SERUM: Simple, Efficient, Robust, and Unifying Marking for Diffusion-based Image Generation
Authors: Jan Kociszewski
Hubert Jastrzębski
Tymoteusz Stępkowski
Filip Manijak
Krzysztof Rojek
Franziska Boenisch
Adam Dziedzic
Venue: ICLR 2026 Poster (2026)
Keywords: watermarks
diffusion models
marking
computer vision
image generation
Primary area: generative models
TL;DR: We propose a simple yet highly effective method for marking diffusion-based image generation by adding a unique watermark noise to the initial diffusion noise and training a lightweight detector to reliably identify watermarked images.

Abstract: We propose SERUM: an intriguingly simple yet highly effective method for marking images generated by diffusion models (DMs). We only add a unique watermark noise to the initial diffusion generation noise and train a lightweight detector to identify watermarked images, simplifying and unifying the strengths of prior approaches. SERUM provides robustness against any image augmentations or watermark removal attacks and is extremely efficient, all while maintaining negligible impact on image quality. In contrast to prior approaches, which are often only resilient to limited perturbations and incur significant training, injection, and detection costs, our SERUM achieves remarkable performance, with the highest true positive rate (TPR) at a 1% false positive rate (FPR) in most scenarios, along with fast injection and detection and low detector training overhead. Its decoupled architecture also seamlessly supports multiple users by embedding individualized watermarks with little interference between the marks. Overall, our method provides a practical solution to mark outputs from DMs and to reliably distinguish generated from natural images.

Published as a conference paper at ICLR 2026
SERUM: SIMPLE, EFFICIENT, ROBUST, AND UNIFYING MARKING FOR DIFFUSION-BASED IMAGE GENERATION
Jan Kociszewski", Hubert Jastrzębski', Tymoteusz Stepkowski", Filip Manijak', Krzysztof Rojek", Franziska Boenisch, Adam Dziedzic CISPA Helmholtz Center for Information Security
ABSTRACT
We propose SERUM: an intriguingly simple yet highly effective method for mark- ing images generated by diffusion models (DMs). We only add unique watermark noise to the initial diffusion generation noise and train a lightweight detector to identify the signature of this watermark directly in the images, simplifying and unifying the strengths of prior approaches. SERUM provides robustness against any image augmentations or watermark removal attacks and is extremely efficient, all while maintaining negligible impact on image quality. In contrast to prior approaches, which are often only resilient to limited perturbations and incur sig- nificant training, injection, and detection costs, our SERUM achieves remarkable performance, with the highest true positive rate (TPR) a 1% false positive rate (FPR) in most scenarios, along with fast injection and detection and low detector training overhead. Its decoupled architecture also seamlessly supports multiple users by embedding individualized watermarks with little interference between the marks. Overall, our method provides a practical solution to mark outputs from DMs and to reliably distinguish generated from natural images. Our code is available at https::/ /ttts:///qthb.... com/ http:/uuuioonnnRRR
INTRODUCTION
In recent years, generative models have attracted significant attention for their ability to synthesize highly realistic images. Diffusion models (DMs) (Ho et al.) 2020), in particular, have emerged as the leading paradigm, achieving state-of-the- art performance across many tasks. However, this same capability to produce images that are nearly indistinguishable from real ones has raised critical concerns: generated content can be misused for malicious purposes, including the creation of deepfakes and copyright infringement (Mirsky & Lee 202T: Franceschelli & Musolesi] 2022). Additionally, when synthetic images are published online and later scraped into future training datasets, they were shown to degrade the performance of generative models (Alemohammad et al. 2024, Shumailov et al. 2024) and amplify existing biases (Wyllie et al. 2024). Together, these challenges underscore the urgent need for reliable detection of generated content.
Watermarking has emerged as the de facto standard to facilitate such detection. embeds imper- ceptible but algorithmically detectable signals into generated images, enabling distinction between generated and original content. Most watermarking methods consist of two components: an injector that embeds the watermark into generated images and detector that retrieves or verifies the wa- termark signal. A naive approach is to apply classical content watermarking techniques (Kansal ct al. 2012 Cox al. 1997; Chen & Wornell 2001) directly to generated images. For example, the watermark currently used in Stable Diffusion (Cox et al.) 2008) operates by altering a specific frequency component in the image's Fourier domain (Wen al.])003) after generation. However, while being computationally fast, these approaches frequently degrade image quality or can easily be removed, limiting their practical effectiveness.
To overcome this limitation, several recent works have introduced diffusion-specifii watermarking strategies that embed the watermarking process into the generative pipeline itself (Wen al. 2023 Ci et al. 2024 Fernandez et al. 2023 Yang et al. 2024 Li et al. 2025). While these approaches
"Equal contribution. Correspondence to: adam saamddriedriccciisadde

---

Published as a conference paper at ICLR 2026
Training
Watermark
Detection
Noiee
Injection
Nolen
LDM
Watermark Detector
Hola
LDM
Decoder
Encoder
Watermank Detector
Watermark score
Figure I: Overview of SERUM. First, we train watermark detector distinguish between watermarked latents (with/without augmentations) from clean latents. Second, to inject the SERUM watermark, the watermark noise is added to the initial random Gaussian noise for diffusion generation and passed through the LDM (Latent Diffusion Model) and decoder to produce a watermarked image. Finally, in order to detect the watermark, the image is encoded using the LDM's encoder and passed through the detector, which outputs high score for watermarked and low score for clean images.
significantly enhance watermark robustness, they often incur substantial computational overhead. This overhead typically arises from extensive parameter tuning (Fernandez et al.) 2023), or from the reliance on computationally expensive diffusion inversion for watermark detection (Li al. [0255]
Wen et al. 2023 Ci et al. 2024), which in practice leads to delays during the detection process.
As solution these drawbacks, we propose SERUM, new DM watermark that injects additional Gaussian noise watermark directly into the initial diffusion noise. We train lightweight external detector identify the signature of this noise directly the generated image, effectively eliminating the need for costly diffusion inversion. Our detector also enables flexible training with arbitrary perturbations, and we show that by incorporating augmented images during detector training, we achieve strong watermark robustness to both standard image augmentations and unseen watermark removal attacks. Consequently, SERUM combines the benefits of fast injection and detection with the high robustness that results from embedding the watermark into the initial diffusion noise from which the image generated.
We thoroughly evaluate SERUM latent diffusion models (LDMs), including Stable Diffusion versions 1.4, 2.0, and 2.1 (Rombach et al. 2022). and compare our results to recent watermarking methods such RinglD (Ci et al.) 2024). Our experiments demonstrate that SERUM consistently achieves superior detection rates under wide range image perturbations and dedicated watermark removal attacks, while also maintaining high image generation quality. In addition, we show that the watermark is radioactive (Sablayrolles al. 2020 Meintz al., 2023 Kerner al. 2025), meaning that it remains detectable even in outputs from models fine-tuned on watermarked data. Finally, SERUM can be readily extended for multi-user scenarios by assigning distinct noise patterns as user-specifie marks and training corresponding classifiers. Taken together, these results highlight the practical utility of SERUM for robust data detection in DM.
GaussMarker (Li et al.
2025 Stable Signature (Fernandez al. 2023), and
In summary, we make the following contributions:
We introduce a novel and efficient method for watermarking generations from DMs, which adds a watermark vector the initial diffusion noise and trains lightweight watermark detector.
Our method seamlessly supports many users by simply instantiating many replicas of our approach per user, while preserving all the desirable properties of the single-instance watermark.
Extensive experiments on eight perturbations and three leading LDMs show that our method achieves high robustness at low training cost and extremely fast watermark injection and detection.
Our evaluation on seven advanced watermark removal attack settings demonstrates that SERUM achieves state-of-the-art performance, even without explicit training against these attacks.
Our marking method is highly radioactive: our watermark signal remains detectable even in outputs from models trained or fine-tuned on images watermarked with SERUM.
2

---

Published as a conference paper at ICLR 2026
2 BACKGROUND AND RELATED WORK
Diffusion Models (DMs). DMs (Ho al. 2020) have emerged as one of the most powerful classes of vision generative models, achieving state-of-the-an the-art results in image synthesis. The central idea of diffusion modeling to learn the reverse of a gradual noising process that destroys the structure of the training data. At inference, new samples are generated by iteratively denoising an initial Gaussian noise map until a clean image is obtained. While this iterative sampling provides high fidelity, it also incurs significant computational overhead compared to prior models, such as generative adversarial networks. To improve efficiency, Soong et al. (202T) introduced the Denoising Diffusion Implicit Model (DDIM), which enables high-quality image generation with fewer denoising steps by employing a deterministic sampling process. Further advances were made with the Latent Diffusion Model (L.MM) (Rombach et al., 2022), which integrates a Variational Autoencoder (Kingma & Welling 2014) to project images into a compressed latent space. Our method and evaluation target LDMs since they represent the state-of-the-art class of image generative models.
Image Watermarking, It is indispensable to watermark outputs from vision generative models since recent LDMs (Esser al. 2024 Podell et al.. 2003) are capable of generating photorealistic images and new legislation, for example, the EU Artificial Intelligence (AI) Act (European Parliament and Council of the European Union| 2024 requires us to distinguish between synthetic and authentic content. The existing approaches to watermark LDMs can be broadly categorized into post-pree prot-processing and in in-rrcessiing methods. Post-processing techniques embed watermarks into generated images after the sampling process (Cox et al., 2008). While extensively studied and well-established, these approaches are vulnerable to removal or degradation. In contrast, in-processing methods integrate watermarking directly into the generation pipeline, yielding watermarks that are harder to remove and more seamlessly embedded (An et al., 2024b Wan et al. 2022). Because of their strong, state-of- the-art performance, we focus in- in-processing methods that can be further divided into tuming-basse and tuing-free approaches.
Stable Signature. Fernandez et al. (2023) proposed Stable Signature, a state-of-the-arr tuning- based technique for LDMss It leverages HiDDeN (Zhu et al. 2018). a framework composed of an encoder, decoder, and adversarial discriminator. The encoder hides a binary message in cover image, while the discriminator ensures visual indistinguishabiliy. The system is trained to be robust against distortions like cropping and JPEG compression by including noise layers between the encoder and decoder. Stable Signature adapts this by fine-tuning a diffusion decoder to create watermarked images extractable by the HiDDeN decoder. While this allows for fast injection without computational overhead during generation, it relies on the pre-trained HiDDeN extractor, which necessitates substantial training time. Additionally, its reliance on pixel space causes to generalize poorly to advanced attacks, making it an undesirable choice if robustness is an important metric.
Tuning-free Watermarks. To avoid the costly fine-tuning of LDMs, tuning-free methods add a watermark directly to the initial diffusion noise. Tree-Ring (Wen et al. (023) embeds the watermark in the frequency space of the initial noise. The method achieves a high level of robustness against common image transformations, such as cropping, dilation, and rotation. Unlike the Stable Signature approach, which modifics the decoder, Rine influences the sampling process itself, allowing for watermark detection by inverting the diffusion process and analyzing the retrieved noise. RinglD (Ci jet al. 2024) extends Tree-Ring by employing multi-channel heterogeneous watermarking, enhancing its capacity to identify multiple keys, and providing slight improvements in verification performance. Gaussian Shading (Yang et al. 2024) is another tuning-free approach that embeds bits directly into the initial noise of the diffusion model. GaussMarker (Li al. 2025) ensembles the techniques of both free-Ring and Gaussian Shading. It introduces a Gaussian Noise Restorer, which is a trained component designed to improve results against common attacks such as rotation, cropping, and scaling. Although it offers improved performance, it requires additional training. Additionally, like most tuning-free methods, its watermark detection relies on the computationally expensive DDIM inversion. In contrast, our detector operates directly on the generated images. We directly compare SERUM to the state-of-the-ar luning-based Stable Signature as well as tuning-free RingID and GaussMarker methods.
TruktMark. To build a more resilient proc-srog watermarking method, the authors proposed training two separate networks: TrustMark (the watermarking model) and TrustMar--MM (the watermark remover). By jointly training TrustMark to embed watermarks and TrustMark- RM to undo TrustMark's transformations, the system embeds signal that is difficult to remove using standard
3

---

Published as a conference paper at ICLR 2026
perturbations. While the method performs well against simple transformations, its watermark remains easy to strip using rotations or static noise, highlighting its fundamental limitations.
3 OUR SERUM WATERMARKING METHOD
SERUM unifies the best elements from both worlds of DM watermarking. On the one hand, it matches the speed of uuiig-bbsse watermarking methods for both injection and detection, while training only a lightweight external watermark detector, thereby leaving the original model intact and substantially reducing training costs. On the other hand, similar to tuning-free approaches, our method adds the watermark to the initial diffusion noise, improving robustness. However, in contrast to prior methods, our SERUM eliminates the need for computationally expensive DDIM inversion during detection by relying on external watermark detector. This significantly improves detection speed and adds the advantage that the detector can be further fine-tuned to be robust against any image augmentations or watermark removal attacks.
The injection of SERUM is relatively simple. Let us denote 17 E Rox x as the initial diffusion noise drawn from the normal unit distribution every time image is generated (17 ~ (O, I),, where c represents the number of channels, and w x h are the spatial width and height dimensions, respectively. We inject watermark noise in the latent space by substituting 1) with vy::
Watermark Embedding.
A' A - mean(A) sld (A)
v/ V1 an VOA''
where E Rexxuxh is the watermark, A' the normalized watermark and hyperparameter controlling the balance between watermark's 's detectability and image diversity. Normalization of provides theoretical guarantee of low Kullback-Leible divergence between the distribution of watermarked and non- non-watermarked noises, we prove in Appendix B This gives our method more theoretically grounded justification of high image fidelity. To ensure that the DM generates high-quality images even after substituting the initial noise with n/', we set A once to values drawn from a normal unit distribution: ~ . NV,0 I) before training the detector. This ensures that most sampled images lie in a region of high unit Gaussian probabilities.
Watermark Detection. We detect SERUM via a lightweight watermark detector. This module is designed avoid computationally expensive DDIM inversion. Our detector is denoted f Rexwxh - [0, 1] and is used to verify whether a particular image is watermarked. Note that the input to f for LDMs is in the latent space (after image embedding), thus, its typical dimensions for SD models are x e R4x W # x (Rombach et 2022), with W and being respectively width and height of the image.
We formulate the loss function used update f at each step as a sum of the loss terms: fo (for watermarked images) and Ln (for non-watermarked images), i.e., f = Lw + L...
The e term of the loss function responsible for training the model f to produce high confidence scores when watermark noise is added for image generation:
log f(x"(x - log (T((
log f(x;)
marked clean marked transformed marked procomputed
where - llg I (x*) serves to identify watermarked images x". The second sub-term - log (T(z)..)) for watermarked images perturbed with a random image transformation T sampled from an aug- mentation sampler. Only m samples are perturbed to reduce the computational overhead of dynamic augmentations where m a hyperparameter. For the sampler's design, we adapt Prioritized Experi- ence Replay (Schaul et al. 2015). The idea is to make the training procedure target perturbations in which the model performs poorly. This, in turn, strengthens the signal pushing the model into the region of robustness against these difficult augmentations. Our version of the algorithm uses combination of four techniques: (1) adaptive step sizes for quick likelihood adjustments to changes, (2) probability smoothing guarantee exploration. (3) temperature term to balance exploration with exploitation, and (4) clipping to ensure that priority values stay in numerically stable ranges. For more details on the sampler, see Appendix A The third sub-term log [(x;) is for precomputed
4

---

Published as a conference paper at ICLR 2026
augmentations. It allows the model to learn robustness against transformations without much addi- tional computing power. Overall, Lu a component of the loss function that trains the model to assign high scores to watermarked images, both clean and perturbed.
The Ln loss term is analogous to Lwv but designed for samples æ generated using a clean random initial noise (no watermark added):
n =
log (1 f(x)) log (1 - ((T(mmm))) log (1 (1- fz=))
clean
transformed
precompated
To reduce training time, perturbations of both xx" and x are precomputed. resulting in 2 and zt. For high-epoch training runs, it is important that, at every training step. m samples be dynamically transformed, as this prevents the model from overfitting. For more details, see Appendix D
The injection of the watermark noise through a simple weighted sum motivated by two factors: (1) high detectability by the trained watermark detector and (2) a provably lower Kullback-Leibler Divergence unit Gaussian distribution than the method proposed by GaussMarker. Thus, our watermark injection has a lower effect the distribution of watermarked images, while providing high watermark identificatinn performance.
Multiple Users. SERUM supports multiple users seamlessly by assigning to each user i a unique subset S, S {l..... m} of normalized noise patterns {4' p E S.} together with a corresponding user-level detector score Dj. The watermark injected for user is obtained by combining all of the patterns belonging to that user. More precisely, for a clean noise sample we define
vI an + VE
E A/p PES;
Each per-patters detector is trained using the same procedure described above but with the corresponding A', used as the injected noise. These lightweight detectors are cached after training, and the user-specific detector score constructed the product
D2(x)
II dz(x), PES.
where (2) is the detector score for pattern p. Verification for a user then reduces to evaluating (x(x) on the generated content. When computing (x),, memoize the values of dz(x).
For set of users (I. (with n S (T)) the overall watermark score for a sample x is defined as S(x) = max dz(),,
where the prediction is labeled as positive when S(x) > J and is the lowest threshold such that S(x) produces a false positive rate of most 1%.
After verifying that the watermark is embedded within the image, the user associated with the detected watermark is given by
i(z) arg max (z).
Consequently, the time complexity training models for multiuser detection is O (n).
EMPIRICAL EVALUATION
We evaluate SERUM along three axes: (1) robustness standard perturbations and watermark removal attacks, (2) the quality of the generated images, and (3) the impact of watermark strength on both robustness and image quality. Finally, we also assess the multi-user setup. We begin by detailing the experimental setup used for our evaluations.
4.1 EXPERIMENTAL. SETUP
Models. We evaluate our method and the baselines on three versions of Stable Diffusion (SD): 1.4, 2.0, and 2.1 (Rombach et al. 2022). All models text-to-image and generate images resolution
5

---

Published as a conference paper at ICLR 2026
Table 1: Watermark robustness against perturbations. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 1% FPR thresholds are calculated separately for each perturbation.
Perturbation Robustness (TPR @ 1% FPR)
Method
Model
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
SD
100.00
4.30
99.98
0.42
100.00
14,80
86,96
35.20
TaustMark
2D0
48.22
93.28
1.88
52.20
96.00
0.14
93.14
21.14
53.58
22.58
SD 1.4
59.32
100.00
4.64
93.36
100.00
0.40
100.00
14.92
86.08
34.54
SD 2.1
90.94
99.96
94.62
91.14
99.96
99.06
99.40
91.02
49.02
94,24
Stable Signature
SD 2.0
91.09
99.96
95.76
90,96
99.92
99.18
99.52
90.80
48.36
95.36
SD
90.98
99.98
95.12
99.98
98.58
99.68
90.26
51,98
94.24
SD 2.1
88.48
100.00
99.88
99.98
5.50
99.96
100.00
100.00
92.30
98.74
RingID
SD 2.0
88.64
100.00
99.88
100.00
6.02
99.98
100.00
100.00
92.66
99.20
SD 1.4
88.77
100.00
99.88
100.00
5.96
99.96
100.00
100.00
93.32
99.82
SD 2.1
97.87
100.00
98
99.48
88.72
100.00
97.72
99.90
97.80
98.24
GaussMarker
SD 2.0
97.78
100.00
99.00
98.92
89.08
100.00
98.02
99.94
96.16
98.86
100.00
98.90
85.94
99.98
95.32
96.70
SD
99.75
100.00
99.34
99,98
99.54
99.86
100,00
100.00
99.30
99.72
SERUM (Ours)
SD
99.78
100.00
99.42
99.88
99.50
99.84
100.00
100.00
99.54
99.84
SD 1.4
99.76
100.00
99.26
100.00
99.58
99.90
100.00
99.98
99.46
99.68
of 512 512 pixels, with latent space size of 4 x 64 64. Sampling is performed using 50 denoising steps with a guidance scale of 7.5. For CLIP score calculations, we employ the ViT-B/32 model from OpenAT's CLIP framework Radford et al. (202T), which utilizes Vision Transformer (Dosovitskiy et al. 2021 architecture with a patch size of 32 pixels.
Datasets. To train our watermark detector, we use generated images based on the first 40,000 prompts from the
repository, using the same latent diffusion model (LDM) on which our method is later evaluated. For the TPR FFPR evaluation, we use a disjoint test set consisting of 5,000 prompts from the same repository, yielding 10,000 images in total (one clean and one watermarked image per prompt). To assess the perceptual quality of the clean and watermarked images, we additionally compute the Fréchet Inception Distance (FID) using 10,000 images from the COCO 2014 validation split (Lin et al. 2014). In both evaluations, the positive prompt drives the image generation, whereas the negative prompt is kept empty, serving only neutral input that contributes no suppressive guidance.
Baselines. We compare method primarily against Stable Signature (Fernandez et al. 2023). TrustMark (Bui et al. 2025), RingID (Ci et al. 2024), and GaussMarker (Li al. (025) as these methods yield state-of-the-art results in DM watermarking. For Stable Signature, we adapt the SD decoder using the watermark extractor released in the corresponding repository. This extractor was trained with a wider range of image augmentations, including blur and rotations, which improves robustness against such attacks, although at the expense of slight reduction in image quality. For our experiments, we line-tune the decoder on 2,000-image subset of COCO (Lin et al., (2014), with default parameters. Gauss Marker combines multiple strategies and reports state-of-the-att robustness when measured as mean TPR @ 1% FPR across various perturbations, making it a strong reference point. We trained, generated, and evaluated Mauser using modified version of their open source pipeline. For more details, see Appendix H.T
Perturbations. To evaluate robustness, we test SERUM under eight different perturbations:
Rotation: Random rotation in the range of (0000, ,90% with gray padding for corner filling.
JPEG Compression: Quality factor of 25.
Crop & Scale (C&S): Random crop retaining 75% of the original area with an aspect ratio of 1.
Random Drop (R. Drop): Random removal of 64% of the image pixels.
Salt & Pepper Noise (S. Noise): Corruption of 5% of the pixels.
Gaussian Noise (G. Noise): Additive white Gaussian noise with standard deviation of 0.1.
Brightness: Application of color jitter by adjusting the brightness with factor of 6.

---

Published as a conference paper at ICLR 2026
Table 2: Robustness against advanced generative removal attacks. We report TPR @ 1% FPR evaluated on 10,000 samples.
Method
Average
VAE
Regen-12 12
Rinse-4x8
Regen-30
Rinse-2x25
CtriRegen
12V
TrustMark
12.30
57.62
1.32
0.70
1.06
1.02
1.18
23.20
Stable Signature
1.18
2.70
1.30
0.62
0.42
0.76
0.86
1.60
RingID
65,40
99.98
98.22
84.12
32.58
24.88
77.82
40.20
GaussMarker
58.01
98.36
89.30
65.80
9.72
10.40
91.06
41.40
SERUM (Ours)
90.87
99.88
99.72
99.38
88.50
90.76
99.64
58.20
Gaussian Blur (Blur): 15 x 15 kernel with standard deviation sampled uniformly from [0.1, 2.0].
provide additional visualization of the above perturbations Figure
Advanced Attacks. For advanced watermark removal attacks, we follow the WAVES (An et al. 2024a) benchmark and evaluate five types attacks: VAE, Regeneration (Zhao et al. 2024), Rinse, CtrlRegen (Liu et al., (025)) and Image-to- Video (I2V) (Lu et al. 2025). Details about the exact experimental setup of the attacks are available in Appendix
Hyperparameters. We train our watermark detector for 50 epochs using Adam (lr = 10-=10-9,,
0.9, B2 = 0.999) and a ReduceLROnPl lat scheduler (factor 0.2, patience 2). The watermark strength is configured with 0.5. Each training batch consists of 32 clean and 32 watermarked images. The perturbation size m is set to 4. Before training, we generate 15,000 watermarked images (x:) and their random perturbations.
4.2 ROBUSTNESS TO IMAGE PERTURBATIONS
Table presents the performance of SERUM under various image perturbations, measured as True Positive Rate (TPR) at a fixed 1 % False Positive Rate (FPR). SERUM consistently outperforms prior approaches across all tested models and perturbations. Across all model versions, SERUM achieves an average TPR above 99.7%, setting new state-of-the-at in robustness. Specifically, our method maintains near-perfect detection clean images and demonstrates exceptional resilience to wide range of augmentations.
In comparison, while TrustMark is resilient C&S, it exhibits severe vulnerability rotation, random drop (dropping below 5% TPR), and noise-based perturbations. Similarly, Stable Signature performs well on clean images and C&S. but suffers substantial drops under Gaussian noise (e.g... 48-52% TPR) and degrades under JPEG compression and rotation. RingID achieves high detection rates for most perturbations but collapses under C&S (5-6% TPR), indicating a critical limitation. Finally, Mauss obtains the second-highest average TPR but displays variable performance, specifically lagging in C&S robustness (65-90% TPR). Overall, SERUM achieves the highest average TPR and the best stability among all evaluated methods.
4.3 ROBUSTNESS TO WATERMARK REMOVAL ATTACKS
Watermark Removal Attacks. We further assess robustness of our SERUM watermark against the baselines under dedicated watermark removal attacks Table We report the TPR @ 1%FP on 10,000 samples (2,000 for 12V) with our watermark detector not trained on these attacks. It maintains TPR exceeding 99% across VAE, Regen-12, 12, Rinse-4x8, and CtrlRegen. Even under significantly more aggressive strategies, SERUM retains robust, performance, yielding TPRs of 90.76% on Rinse- 2x25 and 88.50% on Regen-30. Finally, against the most destructive I2V attack, it achieves 58.20%. substantially outperforming the best available competing methods. This displays SERUM's strong ability to generalize to unseen attacks which we further discuss in Appendix
We observe sharp performance dichotomy in competing methods based the attack intensity. While baselines like RingID and GaussMarker remain effective on low-noise reconstructions (e.g., VAE, Regen-12 12), their detection rates collapse high-noise variants like Regen-30 and Rinse-2x25. In contrast, SERUM exhibits consistent stability across the entire spectrum of attacks, bridging the gap between standard robustness and resilience destructive generative perturbations (further discussed
7

---

Published as a conference paper at ICLR 2026
Table 4: Quantitative analysis of the generation quality, Adding SERUM has negligible effect on the quality of the generated images and comparable to prior approaches.
FID (U)
CLIP Score (*)
Method
SD 1.4
SD 2.0
SD 2.1
Avg
SD 1.4
SD 2.0
SD 2.1
Avg
Clean
17.74
17.53
18.43
17:90
0.3123
0.3169
0.3137
0.3143
TrustMark
17.80
17.51
18.45
17.92
0.312
0,3162
0.3135
0.3139
Stable Signature
17.87
17.60
18.44
17.97
0.3069
0.3159
0.3140
0.3123
RingID
20.17
18.73
20.19
19:70
0,3103
0,3147
0.3125
0.3125
GaussMarker
20.03
19.32
21.13
20.16
0.3115
0.3157
0.3147
0.3140
SERUM (Ours)
19.14
18.51
19.24
18.96
0.3115
0,3164
0,3135
0.3138
in Appendix E}. Overall, these results highlight robustness of our SERUM also against dedicated attacks.
4.4 RADIOACTIVITY
Watermark radioactivity (Sablayrolles et al., 2020 refers to the persistence or transferability of watermark when watermarked images are used to train or adapt new generative models. High radioactivity means that the watermark signal remains detectable in outputs from models trained on watermarked data. This is a desirable property to trace data provenance through its lifecycle where generated data can be used in training of new generative models (Sander et al.) 20244 Meintz al. 20255 Kerner et al.] 2025). We evaluate SERUM'S radioactivity by adapting diffuuiin models on images generated by watermarked SD 2.1 via full fine-tuning (denoted as FFT) and LoRA (Low Rank Adaptation) (Hu) et al. 2022). We present the results in Table 3 For the purpose of this experiment, we train SD 1.4 and SANA-0.6B and report the TPR @ 1% FPR for a checkpoint with the lowest evaluation loss in Table For more details see Appendix Our results suggest that SERUM is highly radioactive for both SD models and SANA, displaying large impact on diverse model families adapted with different methods on watermarked data. To the best of our knowledge, this is the first instance in which watermarked outputs from diffusion models have been demonstrated to be radioactive.
Table 3: Radioactivity.
Adaptation
1%PPR
LoRA 52.30%
SD 1.4
FFT
77.12%
SANA
FFT
96.76
4.5 QUALITY OF WATERMARKED IMAGES
Table reports the impact of watermarking on generation quality, measured by FID and CLIP Score. Our method demonstrates a negligible impact on visual quality across all evaluated Stable Diffusion versions. On average, SERUM incurs only minor increase in FID (17.90 Clean vs. 18.96 Ours) while preserving semantic consistency, as indicated by the nearly unchanged Average CLIP Score (0.3143 Clean vs. 0.3138 Ours).
Regarding baselines, TrustMark and Stable Signature achieve the hest fidelity retention, with averages of 17.92 and 17.97 FID, respectively. However, SERUM demonstrates superior quality compared to methods, RingID and GaussMarker, which suffer from higher degradation
the other distribution-base (19.70 and 20.16 Avg FID, respectively). Overall, these findings highlight that the robustness of SERUM does not come at the expense of visual generation quality, qualitatively shown in Figure
4.6 MULTI-USER WATERMARKING
We train m 135 detectors and evaluate the system with subset size of k = 2, supporting total user base 0.3, producing combined watermark strength of Ottotal = 0.6. Evaluation is performed on 25,000 images for User Accuracy and 5,000 images for TPR calculation.
We illustrate the performance of our method a multi-user setting in Figures 3a and 3b
of n (1355 9. 045. Each pattern
Watermark detection (TPR @ 1% FPR). SERUM proves highly robust at scale. With 9,045 users, maintains 99.96% TPR on clean images, 99.76% on Gaussian Blur, and 99.30% JPEG Com-
8

---

Published as a conference paper at ICLR 2026
surfer standing in the ocean holding surfboard
dog wearing bandanna, sitting on the trunk of a car
Two people on long rowboat in river or lake
blue and yellow train, building, and some cars
wooden bench sitting the grass, under tree
Several sheep eating hay near fence
Clean
Ours
Figure 2: Qualitative analysis of generation quality. We present outputs from the SD 2.1 model without (Clean) and with our SERUM (denoted as Ours with the parameter a = 0.5) watermark. The most important image qualities like style and content are preserved while slightly modifying shape or perspective. More examples can be found in Appendix Figure
100
100.0
TPR (%6
User Accuracy (8g
$5.0-
90-
Rotate
Clea
92.5
Rotala
JPEG
CGS
90.0
JPEG
ERS
Drop
80
5. Notse
Naise
G. Nalce
Bright
82.5
15a
16
16 Users
16
Users
(a) Watermark detection (TPR 1% FPR). SERUM scales robustly to 9,045 users, maintaining over 95% TPR on most perturbations.
(b) User identification accuracy. Identification re- mains precise at scale, achieving over 90% accuracy on 7 of 8 perturbations for 9.045 users.
Figure 3: Performance of SERUM in multi-user setting.
pression. Even under challenging geometric perturbations, it retains strong detectability, achieving 88.70% TPR Crop & Scale and 78.12% on Random Rotation.
User Identification Accuracy. SERUM consistently maps the signal to the correct user. At the full scale of 9,045 users, the system maintains 99.79% accuracy clean images and 99.10% Salt & Pepper Noise. Even under the most difficult transformations, such as Random Rotation and Crop & Scale, the system correctly identifies the user in 82.56% and 90.29% of cases, respectively.
These results highlight the practical utility of SERUM: it scales efficiently to thousands of users while accurately identifying ownership under significant image perturbations.
4.7 ABLATION STUDIES
To further examine the internal properties of our SERUM watermark, we conduct series of ablation studies. We analyze how the watermark strength affects both Fréchet Inception Distance (FID) and detection performance. Furthermore, we dissect the contribution of individual training components (specifically the loss terms and the augmentation sampler temperature) to demonstrate the necessity of our dynamic training strategy. The results highlight that 0.5 strikes the right balance between fidelity and detection, and that combining precomputed and dynamic augmentations is crucial for achieving nate-of-the-ar robustness.

---

Published as a conference paper at ICLR 2026
Table Impact of watermark strength on image quality (FID) and detection robustness (TPR @ 1 % FPR) for SD 2.1. We select 0.5 as the optimal trade-off.
Perturbation Robustness (TPR
1% FPR)
a
Average
Clean
Rotate
JPEG
C&S
Drop
Blur
S. Noise
G. Noise
Bright
0.0
18.43
18.91
78.49
98.64
23.92
94.60
41.18
90.76
97.30
94.82
76.14
89.02
0.2
18.84
91.85
99.74
66.16
97.72
80.08
97.86
99.22
98.90
92.50
94,44
0.3
18.95
97.73
99.96
91.98
99.74
94.84
98.68
99.74
99.78
97.64
97.24
0.4
19.05
98.92
99.98
95.50
99.78
98.38
99.32
99.92
99.76
98.62
98.98
0.5
19.24
99.75
100.00
99.34
99.98
99.54
99.86
100.00
100.00
99.30
99.72
0.6
19.96
99.82
100.00
99.60
99.94
99.58
99.86
99.96
100.00
99.70
99.74
0.7
20.82
99.90
100.00
99.54
99.98
99.86
99.94
99.98
100.00
99.84
99.96
Table 6: Impact of watermark components and sampler temperature on robustness (TPR @ 1 % FPR) for SD 2.1. We compare: clean (training solely on clean images), precompute (adding precomputed augmentations), and transform (our dynamic sampler). The temperature controls the sampler's s focus: T strictly prioritizes hard examples, while = oo samples uniformly.
Perturbation Robustness (TPR @ 1% FPR)
Setup
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
Noise
G. Noise
Bright
clean
78.68
100.00
14.94
99.86
59.80
77.44
100.00
98.52
66,
88.74
precompute
97.16
100.00
79.72
99.90
97.18
99.56
99.96
99.86
99.18
99.06
transform (r 0)
99.48
100.00
98.06
99.70
99.24
99.82
99.98
99.92
98.86
99.30
transform (r 0.1)
99.60
100.00
99.06
99.88
99.12
99.68
100.00
99.94
99.28
99.42
transform (r 0.3)
99.64
100.00
99.00
99.94
99.38
99.66
99.96
99.94
99.44
99.48
transform 0.5)
99.70
100.00
99.30
99.86
99.48
99.86
100.00
99.94
99.50
99.36
transform (1=1.0)
99.75
100.00
99.34
99.98
99.54
99.86
100.00
100.00
99.30
99.72
transform (r 2.0)
99.67
100.00
98.34
99.90
99.56
99.82
100.00
99.98
99.70
99.76
transform 00)
99.34
100.00
95.88
99.90
99.36
99.84
99.98
99.98
99.58
99.52
We provide additional comprehensive experiments Appendix G covering runtime performance, FPR evaluation real-world data, ablation studies the augmentation sampler batch size, general- ization to different architectures, and robustness analysis under stricter evaluation protocols.
Impact of Watermark Strength. We analyze the impact of the watermark strength hyperparameter on image quality and detection performance. As illustrated in Table there is a distinct trade-off: increasing a strengthens the watermark signal, which significantly improves the TPR, but comes at the cost of a higher FID score, indicating a slight reduction in the diversity of generated images. 0.5 as the optimal balance between fidelity and robustness for our main evaluations. However, this parameter is flexible; larger values can be employed for applications where detection robustness is prioritized over strict fidelity retention.
We select
Impact of Individual Components. We further examine how different training components con- tribute to robustness. Specifically, we evaluate the effect of loss terms on clean, precomputed, and transformed samples, alongside the impact of the augmentation sampler's temperature. Results in demonstraee that incorporating all loss terms is essential for high performance and that setting the temperature to yields the best results. We provide a detailed analysis of these sampling dynamics in Appendix G.2
5 CONCLUSIONS
We introduced SERUM, novel watermarking method for DMs that unifies the strengths of prior approaches into a simple, efficient, and robust framework. By combining watermark noise insertion at the initial diffusion stage with the training of a lightweight yet robust watermark detector, SERUM achieves tftte--f-theann performance in watermark detection while preserving both the distribution and quality of generated images. SERUM delivers stronger robustness image perturbations and watermark removal attacks than previous methods while requiring only minimal training and enabling efficient watermark injection and detection.
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY STATEMENT
Our own method and core experiments are fully reproducible through the code provided in the supplementary materials. All evaluations are conducted on publicly available models and datasets hosted on Hugging Face or GitHub, ensuring accessibility for the community. All competing methods are evaluated using their official repositories (versions of early September 2025) and recommended instructions, with additional training performed when necessary for completeness.
ACKNOWLEDGMENTS
Adam Dziedzic was supported by the German Research Foundation (DFG) within the framework of the Weave Programme under the project titled "Protecting Creativity: On the Way to Safe Generative Models" with number 545047250. We also acknowledge sponsors, who support with financial and in-kind contributions: OpenAl and G-Research. Additionally, we thank members of the SprintML group for their feedback. Responsibility for the content of this publication lies with the authors
research
REFERENCES
Sina Alemohammad, Josue Casco-Rodriguez, Lorenzo Luzi, Ahmed Imtiaz Humayun, Hossein Babaei, Daniel LeJeune, Ali Siahkoohi, and Richard Baraniuk. Self-consuming generative models go MAD. In The Twelfth International Conference on Learning Representations, 2024. URL
https://openrevee net Sot
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. WAVES: Benchmarking the robustness of image watermarks. In Forty-first International Conference on Machine Learning, 2024a. URL https::/openrevs ew, net. fo rum? C=URE
Bang An, Mucong Ding. Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. Waves: Benchmarking the robustness of image watermarks. ICMI., 2024b. (RI.https:: http::s:///peeeeeeeeee/ net/ Forum? d---tEuYERRRECSSS
Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational im- age compression with scale hyperprior. In International Conference on Learning Representations, 2018. URL.https: http::://///peeeeeeeeeeee ew. net. forum? d= RCQFRR
Andreas Blattmann, Tim Dockhor,, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, Varun Jampani, and Robin Rom- bach. Stable video diffusion: Scaling latent video diffusion models to large datasets. CoRR, abs/2311.15122 2023. URL
111.0.885500 48550/ 2311 15127
Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Robust watermarking and watermark removal for arbitrary resolution images. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 18629-18639, October 2025.
Brian Chen and G. W. Wornell. Wornell, g.w.: Quantization index modulation: class of provably good methods for digital watermarking and information embedding. ieee transactions on informa- tion theory 47(4), 1423-1443, Information Theory, IEEE Transactions on, 47:1423 1443, 06 2001. doi: 00.1109/18.92372.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Computer Vision (ECCV), pp. 338-354. Springer, 2024. doi: 10.1007/978 0-188-3-335 - 20.
Ingemar| J. Cox. Joe Kilian, Frank Thomson Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia. IEEE transactions image processing publication of the IEEE Signal Processing Sociery, 6 12: 12:1673-87, 1997. URL httpp::/ /api. semanticschon brce/CorppusDD:529123
11

---

Published as a conference paper at ICLR 2026
Ingemar J Cox, Matthew L Miller, Jeffrey A Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking. Morgan Kaufmann Publishers, 54:56-59 2008.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs on image synthesis. In A. Beygelzimer, Y. Dauphin, Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, 2021. URL
net wttp://wwwwweetrteetteeem forum did
AANuCvzaVE
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference Learning Representations (ICLR), 2021. URL https Oral.
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference on machine learning, 2024.
European Parliament and Council of the European Union. Artificial Intelligence Act, 2024. Regulation laying down harmonised rules on artificial intelligence (AI Act).
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In ICCV, pp. 22409 -2420,, 2023. URL
https://doi.... orgg /10. 1109/ www0///CCV1100.... 2023. 02053
Giorgio Franceschelli and Mirco Musolesi. Copyright in generative deep learning. Data & Policy, 4: e17, 2022.
Jonathan Ho, Ajay N. Jain, and Pieter Abbeel. Denoising diffusion probabilistic mod- cls. In Advances in Neural Information Processing Systems (NeurIPS), volume 33, pp. 6840-6851, 2020. URL Cccbecce5Baa006fffaaa0000----a-2
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3, 2022.
Manie Kansal, Gursharanjeet Kalra, and B. V. Kranthi. Dwt, det and svd based digital image watermarking. pp. 77-81, 09 2012. ISBN 978- 778-1-4673-2647-6 doi: 10.1100/CCC.221111
Louis Kerner, Michel Meintz, Bihe Zhao, Franziska Boenisch, and Adam Dziedzic. Bitmark: Watermarking bitwise autoregressive image generative models. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. URL
ftte/forum?idd/// FFP
Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. In Proceedings of the International Conference on Learning Representations (ICLR), 2014. /tttss:s:://ar
6114
Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. Gaussmarker: Robust dual-domain watermark for diffusion models. In Forty-second International Conference on Machine Learning, 2025. /ttp://tse//opeeeeeeeeeeee//eeaa
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft coco: Common objects in context. In David Fleet, Tomas Pajdla, Bert Schiele, and Tinne Tuytelaars (eds.), Computer Vision ECCV 2014, pp. 740-755, Cham, 2014. Springer International Publishing. ISBN 978 1062---
Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. In Y. Yue, A. Garg. N. Peng, F. Sha. and R. Yu (eds.), In- ternational Conference Representation Learning, volume 2025, pp. 87310-87327. 2025. URL 39750088aecc33333334144222222222
iclx wwtppprrrrrppppppeeeepape.eeee.e fiwes/papeeeeeeee http:///r/p.aaeeeeeeaa////////// file/
12

---

Published as a conference paper at ICLR 2026
Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. The Thirteenth International Conference Learning Representations, 2025. URL httpa:://pperreiier
net/ id 608GCm@Wn
Michel Meintz, Jan Dubiński, Franziska Boenisch, and Adam Dziedzic. Radioactive watermarks in diffusion and autoregressive image generative models. arXiv preprint arXiv:2506.23771, 2025.
Yisroel Mirsky and Wenke Lee. The creation and detection of deepfakes: A survey, ACM Comput. Surv., 54(1), January 2021. ISSN 0360-0300. doi: 10. 14553442255 URL https://doi org 10.110014444/47880
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning (ICML), pp. 8748-8763, PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVE Con- ference on Computer Vision and Pattern Recognition (CVPR), pp. 10684-10695, 2022. doi: 10.1109/CVPS52688.222 202...00440...
Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. Radioactive data: tracing through training. In International Conference on Machine Learning, pp. 3326-8335.
PMLR, 2020.
Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems, 37: 21079 200022111 21113,11122111111 2024.
Tom Schaul, John Quan, Ioannis Antonoglou, and David Silver. Prioritized experience replay, 2015, URL at ICLR 2016.
05952 cite 1mrv::5511.05952oommeet Published
Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Nicolas Papernot, Ross Anderson, and Yarin Gal. Ai models collapse when trained on recursively generated data. Nature, 631 (8022))5775,, 2024.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Inter-
national Conference on Learning Representations, 2021.
foorumid=SSt wwiStiggian wig.idddtttgigaiiii... arCLL
Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey robust image watermarking. Neurocomput, 488(C):226 247-222622777222 June 2022. ISSN 0925- 2312. doi: 10. 10. n100://.eeucomm2222200.. 2022. 02.2....00 083
URL https:://oi....oo oow.oo..........oo.ooommmm neucom
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Teirty-seventh Conference on Neural Information Processing Systems, 2023. URL htt.tttpss//pppeeeiieeee wttp://wwwwweeooooonmmmmmmem
7Jrmmbb]
Sierra Wyllie, Ilia Shumailov, and Nicolas Papernot. Faimess feedback loops: training synthetic data amplifies bias. In Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency, pp. 2113-2147, 2024.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. doi: 10.1 00009CCCVPP273..244.01555
13

---

Published as a conference paper at ICLR 2026
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, llya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative AL In The ehihty- Annual Conference Neural Information Processing Systems, 2024. URL
wttpeeiwwwweeeeeeeeeeeeeeeeeeeee net/ rumm? d= d5
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In European Conference on Computer Vision (ECCV), 2018.
14

---

Published as a conference paper at ICLR 2026
A AUGMENTATION SAMPLER
Our method involves drawing perturbations, applied to images during training, from a dynamically adjusted probability distribution. The implementation of the sampler makes the training prioritize more difficult transformations improving our method's robustness. denote the number of augmen- tation candidates by n. the per-augmentation priority vector by p (0, 1)", and the following scalar hyperparameters:
e, Esmonth: T, base_Ir_pee base_ les__l__nee lr_ng, boost, B.
For the purpose of our experiments set
le
3, Esmooth
= le - 3, = 1, base Ir Ir_pos = 0.2, base_Ir lr_ner_________ = 0.05, boost = 3, B = 1.
A.1
SAMPLING
The sampling routine (presented in Algorithm I converts priorities into probability distribution with smoothing and temperature, then samples a single augmentation index.
Algorithm 1: Sampling from the augmentation distribution
Input: priority vector p (0, 1)", smoothing parameter Esmooth 0, temperature т > 0, integer
k 2 1
Output: a single index
Compute softened scores: 8, + (P: + Emoothh /// ) for all i; Normalize to probabilities: + / ΣØ= 8y for all i;
Sample single index i ~ Categorical (q.... 9n);
return i;
A.2
UPDATE
The update rule (presented in Algorithm 2 adjusts a chosen augmentation's priority ps depending on whether it produced a mistake not. The algorithm uses adaptive step sizes that depend on the current priority and multiplicative boost term. Finally, priorities are clipped to stay away from exactly 0 or 1.
Algorithm 2: Updating sampled augmentation's priority
Input: chosen index E (1,...,)). boolean mi stake, current priority p;, scalars
base_lrpos base_Iragg- boost, 3, 6
Output: updated p;
mi mike true then
compute adapt factor: a + (1-p:)) p:)
learning rate: 7) f- base base_lrpo- pos (1 + boost a);
increase priority: Ps P: + (1 pt):
else
compute adapt factor: a t p.; learning rate: 1) 4- base nnn (1 + boost a);
decrease priority: Pi <- p: 1) p;;
clip priority: P: + clip(p,, E, 1- E);
return updated pi, eehosen, e smistake.
B DERIVATION OF KULLBACK-LEIBIA DIVERGENCE
Let c. w h and let
p(x) = (xx 0
be the d-dimensional standard Gaussian distribution.
15

---

Published as a conference paper at ICLR 2026
B.1 KL DIVERGENCE FOR SERUM
Let (ours(2) be the PDF of the initial watermarked noise distribution r/' for our method.
v/ v1 on + vad',
7~~N00,
Thus 1f' NN a)) Using the closed-form KL. divergence between Gaussians
det !
DEI( ||
- va + log det ((1 aa) -
2
= [1 a) ai A' dlog( - a)]
Since A' normalized such that || A this reduces to:
DkL (oous 1l log(1 a)
In particular, for this evaluates to:
d
DEL D [1 =
2 log 2
D 1. (yours 1lp) ss 5,678 for 2
B.2 KL DIVERGENCE FOR GAUSSMARKER
In this work, we focus on the spatial-domai watermarking variant of GaussMarker, where watermark information is embedded by enforcing specific signs of the initial noise. This restriction naturally corresponds to selecting an orthant in R4, determined by the watermark signal map.
We define the GaussMarker distribution (G)(2)) the Gaussian distribution truncated fixed orthant O c. Rd Since the Gaussian is symmetric, the probability mass of any orthant is exactly 2 To obtain a normalized density, scale by 2d
(2 p(x) if x otherwise.
IGM (x) =
(0
DKL (l = f ((x) log g(x)
dx p(x)
= =10 g(x)) log p(x)
2d p(x)
dr
log 2d 1/ q(x)) dr
dlog2
D (gLM [| d log 2
DKL(gGM P) 11,357
B.3 KL DIVERGENCE COMPARISON
As such. DKL. for our method is lower than that of GaussMarker, providing a theoretical explanation for lower FID value of our method.
16

---

Published as a conference paper at ICLR 2026
C ADVANCED ATTACKS DETAILS
VAE. We utilize the factorized prior model from Ballé et al. (2018) with a quality level of one. The attack involves compressing and subsequently resampling the image using the VAE's encoder-decoder architecture, effectively regenerating the image content.
Diffusion-based Attacks Setup. For all diffusion brasdddo--baeedd baselines (Regeneration and Rinse), we utilize the 256 x 256 unconditional version of Guided Diffusion (Dhariwal & Nichol 2021). We operate on downscaled images using the DDIM sampler and upscale the model outputs afterwards.
Regeneration. In this attack, we perturb the image with noise and then denoise it using the last 12 or 30 steps of a 50-step diffusion schedule, yielding the variants Regen- 12 and Regen-30, respectively.
Rinse. This method applies the Regeneration process iteratively. Specifically, Rinse-4xx 4x runs Regeneration with 8 DDIM steps four times, and Rinse-2x25 runs Regeneration with DDIM steps twice.
2025). we generate images starting from CtriRegen. Following the official implementation (Liu al.
random Gaussian noise using the pretrained checkpoints provided by the authors. Unlike standard regeneration attacks that initialize from the watermarked image, CtrlRegen reconstructs the content solely via semantic and spatial guidance, effectively severing the link to the original watermarked latent code.
Image-to- Video (I2V). To evaluate robustness against video generation, employ Stable Video Diffusion (Blattmann et al., 2023) to generate video sequences of 19 frames conditioned on the watermarked image. We perform watermark detection specifically the final frame (19th frame) to assess robustness against the temporal accumulation of diffusion and decoding artifacts.
We illustrate these advanced attacks with qualitative examples in Figure
D PREVENTING BINARITY OF CLASSIFIER OUTPUTS
Training on only precomputed transformations and generated data resulted in poor performance when measured with ROC-AUC after significant number of epochs. We theorized that at least one of the reasons for this phenomenon is classifier binarization, a situation which the model begins to learn to output class predictions with near near-perfect confidence. This causes the output distribution of the model be concentrated in two points, which makes TPR @ FPR results suboptimal. To address this issue, we added additional regularizing sub-term both loss terms. This sub-term ensures that the model outputs correct predictions for randomly transformed training samples. Since this perturbation random at each step, the classifier is unable memorize the outputs for these samples, making the model's 's confidence low for difficult data.
E SERUM'S GENERALIZATION CAPABILITIES
In this section, we investigate the underlying factors contributing to SERUM's strong generalization unseen attacks by analyzing the impact of training augmentations, diffusion inversion, and the detection space.
Firstly, we check whether the augmenta- tions used for classifier training improve its robustness unseen attacks. As such, we train SERUM after removing the perturbation-relate sub-terms from the loss formulation. While do notice significant decrease in performance when evaluated advanced attacks, the results remain high. This suggests that method's robustness to such attacks is a core feature of the method itself, rather than a consequence of the transformations used during training. We report these results in Table
Table Robustness advanced attacks. TPR @ 1% FPR for a watermark detector trained without any perturbations.
VAE Regen-12
Rinse-4x8 Regen-30 Rluse-2x25
CtriRegen
12V
$2.28
We then verify the impact of DDIM inversion on latents by calculating the Euclidean distance between latents of the original image and those of the same image perturbed with random transformation.
17

---

Published as a conference paper at ICLR 2026
Table 8: Watermark robustness. Results showing TPR @ 1% FPR on each perturbation for
watermark detector trained without this specific transformation. Evaluated on 5,000 watermarked and clean samples.
Rotate
JPEG
C&S
Drop
Blur
S. Noise
G. Noise
Bright
18.46
99.96
56.34
64.02
99.96
99.88
91.70
78.02
We compare this distance to the Euclidean distance between the corresponding initial noises after performing DDIM inversion. Running this experiment 1,000 syntheticalyy generated images with SD 2.1 shows that the Euclidean distance increases from 103.18 117.47 after inversion. This indicates that DDIM inversion amplifies the effect of augmentations latents, implying that inversion-free methods possess an inherent advantage.
Lastly, we observe that most perturbations and attacks primarily operate in pixel space and do not modify the semantics of the image. For instance, noise perturbation distorts the image but does not change its high-level semanties. This suggests that latent-based watermarks should be naturally resilient to pixel-space attacks and transformations, giving them a massive ad advantage.
These deliberations lead us attribute our method's success against unseen attacks main factors:
1. SERUM, unlike most other evaluated methods, does not rely on DDIM inversion.
The watermark detector operates latent space rather than pixel space, providing greater robust- ness than Stable Signature's is watermark extractor.
F FLEXIBILITY OF SERUM
Let T; denote the i-th perturbation and T the full set of augmentations used during training. To measure how training on transformations affects robustness to an individual transformation T,, we train the detector on T (Tr) and then report TPR at 1% FPR measured T. Results are shown in Table g We observe substantial drops in performance for rotations, C&S, and random drop when those transformations
omitted from training; in particular, rotation is more damaging than many of the other advanced attacks. The fact that our method can learn near-perfect robustness to rotation when it included in training demonstrates high flexibility; the detector can learn to recover watermarks even under very challenging perturbations.
G ADDITIONAL EXPERIMENTAL RESULTS
G.1 RUNTIME
We evaluate the computational efficiency SERUM against state-of-the-ard baselines on an NVIDIA A100 GPU. The results, summarized in Table 9 demonstrate that SERUM achieves superior trade-off between training effort and inference-time time latency.
Unlike inversion-based approaches such as RingID and GaussMarker, which suffer from prohibitive detection costs (>-100 min) due to the necessity of reversing the diffusion process (DDIM inversion), SERUM enables rapid detection (2.5 min per 5,000 images). Additionally, SERUM achieves near- instantancous injection (17ms), significantly outperforming baselines that rely on computationally costlier spectral domain operations (FFT) (~22). Furthermore, our training phase is significantly more efficient than other learning-basee based methods, requiring only 9.48 hours compared to 57.5 hours for Stable Signature and 336 hours for TrustMark. This efficiency stems from our lightweight detector design.
G.2 RESULTS ON REAL DATA
While training on synthetic data ensures fair evaluation, it does not guarantee low false positive rates when applied to real-world images. To assess generalization, evaluate model on 5,000
18

---

Published as a conference paper at ICLR 2026
Table 9: Runtime Performance. Measured on an NVIDIA A100 GPU. Injection and detection times are reported for batch of 5,000 images. Training time for SERUM includes the overhead for data generation and pre-computing augmentations.
Method
Training Time
Watermark Injection
Watermark Detection
TrustMark
336
76
1.34 min
Stable Signature
57.52 h
0 ms
1.1 min
RingID
1922 ms
140.7 min
GaussMarker
0,93 h
2022 ms
117.0 min
SERUM (Ours)
9,48 h
17 ms
2.5 min
Table 10: Impact of architectures on watermark robustness. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 1% FPR thresholds are calculated separately for each perturbation. We use SD 3.0 (medium) underpinned by the Diffusion Transformer (DiT) and compare it against the UNet-based SD 2.1.
Perturbation Robustness (TPR
1% FPR)
Architecture
Model
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
Transformer
3.0
95.24
99.82
81.18
99.50
88.64
98.66
99.60
99.10
91.86
98.76
UNet
SD 2.1
99.75
100.00
99.34
99.98
99.54
99.86
100.00
100.00
99.30
99.72
randomly sampled images from the LAION-2B and COCO datasets. The model is trained exclusively on synthetic data, and the decision threshold fixed to the value computed over clean synthetically generated images. Under this setting, the FPR (at 100% TPR clean synthetic data) is only 0.24% on LAION-2B and 0.00% on COCO, demonstrating that our method transfers effectively to real data.
G.3 GENERALIZATION TO DIFFUSION TRANSFORMERS
We compare the performance of our SERUM watermark for models underpinned by different ar- chitectures. Concretely, we show that the method generalizes to the Diffusion Transformer (DiT) architecture which used SD 3.0 model and compare its robustness to perturbations against SD 2.1 based on UNet architecture. We think that SERUM's ' strong performance with DiT-based image generator can be attributed to the detector's 's model-specific training. The results are presented in Table [0
G.4 ROBUSTNESS TO EXTREME CROP & SCALE
To assess the limits of watermark persistence under severe geometric distortions, we extend our evaluation of the Crop & Scale perturbation stricter retention rates, ranging from 75% down to 25%. We present the results in Table
We observe sharp divergence in performance the attack severity increases. While Stable Signature remains effective at moderate cropping levels (250%). it degrades rapidly under aggressive conditions, collapsing to near-zero detection 25% retention. RingID exhibits the most severe vulnerability, failing to achieve meaningful detection rates even at the mildest 75% retention setting. Similarly, TrustMark and Mauser exhibit early failure modes, dropping to negligible detection rates as soon as retention falls below 50%. In stark contrast, SERUM demonstrates exceptional resilience, maintaining a TPR of 93.54% (at 1% FPR) and 81.52% (at 0% FPR) even when only one-quarter of the original image content remains.
G.5 EVALUATION AT STRICTER FALSE POSITIVE RATES
19

---

Published as a conference paper at ICLR 2026
Table 11: Ablations on Crop and Scale. We present a range of retain values for the Crop and Scale perturbation on SD 2.1. We report both TPR @ 1 % FPR and TPR @ 0% FPR.
Method
Metric
75%
50%
45%
40%
35%
30%
25%
TPR@ 1%
99.98
0.18
0.04
0.06
0.00
0.02
0.04
TrustMark
TPR 00%
99.96
0.04
0.02
0.00
0.00
0.00
0.00
TPR 1% TPR@0%
99.96
99.72
87.64
57.76
37.68
5.80
0.94
Stable Signature
98.24
80.98
75.66
3.10
0.88
0.00
0.00
TPR 1%
5,50
0.01
0.00
0.00
0.00
0.00
0.00
RingID
@0%
0.12
0.01
0.00
0.00
0.00
0.00
0.00
TPR @ 1%
88.72
5.32
3.72
2.68
3.10
2.30
1.82
GaussMarker
TPR @0%
18.26
0.20
0.10
0.02
0.18
0.06
0.04
TPR @ 1
99.54
98.98
99.08
98.86
98.76
97.22
93.54
SERUM
TPR@0%
95.22
94.12
95.94
89.76
91.00
88.56
81.52
Table 12: Watermark robustness against perturbations. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR 0% FPR thresholds are calculated separately for each perturbation. Please note that this table is equivalent to Table I but with decreased FPR.
Perturbation Robustmess (TPR @ 0% FPR)
Method
Model
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
SD 2.1
59.33
100.00
4.42
93.18
99.96
0.02
100.00
14.78
87.16
34,46
TristMark
SD 2.0
48.12
93.28
1.98
52.18
96.0
0.00
93.02
21.0
54.18
21.44
SD
59.23
100.00
93.38
100.00
0.76
100.00
15.74
85.24
34.56
SD 2.1
77.37
99.78
81.04
44.54
98.24
96.22
95.10
77.62
17.70
86.08
Stable Signature
SD 2.0
80.80
99.98
41.44
98.72
99.88
96.34
97.66
99.90
67.76
25.54
SD 1.4
81.87
99.92
88.14
38.96
99.54
99.52
95.12
91.34
35.70
88.68
SD
85.88
100.00
98.14
99.88
0.12
99.92
99.98
99.86
79.00
95.98
RingID
100.00
99.90
100.00
99.98
74.44
SD
85.48
100.00
99.58
99.85
0.02
99.66
100.00
99.75
77.59
92.87
SD 2.1
23.59
12.12
12.64
11.38
18.26
100.00
3.06
16.78
12.44
37.70
GaussMarker
SD 2.0
31.45
63.42
32.08
2.10
1.16
99.98
2.08
66.76
1,01
14.56
SD
26.54
44.38
3.24
17.36
4.62
99.98
8.48
38.78
0.90
21.16
SD 2.1
96.34
99.96
89.38
99.56
95.22
97.12
99.78
99.76
89.96
96.28
SERUM (Ours)
SD
97.19
100.00
90.16
99.70
94.32
98. 18
99.76
99.46
96.26
96.88
SD 1.4
96.36
100.00
90.12
99.10
92.84
98.68
99.90
99.48
90.92
96.18
To distinguish performance differences masked at the standard 1% FPR, evaluate robustness the stricter 0% FPR threshold in Table This analysis reveals substantial fragility in baseline methods: GaussMarker's performance collapses (Average TPR drops to 23.59% TPR SD 2.1). while RingID exhibits a critical vulnerability to Crop & Scale (0.12% TPR), enabling attackers to easily bypass the watermark. In contrast, SERUM demonstrates superior stability, maintaining average TPR over 96% across all models and avoiding the catastrophic failures observed in prior approaches.
G.6 IMPACT OF AUGMENTATION SAMPLER BATCH SIZE.
We analyze the effect of the augmentation sampler batch size m, which determines the number of dynamic perturbations generated per training step. As detailed in Table [3] increasing yields consistent improvements in robustness, particularly for challenging geometric transformations. For instance, increasing m from 0 (precomputed only) to 4 boosts robustness against Rotation from 79.72% to 99.34%. However, this improvement comes with a computational overhead. We observe diminishing returns beyond 4; while scaling to 32 marginally inereases average TPR
20

---

Published as a conference paper at ICLR 2026
Table 13: Ablation of the augmentation sampler batch size (m). We report TPR @ 1% FPR for the SD 2.1 model, evaluated on 10,000 samples. The precompute row denotes the baseline where only clean and precomputed augmentations are applied (equivalent to m 0). Increasing m consistently improves robustness at the cost of training time.
Perturbation Robustness (TPR @ 1% FPR)
Batch Size
Time
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
precompute
2.63
97.16
100.00
79.72
99.90
97.18
99.56
99.96
99.86
99.18
99.06
M
5.66
99.52
100.00
99.22
99.84
99.00
99.60
99.96
99.92
99.08
99.04
m
9.48 h
99.75
100.00
99.34
99.98
99.54
99.86
100.00
100.00
99.30
99.72
15.69 h
99.80
100.00
99.74
99.90
99.62
99.80
100.00
99.94
99.50
99.74
h
99.83
100.00
99.76
99.88
99.70
99.92
99.96
99.98
99.60
99.70
m 59.35
99.82
100.00
99.42
99.96
99.68
99.96
100.00
99.96
99.80
to 99.82%, it inflates training time by over 6 times (from 9.5h to 60h). Consequently, we adopt m as the optimal operating point, providing a favorable balance between training efficiency and state-of-the-ar robustness.
G.7 ANALYSIS OF AUGMENTATION SAMPLER TEMPERATURE
We analyze the impact of the augmentation sampler's temperature T on detection robustness, with quantitative results detailed in Table 6 This parameter governs the sharpness of the sampling distribution, controlling the critical balance between efficient hard nard-negative mining and optimization stability.
At low temperatures (r - 0), the sampler becomes overly greedy, almost exclusively selecting the perturbation with the highest loss. This introduces optimization instability, the model sequentially overfits to the current worst-case distortion instead of learning generalized representation. Conse- quently, this lack of batch diversity leads high-variane, updates and causes the model forget previously mastered transformations.
Conversely, as - 20, the strategy approaches uniform sampling, which proves inefficient. The model expends significant training capacity on easy augmentations that are already mastered and provide negligible learning signal. This prevents the model from focusing sufficiently on the difficult perturbations required to refine the decision boundary.
Empirically, we find that 1.0 strikes the optimal balance. This setting biases the detector toward high-loss samples to maximize gradient utility, while retaining enough batch diversity to prevent overfitting to specific noise patterns.
H ADDITIONAL INFORMATION ABOUT GAUSSMARKER
H.1 EVALUATION DETAILS
To ensure a fair evaluation of GaussMarker, we modified its training procedure to incorporate our adjusted version of the C&S augmentation. In the original procedure, crops were always assumed to be centered the middle of the image. This a highly optimistic assumption, as an attacker may choose to place crop elsewhere. To account for this, we evaluate all methods using version of this transformation where crops occur at random locations.
For other perturbations that differ from those in the original Gauker paper, higher Gaussian Noise and Gaussian Blur instead of the Median Filter; we do not include them in training. These augmentations change the latent's 's variance, invalidating GaussMarker'ss approximation used for GNR training. For the same reason, the original authors also did not train the GNR on both the Gaussian Noise and the Median Filter.
21

---

Published as a conference paper at ICLR 2026
KIPM-
405
1.4
Staps
Sap
(a) Stable Diffusion 1,4 FFT. (b) SANA-0.6B. Loss decrcases
(c) Stable Diffusion 1.4 LoRA. Checkpoint with minimum evalua- tion loss (19,500 steps) is used for reporting TPR.
Checkpoint with minimum evalua- steadily across epochs; final check- tion loss (3,000 steps) used for point used for reporting TPR. reporting TPR.
Figure 4: Evaluation of radioactivity.
H.2 IMPACT OF SAMPLE SIZE ON EVALUATION
The authors of GaussMarker report their Fréchet Inception Distance (FID) using only 5,000 samples, whereas at least 10,000 samples are typically recommended for statistically reliable estimate. A more concerning issue arises their evaluation of TPR at 1% FPR, as this metric was computed on merely 1,000 samples. In this setting, the threshold at 1% FPR is determined by only 10 negative examples, which we argue is far too few to yield a reliable estimate. In contrast, we performed this evaluation on 5,000 samples and found that the resulting performance is slightly worse than what the original authors report. This suggests that their results may be overly optimistic due to the insufficient sample size, which may also explain the discrepancies between their reported results and ours.
I RADIOACTIVITY
I.1 EVALUATION SETUP
For both models we perform full fine-tuning (without the text-encoder) and for SD 1.4 we also adapt with LoRA on 5,000 training samples, generated by watermarked Stable Diffusion 2.1 with a = For every training checkpoint, we report TPR @ 1% FPR and evaluation loss. Specifically, TPR evaluated on 5,000 images, while evaluation loss is computed as the MSE of the denoising prediction random diffusion timesteps on 1,000 images.
We believe that evaluating loss on unseen images is essential to claim radioactivity. In particular, model that has memorized a watermarked image would yield artificially perfect radioactivity results. For this reason, we expect that most engineers would stop training before the model enters this stage. We therefore report the TPR at the checkpoint with the lowest evaluation loss, which we consider more realistic estimate.
For TPR @ 1% FPR we utilize a threshold calculated over clean images. We choose this particular metric to have direct comparison to images generated with real watermarked model.
For full fine-tuning Stable Diffusion, we chose to use learning rate equal to 5e-6. For LoRA we utilized rank 4 and learning rate equal to le-5, To train SANA set the learning rate to 1.8e-5. All training runs use a batch size of 8.
1.2 RESULTS FOR STABLE DIFFUSION 1.4 FFT
We present the results of this experiment in Figure 4a We observe that SD 1.4 achieves 77.12% TPR for the checkpoint with minimum evaluation loss. This result demonstrates that SERUM is highly radioactive for this model.
Continued training results in higher loss. suggesting that the model may be beginning memorize its training samples. Therefore, we believe that TPR values at later checkpoints may not accurately reflect the true radioactivity of the watermark.
22

---

Published as a conference paper at ICLR 2026
Conv2d 4, out: kemet: stride: 1, padding: 1
Conv2d out 64, kernet: stride:
Conv2d out 128, kernet 3, stride: padding:
Conv2d in: 128, 256, kernel: stride: padding:
Linear 4096,
out: 512
padding: 1
ReL U
BetchNorm2d
BatchNorm2d
BatchNorm2d
BatchNorm2d
in: out
ReLU
MaxPool2d kernet:
MaxPool2d kemet:
MaxPool2d kernei:
2
MaxPool2d kemet: 2
Sigmold
Figure 5: Watermark detector architecture.
1.3 RESULTS FOR SANA-0.6B
For these results, we refer to Figure 4b In contrast to Stable Diffusion, we do not observe SANA overfitting throughout training. Accordingly, we select the final available checkpoint, which achieves a high TPR of 96.76%. This suggests that SERUM is not only radioactive for SD models, but rather for variety of diffusion models.
1.4 RESULTS FOR STABLE DIFFUSION 1.4 LoRA
The results for this setting are presented Figure 4c At checkpoint with the lowest evaluation loss, it attains a TPR of 52.30%. This shows that SERUM remains distinctly radioactive even when the model is trained using parameter-efficiee fine-tuning methods such as LoRA.
J WATERMARK DETECTOR ARCHITECTURE
The watermark detector is a lightweight Convolutional Neural Network with 2,487,841 parameters. The exact architecture is depicted in Figure
K LLM USAGE DECLARATION
Large language models were used exclusively to enhance readability, specifically for style, grammar, and spelling, without altering the original meaning of the manuscript.
L ETHICS STATEMENT
Our work does not raise any direct ethical concerns. On the contrary, SERUM is designed as a defensive tool promote transparency and accountability by enabling reliable identification of images generated by diffusion models. Such capabilities can help mitigate risks associated with the misuse of generative models, including phishing and the spread of misinformation. The method is computationally lightweight, resulting in negligible carbon footprint.
23

---

Published as a conference paper at ICLR 2026
Clean
VAE
Rinse-4x8
Regen-12
Rinse-2x25
Regen-30
Y.
CtriRegen
12V
Figure 6: Visualization of advanced attacks. Qualitative examples of advanced watermark removal attacks.
24

---

Published as a conference paper at ICLR 2026
Ceaa
Random Rotation
JEG Compression
Resized Crop
Patch Drop
Salt Pepper
Gaussian Noise
Brightness
Gaussian Blur
Figure 7: Visualization of augmentations. We show qualitative examples of augmentations used to perturb the watermarked and non-watermarked images.
25

---

Published as a conference paper at ICLR 2026
Clean
Ours
Clean
Ours
Clean
Ours
Figure 8: More qualitative results, Clean vs Images watermarked with our SERUM.
26


Reviews:
[{"review_id": "68grvgJcMI", "reviewer": "Reviewer_9VoN", "summary": "- This paper proposes a new watermarking framework for DMs that is simpler, more efficient and more robust than existing DM methods.\n- Watermarking: A fixed user specific pattern of Gaussian noise is combined (additively) with the initial random noise vector before the diffusion generation process begins. The authors also provide a theoretical guarantee of low KL divergence between the distributions of watermarked and non-watermarked noises due to watermark injection to explain the high output image fidelity using this method\n- Detection: A lightweight external detector, which is a CNN is trained to identify the signature of this watermark directly in the VAE latent space of the generated image. Therefore this avoids the need for expensive diffusion inversion for detection which is used in prior tuning free works\n- Results: \n   1. The method achieves SOTA robustness against a wide variety of image perturbations and advanced generative watermark removal attacks\n  2. The method is efficient - it has fast injection and detection times and low training overhead with a low impact on the perceptual quality of the generated images\n  3. The method is practical - the authors demonstrates the practical utility through its support for multi user scenarios\n  4. The method is shown to have a high degree of 'radioactivity' - the watermark remains detectable even in models that have been finetuned on watermarked data", "questions": "- Can the authors comment on the theoretical/empirical limits of one detector per user approach? Have they analyzed the cross detection score distributions to assess the probability of false user identification as the number of users grows into the thousands or millions? \n- Can the authors explain on whether the SERUM watermark would be expected to survive parameter-efficient finetuning methods like LoRA where the majority of the base model's weights remain frozen?\n- The paper mentions using an augmentation sampler inspired by Prioritized Experience Replay to focus training on more difficult transformations (Appendix A). Can the authors provide an ablation study/further analysis on the impact of this adaptive sampling strategy? How much does it contribute to the final robustness metrics compared to a simpler uniform sampling of augmentations during detector training?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The main idea proposed in the paper is simple but effective. By decoupling the watermark embedding in the initial noise from the detection mechanism which is a separate and lightweight classifier, the method avoids the bottlenecks of prior works - DDIM inversion which is slow, and expensive finetuning\n- The authors have presented sufficient proof to validate better robustness of this method in Table 1 against 3 other DM based methods on all standard perturbations. In addition to the method achieving a high average TPR and low FPR across the 8 perturbations, it also shows consistently high performance across perturbations in comparison to the other methods that have failures on certain transformations ex: RingID on Crop+Scale which falls to 5-6% TPR and Stable Signature on Gaussian Noise which falls to 48-52% TPR\n- The method shows superior performance against advanced removal attacks in Table 2 maintaining high TPRs against all baselines and its performance does not collapses under more aggressive attacks like Regen-30 unlike the other methods\n- The explanation of generalization in Appendix E and the empirical demonstration that the DDIM inversion process used by the other models actually amplifies the distortions caused by perturbations, making the watermark signal harder to recover is compelling. The method's inversion free, latent space detection is therefore more robust by design\n- The method is practical for real world deployment. Table 8 shows that SERUM's detection is orders of magnitude faster than inversion based methods ex: 2.5 min vs 117-140 min to check 5000 images. Watermark injection is 17 ms, and the total detector training time ~9 hrs, including data generation is a fraction of that required for model fine tuning in Stable Signature which is ~57 hours.\n- SERUM has a negligible impact on image quality, as confirmed by FID and CLIP scores in Table 4 that are very close to clean generation, and by qualitative examples in Figures 2 and 8", "weaknesses": "- Multi user support involves training a unique detector for each user's unique noise pattern. Figure 3 demonstrates that this approach works well for up to 10 users, but this does not guarantee its viability at a large scale. A system with millions of users would require managing millions of individual detector models. As the number of unique noise patterns grows, the probability of 'collisions' where a pattern coincidentally produces a signature detectable by another user's detector may increase. The paper does not provide an analysis of cross detection scores to quantify this risk.\n- The evaluation of radioactivity results is confined to a full model fine-tuning scenario. It does not investigate the watermark's persistence under more modern and widely used PEFT methods, such as LoRA.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MFQJCJwGcT", "reviewer": "Reviewer_fqMS", "summary": "This paper tackles the problem of marking images generated by diffusion models to distinguish them from real images and ensure content traceability. SERUM embeds a unique Gaussian watermark in the initial noise of the diffusion process and trains an external detector to identify watermarked images. Evaluated on multiple Stable Diffusion versions and against existing methods, SERUM shows strong robustness to image perturbations and removal attacks, preserves watermark detectability after model fine-tuning, and has minimal impact on image quality.", "questions": "• Given that watermarking enables not just content detection but also tracking of model and user identities, what is the primary motivation for framing this work as a detection task rather than as a comprehensive provenance or attribution framework?\n\n• Based on the simplicity illustrated in Figure 1, can the authors elaborate on the specific technical challenges addressed by their approach? In what ways does the method go beyond the obvious, and what unique difficulties does it solve?\n\n• Have the authors compared SERUM to non-watermarking detection baselines? How does the method perform when only a simple classifier or traditional watermark is employed instead?\n\n• Does the paper’s contribution fundamentally change our understanding of the detection/provenance problem for AI-generated images, or is it an incremental improvement in watermarking as a technology?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "**Originality:**\n\nThis work introduces a new approach to diffusion model watermarking by injecting a unique Gaussian watermark into the initial noise and employing a lightweight external detector. The technique is distinct in its simplicity, enabling scalable multi-user attribution without modifying the underlying generative model.\n\n**Quality:**\n\nThe methodology is supported by comprehensive experiments on multiple Stable Diffusion models, benchmarking detection robustness against diverse perturbations and removal attacks. The empirical results are thorough and reproducible, substantiating the efficacy and efficiency of the proposed method.\n\n**Clarity:**\n\nThe paper is well organized, with clear exposition of problem motivation, methodological details, and experimental results. Figures and comparative analyses further enhance the transparency and accessibility of the work.\n\n**Significance:**\n\nSERUM addresses a challenge in generative AI: reliable attribution and provenance of synthetic images. Its robust, efficient, and scalable design substantially advances the practical enforcement of content identification and AI governance in contemporary applications.", "weaknesses": "1. Although the detector is described as lightweight, performance scaling to much larger numbers of unique watermarks (multi-user setting) may face practical bottlenecks. The paper assesses up to 10 users. In a real-world application, it will be hundreds and even thousands of users. I suggest that the author should invest further in a large-scale application if possible. \n2. The work primarily compares SERUM to recent DM watermarking approaches like Stable Signature, RingID, and GaussMarker, but post-processing and hybrid watermarking methods (e.g., non-diffusion-based or steganographic approaches) may offer complementary strengths. Including such baselines—even if weaker in some respects—could clarify SERUM’s advantages and limitations in broader practical contexts.\n3. Although architectural details and loss functions are provided, some choices (e.g., watermark noise hyperparameters, batch size, augmentation prioritization) could benefit from clearer justification or ablation. \n4. several section titles in the paper are overly long and verbose, detracting from professional presentation. For instance, Section 3 titled \"Our Screen Watermark Method for Diffusion Model\" could be concisely phrased as \"Screen Watermark Method.\" Similarly, Sections 4.2 and 4.3 use full sentences as titles, which appear unprofessional and lack clarity. More concise alternatives such as \"Robustness to Image Perturbations\" (for 4.2) and \"Robustness to Watermark Removal Attacks\" (for 4.3) would improve readability and presentation. Revising section titles throughout the manuscript to be clear and succinct is recommended to strengthen the overall professional quality and accessibility.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tIjQ3Favzj", "reviewer": "Reviewer_Emwh", "summary": "The authors propose SERUM, a watermarking method for diffusion models that injects the watermark into the model’s initial noise and trains a lightweight detector to extract it.", "questions": "1. Why design an AugSampler and also precompute the perturbation? Is it because of augmentations like JPEG compression? I did not see which augmentations were precomputed in the paper and I think it needs to be explained.\n2. Can you use a stronger Crop and Scale attack setting like retain 50% or 25%? How does it compare to Stable Sig under such conditions?\n3. You design $A \\sim \\mathcal{N}(0, I)$ so that the watermark does not change the Gaussian nature of the initial noise. However, Table 5 still shows a drop in FID. Could you explain whether the FID drop is due to reduced diversity in the generated results after adding the watermark?\n4. In real-world scenarios, a platform can easily have thousands or even tens of thousands of users. Can SERUM handle 10,000 user setting?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "Method-wise, the pipeline is simple in design and the description is clear and easy to understand. Experiment-wise, the authors conduct experiments on SD1.4, SD2.0, and SD2.1, with a fairly comprehensive amount of evaluation.", "weaknesses": "1. Robustness to Crop and Scale remains an issue. The choice to retain 75% in evaluation is relatively weak. I think it quite common to retain 50% of image in life. What will the performance be like if under stronger Crop and Scale attack?\n2. The metric TPR at 1% FPR is weak. Scores are all close to 100%, which makes it hard to distinguish performance differences between methods. Although prior work used this evaluation metric, I still recommend controlling FPR at a much smaller range, for example 10e-6.\n3. In the multi-user setting, SERUM needs to train one detector per user. Considering that training a detector requires 40,000 images (the authors mention 40,000 prompts, and I assume each prompt is used at least once), this will introduce significant overhead and makes the multi-user scenario impractical. In Section 4.5 the authors test only 10 users, which indirectly demonstrates this point. I think its an important weakness needs to be addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pGi9Zi9xZz", "reviewer": "Reviewer_cDi8", "summary": "The paper introduces SERUM, a watermarking method for diffusion-based image generation models that adds a normalized Gaussian watermark noise to the initial diffusion noise and trains a lightweight external detector to identify watermarked images directly, avoiding costly diffusion inversion. Key contributions include high robustness to perturbations and removal attacks, with minimal impact on image quality, and support for multi-user scenarios through individualized noise patterns and detectors. Evaluated on Stable Diffusion variants, SERUM outperforms baselines like Stable Signature, RingID, and GaussMarker in TPR@1%FPR across various perturbation experiments.", "questions": "To better indicate the sources of robustness, could the authors provide an ablation study on the impact of the Prioritized Experience Replay (PER) sampler? This would help distinguish architectural gains from training strategy gains.\n\nCan the authors comment on the method's portability and generality to newer architectural paradigms? The field of diffusion models is rapidly shifting from UNet-based backbones to Diffusion Transformer (DiT) architectures. Given that the proposed method injects noise at the initial stage and detects it in the latent space, how readily can SERUM be adapted to these new DiT-based frameworks, and what challenges are anticipated?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Good Paper Writing: with well-structured sections, a detailed method description. Also, the authors provide a good theoretical argument in the Appendix.\n\n2. Good Method Robustness: The method's primary strength is its exceptional performance. SERUM consistently outperforms strong baselines across all tested models (i.e., SD 1.4, 2.0, 2.1). It shows remarkable resilience to advanced watermark removal attacks (as shown in Table 2).\n\n3. High Efficiency in Watermark Processing: By eliminating the need for DDIM inversion, and using a simple forward pass through the encoder and a small CNN, SERUM's detection is significantly faster than some classic methods. Besides, the simple noise addition strategy also brings a near-zero-cost injection process, which provides insights for future research and becomes a potential option for real-world applications.", "weaknesses": "1.  Limited Ablation Studies: The method's strong robustness stems from both its architectural design (i.e., using initial noise injection, latent space detection) and its sophisticated training strategy, which includes dynamic augmentations sampled via Prioritized Experience Replay and a multi-component loss function. However, the paper provides limited ablation studies to disentangle these effects. It is unclear how much of the performance gain is attributable to the core architectural ``trade-off\" versus the advanced training techniques. Adding ablations that isolate the impact of the PER sampler and the specific loss terms (e.g., the temperature) would provide a clearer picture of the true sources of the method's advantage.\n\n2.  Unclear Efficiency in Multi-User Training Scenarios: The paper claims support for multi-user scenarios by training a separate detector $D_i$ for each user $i$. While the performance and accuracy for this setup are reported (refer to Figure 3), the time consumption is conspicuously absent. From my understanding, the proposed detection method scales linearly, $O(k)$, with the number of users $k$ being checked, as each detector must be run. This computational cost is not reflected in the main runtime analysis and may not meet expectations for a \"highly scalable\" or \"efficient\" system in practice, especially one with a large user base (p.s., if it takes 9.48 hrs for each user training, it can be even more expensive than the existing methods).\n\n3.  Limited Scope of Experimental Validation: The paper's convincingness is constrained by two factors: (a) Limited Baselines (Optional, since the authors mentioned that the selected methods are the existing SOTAs, but 3 baselines are still limited): The experimental comparison is restricted to only three baseline methods. While these are relevant, a more comprehensive comparison against a wider array of recent watermarking techniques would be necessary to substantiate the claim of state-of-the-art performance fully. (b) Insufficient Focus on Advanced Attacks: The paper dedicates significant evaluation to robustness against standard image perturbations (Table 1). However, robustness to such traditional edits (e.g., compression, noise, blur) is largely a solved problem for modern, DL-based watermarks. The true challenge lies in resilience to advanced, generative-AI-based attacks. The paper's evaluation on this front is a good start, but it is not comprehensive. To truly prove its robustness, the method should be tested against more diverse and practical generative editing attacks, such as regional editing, diffusion-based inpainting, object composition, and even more challenging topics of image-to-video transformations (optional, I understand it is highly difficult), and then demonstrate successful watermark retrieval.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)