a novel spherical mapping mechanism, we propose a novel lossless watermarking scheme for text-to-image diffusion models.

Abstract: Diffusion models have revolutionized image synthesis but raise concerns around content provenance and authenticity. Digital watermarking offers a means of tracing generated media, yet traditional schemes often introduce distributional shifts and degrade visual quality. Recent lossless methods embed watermark bits directly into the latent Gaussian prior without modifying model weights, but still require per-image key storage or heavy cryptographic overhead. In this paper, we introduce Spherical Watermark, an encryption‐free and lossless watermarking framework that integrates seamlessly with diffusion architectures. First, our binary embedding module mixes repeated watermark bits with random padding to form a high-entropy code. Second, the spherical mapping module projects this code onto the unit sphere, applies an orthogonal rotation, and scales by a chi-square-distributed radius to recover exact multivariate Gaussian noise. We theoretically prove that the watermarked noise distribution preserves the target prior up to third-order moments, and empirically demonstrate that it is statistically indistinguishable from a standard multivariate normal distribution. Adopting Stable Diffusion, extensive experiments confirm that Spherical Watermark consistently preserves high visual fidelity while simultaneously improving traceability, computational efficiency, and robustness under attacks, thereby outperforming both lossy and lossless approaches.

Published as a conference paper at ICLR 2026
SPHERICAL WATERMARK: ENCRYPTION-FREE, LOSS- LESS WATERMARKING FOR DIFFUSION MODELS
Xiaoxiao Hu', Jiaqi Jin', Sheng Li', Wanli Peng", Xinpeng Zhang', Zhenxing Qian 'Fudan University, *China Agricultural University [xxhu23, jqjin24] )mm fudan. edu.. en (lisheng, zhangxinpeng, zxqian ) @fudan.edu.cm wipengecau. edu.
(m.
ABSTRACT
Diffusion models have revolutionized image synthesis but raise concerns around content provenance and authenticity. Digital watermarking offers a means of tracing generated media, yet traditional schemes often introduce distributional shifts and degrade visual quality. Recent lossless methods embed watermark bits directly into the latent Gaussian prior without modifying model weights, but still require per-image key storage or heavy cryptographic overhead. In this paper, we introduce Spherical Watermark, an encryption-fres and lossless watermarking framework that integrates seamlessly with diffusion architectures. First, our binary embedding module mixes repeated watermark bits with random padding entropy code. Second, the spherical mapping module projects this code onto the unit sphere, applies orthogonal rotation, and scales by a chi-square distri-bitt radius to recover exact multivariate Gaussian noise. We theoretically prove that the watermarked noise distribution preserves the target prior up third-order moments, and empirically demonstrate that it is statistically indistinguishable from a standard multivariate normal distribution. Adopting Stable Diffusion, extensive experiments confirm that Spherical Watermark consistently preserves high visual fidelity while simultaneously improving traceability, computational efficiency, and robustness under attacks, thereby outperforming both lossy and lossless approaches.
form high-
INTRODUCTION
Diffusion models have demonstrated transformative potential in creative applications (Rombach et al. Sahoo et al. (024). but also raise concerns over authenticity and ownership (Craver et al. 1997
2022
Grinbaum & Adomaitis, 2022). Malicious users can exploit them fabricate images and spread disinformation, eroding public trust and creating legal and ethical challenges. As governments and
platforms face mounting pressure to address harmful content (Biden) [023] Wiggers) 2023). reliable
provenance mechanisms are urgently needed to trace and identify malicious actors.
Image watermarking offers a promising direction by embedding imperceptible identifiers into images. However, traditional schemes alter the data distribution and degrade visual fidelity, whether operating in the spatial (Li et al. 2009 Bender et al., 1995) or frequency HAi- 2007| Navas et al.) (2088) do- approaches inject watermarks by training iine-tuning generative models. For example, Fernandez et al. (Fernandez et al. 2023) fine-tune the Stable Diffuusion (Rombach et al., 2022) decoder to bake in hidden mark. To avoid costly retraining and improve flexibility, Wen al. (Wen et af.) 2023) embed tingppaterns in the frequency domains of the latent space. Although robust lossy transmission, these methods introduce perceptual artifacts and reduced fidelity.
main. Additionally,
Recently, the concepts of lossless or undetectable watermarking have been proposed. These methods seek to establish an invertible mapping from watermark bits standard Gaussian noise, embedding watermarks without any modifications to the pretrained generative model. For example, Yang et al. (Yang et al., 2024) introduce Gaussian Shading which uses repeated watermarks and stream cipher for sampling but demands a unique key and nonce per image, incurring substantial storage
"Corresponding author.

---

Published as a conference paper at ICLR 2026
and management overhead. Gunn et al. (Gunn et al. 2025) later replace the stream cipher with fixed-key pseudorandom correccorg codes (Christ & Gunn 2024). Nonetheless, the heavyweight cryptographic constructs also introduce drawbacks: they incur nontrivial computational and decoding latency, demand careful parameter tuning to balance code rate and error-correction capability, and fail under strong attacks that exceed the code's 's designed distortion bounds.
In this paper, we propose Spherical Watermark, a simple yet effective lossless scheme that is encryption- and robust against common attacks. Our method integrates seamlessly with pretrained diffusion models via three modules: binary embedding. spherical mapping, and diffusion integration. The binary embedding module mixes watermark bits with random paddings to produce a 3-wise independent bitstream. The spherical mapping module then projects this bitstream onto the umit sphere, applies an orthogonal rotation, and scales it by a chi-square-diste distribedtt radius. We theoretically analyze each intermediate distribution and prove that the final noise is statistically indistinguishable from standard Gaussian noise. In addition, our encryption free design eliminates the need for per- image key storage. The diffusion integration module then feeds the watermarked noise into Stable Diffusion (Rombach et al. 2022) to produce watermarked images. Experiments show that our scheme preserves fidelity and surpasses lossy methods. Compared to lossless approaches (Gunn et al. 2025 our method offers stronger traceability, reduced complexity, and enhanced reliability.
In summary, our key contributions are three-folded: 1) We propose novel lossless watermarking framework, which seamlessly integrates with diffusion based architectures. Our method guarantees robust watermark extraction while preserving the original generation fidelity. 2) We introduce simple yet effective mapping strategy that transforms binary watermarks into Gaussian noise inputs. We provide both theoretical analysis and empirical evidence that the watermarked noise distribution is statistically indistinguishable from standard multivariate normal distribution. 3) Compared to existing lossless watermarking schemes, our encryption-fre -feee approach omits key storage overhead, enabling an excellent raae-off between undetectability and watermark robustness.
2 RELATED WORKS
Digital image watermarking has been extensively studied safeguard intellectual property. Tradi- tional watermarking methods can be applied directly to diffusion outputs, whether operating in the spatial domain (Li al. 2009 Bender al., 1995). the frequency domain (Navas et al.! 2008 Liu
eet al. 2017: Kashyap & Sinha 2012), or via neural-network embedding (Zhang et al. 2019 ZZhu et al.
2018; Tancik et al. 2000). In addition, several works embed watermarks by tine-tuning diffusion models (Fernandez et al. 20233 Xiong et al. [023 Kim et al. 2024] Wang et al.) 2025). For example, SleeperMark (Wang et al. 2025) introduces trigger mechanism to decouple watermark information from semantic content, keeping the watermark extractable after model fine-tuning. More recently. latent- watermarking has gained attention. Wen al. propose the Tree-Ring (Wen et al., (023) watermarking scheme, which embeds ring-shaped patterns into frequency domains of the latent space to enable detection. Subsequent works such as RinglD (Ci al. 2024). SEAL (Arabi et al., 2025b),
and WIND (Arabi et al. 2025a) design alternative patterns. Beyond patee designs, Wei et al. (Wei et al. (024) provide unified analytical framework for diffusion watermarking and instantiate schemes, including truncated Gaussian sampling and Gaussian ring watermarking. However, these methods are limited to merely verifying the presence of watermark, not supporting large-scale provenance.
several distributtion-presevvve
To overcome this limitation, Yang et al. Yang et al. 2024) introduce Gaussian Shading, a provably lossless watermarking method that employs repetition codes and stream cipher sample from the standard Gaussian distribution. However, the reliance on a distinct cipher key and nonce for each generated image imposes huge man-menngemnnt overhead that impractical in the real world. Gunn et al. (Gunn et al., (222)) advocate replacing the stream cipher with the pseudorandom correccorg codes (PRC) (Christ & Gunn 2024), which allow the generation of distinct pseudorandom sequences from fixed secret key. PRC s extensive cryptographic operations also introduce several challenges. Encoding and propaa-propagation decoding (Pearl 2014) incur substantial computation and latency. Finding a trade-off between code rate and error-correction strength requires careful tuning. Moreover, under aggressive post-processing or shifts in the data distribution, the scheme can hit an irreducible error floor and fail to recover the watermark. In this paper, we introduce Spherical Watermark, framework that eliminates per-image key management, ensures lossless watermark embedding, and demonstrates superior robustness with high computational efficiency.
2

---

Published as a conference paper at ICLR 2026
(a) T workflow of Spherical Watermark
-aggaturr
melicious
Diffusion Model
Spherical
API
Embedding
Users
Receased Model
Model Developer
Signatura (T.C)
Relessed Model
Spherical
Imch
Extraction
Normal User
Offline Build Pbase
Online Runtime Phase
(b) Spherical Embedding: 2 and Extraction: s B
embeediing
extraction
Randdn Podcing
Cai-square
Rotate
Scaling
010110...
m
Watermark Mossage
Embolding Manrix
Saquince
Sphere
Rocaroon Mitris C
Sphere
Gaussian nolso
Figure
The overall pipeline of our framework.
METHOD
As illustrated in Figure Ia), method constructs a tracing mechanism from the model developer's perspective. In the offline build phase, the model developer generates a fixed "Signature", a set of invertible transforms that encode distinet binary watermarks into the diffusion model's Gaussian noise input. During the online runtime phase, API-driven image request automatically applies the same signature embed user-related watermark into the latent code before it passed through the diffusion model, ensuring that synthesized images carry traceable provenance. Finally, the developer inverts generated images to extract watermarks for reliable provenance tracking.
3.1 PROBLEM FORMULATION
The secret watermark m encodes API metadata (c.g., user ID, timestamp). Let -I denote fixed, pretrained diffusion generator that maps standard Gaussian noise z to a generated image O. Since diffusion models admit an approximate inverse mapping, we use g to recover the latent representation from generated image. Assume the watermark length is lm. Our goal is to design two efficient procedures the latent space:
Embed: m E 10, + Zm E R
Extract 2,, E B + m E 1m
(I)
Specifically, Embed takes m to produce the watermarked latent Zw = (mbed(m), and Extract predicts in from the inverted latent 2., (O, w.). where 1y denotes the latent dimensionality of z and O is the generated image with tracable watermark. Let Pr[.] denotes probability, and neg)(p)
a function that vanishes faster than any inverse polynomial the security parameter p. We require:
Undetectability (Losslessness). For any probabilistic polynomial-tine adversary A.
Pr[A(z))= 1] Pr[A(z) = 1]] S neg)(p).
In other words, watermarked noise is computationally indistinguishable from standard Gaussian noise z. Thus, for any polynomial-time adversary A', the generated images remain indistinguishable:
Pr(A'(G(zw))
Pr[)'(((z)) 1]] s negl(p).
Traceability (Exact Extraction). There exists an Extract such that, given watermarked image O... a..
Pr Extrract(( m]
np)
That is, the recovered watermark matches the original except with only negligible error in p.
For watermarking generated samples, losslessness the central design principle. It preserves visual fidelity and underpins robustness in adversarial settings. We formally justify this in Appendix and provide empirical evidence in Section (422, showing that lossy watermarking can be easily broken by adversarial attacks, whereas lossless watermarking remains unaffected.
3

---

Published as a conference paper at ICLR 2026
3.2 METHODOLOGICAL DESIGN
Watermark Preprocessing. We represent watermark m as independent Bernoulli() + bits. To enhance randomness and error correction, we repeat across N blocks and append padding vector r E 10, drawn i.i.d. from a Bernoulli( } distribution on each invocation. The resulting vector
m r]" E (0,1)" ,4 = N x bm + 4r
x
m
(5)
serves the sole input to the subsequent transforms.
Build Phase. In the build phase, the model developer constructs the Signature CT To reduce the correlation introduced by repeating m, inject randomness from the padding vector Accordingly, the embedding matrix T E {0, 1) xxxx is designed to mix watermark bits with random paddings while remaining invertible. The rotation matrix C, also invertible, then maps the binary sequence into Gaussian-like noise. IC is kept fixed and secret during runtime to prevent unauthorized removal. The embedding matrix T is constructed from the identity matrices Iix., and I, of sizes Inm and b, together with a sparse binary matrix R E {0, 13 Xl, generated by Algorithm
R I, .N' = N 4m
(6)
The core design lies in R. which injects randomness from the padding vector into the watermark bits. Two parameters govern this construction. The row sparsity specifies how many random paddings each watermark bit mixed with: a larger improves indistinguishability the cost of amplified error propagation (see Section 4.3 In addition, redundancy is introduced through N repetitions, which enable majority vote decoding. Algorithm ennsrres that the N copies of each bit are mixed with disjoint subsets of paddings, guaranteeing the independence property proved in Theorem 3.1
Algorithm Construction of Binary Matrix R
Require: Positive integers N, Im ly, such that 2 x Ensure: Binary matrix R E {0, I xl, Indices Set P
1: Initialize + 0 xlm xl,
2: P rtg 0
3: for j = to im do (inddompermuuation(11,,,1111
4:
5: TMP < .|1 N x
6: for 1o do
7:
G - x 8: RÍ
9:
P+ P+
end for
11: end for
Return Reshape(R, (UNm;1))), P
By design, T is bijective over the binary field F2 and its inverse T-1 follows that T T. And the rotation matrix C E Illxxle is orthogonal, so its inverse satisfies C-1 C² We obtain C by drawing a matrix lc lc with i..d. (O, 1) and then applying a QR decomposition, retaining the orthogonal factor. C maps the binary sequence into continuous noise compatible with the latent input of diffusion models. For notational convenience, we set Lc L, the following description
Runtime Phase. Latent-based diffusion models adopt the encoder and decoder of VAE (Kingma & Welling 2014) construct bidirectional mappings between the latent and pixel space.
EVAE I R DVAE: R + I.
denote the pretrained VAE encoder and decoder, respectively. Let Zy be standard Gaussian noise in latent space, and let Zo = EVAE (O) denote the clean latent encoding of an image O. To transform ZT into Zo, the diffusion model iteratively perform denoising steps over T discrete timesteps:
In practice, Ic is chosen as a factor of ly (e.g. lo [Vtz]) balance rotational expressiveness with computational and storage efficiency.
4

---

Published as a conference paper at ICLR 2026
Zr ZT-1
Zu- At each diffusion timestep, the marginal distribution of is governed by the probability-fee ordinary differential equation (ODE) (Song et al. 2021b):
dz. dt f((z)) g 22 log))(z)),
(8)
where fi and are drift and diffusion coefficients determined by the pre-defined noising schedule. The score function v, log pr(2,) is approximated by neural network se (Ze. (). We now describe how watermark embedding and extraction are seamlessly integrated into the Stable Diffusion pipeline.
Our approach decomposes into three reversible modules: Binary Embedding Module B, Spherical Mapping Module S, and Diffusion Integration Module G. As illustrated in Figure Ib), for water- marked image generation, we first construct the preprocessed input x by repeating m and appending random padding Then binary embedding module B performs the matrix multiplication
z (1)
Tx
in F2. Next, spherical mapping module S converts (1)) E (0,1)/=
into Gaussian noise by
2z 1, 1z) |v|12 2 Cz
(10)
draw r such that y2 ~ x (1zz), Zu = rz)
Here, ||-1|2 denotes the Euclidean norm, and (4x) is the chi-square distribution with L, degrees of freedom. The diffusion integration module 9 then generates the watermarked image. We set the initial noise ZT Zw. and by solving Eq. 8 from / = 7 to = 0, recover the clean latent Zu from Zy,
Z0 ODESolve (zr: s0, cond, T. O).
(11)
Here, cond denotes sampling conditions (e.g. text prompts), and ODESolve may be instantiated with different solvers such as DDIM (Song et al. 2021a). DPM-Solv (Lu et al. 2022, 2025). or other ODE integrators. Zo is then passed through DVAE to produce the watermarked image
O D VAE (zo).
For watermark extraction, the developer applies the inverse modules in the order ,-, on a suspect image Ô Specifically, the developer uses EVAE to estimate the latent 2n = EVAE Ow.) and then solves Eq. 8 from = to = to obtain an estimate of the initial noise:
2g = ODESSolve22u: 8p, Ø, 0, T).
(12)
Here, Ø denotes the empty condition (no text prompt). Finally, the developer inverts 2y as,
( = C 27,2() = round x(2)+
(1)
(13)
where round(-) refers to the rounding operation. The first 1Nm entries of x correspond to N repeated copies of the watermark message. We therefore apply a majority-vote rule across each group of N bits to obtain the final decoded watermark m. To avoid ties, N is chosen to be odd. Our embedding and extraction pipeline guarantees nigh-precisio watermark retrieval for reliable provenance tracking.
3.3 THEORETICAL ANALYSIS
In this section, provide theoretical guarantees that, after the successive mappings x z(1) - (2 + (3) + Zw, the final latent code z is distributed as (0, I,,) in R The detailed proofs of all lemmas and theorems stated in this section are provided in the Appendix
First, analyze the distribution of (1) in Theorem 3.1
By introducing and carefully designing T, ensure that the resulting high-entropy code (1) exhibits strong independence properties.
Theorem 3.1. If and consist of independent Bernoulli()) bits, then for (1) in Eq. we have Bernoulli(} (1) for every E .,). and (1) is both 2-wise and 3-wise independent.
Building on the properties established in Theorem 3.1 we show that z (2) satisfies the conditions of spherical dediin.. A spherical t-design (Bannai 1979 Bajnok 1992) is a finite set of points on the unit sphere that, up degree t, exactly matches the averages of all real polynomials with those of the continuous uniform distribution. Consequently, can be regarded as an approximate uniform distribution the unit sphere. The rigorous mathematical definition of spherical (-design is as,
5

---

Published as a conference paper at ICLR 2026
Definition 3.1 (Spherical t-Design). A finite set of points X (I1....,.0) NN} C - on the unit sphere in I" is called a spherical t-design if. for every real polynomial f of total degree at most t,
f(x) = 1 s--.
(x)),
N
ZEX
where do the uniform surface measure on S and |sm-1| denotes the total surface area of the unit (n -pshhee..
Equivalently, X a t-design if and only if it matches all moments of the uniform distribution on the sphere up to degree t. Consequently, spherical t-design is indistinguishable from the uniform distribution on 5 by any statistic of degree S t, and thus may be viewed as an approximation to the
uniform spherical distribution. We derive that the set of (2) is a spherical 3-design in Theorem 3.2
Theorem 3.2. z satisfies that each (2) takes values + Ate with Pr[zz = + -ेo! = Pr(z:
- 1.2 E (1, ,0);,), (2 is 2-wise and 3-wise independent. Then the finite set of (2) on the unit sphere 5 -1 is a spherical 3 design.
Finally, the following two lemmas analyze the distributions of (3) and 2m. In Lemma 3.3 we show that the orthogonally rotated vector ( remains uniformly distributed on S In Lemma 3.4 we prove that scaling by r ~ x((x) yields zn = r rz x (O, It) in IR The detailed proof' are given in the Appendix C and our experiments confirm that the empirical distribution of zw is statistically indistinguishable from standard Gaussian distribution in Section 4.2
Lemma 3.3. Let (2) E Sla be spherical 3-design. If we apply fixed orthogonal rotation
(3) (z) then z (3) is also spherical 3 Bedein... For each coordinate 2, (3) has [[ 0
and E[2;] = 1/l2. and as l + oc, the marginal law of z converges to (0, 1/tz)-
Lemma 3.4. Let (O, In) ) be standard multivariate normal vector in I Then admits polar decomposition of the form
where 22 ~ (n), and u is uniformly distributed on the wnit sphere 5m-1, Furthermore, T and u are statistically independent. Conversely, 1f x²),), is uniformly distributed on 5 and r 1 u, then the product n r u follows a standard multivariate normal distribution, i.e., n ~ (O, I.).
4 EXPERIMENT
4.1 EXPERIMENTAL SETTINGS
Implementation Details. We adopt Stable Diffusson (SD) v1.
and v2. backbone generative
models. Generated images are 512 x 512 color images with latent size 4 x 64 x 64. During the diffusion process, we use 50-step 3PM-Solver++ (Lu et al.
2025) for image generation with
2021a) with a guidance scale of 1.0. To simulate real-world scenarios, DDIM inversion uses empty prompts. Default settings are N 31, Im = 512, 4, = 512, and = 1, giving Nn = 15872 and 4, latent dimensionality. All experiments are conducted in PyTorch on four NVIDIA RTX 4090 GPUs.
guidance scale of 7.5 and a 50-step DDIM inversion (Song et al.
16384, which matches the diffusion
Watermark baselines. We consider the following baselines: traditional watermarking methods include DwtDet (AI-Haj) 2007). DwtDetSvvd (Navas et al. 2008), and RivaGAN (Zhang et al. 2019)) all configured to embed 32-bit watermarks. Latent-based baselines include Tree- Ring (Wen et al.) 2023). Gaussian Shading (Yang et al.] (024)), and PRC Watermark (Gunn et al. 2025). All schemes evaluated with 512-bit watermarks, except Tree-Ring, which supports detection only. For latent- based methods, we generate five fixed keys (or signatures) and report the mean and standard deviation of each metric over five independent runs. Unless noted otherwise, baselines their default settings. Note that with fixed keys, Gaussian Shading no longer achieves true losslessness.
Datasets & Evaluation metrics. For text prompts, we use two datasets, termed COCO and SDP Each comprises 1000 text prompts randomly sampled from the MS-COCO va]2017 set (Lin et al. 2014

---

Published as a conference paper at ICLR 2026
Table 1: FID value for different watermarking methods. Lower FID indicates higher image quality. Meanstd represents the mean value with 1-sigma enror bar.
COCO
SDP
Method
SD v1.5
SD v2.1
SD v1.5
SD v2.1
Original
48, 1744
46.81466.0817
49.7041o.5422
46.4060p.523)
DwtDet
48.29751..90
46.97711.070z
49.98530.65s
46.7304p.5165
Dw
48.7179
47.40491.011
51.0160p.co
47.5044p.6438
RivaGan
48,7956 .3952
47.61241.1012
51.27730 6320
47.82980.4744
Tree-Ring
47 47.87211,1322
90.64911.u197
47.39170.7127
Gaussian Shading
50,69681.3200
49 19.43791.0azz
51.522
48.25390.4866
PRC Watermark
48. 13481
46. 1..7544
49.5250u.rr
46.41570.3444
Ours
48. 18.11221.546
46.8132 0962
49. 49.3894o.
46.431 10,311
MAN
Figure 2: Classification performance over training epochs for distinguishing watermarked from unwatermarked samples. Left Two: Training loss and test accuracy at latent-level. Right Two: Training loss and test accuracy at image-level SDP dataset with SD v2.1.
Original
DwiDeiSvd
RivaGan
Ring
Shading
Watermonk
Figure 3: Examples of different watermarking methods. Top: COCO dataset. Bottom: SDP dataset.
and the Stable Diffusion Prompt datase respectively. To evaluate the performance of our method, we focus
criteria: undetectability and tracing accuracy. For undetectability, first assess any degradation introduced by watermark embedding. To detect subtle distributional shifts, we employ the Fréchet Inception Distance (FID) (Heusel et al., 2017) measured against the unwatermarked output distribution. We also train binary classifiers on both image-level pixels and latent-space inputs distinguish watermarked from non-watermarked samples, reporting classification accuracy to reveal detectable artifacts introduced by the watermark embedding. Next, we evaluate the reliability of watermark extraction for 100 distinct users under common storage and transmission degradations, including post-processing attacks and adversarial attacks from WEvade (Jiang et al., (023). Extraction performance quantified by bit-level accuracy (ACC) and the true positive rate 1% false positive rate (TPR @ I 1%FPR) For simplicity, we abbreviate TPR @ 1%FPR as TPR in the sequel.
We report mean and standard deviation over five runs for all metrics. Additional experimental results provided in Appendix F including further undetectability experiments and ablation studies.
4.2 PERFORMANCE ANALYSIS
Undetectability. To assess undetectability, we train classifiers to capture distributional shifts. First, we train a two-layer MLP (Rumelhart et al.) 1986) for latent-level classification. According to F both Tree-Ring and Gaussian Shading (with fixed keys) are easily detected with accuracies of 100% and 97%, while PRC Watermark and our method remain indistinguishable. Second, we

---

Published as a conference paper at ICLR 2026
Table Comparison results on ACC and TPR. Dataset: COCO dataset. Model: SD v2.1. "Post." refers to "Post-Processing" and "Adv." refers to "Adversarial".
Metries
Method
ACC (Clean)
ACC (Post.)
ACC (Adv.)
TPR (Clean)
TPR (Post.)
TPR (Adv.)
DwtDet
90.14,, 11.14..15 115
64.751.0s
49.28g.00
92.803
52. 52.233.41
16. 15.02
DwtDetSvd
100.00s.00
93.21o.17
48.95g.01
100.00..0o
91.94..68
17.05n.02
RivaGan
99.68%.10
96.78p.22
52.31g.01
100.00a.0e
99.13g.22
26.75o.02
Tree-Ring
100.00o.oo
98.850.31
6.7 0..00.02
Gaussian Shading
100.00g.on
98.43p.04
88.06p.11
100.00g.00
99.97a.04
99.23g.
PRC Watermark
100.00g 000.00..00
23.520.20
97.69p.0r
100.00n.oo
87.03a.39
95,38p.00
Ours
99.99o.u1
95.02p.08
18.144.04
100.00u.00
97.50a.18
99.83u.00
sample one prompt and generate ten watermarked images per user across 100 distinct users for image-level evaluation, with qualitative examples shown in Figure 3 In Figure 2 we also train ResNet-18 classifier (He al. 2016) for image-level classification. Tree-Ring and Gaussian Shading are detectable, while PRC Watermark and ours show near-chance detection (50%). Table shows that only PRC Watermark and our method match the original in FID, whereas other methods incur distribution shifts. These results support our theoretical analysis in Section [33 by showing that watermarked samples are statistically indistinguishable from unwatermarked ones.
Computational Efficiency. To demonstrate the advantages our encryption-fre free design, we evaluate the embedding and extraction times of latent-based watermarking schemes, with each result averaged over 100 trials. In this compari- son, we focus exclusively on the transformation between the watermark and its latent noise rep- resentation, excluding any diffusion sampling inversion procedures. As illustrated in Fig- ure 4 we employ a logarithmic scale on the y- axis for visualization. The extraction time of the PRC Watermark is much higher than that of ours, roughly four orders of magnitude slower on ex- traction. This difference reflects the computa- tional burden introduced by belief- propaatprooaattionn decoding in the PRC scheme. In contrast, our approach eliminates the need for complex key design, thereby enhancing execution speed, im- proving computational efficiency.
10"
Emaedding "Ime
Extruction Time
10
10-3
TheeRing
Figure 4: The watermark embedding and extrac- tion time for different latent- schemes. Here, the Y-axis is on a logarithmic scale.
Tracing Accuracy. In Table evaluate tracing accuracy under varied conditions. "Clean" refers to PNG storage, refers attacks from (Jiang et al. 2023) (See Appendix F.4 for details). Compared to lossy schemes, our method achieves comparable accuracy above 95% both Clean and Post- PrtteProoesinnggg settings. We introduce a tunable parameter s, which entails slight robustness trade-off relative Gaussian Shading. Under Adversarial conditions, however, the accuracy of lossy schemes degrades sharply, as their embeddings enable effective classifiers to be trained for watermark detection, which can then be adversarially attacked. In contrast, lossless schemes demonstrate clear superiority: our method improves accuracy by more than 10%, consistent with the theoretical analysis Appendix E
reports common post-pree pooocesccssing distortions, and "Adversarial"
Comparison with PRC Watermark. In Table and Figure 5 we compare our method with PRC Watermark under varied distortions. Our method consistently achieves higher TPR and ACC, with larger margin at stronger distortions. In addition, Figure ((a) examines the effect of watermark capacity Lm on tracing accuracy under JPBG-70 compression. As Im increases, PRC Watermark's decoding performance deteriorates rapidly and fails entirely beyond 4m 2000. In contrast, Spherical Watermark sustains high detection rates across the full capacity range. Furthermore, the computational efficiency comparisons show that embedding and extraction incur significantly lower overhead than PRC Watermark, with extraction being about four orders of magnitude faster. These results confirm the superior robustness of method.
8

---

Published as a conference paper at ICLR 2026
(a) PNG.
(b) Gaussian Noise.
Brightness.
(d) Drop.
(c) Gaussian Blur.
(f) JPEG.
Median Filter.
(h) Resize.
Figure 5: ACC and TPR values under Attacks, averaged over two datasets and two models.
452
Vodky 0
1480
(a) Ablation on bm-
(b) Ablation on Modules. (c) Ablation on Modules. (d) Ablation on Scttings.
Figure Ablation Study. (a) ACC comparisons under different capacities, (b) and (c) Undetectability and robustness of module ablation, (d) Undetectability analysis of varied parameter settings. Here, (a-c) are all conducted on the COCO dataset with SD v2.1.
4.3 ABLATION EXPERIMENTS
Ablation on Modules. In our ablation study, we isolate the effects of each module. In one variant, we omit the spherical mapping S and substitute the Gaussian Shading transform; in another, we skip the binary embedding B and apply only the spherical mapping x. We then evaluate both latent-level undetectability and tracing accuracy. In Figure b(b). omitting the binary embedding makes the latent noise trivially distinguishable. Figure (( shows that robustness under brightness adjustment drops dramatically without spherical mapping. These results confirm that binary embedding enforces independence, while spherical mapping essential for restoring robustness. A rigorous analysis of why our orthogonal rotation design achieves optimal robustness is provided in Appendix D
Ablation on Parameters. We further investigate the sensitivity of our method to hyperparameters: the watermark length in. the padding length 4,, the row sparsity parameter and the repetition count N. In Figure 6 d), we vary these parameters and train latent-level classifier evaluate their effect. The results show that classification accuracy remains near 50%, indicating that parameter changes do not impair undetectability. As s increases, each watermark bit depends on more paddings, making errors more likely to propagate and amplify. Similarly, reducing N decreases redundancy for majority-vote correction. Thus, both larger and smaller N reduce accuracy by design, trend also confirmed by the experimental results in Table 3 In addition, Figure 6 a) shows that Spherical Watermark maintains high detection rates across all watermark capacities under JPEG-70 compression.
Ablation on Diffusion Sampling Settings. We conduct ablation studies on the COCO dataset using the SD v2.1 model to assess the sensitivity of our method to diffusion sampling configurations. Table 4 compares watermark extraction accuracy under various attacks across three ODE solvers: DDIM (Song et al.) (221a), PNDM (Liu et al.) 2022), and 3PM--Solve+++ (Lu et al. (025). Settings of each attack type provided in Appendix
F5 We then investigate the role of generation and

---

Published as a conference paper at ICLR 2026
Table 3: Ablation of parameters and V TPR under different attack. Dataset: COCO. Model: SD
v2.1. Case I: Gaussian Blur, kernel size 9. Case 2: JPEG-70. Case 3: Brightness, factor = 2.
sparsity parameter s
repetition count N
Case
31
100.00p.on
99. 12
99.08a.25
97.58n.
99.40p.
99. .9.96..
99. 99.94p.05
100.00g.o0
2
99. 99.949.0s
99.460.26
96.64u.u 42
92.38u.74
98. 08.38
99.86u. 19.86.14
99 99.92..12
99.94o.u
3
99.72a.12
98.006.21
93. 120.sa
83.680.71
95. 10b.45
99.50p.
99.68p.19
99.72a.12
Table 4: Ablation results of extraction accuracy on ODE solvers under post post-processing perturbations.
Post Post-procsssing Perturbations
Solver
PNG
Brightness
Gaussian Blur
Median Filter
JPEG
Resize
DDIM PNDM
99.98g.o
96. 96.06g.2
99.43g.o2
99.20g.os
98.39h.16
99.85g.01
99.98o.o1
96. 96.170.29
99.40o.o2
99.15g.03
98.41n.15
99.8 99.84g.01
DPM-Solver++
99.98p.01
96.02o.2a
99.44g.01
99.21p.03
98.40b.15
99.85a.01
Table 5: Ablation results of extraction accuracy on sampling timesteps.
Inversion Timesteps
Generation Timesteps
30
40
50
99.85g.ss
99.92g.71
99.95o.57
99.95o.s
99.95e.e0
20
99.96o.s2
99.97o.46
99.98p.35
99.98p.3a
99.98o.38
30
99.97o
99.99o.18
99.99o.1e 16
99.99o.12
99.99o.12
40
99.97a.se
99.98g.52
99.98p.48
99.98u.47
99.98a.48
99.97a.36
99.98g.36
99.98p.29
99.99u.29
99.99g.26
inversion timesteps under PNG storage, as summarized in Table Results show that neither the choice of ODE solver nor the variation in timestep schedules introduces meaningful degradation. The minor numerical discrepancies caused by switching solvers or adjusting timesteps are effectively absorbed by the inherent redundancy of our spherical mapping, which provides robustness against moderate inversion inaccuracies. Further quantitative analysis is provided in Appendix F.3
DISCUSSION AND LIMITATIONS
Our Gaussian-nowd noise guarantee depends on spherical 3-design definition. While watermarked and random noise are empirically indistinguishable. higher-order moments may deviate from the true prior. Extremely strong preesionbbreaiin attacks (e.g., perturbations targeting the VAE encoder ODE solver) still compromise recovery. We provide extended analysis of method against re-generation and editing attacks in Appendix F.2, showing that the proposed approach retains robustness in these scenarios. Nevertheless, our primary focus on tracing the origin of maliciously generated content. Since editing and forgery may involve different adversarial, such cases are outside our scope. Overall, our method can generalize to any generative model with a Gaussian prior and invertible mappings, with detailed analysis in Appendix F.I
CONCLUSION
In this paper, we introduce Spherical Watermark, a novel watermarking framework for image generation that requires no modifications to the diffusion model. Our key innovation is the binary embedding and spherical mapping module that converts binary watermark bits into Gaussian noise input. Watermarked latent inputs are provably and empirically indistinguishable from standard Gaussian prior. Additionally, we eliminate per-image key management while delivering superior robustness under realistic distortions. Extensive experiments demonstrate that our method outperforms existing schemes in terms of undetectability, traceability, and computational efficiency.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
We sincerely thank the anonymous reviewers and area chairs for their constructive comments and suggestions. This work was supported by the National Natural Science Foundation of China (Grant 62572125) and the Natural Science Foundation of Shanghai (Grant 252R1401019),
ETHICS STATEMENT
We have carefully reviewed and adhered to the ICLR Code of Ethics throughout the development of this work. We have ensured that our methodologies and findings are transparent, reproducible, and free from discrimination, bias, or unfairness concerns, Any potential ethical concerns have been carefully considered, and encourage responsible use of our contributions in future research.
REPRODUCIBILITY STATEMENT
We are committed to ensuring reproducibility our results. All theoretical claims are supported with complete proof's provided in Appendix C Appendix [ and Appendix E For empirical studies, we specify datasets, model architectures, hyperparameters, and implementation details in Section [ with additional information in Appendix The source code is included in the supplementary material, with README file that clearly documents the execution steps. All experiments are repeated five times, and we report the mean and standard deviation to mitigate randomness and measurement error.
REFERENCES
Rameen Abdal, Yipeng Qin, and Peter Wonka. Image2stylegan: How to embed images into the stylegan latent space? In Proceedings of the IEEE/CVF international conference on computer vision, pp. 4432-4441, 2019.
Ali AI-Haj. Combined dwt-det digital image watermarking. Journal of computer science, 3()): 740-746, 2007.
Kasra Arabi, Benjamin Feuer, R. Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two-stage robust watermarking for images. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net, 2025a.
URL https: /ttpss://openrevien net forrumiid-112ne 6qwRG
Kasra Arabi, R Teal Witter, Chimmay Hegde, and Niv Cohen. Seal: Semantic aware image water- marking. arXiv preprint arXiv:2503. /2/72, 2025b.
Bela Bajnok. Construction of spherical t-designs. Geometriae Dedicata, 43:167-179, 1992.
Eiichi Bannai. On tight spherical designs. Journal of Combinatorial Theory, Series A, 26(1):38-47, 1979.
Eiichi Bannai and Etsuko Bannai. A survey on spherical designs and algebraic combinatories on spheres. European Journal of Combinatorics, 3066):1392-1425, 2009.
Walter R Bender, Daniel Gruhl, and Norishige Morimoto. Techniques for data hiding, In Storage and Retrieval for Image and Video Databases III, volume 2420, pp. 173. SPIE, 1995.
Joseph R Biden. Executive order on the safe, secure, and trustworthy development and of artificial intelligence. 2023.
BlackForrstt.abs, Flux. dev.. hntpss://blcckforetttt
aii 2024.
Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image
editing instructions. In Proceedings of the IEEE/CYF conference on computer vision and pattern recognition, pp. 18392-18402, 2023.
11

---

Published as a conference paper at ICLR 2026
Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Robust watermarking and watermark removal for arbitrary resolution images. In Proceedings of the IEEE/CVE International Conference Computer Viston, pp.
2025.
Louis HY Chen and Qi-Man Shao. Normal approximation under local dependence. 2004.
Miranda Christ and Sam Gunn. Pseudorandom error-correcting codes. In Annual International Cryptology Conference, pp. 325-347. Springer, 2024.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Computer Vision, pp. 338-354. Springer, 2024.
Thomas M Cover. Elements of information theory. John Wiley Sons, 1999.
Scott A Craver, Nasir D Memon, Boon-Lock Yeo, and Minerva M Yeung. Can invisible watermarks resolve rightful ownerships? In Storage and Retrieval for Image and Video Databases V, volume 3022, pp. 310-321. SPIE, 1997.
Ph Delsarte, JM Goethals, and JJ Seidel. Spherical codes and designs. Geometriae Dedicata, 6(3): 363-388, 1977.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida, USA. pp. 248 255. IEEE Computer Society, 2009. doi: 10. (099/CVPR.20995506888
URL https: http://ooooorroo
1109/CVPR, 5009..2064888898
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans on image synthesis. In Marc' Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan (eds.), Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pp. 8780-8794, 2021. URL http::tt///ccceepiiggge////////s
Mucong Ding, Tahseen Rabbani, Bang An, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Benchmarking the robustness of image watermarks. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models, 2024.
Laurent Dinh, David Krueger, and Yoshua Bengio. Nice: Non-linear independent components estimation. arXiv preprint arXiv:1410.8516. 2014.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition scale. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021. URL https: http::///peeeevveeeeeee net worummrirmi...
YicbFaNTTy
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning, 2024.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466-22477, 2023.
Alexei Grinbaum and Laurynas Adomaitis. The ethical need for watermarks machine machine-generated language. Al and Ethics, 2022.
12

---

Published as a conference paper at ICLR 2026
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2025. OpenReview.net, 2025. URL forum? dddimidddddmmmd33
net/
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge a local nash equílibrium. Advances in neural information processing systems, 30, 2017.
Runyi Hu, Jie Zhang, Ting Xu, Jiwei Li, and Tianwei Zhang. Robust-wide: Robust watermarking against instructiio-driveer image editing. In European Conference on Computer Vision, pp. 20-37. Springer, 2024.
Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai-generated content. In Weizhi Meng, Christian Damsgaard Jensen, Cas Cremers, and Engin Kirda (eds.). Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen. Denmark, November 26-30 2023, pp. 1168 1181. ACM, 2023. doi: 10.1 141/357661155362555
URL SRLLhttss://ee
org. / 10. 1 357 7915, 3623189
Nikita Kashyap and GR Sinha. Image watermarking using 3-level discrete wavelet transform (dwt). International Journal of Modern Education and Computer Science, 4(3):50, 2012.
Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 8974-8983, 2024.
Diederik Kingma and Prafulla Dhariwal. Glow: Generative flow with invertible 1x1 convolutions. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa- Desa-Bianchi, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 31; Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada. pp.
2018. URL http::::s//pccccceeeeeeeeoe newripeiaipp.... wwtpuppppiicccppee/eeeeppppppp paper/ 3
html
Diederik P. Kingma and Max Welling, Auto-encoding variational bayes. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http:
//ara wxivvoog//bbs..oo.oo 111/ 6114
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Xiaolong Li, Bin Yang. Daofang Cheng, and Ticyong Zeng. A generalization of Isb matching. IEEE
signal processing letters, 16(2):69-72. 2009.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and Lawrence Ziticck. Microsoft coco: Common objects in context. In Computer vision- ECCV 2014: 13th European conference, zurich, Switzerland, September 6- 12, 2014, proceedings. part 13, pp. 740-755. Springer, 2014.
Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. arXiv preprint 220.:22000009778. 2022.
Shuai Liu, Zheng Pan, and Houbing Song. Digital image watermarking method based dct and fractal encoding. IET image processing, 11(10))815-821, 2017.
Giacomo Livan, Marcel Novaes, and Pierpaolo Vivo. Introduction to random matrices theory and practice. Monograph Award, 63(54):914, 2018.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-5787, 2022.
13

---

Published as a conference paper at ICLR 2026
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. Machine Intelligence Research, pp. 1-22, 2025.
Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. arXiv preprint arXiv:2410.1877 2024.
Yuging Ma, Xianglong Liu, Shihao Bai, Lei Wang, Aishan Liu, Dacheng Tao, and Edwin R Hancock. Regionwise generative adversarial image inpainting for large missing areas. IEEE transactions on cybernetics,
2022.
Francesco Mezzadri. How generate random matrices from the classical compact groups. arXiv preprint math-ph/0609050, 2006.
Robb J Muirhead. Aspects of multivariate statistical theory. John Wiley & Sons, 2009.
KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based watermarking. In 2008 3rd international conference on communication systems software and middleware and workshops (COMSWARE' (0).. pp. 271-274. IEEE, 2008
Judea Pearl. Probabilistic reasoning in intelligent systems: networks of plausible inference. Elsevier, 2014.
John Proakis and Masoud Salchi. Digital communications. McGraw-hill 2008
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nathan Ross. Fundamentals of stein's method. 2011.
David Rumelhart, Geoffrey E Hinton, and Ronald Williams. Learning representations by back-propagating error.. nature, 323(6088):533-536, 1986.
Subham Sahoo, Marianne Arriola, Yair Schiff, Aaron Gokaslan, Edgar Marroquin, Justin Chiu, Alexander Rush, and Volodymyr Kuleshov. Simple and effective masked diffusion language models. Advances in Neural Information Processing Systems, 37:1 37:130136-11 130184, 2024.
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. Improved techniques for training gans. Advances neural information processing systems, 29, 2016.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In 9th Interna- tional Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021a. URL
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In 9th Interna- tional Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OeenReview.net, 2021b.
.nt/ wtt.:eommm-i-xI11112220.-
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1112-21 2020.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention all you need. Advances in neural information processing systems, 30, 2017.
Jangshan Wang, Junfu Pu, Zhongang Qi, Jiayi Guo. Yue Ma, Nisha Huang, Yuxin Chen, Xiu Li. and Ying Shan. Taming rectified flow for inversion and editing, arXiv preprint arXiv:2411.04746, 2024.
14

---

Published as a conference paper at ICLR 2026
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600-612, 2004.
Zilan Wang, Junfeng Guo, Jiacheng Zhu, Yiming Li, Heng Huang, Muhao Chen, and Zhengzhong Tu. Sleepermark: Towards robust watermark against fine-tuning eoxt-to-imag diffusion models. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 8213-8224, 2025.
Wei, R Qiu, Chen, Y Qi, Lin, W Xu, S Nag, R Li, H Lu, Z Wang, et al. Ro- bust watermarking for diffusion models: A unified multi multi-dimensional recipe, 2024b. URL 2024.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Finger- prints for diffusion images that are invisible and robust. 2023.
Kyle Wiggers, Microsoft pledges to watermark ai-generated images and vidcos. TechCrunch blog, 2023.
Wikipedia contributors. N-sphere Wikipedia, the free encyclopedia, 2025. http::/://ee
wik /ttp:pp/l/..///////////------ wttp.//////...////pe//eeaa st obt.:ppeeeeeeettttt.tooooooooooo caaeiioonoo____e____e_e htt.eeeffssstcooooiiaattttt
Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proceedings of the 31 ACM International Conference on Multimedia, pp. 1668-1676, 2023.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossee image watermarking for diffusion models. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pp. 12172-12171, 2024.
Kai Zhang, Lingbo Mo, Wenhu Chen, Huan Sun, and Yu Su. Magicbrush: manually annotated dataset for instruction-guide guiided image editing. Advances in Neural Information Processing Systems, 36:31428-31444 2023.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. CoRR, abs/1909.01285, 2019. URL http://aaxivvorr
abs/1909. 01285
Haozhe Zhao, Xiaojian Shawn Ma, Liang Chen, Shuzheng Si, Rujie Wu, Kaikai An, Peiyu Yu, Minjia Zhang, Qing Li, and Baobao Chang. Ultraedit: Instruction-based fine-grained image editing at scale. Advances in Neural Information Processing Systems, 37:3058-3092 2024.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018.
APPENDIX
In the supplement, Appendix A provides statement on the use of large language models (LLMs) during the preparation. Appendix B presents the theoretical proofs for the theorem and lemmas introduced in Section 3 of the main paper. Appendix [D] examines the rotation operation within the proposed spherical mapping module, demon- strating contribution to robustness and showing that constitutes a near-optimal solution under some lossy channels. Appendix D provides our theoretical analysis of the importance of losslessness, showing that it plays a crucial role in resisting adversarial attacks. Finally, Appendix IT supplies additional experimental details and results that further validate the effectiveness of our method.
pressntss the technical details of basclines. Appendix CiriixCpppnne provides
A USE OF LARGE LANGUAGE MODELS
We used large language models (LLMs) to assist with language polishing and improving the clarity of exposition. All technical content, including theoretical claims, proofs, algorithms, and experiments, was developed entirely by the authors.
15

---

Published as a conference paper at ICLR 2026
Original
DwiDct
DwiSvd.
RivaGAN
GS.
PRC.
Ours
Figure 7: Examples of watermarked images. Generated images from top to bottom: COCO-SD v1.5, COCO-SD 12.1, SDP-SD v1.5, SDP-SD 1. Here, "DwtSvd." refers to "DwtDetSvd", "TR." to "Tree- Firee-Ring", "GS." to "Gaussian Shading", and "PRC." to "PRC Watermark".
B OVERVIEW OF BASELINE METHODS
This section systematically reviews and analyzes several previously proposed watermarking schemes evaluated in the experiments. These methods range from traditional signal processing techniques state-of-the-arr latent-based schemes, reflecting the evolution and diversity of watermarking methodologies. We present several examples of watermarked images in Figure 7
DwtDet. DwtDet (Al-Haj 2007) is hybrid watermarking technique that integrates Discrete Wavelet Transform (DWT) and Discrete Cosine Transform (DCT). It performs multi-level wavelet decomposi- tion the carrier image, extracts the low-frequency sub-band to find stable regions, and then applies block-wise DCT to embed the watermark into mid-frequency coefficients. The method balances quality and robustness using DWT for structure retention and DCT for compression resistance.
Dw Dw. DwtDetSvd Navas et al. 2008) is an improved watermarking scheme based on DwtDet, enhanced by incorporating Singular Value Decomposition (SVD) boost security and stability. The method performs DWT on the carrier image, selects specific sub-bands for block-wise DCT, and then performs SVD on each block embed the watermark into the singular value matrix. resists geometric transformations and signal processing attacks.
RivaGAN. RivaGAN (Zhang et al. 2019) is watermarking framework based on Generative Adver- pecoder-decodee architecture for adaptive watermark embedding
sarial Networks (GANs), using and extraction. The generator embeds the watermark covertly, while the discriminator and extraction network trained together to enhance attack resistance. Adversarial training enables adaptability to diverse attacks, ensuring strong robustness.
Tree-Ring, The Tree-Ring (Wen et al. 2023) watermarking scheme embeds specific ring-shaped pattern, referred to as a key into the Fourier space of the initial noise vector in the diffusion model. This subtle modification influences the entire image generation process during sampling, in way that is imperceptible to humans. By leveraging the properties the Fourier domain, the watermark exhibits invariance common attacks.
Gaussian Shading, Gaussian Shading (Yang et al. 2024) a provably secure watermarking scheme. This method utilizes repetition codes and stream encryption to transform the watermark information m into a binary bit sequence 8 E {0, 1 that follows a uniformly random distribution, where each bit s; ~ Bernoulli (), E 1.., r2). Then, through truncated sampling scheme, the sequence is mapped into latent representation x that conforms standard Gaussian distribution. This
16

---

Published as a conference paper at ICLR 2026
process can be formally expressed as:
24 (2s; 10-11 |=|, 1).,
(14)
Here, is randomly sampled in each invocation, following standard one-dimensional Gaussian distribution. However, it requires storing a unique key for each image to preserve the original distribution, which introduces substantial management overhead. Moreover, the truncated sampling scheme is suboptimal and fails to reach the theoretical upper bound of error correction, as rigorously analyzed in Appendix()
PRC Watermark. The PRC Watermark (Gunn et al. 2025) embeds information into the latent
representation diffusion models by using pseudorandom error-correcting codes (PRC) (Christ & Gunn] 2024) instead of stream cipher techniques. While their approach eliminates the need to store a separate key for each image, it introduces heavyweight cryptographic complexity. The use of encoding and belief-proppe propaatpoopagtiion decoding (Pearl) 2014) incurs substantial computational cost and latency during watermark embedding and extraction. Moreover, their inherent uncertainty leads to them being prone to hitting performance ceiling, failing recover the watermark under certain lossy conditions.
C PROOFS OF THEOREMS AND LEMMAS IN SECTION 3.3
Lemma 3.1. m and consist of independent Bernoulli()) bits, then for (1) in Eq. 11, have +0)) Bernoulli (1) for every E (1,....1a), and (1) is both 2-wise and 3-wise independent.
Proof. In 2, linear independence of Boolean linear forms is equivalent to their statistical indepen- dence. We form the combined variable
mi, ma mim: F1, T2: mi,]
(15)
which can be viewed as the concatenation of m and r, with all entries mutually independent. We then construct the binary matrix
Im I
R
Q
E {0, (0.1,(0x0
(16)
L
N copics
I
so that the encoding (4) = Tx of E2 in Eq. the main paper can be compactly re- re-written as (1) Qe Since each row of Q is a nonzero vector in Elmtle we can write
-/ tid ej l.)
(1) z
(q. e)r,
(17)
where qi is the ith row of Q liy represents its jth entry. ()),, denotes the binary inner product, ej is the jth entry of c, and Q refers to the bitwise XOR. Because the bits ej are independent and each satisfies Pr(e, = 1] = t. any nontrivial XOR of them remains unbiased, hence
Pr[2 (1)
1] Pr[z] (1) 0] 2
(18)
i.c. 2( Bernoulli(}) (}) for all
In this setting, verifying independence ( reduces to a simple rank condition on Q. Specifically:
(1) is k-wise independent if and only if every k-row submatrix of Q has full row rank.
17

---

Published as a conference paper at ICLR 2026
Equivalently, for any choice of indices ......, ik.
ranky, Q (ttmm)it)))
k,
(19)
which ensures that the corresponding outputs 24, ..... Rig are linearly independent, and hence statisti- cally independent. By Algorithm of the main paper, any two distinct rows Q are not identical. Consequently, every 2-row submatrix of Q has full row rank. It follows that the corresponding output bits are linearly independent, and hence ( is 2-wise independent. Assume, for the sake of contra- diction, that 2 not 3-wise independent. Then there exist distinct indices i1, i2, i3 (61 < i2 < is) and coefficients a, b, c F2,, not all zero, such that
(1) 21
① b2
(I) 2
0.
(20)
However, since (1)) is already 2-wise independent, no nontrivial relation can hold among any two (1)
bits. For example, if O, then we have zi, @ b (1) with (a, b) + (0, 0), which contradicts 2-wise independence. Therefore, in the above three-term combination, a, and e must be 1; otherwise we would contradict 2-wise independence. Hence,
=
Pi + qi
@ qis
O.
(21)
The leftmost Im columns of Q can sum to zero only in two cases:
All three indices lie in the bottom block: i1, i2, is > N x 4m Then in the last I, columns their rows to nonzero vector, contradicting Qi @ 9i q/s O.
Two indices lie in the top block but align on repeated identity rows: 11, 12 S N lms i2 mod Im 0 and i3 > N x Im- In the R block constructed by Algorithm of the main paper, the positions of the 1-entries in rows i and i2 are guaranteed be disjoint, so their sum over the last 1, columns is nonzero, again contradiction.
In either case we reach a contradiction. Therefore no nontrivial three-term relation exists, and ((1) is 3-wise independent.
Li
Definition 3.1 (Spherical (-Design). A finite set of points X = (xi,..., .N) C S on the unit sphere in I is called a spherical t-design if. for every real polynomial f of total degree at most t,
Σ
f(x)
f(x) (z)),
(22)
N
5n-1
where do is the uniform surface measure on S and |5n-1| denotes the total surface area of the unit (n 1 -sphher
Equivalently, X is (-design if and only if matches all moments of the uniform distribution on the sphere up to degree t. In the following theorem, we show that the finite point set sampled from (2) constitutes a spherical 3-design.
VT Theorem 3.2. z satisfies that each 2; (2) takes values + 1 with Pr|=;= =
+
Pr(z
VT. 1. i E (1,.... Lz); (2) is 2-wise and 3-wise independent. Then the finite set of (2) on the unit sphere sl. -1 is spherical 3 dedsin...
Proof. z E 10- < is 2-wise and 3-wise independent with Pr(z(") 1] = Pr(2 0]
i, E (I, Define
v 2z (2
(23)
||v|12
Since 2!") Bernoulli(y), we have ; = 22 E {+1} with Pr(u; = 1] = Pr(p: - 11=
Because ||v||2 = VTz, follows that
(2)
E
+ v
(24)
Vi
18

---

Published as a conference paper at ICLR 2026
and Pr(z; (2) consists solely of affine shift followed by a normalization. Neither step mixes entries across different coordinates: each z/?) depends only on the corresponding 2) Moreover, both operations are invertible. Hence any independence property of 2 is preserved exactly in z²²), and no new dependencies are introduced. We can derive that z (22) is also 2-wise and 3-wise independent.
- Pr(z (2)
- - VT.
2. Note that the transformation from z!1) to 2
By the polynomial-average 1977 (Delsarte et al. 1977). Theorem 5.3; Bannai & Bannai 2009 (Bannai & Bannai Bannail Theorem 2.2). it suffices to check that z (2)) matches the uniform sphere's moments for every monomial of total degree < 3. Let U = (U1,..., ... Ut,) be random vector drawn uniformly from the unit sphere 5/2-- By symmetry,
characterization of spherical designs (Delsarte-Goettall--Seiiee
1 T.
B[U,] = 0,
E[U
-
B[U.U,] =
f),
(25)
and all mixed moments of total degree up to three that are odd any coordinate equal zero. We list all cases:
Degree 1.
E| E|2
= 1 (v). 2 vT
+ +
+(-,,))
(26)
matching the sphere's [E(U:] = 0.
Degree 2.
((12)))91
-
VT. +
E[z - 11: B|z]²1 =0 f),
(27)
which agrees with the uniform-sphere values E[U?} = B[,UU =0.
Degree 3.
B[ 11 3 ( 2) = =0
(28)
E (=( (2) 2=
[[{ R[2 (2)
+ 0 (i + j),
(29)
2 () 2, | |1
(2) 1|x ||,,
(distinct i.),
(30)
These all match the sphere's vanishing of odd moments up to degree Since every polynomial of degree < 3 is linear combination of these monomials, (2)) reproduces exactly the uniform-sphere averages through degree 3. Hence, the finite set of z is spherical 3-design.
Lemma 3.3. Let (2) E Six-1 be spherical 3 dessin.. If we apply fixed orthogonal rotation
(3) C (2) then z (3) is also spherical 3 design. For each coordinate 2,3) has E[2,] 0
and E = 1/1g, and as l + co, the marginal law of (3) converges to N 1/1x)-
Proof. Since the point set
X= (2))) S
(31)
is spherical 3-design, it integrates exactly all polynomials of total degree < 3. Hence for any polynomial f IR + IR with deg f < 3,
Σ fz(
= 114. -1| f 9 f(x) do(x).
(32)
X
xx
Define the rotated set
X = (z (3) 2z z E X).
(33)
Since orthogonal rotations preserve the spherical surface (Haar) measure,
JS... f(Cx) do
- (
(34)
19

---

Published as a conference paper at ICLR 2026
Because f(Cx) is still a polynomial of degree I 3, the design property of {z(2)) gives
1
Σ f(z(3)
Σ 2
f(Cz(()
|
=
X
x
(35)
1
/
f f(Cx) do( 84a-1
f(z) do(x).
8
15 Sta-1
Therefore the rotated set also constitutes a spherical d-design.
Recall that from the spherical 3 design property in the proof of Theorem 3.2 (or equivalently from the
degree-1 and degree-2 moment matching) we have for the original vector (2)
(#1
(2)
2 T
2 (2) = O, E
1e dzks =
1k.,,...,4
(36)
the symbol 6ōā denotes the Kronecker delta, which is defined by
1, j=
65k
(37)
0,
j k.
Let 23)) Cz (2) be the rotated vector, so that
(3)
Σ
Cig zj
(38)
j=1
Here, Ciy represents the ith row, jth column entry of C. By linearity of expectation and the above moment identities,
E
City
E
(2)
0,
(39)
==1
and
E (x
(3)
E
Cs 2j =
(40)
4
4 Σ Ca Elz 1 -
4 Σ
Σ 3
21
C2 Le
12'
j=1
The classical central limit theorem for independent summands
directly applicable here since
22)) may exhibit local dependence. Instead, we construct the dependency graph according to Stein's method (Ross, 2011 Chen Shao 2004). For the rotated item (3) derived by Eq, 38 we build
dependency graph with l vertices, where vertex corresponds Cij 2 Following the generation procedure, each entry (²)) given by
=
2/q e)F, vTz
(41)
where qi denotes the j-th row of the binary matrix Q (see Eq. 16p. and is defined by Eq. 15 We
connect two distinct vertices ý1 * j2 by an edge if and only q; and qi share at least one common index which both entries equal 1, i.e., supp(q;, (suup( (p,)();))))))) * Ø, where supp(q,) = {klqj,.
}} denotes the support set of indices. Equivalently, an edge exists when "ij and Zjz
(2) share at least
one underlying source bit from m or r. Morcover, [[(( normal-approsee curmal-approximation bound for locally dependent sums. By Theorem 3.6 in (Ross) 201T), the degree of the dependency graph is bounded by the maximum degree D, then for the Wasserstein
1/Lg, and we can derive a standard
distance dw of VTaz(
(3) and (o, J, it satisfies.
Lx
1/2
dw D2
E
VT C
28
D
Σ
E
(vT
(42)
Obviously, |VT, 2/ (2) 1, so the right-han hand side reduces to terms involving [Cay). Next, we verify that our dependency graph satisfies the conditions above.
20

---

Published as a conference paper at ICLR 2026
Due the constraint imposed by Algorithm I the maximum degree D is uniquely deter- mined by the embedding matrix TT and satisfies S N Since N and im are preset constants, we can treat D constant.
The entries Ciy come from the orthogonal matrix C, which is sampled from the measure according to (Mezzadri) 2006). For typical Haar-random C and sufficiently large 1,. the row-wise empirical averages concentrate around their Haar expectations in probability over the draw of C. For any fixed (i.j). the squared entry [C,y] follows the Beta
distribution Beta(} ( 1²5²) (Wikipedia contributors 2025 Livan et al. 2018). In partieular,
the third and fourth absolute moments are,
[(3)
r ((
E E|[Ci,
3/2) B[
((52),
VT r 333
VTI
(43)
where I()) denotes the Gamma function, and O is the standard asymptotic order notation.
Therefore, ignoring constant factors, the distributional discrepancy in Eq. 42 can be simplified as,
dw ( + (D2/2112112
0 (111112)
(44)
where (-) denotes the standard Big-O notation. As 11 - oo, we have dw - 0, which implies that the marginal distribution of zi converges to N(0 1/12).
(3)
This completes the proof.
Lemma 3.4. Let (O, I,) be standard multivariate normal vector in TR. Then x admits polar decomposition of the form
x=r.u.
(45)
where p² ~ (n). and u is uniformly distributed the unit sphere Sa-1, Furthermore, and statistically independent. Conversely, if x²²(n), u is uniformly distributed on S and r 1 u, then the product
follows a standard multivariate normal distribution, iee., (0, I,)-
Proof. In the sequel, we denote the Euclidean norm || 1l12 simply by |. We begin by demonstrating that any random vector drawn from standard multivariate normal distribution can be decomposed into a radial component and directional component u. We refer to classical result on spherical distributions (see Theorem 1.5.6 in (Muirhead] (209)), which states,
Theorem. If x has an n-variate spherical distribution with Pr(x = 0 0, and we define the radial part as |||| (x xx2 and the normalized direction T(x) = |X|--x -'x, then T(X) uniformly distributed on the unit sphere -11 and T(X) and are statistically independent.
Since the multivariate normal distribution is continuous, we have Pr(x = 0 = Moreover, the standard normal distribution is rotationally invariant; that is, for any orthogonal matrix C E R=**
we have Cx d x (The notation d' denotes equality in distribution). Therefore, is spherically distributed in R" and it satisfies all the conditions required by the theorem. By applying the above theorem, decompose into a radial part and direction follows:
1/2
r =
|||||
Σ
== T(x)
(46)
|
Since each H; (N( 1) and the components independent, it follows that y2 direction u is uniformly distributed over the unit sphere 5 and r and u are independent by the theorem. This establishes the sufficiency: any standard multivariate normal vector x /N I,) can be decomposed into an independent product Xx, disttribueee magnitude and a uniformly distributed direction.
(n).. The
21

---

Published as a conference paper at ICLR 2026
Here Unif(S - sueporeeees
Conversely, suppose we independently sample Unif(S"-1) and Xn. and define z r represents the uniform distribution one the unit sphere S S"-1 Then, using the Gaange-of-varibble formula in polar coordinates, the probability density of z in R is given by:
fa(z) - f+(llz)) fu
2 |
-||=||
||
(47)
where f-(+) and fu(+) are the densities of Xn. and the uniform sphere distribution, respectively. Substituting the known densities and simplifying, we recover the standard multivariate normal density:
fz(z) (2 (2 exp (- |
(48)
Therefore, I,).
D ROLE OF ROTATION IN ENHANCING ROBUSTNESS
In the ablation experiments of the main paper, we observed that replacing the spherical mapping mod- ule with the provably secure transformation introduced in Gaussian Shading results in a degradation of robustness. In this section, we analyze the underlying reasons for this behavior. Note: To avoid notational conflicts, this section is self-contained and uses its own symbols.
First, compare the provably secure mapping used in Gaussian Shading with the spherical mapping in our scheme. Let the watermark- bearing bit-string be denoted by the vector s E 13". We first convert into {=1] vector via
S
+ 2s - 1.
(49)
In the Gaussian Shading pipeline, one then samples a Gaussian noise vector z ~ MO, I,) (of same dimension s) and forms the watermarked Gaussian noise x by element- wise multiplication:
x
o s.
(50)
Here, || represents the element-wise absolute value operator. By contrast, our scheme applies fixed orthogonal rotation:
x = rCs,
(51)
where 1=x= is an orthogonal matrix satisfying C I,, Here, I, is the identity matrix of size x The scalar is defined as
q X2
(52)
ie.. @ follows chi-square distribution with n degrees of freedom.
AWGN channel. We now compare the per-bit extraction accuracy of the two mappings under an additive white Gaussian noise (AWGN) channel. Let the received vector be
y + e,
(53)
Gaussian Shading, each coordinate of x takes the form
| 8;, 2; (0 1),
E (+1}.
(54)
We extract & by the sign of the noisy sample y: = F; + ez Hence, the per-bit extraction accuracy by Gaussian Shading is
((x) P(x + < 0) dr + 1 x(x) P(x 0) dr.
Pas = P(s: = xi) (i)
(55)
Let & and tb are the standard Gaussian density and cumulative distribution function (CDF). Since
p 0) d(z/o), P( <0) = =1- 4z/o).
(56)
we get
Pas = 0 6(x) [1- 2<//0)] dr ( (z/0) / 20(z) ((z/o) dz.
(57)
22

---

Published as a conference paper at ICLR 2026
In our spherical mapping scheme,
x= = rss, c'C=I,,
(58)
Upon reception we compute
(59)
(0,
Extraction is done coordinate-wise by 8, = sign(y(), the per-bit bit accuracy of our method is derived by
Pours P(s; = 8:)
P(rs; + ni > > 0 - P(s: = +1) + + + <0 = -1) P(s: = -1)
P > 0) P <0)
"Kr/0),
(60)
Recall the design of Eq. 52 so that E[r] and Var(r) (11/n). In particular, for large n,
Var(r) [E 1)
1/2
0 (n + 00).
(61)
n
n
2n
Hence r concentrates around 1 in probability,
E, [[(//)]] - & (1/o), Pours - 2(1/o).
(62)
By definition,
PGs = (x [o[((//))]
(63)
where U 12| with Z ~~ N(0 1) (so U is half-normal on [0, oo)). Since strictly concave on [0, oo) and B[U] = 2 1, Jensen's inequality gives
Pas Eu [U//]]] s (E(U1//) ((1/o) Pouns
(64)
Hence Pas < Pours for all O. In other words, under the AWGN channel, our proposed scheme achieves a higher per-bit extraction accuracy than Gaussian Shading.
Optimality under Equal-Energy Constraint. In the sequel, we denote the Euclidean norm || lla simply by ||- |l. Both Gaussian Shading and our mapping embed s E {=1}" such that the total energy, measured by the squared Euclidean norm of the embedded vector, is on average yielding per-bit energy of exactly 1. In other words, E x; 2
=1,i= -.1i=1....,77 n. Concretely:
XGS = 2 ④ 8, NO,,
(65)
so ||xas|| 2== = ||z||2 and B([[xcs||3)
XOurs = r Cs, C = I,, =1,
(66)
so ||Ourrs|l = ,2 |||||2 n and E( [[[[Ouurs (2) = n. After de-rotation by CT, bit yields
y/ = r: + 17s- 7 ~ o0,
(67)
so the two hypotheses correspond to symbols +r and -r with distance Aoure = 2r + 2 in probability as n - oc. In Gaussian Shading, bit is observed as
y: = +/2 + Css 2, (),
(68)
so Ags 2| whose expectation 2//2/T <.
is a classical result in digital communications (Proakis, Digital Communications (Proakis & Salehi 2008), Section 5.2) and information theory (Cover & Thomas, Elements of Information Theory Cover 1999)) that, under equal-energy constraints in any symmetric, memoryless additive- noise channel, larger Euclidean separation between symbols strictly reduces bit-error probability. Since our scheme attains the maximal possible distance of 2 for unit-energy symbols, is provably optimal among all binary mappings with the same energy constraints.
23

---

Published as a conference paper at ICLR 2026
E WHY LOSSLESSNESS MATTERS: AN DETECTOR-DRIVE OPTIMIZATION ANALYSIS
Our goal is justify, in detector-await threat model, that losslessness (distributional indistinguisha- bility between watermarked and unwatermarked inputs) is more fundamental than merely increasing robustness. If the watermarked distribution leaves any detectable shift from the clean distribution, an adversary can exploit it to mount effective detector-aware attacks; if the two distributions coincide (losslessness), the optimization collapses to blind perturbations with little extra damage.
Consider an input image x, and let å denote an adversarial perturbation constrained by ||01|2 s e.
We write the attack objective as
min (x = [(x(x + 5)) + 11 [|
(69)
where s()) E R is the detector score, is a loss applied to the score, and > 0 controls the trade-off between reducing the score and keeping the perturbation small. The loss L is chosen to encourage the detector prediction to flip, similar to the binary cross-entropy (BCE) loss used in standard classification.. For instance, if s(x) is interpreted as the probability that x is watermarked, an adversary may apply a BCE-type objective with the target label flipped from "watermarked" to "clean". In this case, the loss explicitly drives the detector to misclassify watermarked input as unwatermarked. The derivatives L' of such objectives are uniformly bounded, ensuring that the gradient scaling factor they introduce remains finite.
Next, we derive the optimal perturbation 8* that minimizes Fx. A first-order expansion at ō gives (we use the notation ( denote the Euclidean inner product of vectors),
(6) ~ (O) + (ax: 5) + 110 ax = (s(()) V sx))..
(70)
The optimal perturbation is given by
8 5*(x) = min { || } ||ax l|2"
ax
(71)
Substituting 8" into the objective yields the decrease
-x - (x = min { 10 X 2=||ax 12 }=²].
(72)
This shows that the decrease is monotone in the gradient magnitude: when ||ax l2 large, the optimizer exploits the distortion budget and achieves a significant reduction; when |ax ||2 ss 0, the decrease vanishes and the attack is ineffective.
Next, we will analyze how the lossless and lossy cases differ in terms of the expected gradient energy, and prove that lossless watermarking methods yield smaller values of E||aax 1|ž, whereas lossy methods result in larger values. Formally, let Pwm and Pelean denote the watermarked and clean distributions with densities pwm and Pelean, respectively. If they differ, the KL divergence is strictly positive. By the Neyman-Pearson lemma, the optimal detector takes the form of the log-liielihood ratio,
Pwm (x)
s(x) = log
(73)
Peleau (x)
Its gradient satisfies
Vxs(x)= = Vx log Pwm (x) Vx log Pelean (x);
(74)
and therefore
Ep [x = J(Pwm |Pleen))) )
(75)
the Fisher divergence between the two distributions. is known that
J(Pwmlll (Pleaa)
2 DDuu(Pwmll (Pem|PPll))
(76)
for some constant C 0. Since ax only differs from Vxs(x) by the bounded factor L' ('(ssx)),
conclude that
E aax 1
C C (P (Pwm PPlcaa).
(77)
Thus, the KL divergence provides a lower bound on the expected gradient energy. In lossy cases, when DRa. Pum Pelean) > the gradients remain informative and provide actionable descent directions,
24

---

Published as a conference paper at ICLR 2026
Figure 8: Watermarked images generated by SD v3 and FLUX.I-DEV. Top: COCO dataset with SD v3. Bottom: SDP dataset with FLUX.I-DEV.
Table 6:
Extraction performance for different models under proseprocessing perturbations. The strength of the post-processing perturbations are consistent with Table in the main paper.
Post-processing Perturbations
Method
Metrics
PNG
Brightness Gaussian Blur Median Filter
JPEG
Resize
FLUX.I-DEV
ACC
99.99..o.
98.84..28
95.42o.a
91.92o.3s
88.85 88.85o.36
99.10o.13
ILUX.I-DEV
TPR
100.00...0 99.80..au
100.00g..v
100.00o.um
99.90b.20
100.00p.ou
SD
ACC
99.99a.u1
98.67u.11
99.83a.10
99.74u.11
98.97o.
99.92..uc
SD v3
TPC
100.00..00
99.33p.24
100.00g.u0
100.00o.u0
99.50p.0
100.00o..0
allowing the adversary exploit the distortion budget and cause substantial degradation. In contrast, in the lossless case Pwm = Pelean we have (x) = O, the expected gradient energy collapses, and the optimizer stalls 8 = O. This analysis demonstrates why losslessness is fundamental: only when the watermarked and clean distributions are indistinguishable does the adversary lose the ability to perform adversarial attacks that evade the detection system.
F MORE DETAILS AND EXPERIMENTAL RESULTS
F.1 GENERALIZABILITY
Our method demonstrates strong generalizability and can be readily adapted to other latent-space diffusion architectures, including those based on transformer designs (Vaswani et al., 2017: Dosovitskiy et al. 2021). As an example, Stable Diffusion v3 (SD v3) (Esser et al. 2024) and FLUX. I-DEV (BlackForesttLabs 2024). For SD v3, we use first-order Euler ODE solver for both gener- ation and inversion, with 50 timesteps for generation and 20 timesteps for inversion. The generated images have a resolution of 1024 x 1024 with prompts sam- pled from the SDP dataset, and each image carries a 512-bit watermark. For FLUX. we adopt RF-Solver (Wang et al. 2024) for both generation and inversion, each using 30 timesteps. We evaluate the model on prompts from the COCO dataset. Prgusenpsesentts Each generated image is sized 512 x 512, with 512-bit watermark embedded. Figure presents visual examples of watermarked images, which preserve high perceptual fidelity. To further evaluate the adaptability of watermarking scheme, we measure extraction performance under variety
Table 7: Watermark tracing accuracy on Guided Diffusion and Glow.
deploy scheme
Model
Im
Accuracy (%)
96
98.75..15
G-Diffusion
192
98. 08.786.u0
384
98.755.92
32
99.97
Glow
64
99.97
128
99.73p.18
25

---

Published as a conference paper at ICLR 2026
Original
Regen-Diff
Rinse- 2xDiff
Regen-VAE
Figure 9: Visualized comparison of watermarked images under re- re-generation.
Original
MagicBrush
UltraEdit
InstructPix22Pxx
GAN-edit
GAN-edit Mask
Figure 10: Visualized comparison of watermarked images under image editing.
of post-processing operations in Table 6
Across these attack settings, the extraction performance remains high, indicating that the proposed scheme adapts well different latent-space diffusion architectures.
Moreover, method is not limited to latent-space diffusion architectures. To assess its broader applicability, we apply our scheme to two classic generative models: G-Diffusion (Dhariwal Nichol 202T), pixel-space diffusion model trained ImageNet (Deng et al.) 2009,, and Glow (Kingma & Dhariwal (2018, a flow-based model with invertible transformations trained on the CIFAR-I0 dataset (Krizhevsky al., 22009. We evaluate 1000 images for each model and report watermark tracing accuracy across multiple watermark lengths (Table 7p. In both cases, extraction accuracy under lossless conditions exceeds 98%, demonstrating the effectiveness of our method.
More broadly, our approach applies to any generative model that satisfies two conditions: (1) sampling from a Gaussian prior, and (2) supporting an invertible mapping between the image and noise domains, These conditions are met by wide range of architectures, including diffusion models (Rombach al. 2022), normalizing flows (e.g., NICE (Dinh al. (014). Glow (Kingma & Dhariwal (0T8)), GANs with inversion (Abdal al. 2019).
F.2 ROBUSTNESS AGAINST RE-GENERATIION AND EDITING
We evaluate the extraction accuracy of different watermarking methods against image re- re-genrration and image editing attacks. We additionally include TrustMark (Bui al.) (222)) and Robust- Wide (Hu et al. 2024) for comparison, as both methods represent more recent advances in robust watermarking. TrustMark provides resolution-agnosti pixel-space watermarking framework
In Table g
26

---

Published as a conference paper at ICLR 2026
Table 8: Extraction accuracy for re-generation and editing attacks. Here, mm means watermark length, "Robust." refers to "Robust-Wide and "InstructP2P." refers to "InstructPix2Pix..
Re-generation
Editing
Method
km
Regen-Diff Rinse-2xDiff Regen-VAI VAE MagicBrush
UltraBdit
InstructP2P.
GAN-edit
DwtDet
32
19.96o. 73
19.91
50.27o.72
50.251.22
49. 19.281.90
50.561.
19.88g.21
Dwd
32
90.20n.93
49.69p.74
48.98p.5s
49.221.76
49.621.62
48.53g.88
48. 28.444.44
RivaGan
32
56.770.56
54.19b.53
50.89u.33
67.311.24
52.062.33
60.561.52
99.84..14
TrustMark
100
71.360.4r
59.94o.s0
93.87o.33
86.741.85
68. 18.161..8
81.683.54
15.851.34
Robust.
64
96.90o.
23.22
15..5..c3
94.361.54
80.09p.es
96, 96,441..10
98.339.61
PRC
100
99.26o.
94.22o.as
75.91
94.142.33
81.533.09
83.537.82
100.00g.00
Ours
100
99.63o.17
97.70p.37
87.480.45
93.962.94
86.11
92.532.38
100.00g.00
Table 9: PSNR and SSIM for traditional watermarking methods. Model: SD v1.5.
COCO
SDP
Method
PSNR
SSIM
PSNR
SSIM
DwtDet
38.08990.154
0,9998 999998.0000
38,46490.111
0,99944.00 0.0001
DwtDetSvd
38.07366.150
0.9998 9,0900
38.9261
0.9999 0000000000
RivaGan
40.5620p.004s
0.9968
40.82940.0718
0.9905g.0011
with superior robustness. Robust-Widd focuses on robustness against instruction-driven image editing, and evaluate its 64-bit configuration following the original implementation. For fair comparison, we adjust the watermark length of our method to 100 bits.
For re-generation attacks, we adopt the WAVES benchmark (Ding et al. 2024), which contains three re- g--geeeeraton attacks: Regen-Dite Diff, 2xDiff, and Regen- VAE. Specific attacked examples are shown in the Figure 9 The experimental results the COCO dataset using SD v2.1 reported in Table g Our method achieves the highest accuracy under both Regen-Diff and Rinse-2xDiff, demonstrating superior robustness diffusion-based re-generation attacks. In the Regen-VAF. setting, TrustMark and Robust-Widd Wide obtain slightly higher accuracy, while our method still outperforms the lossless PRC Watermark across all attack scenarios.
For image editing and forgery, we employ the W-Bench benchmark (Lu et al. 2024). This evaluation covers range of manipulations, including MagicBrush (Zhang al. 2003). UltraEdit (Zhao et al.
2024), InstructPix2Pix (Brooks et al., 2023). We also introduce GAN-edit (Ma et al.) 2022), GAN-bace based inpainting method. Figure 10 presents examples of the applied image editing attacks. The experiments are conducted on the W-Bench dataset using the SD v2. As shown in the Table g our scheme delivers high extraction accuracy across diverse editing operations, staying above 85% on average across all attack scenarios. These results indicate that robustness against image editing is broadly comparable to existing state-of-the-art watermarking methods.
F.3 UNDETECTABILITY AND IMAGE QUALITY
In this section, we present additional experiments on both undetectability and image quality assess- ment. First, Tables 9 and 10 report the Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index Measure (SSIM) (Wang et al.] 2004) of traditional watermarking methods. These results indicate that conventional approaches tend to degrade image quality, with an average PSNR of 39 dB. To further evaluate the perceptual quality of watermarked images generated by latent-based methods, we incorporate the Inception Score (IS) (Salimans et al. (016) as an additional metric, as shown in Table [I Although the IS is not sensitive to distribution shifts, we still observe that lossy watermarking schemes tend to yield lower scores compared to lossless ones. This observation aligns with our theoretical expectation that lossy watermarking inherently induces distributional deviations.
For undetectability, we compare the classification performance of trained detectors watermarked versus unwatermarked images in Figure II] and further illustrate the ability to distinguish watermarked images generated by different keys in Figure 12 The PRC Watermark and method exhibit strong
27

---

Published as a conference paper at ICLR 2026
Table 10: PSNR and SSIM for traditional watermarking methods. Model: SD v2.1.
COCO
SDP
Mcthod
PSNR
SSIM
PSNR
SSIM
DwtDet
38,504 1.1444..1444
0.9999..omm
38.06 28..06400.254.
0,9999p.au0x
DwtDetSvd
0.9999..umm
37.9 37.9792u.u 2027
1.99990.00xx
RivaGan
40.5628u.oord
0.9968p,0uu1
40.5 10.0064
0,9968p.au01
Table 11: IS value for different watermarking methods. Higher IS indicates higher image quality.
COCO
SDP
Method
SD v1.5
SD v2.1
SD v1.5
SD v2.1
Original
29.35461.8784
28,8780
11.5965p.
10.2936
DwiDet
29.23781.779
28.46451.4454
10.9270
10.15930.7255
DwtDetSvd
29 39.40931.7990
28.6121
11.0862
10.22260.69e
RivaGan
29.2398
28,2529
10.99880.741
10.16680.7217
Tree-Ring
29.3 29.3528d
28.8102,.391
11.5670p.
10.0701o.r270
Gaussian Shading
29.0868d 2218
28,45301.6900
11.4438p. 5970
10.13220.1784
PRC Watermark
29.42441. o0163 0163
28. 28.9931, 1.5086
11. 11.68870.678 6.6811
10.2102d.s2ur
Ours
29.5521 2.2532 2532
28.978 1,7562
11.66 11.66280.6799
10.26720.r216
(a) Latent Level.
(b) Image Level.
(c) Image Level.
(d) Image Level.
Image Level.
(0 Latent Level.
(g) Image Level.
(h) Image Level.
(i) Image Level.
Image Level.
Figure 11: Training loss and test classification accuracy for watermark and unwatermarked samples classification. (a)(f) on the latent level. (b)g) on the COCO dataset with SD v1.5. (c)(h) on the COCO dataset with SD v2.1. (d)() on the SDP dataset with SD v1.5, (e)() on the SDP dataset with SD 1..1. 1. Top: Training loss. Bottom: Test classification accuracy.
resistance to classification, maintaining strong indistigguisaabiity in both latent and image levels. In contrast, the Tree-Ring and Gaussian Shading methods, which rely on fixed key patterns, introduce significant and consistent artifacts. These artifacts are easily captured by the detectors, resulting in classification accuracies of 100% and 98%. respectively. This indicates that such methods lack robustness against adversarial classification and are highly susceptible to reverse-engineering attacks.
F.4 TRACING ACCURACY
We evaluate tracing performance in Table 12 13 and 14, comparing the two diffusion model variants under clean, post-processing. and adversarial conditions using the COCO dataset and SDP dataset. As mentioned in the main paper, "Clean" refers to PNG storage, while "Post-Processing" reports the average performance under a range of common image perturbations. These post-processing perturbations include Additive White Gaussian Noise with standard deviation of 0.05, Brightness Adjustment with a factor of 2, Random Drop with a drop ratio of O. Gaussian Blur with a kernel size of 9, JPEG compression with quality factor of 70 (QF=70), Median Filter with kernel size of
28

---

Image Level. Published as a conference paper at ICLR 2026
(a) Latent Level.
(b) Image Level.
(c) Image Level.
(d) Image Level.
(c) Image Level.
Latent Level.
(g) Image Level.
(h) Image Level.
Image Level.
Figure 12: Training loss and test classification accuracy on watermarked images generated by different
keys. (a)(f) on the latent level. (b)(g) on the COCO dataset with SD v1.5. (c)(h) on the COCO dataset with SD v2.1. (d)(i) on the SDP dataset with SD v1.5. (e)() on the SDP dataset with SD v2.1. Top:
Training loss. Bottom: Test classification accuracy.
(a) PNG.
(b) Gaussian Noise.
(c) Brightness.
(d) Drop.
(e) Gaussian Blur.
(1) JPEG.
Median Filter.
(h) Resize.
Figure 13: Images under common attacks. (a) PNG image. (b) Additive White Gaussian Noise, 0, = 0.05. (c) Brightness, factor=2, (d) Drop, drop ratio=0.1. (e) Gaussian Blur, kernel size=9,
(f) JPEG, QF=70. (g) Median Filter, kernel size=5. (f) 50% Resize.
5, and 50% Resize (followed by restoration to the original dimensions). Representative examples of these perturbations are shown in Figure [3
For the Adversarial conditions, we adopt the adversarial attack WEvade (Jiang et al. 2023 In the White-box setting, we use WEvade- W-I with the parameters: maximum pixel perturbation rb 10, gradient learning rate 2, and eиror rate 0.01. For the Black-box setting, B-S, which relies only on binary output predictions, and additionally adopt the JPEG compression with quality factor of 50 (QF=50) from WEvade-B-4 B-Q, before applying the same default parameters as in the White-box setting. A pre-trained ResNet-18 is employed as a surrogate model for generating the adversarial perturbations. The final results are obtained by averaging
employ WEvade-
the two settings.
In Table 12 B and 14 our method achieves over 95% ACC and TPR across Clean and Post- Processing settings. Under Adversarial conditions, the accuracy of lossy schemes drops sharply,
29

---

Published as a conference paper at ICLR 2026
Table 12: Comparison results on ACC and TPR. Dataset: COCO dataset. Model: SD v1.5. "Post."
refers to "Post-Processe "Post-Processing" and "Adv." refers to "Adversarial".
Metrics
Method
ACC (Clean)
ACC (Post.)
ACC (Adv.)
TPR (Clean)
TPR (Post.)
TPR (Adv.)
DwiDDt
88.8 68.830.74
64.34o.77
49.22g.o
92.70 1.03
51.461.72
15.80
DwiDetSvd
100.00n.e1
92.860.20
48.71..00
100.00p.o0
91.49n.71
18.45g.o1
RivaGan
99.55o.15
96.59a.31
52.780.01
100.00a.00
99.13u.25
27.85g.03
Tree-Ring Ring
94.50s.
93.984.24
13.72o.0r
Gaussian Shading
100.00n.co
98.55g.04
89.42o.11
100.00p.o0
99.95p.a3
99.30s.00
PRC Watermark
100.00p.oo
93.75a.14
98.30 0.
100.00p.on
87.51p.28
96.61a.01
Ours
99,99u.00
95.270.11
08.500.03
100.00p.ou
97.57u.18
99.95%.00
Table 13: Comparison results on ACC and TPR. Dataset: SDP dataset. Model: SD v2.1. "Post."
refers to "Post-Processing"" and "Ady." refers "Adversarial".
Metrics
Method
ACC (Clean)
ACC (Post.)
ACC (Adv.)
TPR (Clean)
TPR (Post.)
TPR (Adv.)
DwtDet
83.07n.74
63.14m.70
48.83n.01
87. 87.80
52.772.23
15.60p.os
DwiDetSvd
99,97 00.02
92.50u.2m
49. 19.40u.01
100.00p.au
89.46u.41
20. 20.00
RivaGan
99.060.21
95.870.38
50.770.00
100.00p.00
98.940.36
22. 22.40p.06 03
Tree-Ring
100.00o.00
98.590.35
2.84p.01
Gaussian Shading
99.99..00
98.470.04
84,50n. 10
100.00p.00
99.96n.03
99.69o.00
PRC Watermark
99.97u.ux
93.59u.18
96.19u.
99 94..as
87.19u.36
92.39u.00
Ours
99.89..02
94.92o.00
96.94o.05
100.00p.00
97.69o.18
99.870.00
Table 14: Comparison results on ACC and TPR. Dataset: SDP dataset. Model: SD v1.5. "Post."
refers to Prost-Processing" and "Adv." refers to "Adversarial".
Metrics
Method
ACC (Clean)
ACC (Post.)
ACC (Adv.)
TPR (Clean)
TPR (Post.)
TPR (Adv.)
DwiDet
84.91 1.55
63.23o.sr
49.55o.01
90.50s.os
51.542.54
16.20e
DwiDetSvd
100.00n.00
92.48g.35
49,24o.00
100.00p.on
89.46n.5
17.85o.o1
RivaGan
99.32..11
96.340.30
51.480.01
100.00p.00
98.97u.23
23. 23.95o.04
Tree-Ring
100.00p.oo
99.10p.39
4.67o.03
Gaussian Shading
99.99u.b1
98.49a.06
85.80 15.800.10
100.00p.au
99,95u.02
99.81g.00
PRC Watermark
99.970.02
93.58a.20
97.28p.oo
99. 99.940.o5
87.16n.39
94.58g.on
Ours
99.930.01
95.01
97.53u.05
100.00p.00
97.63u.19
99.81g.00
Table Ablation of parameters s and on TPR under different attacks. Dataset: COCO. Model:
SD v1.5. Case 1: Gaussian Blur, kernel size 9. Case 2: JPEG-70. Case 3: Brightness, factor = 2.
sparsity parameter
repetition count N
Case
11
21
31
99.90 19.966..5
99. 99.80p.o 08
99.34..26
98.4 98.420.29
99.58o.15
99.980.04
99,90o.06
99. 99.96..05 o5
99.98o.01 04
99.60p.2
98.72o.32
94. 9..98
98.660.2
99.94o.12
99.94..05
99.98,
3
99.88p.01
98.44
94.12o.77
85.96p.s6
95.860.51
99.480.07
99.80p.14 14
99.88.
since lossy embeddings expose detectable patterns that enable targeted attacks. By contrast, lossless schemes show clear superiority: our method improves accuracy by more than 10%. Compared with PRC Watermark, our approach achieves an additional gain of nearly 10% in TPR under Post- Processing distortions, consistent with the main paper. Overall, these findings confirm that Spherical Watermark enables exact recovery while maintaining superior robustness over both lossy and lossless baselines.
30

---

Published as a conference paper at ICLR 2026
Table 16: Ablation parameters s and N on TPR under different attacks. Dataset: SDP. Model: SD
v1.5. Case I: Gaussian Blur, kernel size 9. Case 2: JPEG-70. Case 3: Brightness, factor = 2.
sparsity parameter
repetition count N
Case
21
31
99.96 969.0s
99.66 99.60p.20
98.06n.41
95.80p.a7
98.78g.26
99.92n.07
99.86p.0s
99.96o.05
2
99.86p.10
98.92. 22.
96.26u.49
92.62g.86
97.36u.46
99.52u.23
99.94o.06
99.86u.10
3
99.90. 99.90p.06
99.046.23
25.84p.a
91.74p.48
97.24u.2s
99.60u.13
99.72a.15 99.900.06
Table 17: Ablation parameters s and N on TPR under different attacks. Dataset: SDP. Model: SD
v2.1. Case I: Gaussian Blur, kernel size 9. Case 2: JPEG-70. Case 3: Brightness, factor = 2.
sparsity parameter
repetition count N
Case
2
3
4
11
21
31
100.00 100.00p..n
99. 19
98. p4.6
96.12p. 12..48
99.14g.m 14..0 .20
99. 99.940.05
100.00..om
100.00
99. 19.966.05
98.560.19
94.08p.68
88 88.44..72
96.28g.aa
99.66n.16
99.82p.13
99.96n.
99.98 99.98p.04
99.200.18
95.960.39
89.741..0
97.220
99.760.16
99.88o.
99.980.0r
(a) Ablation on Im and Ir-
Ablation on and N
Figure 14: Ablation on hyperparameters undetectability.
F.5 ABLATION EXPERIMENTS
Ablation on Modules. We have supplemented additional module ablation experiments, isolating each module for testing across two datasets and two models. Figure 15 details the experimental results. Here we apply four representative types of attacks: Brightness Adjustment, Gaussian Blur, Median Filter, and Resize. The results clearly show that the absence of the spherical mapping module leads to significant drop in robustness against all tested attacks. This observation is consistent with the findings discussed in the main paper and underscores the importance of spherical mapping in preserving watermark integrity under perturbation. Furthermore, in the Appendix D rigorous analysis of how orthogonal rotation enhances robustness.
we provide
Settings for the Ablation Parameters. In the ablation studies, we configure parameters with different settings. To evaluate their impact on undetectability, we set 1, = 31, Im = 512 and 4, 512 in default. Then, we systematically vary single parameter at time while keeping the others fixed to the default configuration, allowing us to isolate the impact of each parameter on performance. Note that the size l of the latent space varies with parameter adjustments. In Figure of the main paper, the values of and N range from to 31, resulting in 31 test points. For Iy and l,, the values range from 256 to 512 with a step size 8, yielding 33 test points.
To evaluate the impact of the ablated parameters N, Im on tracing accuracy, vary one parameter at a time while keeping the latent space size Lg fixed to match the input dimension of diffusion models. Specifically, varying does not affect other parameters, whereas changing N requires adjusting 4, accordingly, and modifying i,, necessitates updates to both N and 4,, so that the constraint 1 = N Im remains satisfied. This ensures fair comparisons across different ablation settings.
31

---

Published as a conference paper at ICLR 2026
(a) Brightness.
(h) Gaussian Blur.
(c) Median Filter.
(d) Resize.
8-
04
Snglam
(c) Brightness.
(I) Gaussian Blur.
(g) Median Filter.
(h) Resize,
020
200
AJR
CN
400 370 250
(i) Brightness.
(i Gaussian Blur
(k) Median Filter.
(1 Resize.
800
2
(m) Brightness.
(n)
Gaussian Blur.
Median Filter.
(p) Resize.
Figure 15: The ACC result of ablation on module B and S. (a-d) COCO dataset with SD v1.5. (e-h) COCO dataset with SD v2.1. (i-l) SDP dataset with SD v1.5. (m-p) SDP dataset with SD v2.1.
We do ablate 4, separately, since changes in 1, do not affect the number of watermark paddiin mixtures (which is controlled by s), and thus have negligible influence on tracing accuracy.
Ablation on Parameters. We conduct ablation studies on four hyperparameters: the watermark length 1m. padding length 4,, row sparsity parameter 8, and repetition count N. To evaluate the undetectability of the four hyperparameters, we conduct experiments in the latent space, as shown in Figure 14 It can be observed that the classification accuracy fluctuates around 50% across all settings, indicating that variations in these parameters do not affect undetectability. In Tables [5] 16. and 17 report the TPR under various attack scenarios for different values of and N. Consistent with the main paper, increasing s and decreasing tend to degrade the model's robustness. evaluate the impact of watermark length 4m i.e., capacity, across different datasets and models. The attacks include Brightness Adjustment with a factor of 2, Gaussian Blur with kernel size 9, JPEG compression quality 70, and 30% Resize. The performance of the PRC Watermark drops sharply when the watermark length in approaches 2000, whereas the Spherical Watermark maintains relatively high ACC and TPR. This demonstrates the design flexibility of our approach, making well-suited for high-capacity scenarios.
Figure [6
Settings for the Ablation on Diffusion Sampling Configurations. In the ablation of diffusion sampling settings studies, we conduct experiment on the COCO dataset using the SD v2.1 model. Here, we evaluate the watermark extraction accuracy under various attacks across three ODE solvers.
32

---

Published as a conference paper at ICLR 2026
(a) Brightness.
(b) Gaussian Blur.
(c) JPEG.
(d) Resize.
100
253
200
23:0
200 feaelyy
300
100
10
380
300
100
200
200
(c) Brightness.
(f) Gaussian Blur.
(g) JPEG.
(h) Resize.
30
ii) Brightness.
Gaussian Blur.
(k) JPEG.
(1 Resize.
200
200
12:0 300
100 300
200
200
210
(m) Brightness.
(n) Gaussian Blur.
(0) JPEG.
(p) Resize.
Figure 16: The ACC and TPR of PRC Watermark and Ours under different watermark length 4m (a-d) COCO dataset with SD v1.5. (e-h) COCO dataset with SD v2.1. (i-l) SDP dataset with SD v1.5. (m-p) SDP dataset with SD v2.1.
These attacks include Brightness Adjustment with a factor 2, Gaussian Blur with a kernel size 9, JPEG compres- sion with quality factor of 70 (QF=70), Median Filter with a kernel size of 5, and 50% Resize.
0.9
0.8
Ablation on Diffusion Sampling Settings. To quantita- tively assess the impact of inversion errors on watermark extraction, we conduct the ablation study of latent-space perturbation on extraction accuracy. Specifically, we inject Gaussian noise with zero mean and standard deviation into the watermarked latent vectors, where a controls the noise level
0.7
0.6
0.5
noise level. As shown in Figure 17| 1.5x larger than the latent's original standard deviation, the extraction success rate remains above 95%. This con- firms that our method is highly tolerant to moderate latent perturbations.
Noow
Figure 17: Extraction accuracy for dif- ferent noise level.
33


Reviews:
[{"review_id": "YrEnVqyyXn", "reviewer": "Reviewer_YSkV", "summary": "This paper addresses the critical need for provenance in diffusion-generated images by proposing a new watermarking scheme. The authors introduce \"Spherical Watermark,\" a lossless and encryption-free framework that embeds a binary watermark into the initial Gaussian noise by mixing it with random padding, projecting it onto a unit sphere, applying an orthogonal rotation, and scaling it with a chi-square-distributed radius. The method is theoretically proven and empirically demonstrated to be statistically indistinguishable from standard Gaussian noise, while also being computationally efficient and robust to various post-processing and adversarial attacks, outperforming prior lossless methods.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "S1 (technical novelty): The proposed spherical mapping module is a novel technical contribution. It provides a clear mathematical pipeline to transform a structured binary vector into a vector that is statistically indistinguishable from a standard Gaussian distribution.\n\nS2 (theoretical foundation): The \"lossless\" claim is strongly supported by a rigorous theoretical analysis. The paper proves that the watermarked noise distribution matches a true Gaussian prior up to third-order moments by leveraging the properties of spherical 3-designs.\n\nS3 (strong performance): The paper shows clear improvements in efficiency and robustness over baseline methods. The method is also shown to be effectively indistinguishable from the original, non-watermarked distribution.\n\nS4 (comprehensive experiments): The ablation studies clearly justify the design, demonstrating the necessity of both the binary embedding and spherical mapping modules for undetectability and robustness, respectively.", "weaknesses": "W1 (motivation): The paper claims that existing methods require per-image key storage or cryptographic overhead, but this method also has cryptographic overhead (Eq. 13). Hence, The \"encryption-free\" claim is potentially misleading.\n\nW2 (scope of robustness): The paper does not explicitly test against attacks that are more specific to generative models, such as watermark destruction via diffusion-inversion and re-generation with different noise. The authors have acknowledged that resisting editing/forgery is a limitation but is out of scope.\n\nW3 (missing related work): Some recent works are not discussed, such as [1,2].\n\n- [1] Wei et al. Robust watermarking for diffusion models: A unified multi-dimensional recipe. 2025.\n- [2] Wang et al. SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models. 2025.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rG81BHxBtD", "reviewer": "Reviewer_vTJw", "summary": "This paper proposes a training-free and lossless diffusion watermarking method that encodes a binary watermark message into the initial noise of a diffusion model. The method consists of two main transformation steps. First, the message is encrypted by mixing it with random padding through a structured binary embedding matrix. Second, the resulting vector is projected onto a unit sphere and then transformed by a random orthogonal rotation followed by a radius rescaling using a chi distribution. This produces a final watermark vector that closely matches the distribution of standard Gaussian noise, making it suitable as the initial noise for diffusion models and statistically indistinguishable from normal noise. The method is compatible with multiple diffusion models, does not modify model parameters, and enables fast decoding.", "questions": "1. Have you evaluated your method under regeneration-based or rinse attacks? If not, can you comment on the potential vulnerability under such transformations?\n\n2. Could you elaborate on whether $T$ and $C$ are reused across images, or whether they are derived per image? What is the typical memory overhead for storing or generating them in a realistic deployment?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well motivated and logically structured. The paper addresses the problem of embedding watermarks in diffusion-generated images in a clean and motivated way. \n2. The proposed method is reasonable and effective. The approach avoids any model fine-tuning or training and leverages statistical geometry (spherical design + chi rescaling) to achieve high-quality watermarking while maintaining indistinguishability.\n3. The experiments are comprehensive. The paper evaluates watermark accuracy and detectability under different attacks. The ablation study also demonstrates the effectiveness of their key designs.\n4. The paper is easy to read and well-organized, with clear diagrams and concrete definitions.", "weaknesses": "1. Lack of diffusion-based attacks: While the paper evaluates robustness under post-processing and adversarial attacks, it does not include experiments on regeneration or rinse-based attacks (e.g., re-diffusion or editing using other diffusion models), which have been recently identified as strong attacks for watermark removal. I suggest the authors refer to arXiv:2401.08573 and consider incorporating some of their benchmarking strategies.\n\n2. Storage overhead for decoding: To decode the watermark, the user must store the embedding matrix $T$ (specifically, the sparse matrix \n$R$) and the rotation matrix $C$. Since $R \\in \\mathbb{F}_2 ^{N l_m \\times l_r}$ and $C \\in \\mathbb{R}_2 ^{l_x \\times l_x}$, the memory cost could be significant, especially when generating high-resolution images with large latent dimensions. A naïve implementation would incur nontrivial storage. Discussion about the storage overhead should be included in the main text.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FfUuQktdpZ", "reviewer": "Reviewer_K12q", "summary": "This paper introduces Spherical Watermark, an encryption-free and lossless watermarking approach designed for diffusion models. It focuses on tracing and verifying the provenance and authenticity of AI-generated images, addressing recognized limitations of current watermarking techniques, such as quality degradation, detectable shifts, and key management complexity. The method embeds watermarks into the latent noise with indistinguishable Gaussian statistics, utilizing a high-entropy binary embedding and spherical mapping mechanism. The framework maintains perfect image fidelity and allows rapid watermark extraction without modifying the diffusion model. Empirical results demonstrate strong robustness against common image manipulations and adversarial attacks, competitive and often superior to prior approaches. The paper also emphasizes ethical considerations and provides theoretical analysis for transparency and reproducibility.", "questions": "This is an interesting paper. So I want to know what the main motivation is for the introduction of the spherical mapping module in the context of watermark embedding. Secondly, if this method is so promising, are there any limitations for this method to scale up in practice?", "limitations": "", "rating": 8, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The proposed watermarking technique preserves image quality, making watermarked and non-watermarked images visually indistinguishable. The framework is efficient, enabling fast watermark extraction with no need for per-image keys or model modifications.\n- Robustness is demonstrated against a wide range of image processing operations and adversarial settings.\n- The solution is well-supported with both theoretical analysis and comprehensive experiments.\n- The method is deployable on mainstream diffusion architectures and easy to integrate in practice. The authors address the ethical implications of watermarking and ensure reproducibility standards.", "weaknesses": "- The method may have limitations when facing extremely sophisticated adversarial attacks specifically designed to break watermark recovery.\n- There is limited discussion on extending the approach to content editing or direct forgeries, such as partial GAN-based manipulations.\n- Some implementation parameters may require careful adjustment for different generative scenarios and applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zRfY2zlvyB", "reviewer": "Reviewer_Hgmm", "summary": "This paper introduces Spherical Watermark, a novel encryption-free and lossless watermarking framework for diffusion models designed to overcome the drawbacks of existing methods that either degrade image quality or rely on computationally expensive cryptography. The core contribution is an elegant method that embeds a binary watermark into the model's initial Gaussian noise latent vector. This is achieved first through a binary embedding module that creates a high-entropy bitstream, which is then processed by a spherical mapping module that projects it onto a unit sphere, applies an orthogonal rotation, and scales it with a chi-square distributed radius. This process yields a noise vector that is statistically indistinguishable from a standard Gaussian distribution, a claim supported by theoretical proofs. The framework's key contributions include this new mapping technique, the elimination of cryptographic overhead, and state-of-the-art performance. Experiments show that Spherical Watermark preserves high visual fidelity while offering superior robustness against attacks and a dramatic improvement in computational efficiency, with watermark extraction being orders of magnitude faster than its closest lossless competitor.", "questions": "See the weakness.", "limitations": "", "rating": 8, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1.\tThe core methodology is novel and elegant, using spherical geometry to transform a binary watermark into statistically standard Gaussian noise, which successfully bypasses the need for complex and computationally heavy cryptographic components used in prior lossless methods.\n2.\tThe paper is supported by a strong theoretical foundation, providing formal proofs that the watermarked noise distribution matches a true Gaussian prior up to the third-order moments by leveraging concepts like spherical 3-designs.\n3.\tThe method demonstrates exceptional performance and efficiency, as it is extremely fast in the extraction phase (approximately four orders of magnitude faster than its closest competitor), shows superior robustness against various attacks, and maintains high fidelity and undetectability.\n4.\tIt offers excellent scalability and capacity, handling large watermark payloads without the performance degradation seen in competing approaches, which makes it highly flexible for applications requiring the embedding of rich metadata.", "weaknesses": "1.\tThe comparison of computational efficiency should be included in the main paper instead of the appendix as it can effectively demonstrate the advantages of this method compared to PRC watermark.\n2.\tLack of experimental comparison on newer models such as FLUX and Qwen image.\n3.\tDoes this method rely on the accuracy of inversion? I want to know if different inversion methods will affect the accuracy of extraction, and if the sampling step size will also have an impact. In other words, when will the deviation between the latent obtained from inversion and the latent obtained from the original embedding render this method ineffective?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Oral)