FARI: Robust One-Step Inversion for Watermarking in Diffusion Models
Authors: Jindong Yang
Han Fang
Weiming Zhang
Nenghai Yu
Kejiang Chen
Venue: ICLR 2026 Poster (2026)
Keywords: digital watermark
diffusion models
inversion
Primary area: applications to computer vision, audio, language, and other modalities

Abstract: Inversion-based watermarking is a promising approach to authenticate diffusion-generated images, yet practical use is bottlenecked by inversion that is both slow and error-prone. While the primary challenge in the watermarking setting is robustness against external distortions, existing approaches over-optimize internal truncation error, and because that error scales with the sampler step size, they are inherently confined to high-NFE (number of function evaluations) regimes that cannot meet the dual demands of speed and robustness. In this work, we have two key observations: (i) the inversion trajectory has markedly lower curvature than the forward generation path does, making it highly compressible and amenable to low-NFE approximation; and (ii) in inversion for watermark verification, the trade-off between speed and truncation error is less critical, since external distortions dominate the error. A faster inverter provides a dual benefit: it is not only more efficient, but it also enables end-to-end adversarial training to directly target robustness, a task that is computationally prohibitive for the original, lengthy inversion trajectories. Building on this, we propose **FARI** (**F**ast **A**symmetric **R**obust **I**nversion), a one-step inversion framework paired with lightweight adversarial LoRA fine-tuning of the denoiser for watermark extraction. While consolidation slightly increases internal error, FARI delivers large gains in both speed and robustness: with ~20 minutes of fine-tuning on a single NVIDIA RTX A6000 GPU, it surpasses 50-step DDIM inversion on watermark-verification robustness while dramatically reducing inference time.

Published as a conference paper at ICLR 2026
FARI: ROBUST ONE-STEP INVERSION FOR WATER- MARKING IN DIFFUSION MODELS
Jindong Yang Han Fang Weiming Zhang Nenghai Yu! Kejiang Chen 1.2+
University of Science and Technology of China
2 Anhui Province Key Laboratory of Digital Security
National University of Singapore
dx dx929@mail. .usuuut edu. cn, fanghanênus .ww.ieuuuueeuu..... sg {ynh, zhangwm, chenk jeankj@@uste edu.cn
ABSTRACT
Inversion-based watermarking is a promising approach authenticate diffusion- generated images, yet practical use is bottlenecked by inversion that is both slow and error-prone. While the primary challenge in the watermarking setting is ro- bustness against external distortions, existing approaches over-optimize internal truncation error, and because that error seales with the sampler step size, they are inherently confined to high-NFE (number of function evaluations) regimes that cannot meet the dual demands of speed and robustness. In this work, we have two key observations: (i) the inversion trajectory has markedly lower curvature than the forward generation path does, making it highly compressible and amenable low-NFE approximation; and (ii) in inversion for watermark verification, the trade-off between speed and truncation error is less critical, since external distor- tions dominate the error. A faster inverter provides dual benefit: it is not only more efficient, but it also enables end-to-end adversarial training to directly target robustness, a task that computationally prohibitive for the original, lengthy in- version trajectories. Building on this, we propose FARI (Fast Asymmetric Robust Inversion), one-step inversion framework paired with lightweight adversarial LoRA fine-tuning of the denoiser for watermark extraction. While consolidation slightly increases internal error, FARI delivers large gains in both speed and ro- bustness: with 20 minutes of fine-tuning it surpasses 50-step DDIM inversion on eidermark-verificatte robustness while dramatically reducing inference time.
single NVIDIA RTX A6000 GPU,
INTRODUCTION
The rapid proliferation diffusion models (Ho et al. 2020; Song et al. (2021) has led to an explosion
of Al-generated content, simplifying creative production but also fueling the spread of synthetic
misinformation and raising concerns about intellectual property protection for model providers. In
response, inversion-based watermarking (Yang et al.) 2024 Wen al.) 2023 Huang et al. 2024
Gunn et al.) 2024) has shown remarkable promise for authenticating and tracing diffusion-gennrraee images. By embedding watermark in the initial noise, the mark becomes deeply integrated with the image's semantics during the iterative generation process, ensuring minimal visual impact. To reconstructed back to noise via inversion techniques (Song et al., 2222]] Hong et al.) (2024.. This inversion step, however, is the method's computationally expensive, time-consuming, and introduces substantial
extract the watermark, the image typically needs
critical bottleneck. emors, all of which hinder the practical, large-scale deployment of inversion-based watermarks. This bottleneck motivates the development of fast and accurate inversion method tailored for watermark extraction.
Although many inversion techniques (Mokady et al. 2023 Hong et al. 2024 Wallace et al. 2023) exist, most primarily aim to reduce internal inversion (caused by discretization truncation and Classifier-Free Guidance) via iteration (Pan et al. 2023 Garibi et al. 2024] (Samuel et al.
"Corresponding authors.

---

Published as a conference paper at ICLR 2026
2023), optimization (Hong et al. 2024 Li et al. 2024 Mokady al. 2023), analytical control of truncation-erve error bounds (Wallace et al. 2023: Zhang et al. 2024a| Wang et al. 2024). While effec- tive for diffusion-basets image editing (Hertz et al. (2022), this strategy is ill-suited for watermarking. Prior to extraction, images may be subjected to diverse distortions (e.g.. JPEG compression, blur) that induce substantial initial-condition shifts; given the denoiser's sensitivity, these perturbations compound rapidly along the inversion trajectory and become the dominant bottleneck to extraction accuracy.
This shift in the error bottleneck for watermark extraction leads us to question the necessity of traditional high-NFE inversion. In prior methods, which primarily address clean-image scenarios, performance is limited by the discretization truncation error of the ODE sampler, which is directly related to the step size. Consequently, a high NFE is required to maintain precision. In the wa- termarking context, however, this internal error is dwarfed by the accumulated error from external distortions, a factor that is not explicitly mitigated by larger number of steps. Furthermore, the natural solution to instill this robustness, adversarial training, is blocked by the high NFE of these traditional inverters. A powerful end-to-end training regime is rendered computationally infeasible by the prohibitive memory costs of backpropagating through long iterative process. Meanwhile, the more computationally feasible, factorized objective, similar to that used in diffusion pretraining (Ho al., ). proves insufficient for learning the global robustness required to counter complex distortions (see Appendix [E.3). These facts indicate that first finding a low-NFE solution is not only beneficial for speed, but also enables breakthrough in enhancing robustness.
Fast Asymmetric Robust Inversion, a framework that achieves fast and robust inversion tailor-made for watermarking minimal fine-tuning cost. FARI is based on a key insight into the geometric asymmetry between generation and inversion trajectories: while the estimation error in inversion makes the reconstructed noise inaccurate, it also indirectly en- dows the inversion path with significantly lower curvature than its generation counterpart. A lower-curvature trajectory is inherently easier to approximate with fewer steps. This enables step- distillation approach that collapses multi-step inversion into a single efficient step. This reduction in NFE unlocks efficient end-to-end adversarial training. While this distillation-basee estimation slightly sacrifices precision clean, distortion-free inversion, the direct speed-up and the indirect enhancement in robustness are substantial, and we find that the downside of this trade-off has a negligible effect the performance of the downstream watermarking task (Yang al. 2024 Wen et al. 2023). Furthermore, our use LoRA (Hu et al.) (022) for fine-tuning elegantly avoids the degradation of image quality. By storing the learned robustness knowledge externally in the LoRA parameters, we can simply deactivate the LoRA branch during generation, ensuring that the orig- inal model's generation quality remains unchanged. Our experiments demonstrate that with just 20 minutes of fine-tuning on a single NVIDIA RTX A6000 GPU, the one-step FARI surpasses the robustness of the 50-step DDIM baseline in watermark verification tasks.
Motivated by this, we propose FARI:
BACKGROUND
2.1 DIFFUSION MODELS
Diffusion models (Ho et al. 2020 Song et al. 2021) are a class of generative models that operate by iteratively transforming pure Gaussian noise vector zT (O, into a real data sample 2o ~ g(z) through 7 denoising steps. The process is defined by two Markov chains. The forward process gradually diffuses a data sample zu by adding Gaussian noise over T timesteps according to fixed variance schedule {3)
(<1(<==1) = N(zz 11-,,,11,8,1))
(1)
A key property of this process is that we can sample z, at any arbitrary timestep t directly from Zg:
vo + v1 a.c.
(2)
where a; = 1 Br, a. = H as and E ~ NO, I). The reverse process learns to denoise these corrupted samples to recover the original data. This is achieved by training a neural network to predict the added noise e from the noisy input 2t. The objective function is typically a simplified version of the evidence lower bound:
(()) F2 Uniforrmm11 e~~0.)) [[|e (12
(3)
2

---

Published as a conference paper at ICLR 2026
2.2 DDIM SAMPLING AND INVERSION
The denoising diffusion implicit model (Song et al. 2021) (DDIM) provides deterministic sam- pling process by defining a non- oon-Markovian forward process that leads to the same marginal distri- butions. Given noisy latent 2;. DDIM computes the subsequent latent 2₁-1 by first predicting an estimate of the clean image, &o, and then stepping towards it:
2t vI 04E0 (2+,
20
(4)
Vāt
21-1 vāu-1 /1 011-0(-10(Zz.t)
(5)
The deterministic nature of DDIM is crucial allows for an invertible generation process, which iteratively computes z, from 1 by reversing the sampling steps. This unique invertible charac- teristic allows us to recover the initial noise representation 27 from any generated image 20, which serves powerful tool for inversion-based watermarking.
2.3 INVERSION- -BASED WATERMARKING FOR DIFFUSION MODELS
We categorize these methods into three classes. The first class, epitomized by Tree-Ring (Wen al., 2023). embeds a robust pattern into the Fourier domain the initial noise to enable detection. Sub- sequent works have focused on enhancing its practical applications or extending its capabilities. For instance, RinglD Ci et al. 2024) extends it to a multi-bit watermark, ROBIN (Huang et al. 2024) improves its imperceptibility. and ZoDiac (Zhang et al. 2024b) generalizes watermark, all without altering the core embedding and extraction logic. The second class, rep- resented by Gaussian Shading (Yang et al., 2024), embeds a multi-bit watermark into the spatial domain of the noise through distribution distribution-presevving sampling. Follow-up research has concentrated on improving key reuse problem, as seen
post-processing
(Gunn al. (2024) and Gaussian Shading++ (Yang al. 2025), and on functional extensions; for example, TAG-WM (Chen et al.) 2025) and VideoShield (Hu et al. 2025) provide functionality for detecting tampered regions. The third class, such as GaussMarker (Li al. (025), combines the first two approaches to compensate for their weakness against geometric distortions.
2.4 INVERSION METHODS
There is a substantial body of work on diffusion model inversion. Methods such as BELM (Wang al. 2024), BDIA (Zhang et al. 2024a), and EDICT (Wallace et al., 2023) directly modify the sampling process to make it invertible. Others, including AIDI (Pan et al. 2023). ExactDPM (Hong al. 2024), and ReNoise (Garibi et al. 2024), employ iteration or gradient descent to obtain better intermediate values for trajectory alignment. A third category, which includes NTI (Mokady et al.) 2023) and NPI (Miyake et al.) 2025), focuses on optimizing better null-text embedding to guide the regeneration process. As we have previously mentioned, these methods are primarily designed for training-free image editing. Consequently, they may fail in adversarial watermark extraction scenarios, point will demonstrate in our experiments section.
2.5 DIFFUSION MODEL ACCELERATION
The acceleration of diffusion models can be broadly categorized into two paths. The first path in- volves using solvers with lower truncation error (Lu et al. 2022a by Zhang & Chen 2022). While these methods can reduce the number of inference steps between 20 and 30, the quality of image generation in extreme few-step scenarios (c.g.. < 10) remains unsatisfactory. A noteworthy method in this category the AMED-Solver (Zhou et al., 2024a), which is based on the mean value theo- rem. It uses small model to predict the timestep where the mean value occurs, thereby estimating the average velocity and enabling generation in as few as two steps. The second path is distilla- tion, where a student model is trained to replicate the output of multiple teacher steps in a single step. Techniques such as progressive distillation (Salimans & Ho. 2022), consistency distillation (Song et al. 2023), and distribution matching distillation (Yin et al. 2024b a) follow this paradigm. However, these methods typically demand a substantial amount of pre- rere-genertted training data, GPU memory, and time.
3

---

Published as a conference paper at ICLR 2026
3 OUR PROPOSED METHOD
In this section, we propose FARI, a robust one-step inversion method designed for watermark ex- traction. It is based on our key finding that the inversion trajectory exhibits significantly lower curvature than the generation path does, enabling efficient one-step distillation, which in turn makes the adversarial fine-tuning computationally feasible.
3.1 THE INVERSION TRAJECTORY EXHIBITS LOWER CURVATURE
We begin with the inherent systematic enror in DDIM inversion (Song et al. 2021). For deterministic
DDIM sampling, the denoising process, which computes 2 from 2t, can be written in a single recurrence relation(the conditioning terms omitted for simplicity):
ō ōt-1 ail
+
VI VI- ar-
E0(Zi,t).
(6)
The inversion step, which solves for 2, based on 2t-1, derived as:
/ āt 0r-1
VI- - āi( ãc-1) 21-1
Ea( ()
04-1
However, since our goal is to solve for zt, the term (z. (1.t)) t) on the right-hand side of Eq. cannot be explicitly calculated. Generally, this is addressed by making piecewise linear assumption, approx- imating co Et, t) = co c0(2)-1,t). The validity of this assumption, however, requires a sufficiently small step size, condition that practical settings often fail meet. This becomes a significant source of inversion error, even for clean images. While many works (Lin et al. 2024 Wang et al.) 2024 Staniszewskii al. 2024) have recognized that changes in the trajectory direction EØ(-) cause an offset of the reconstructed noise žT and have attempted to mitigate this asymmetry, we further point out that under the combined effect of directional and positional offsets, curvature- higher- order property of the trajectory- also exhibits profound asymmetry. Specifically, the curvature of the inversion trajectory is substantially lower than that of the denoising trajectory.
Curvature over Sampling
Tolerance
generation
MSE Error (compared to NFE-50)
0.20
10
Inversion
Inversion
0.15
Curvaturee
0.10
0.00
Residual 2y
200
600
1000
de
Timestep
NPE (Number of Function Evallaations)
Figure I: Left: Visualization of the inversion error, where latent vectors are projected down to channels via PCA for display. Middle: Curvature of generation and inversion trajectories across diffusion timesteps. Discrete curvature estimated using 100 unconditionally generated images from Stable Diffusion v2.1. Right: The resulting error for generation and inversion when reducing the NFE, compared with 50-step NFE baseline.
In Figure D middle), we illustrate the curvature differences between the 1000-step denoising (gener- ation) and inversion trajectories. We observe that trajectories exhibit greater curvature near the noise end of the process (as > T)) This because the denoising network is trained on the forward diffu- sion process, where different images (Lee et al., (023). Consequently. in the early stages of denoising, the model must constantly correct its direction, leading high curvature (Lee at. 2023). This effect is particularly pronounced the
diffuse to the same noise point, causing trajectory crossing
4

---

Published as a conference paper at ICLR 2026
LoRA
x (N 1)
Z1'
20
X
0101...
Watermark Encoding
VAR
Nistep Generation
D
Distortion
Watermark Content
MSE Loss
(..T)
1-step Inversion
0101
Watermark
Decoding
VAE
2/
XD
2D
Watermark Pipeline
(Disabled during mannng)
Backpropagation
trainable
frozen
The framework of FARL FARI simultancously performs ste-step distillation and adver- sarial training through a unified, end-to-end, LoRA-based fine-tuning process, enhancing both the efficiency and robustness of the inversion. The LoRA adapters injected into the denoiser net- work and are deactivated during generation but activated for inversion. This strategy prevents any degradation of the original model's generation quality and eliminates the need deploy a second, complete denoiser, making it highly memory-efficient.
Figure 2:
very beginning when the latent variable is nearly pure noise. Once the fundamental semantics of the image have formed, the direction of progress becomes relatively fixed, and the trajectory's s curvature decreases significantly. However, this high-curvature phenomenon is substantially less pronounced during the inversion process.
We attribute this partly to the fact that the accumulated error during inversion retains low- www-freuenncy information from the source image. As shown in Figure Ieftt), partial outlines of the image remain visible in the noise reconstruction error, an observation consistent with prior work (Lin et al.) [024 Staniszewski et al. 2024] Nguyen et al., 2025). This residual semantic information helps to more accurately determine the correct direction of progress the inversion approaches the noise end.
In general, a trajectory with lower curvature can be more accurately approximated with fewer linear steps (i.e., lower NFE), as curvature strongly correlated with the truncation error of the numerical solver. In the simple case where the curvature is zero, single sampling step is sufficient. This key finding motivates to explore the change in precision and inversion. We decreased the NFE from 15 to 3, observing the deviation from the results of standard 50-step NFE. The results in Figure[rrghtt confirm that the inversion trajectory can indeed tolerate much lower NFE, which provides the foundational premise for our proposed method by offering significant increase processing speed and, crucially, by enabling efficient adversarial training.
the NFE is reduced for both generation
3.2 FARI
Guided by the geometric intuition that the inversion trajectory highly compressible, our method is simple and effective. In essence, our strategy is to first find a low-NFE approximation of the DDIM inversion (Song et al., 202T) trajectory and then perform adversarial training upon this condensed path to achieve both speed and robustness. We use distillation, common technique for accelerating diffusion models,
Hoj 2022 [Sogg et al. 2023 Yin et al.) 2024a) for the generation process often requires days or even dozens of GPU-days and substantial memory, the favorable geometric properties of the DDIM version trajectory allow to obtain reasonably accurate low-NFE estimate with minimal effort. Although this initial estimate has some error (see Figure 3). we find this trade-off acceptable in exchange for the immense gains in robustness and speed, and it has a negligible effect the performance of the downstream watermarking tasks.
achieve the first step. While standard trajectory distillation (Salimans
For simplicity and efficiency, we do not explicitly separate the distillation and adversarial fine-tuning into two distinct stages, as they share a consistent optimization objective and converge rapidly. crucial note departure from common distillation practices for the generation process. We
5

---

Published as a conference paper at ICLR 2026
do not start with real image and train one-step model mimic the output of 50-step DDIM inversion. Instead, we sample a ground-truth Gaussian noise vector, perform the full generation process obtain image, and then learn direct one-step mapping from this generated image back to the ground-truth initial noise. This approach avoids the performance ceiling imposed by the inherent inaccuracies of the 50-step DDIM inversion itself and is better aligned with the generative nature of the watermarking scenario.
Specifically, we fine-tune the denoising network of the diffusion model using Low-Rank Adaptation (LoRA) (Hu ane-ttuning technique
MSE over Timesteps
al. 2022), a parameter-effictte that updates pretrained weight matrices through low-rank decomposition. Given a weight matrix Wo E RRdx the update is represented as Wo + AW Wo + BA, where B E RRdxr A E R and the rank r < min(d, k). During training, Wo is frozen, and gradient updates are applied only to A and B. The modified forward pass for an input becomes:
0.4
DDIM Inversion(50 steps, Clean)
DDIM Inversion(50 steps,Jpep
FARI(Ours) (1 step, Clean)
0.3
(Ours)))) (1 step. (peg)
0.1
h = Wo + AW= Woz + BAz.
(8)
0.0
200
400
600
800
1000
Timestep
By decomposing the full-rank matrix into the product of two low-rank matrices, LoRA significantly reduces the number of trainable parameters, thereby lowering mem- ory usage.
Figure 3: Inversion trajectory error of FARI and DDIM on clean and JPEG- compressed images.
As illustrated in Figure 2 each training loop proceeds as follows. We randomly sample an initial noise vector æT ~ (O, J) and condition from dataset C' to generate an image X. During this generation phase, the LoRA branch deactivated. The resulting image is then subjected to distortion D(-) randomly selected from predefined set T. yielding distorted image X which is then encoded by the VAE encoder into a latent representation zp. Subsequently, the LoRA branch is activated to perform one-step inversion, which reconstructs the noise according to the following formula:
ār(1 - oo)
20 D +
V1 V1
60(20 0, (b);
On
6g
Since ag = 1, this formula can also be equivalently written in the form of Eq
Varzi + -i--areo 0, 0; bb),
(10)
where zb represents the LoRA parameters. For the inversion process, we use an unconditional setting
(guidance scale 1.0 and null prompt). Prior works (Mokady et al. 2023 Wallace et al., 2023)
have demonstrated that for standard DDIM inversion, an unconditional setting is often more precise because of the lack of invertibility in Classifier-Free Guidance (Ho & Salimans 2022) (CFG). It is also important to note that we set the timestep t = 0 in the formula, rather than f t= T as expected clearly
from Eq. 7 This is because in a single-step scenario, the piecewise linear assumption violated. Empirically, we find that any other small timestep value (t ~ 0) can achieve performance comparable O, providing much better match for the latent z reducing the initial error and improving convergence. Finally, our training objective is defined as:
min Bzy [||=T 2 1]]
(11)
Similarly, after training is complete, we deactivate the LoRA branch during denoising inference to preserve the original generation quality and enable it only for watermark extraction. This strategy is memory-efficiiet, eliminating the need to deploy two separate, largely identical denoisers. It is worth noting that the LoRA component can be regarded as plug-and-play enhancement module. Even when it is removed, DDIM in principle allows inversion with arbitrary step counts, but the error may be very large. Further discussions, including details the fine-tuned modules, training strategies, and hyperparameter selection, are provided in the ablation studies (Section4.4) and the Appendix E.

---

Published as a conference paper at ICLR 2026
4 EXPERIMENTS
4.1 IMPLEMENTATION DETAILS
Diffusion Models. We selected Stable Diffusion v1.5 and v2.1 (Rombach et al. 2022) to cover the requirements of both the inversion baselines and the downstream watermarking task. For genera- tion. we use a guidance scale of 7.5 and a number of function evaluations (NFE) of 50, employing the DDIM scheduler for all generations, except for those inversion methods that rely on their own specific sampling procedures.
We conduct experiments with Tree-Ring (Wen et al., 2023 (TR) and Gaussian Shading (Yang et al.) (202)) (GS), which embed watermarks in the frequency and spatial domains the initial noise, respectively.
Watermarking Methods.
Comparison Methods. We evaluate our method against several categories of baselines for com- prehensive comparison. First, we establish standard benchmarks using 50-step DDIM inversion and one-step DDIM inversion. Next, we compare against methods specifically designed for high- fidelity inversion, including EDICT (Wallace et al. 2023) and BELM (Wang et al. (024). We also consider ExacIDPM (Hong et al. 2024), but owing to its extremely slow inference speed, we limit this comparison to the SD v2.1 model. Finally, given the scarcity of dedicated few-step inversion techniques, we adapt
acceleration methods originally designed for generation. For fast numerical solvers, we select AMED-Solver (Zhou et al. 2024a). Among the distillation-base methods, we include LCM-LORA (Luo al., 2023) and DMD2 (Yin et al. (024a). Since the pub- licly available weights for these methods are limited to SD v1.5, these comparisons are performed only on that version. A detailed justification for our choice of baselines and a discussion of other related works are provided in the Appendix
Training. We train our model for 1,000 steps on 1,000 prompts from the MS-COCO-2017 dataset (Lin et al. 2014). The training is configured with batch size of 4 and a learning rate of le-4. For LoRA, we use a rank of 8 and inject the adapters only into the attention-related modules. During the training loop, images are generated using an accelerated 20-step DDIM process to improve efficiency. Our adversarial distortion set includes 9 different augmentation types.
Evaluation. We evaluate all methods on a test set of 1,000 prompts from the Stable-Diffusion Prompts (SDP) d under a range of common distortions. To accurately assess practical per- formance, we bypass general image-level metrics and instead adopt the specific evaluation metrics defined by the downstream watermarking methods themselves. Specifically, for Gaussian Shading, measure the bit- bise accuracy of the extracted message; for Tree-Ring, we measure the TPR at a stringent fixed FPR of 10 10-3, obtained by fitting the ROC curve on 1,000 positive and negative examples each and extrapolating.
All experiments are implemented in PyTorch 2.4.1 and run on a single NVIDIA RTX A6000 GPU. More details can be found in Appendix
4.2 MAIN RESULTS
The main results are presented in Table [ Across both diffusion models and both downstream watermarking tasks, our FARI method achieves the most robust performance with the lowest NFE.
As anticipated, the performance of EDICT (Wallace et al., 2023 and BELM (Wang et al. 2024) on noise reconstruction is not as strong their reported performance image reconstruction. Their results are often inferior even to the standard DDIM baseline. This is particularly true for BELM; a multi-step method, its errors appear to accumulate more rapidly, and it exhibits significant sensitivity to mismatched guidance scales between the generation and inversion phases.
ExactDPM (Hong al.] 2024), which uses gradient descent to optimize the inversion trajectory, is extremely time-consuming but does show effectiveness against certain distortions like Gaussian noise. However, its objective is often misaligned with our task. For distortions involving missing content, such as random cropping or dropping, the method's attempts to inpaint the image can cause the trajectory deviate in the wrong direction, harming noise reconstruction.

---

Published as a conference paper at ICLR 2026
Table I: Comparison of inversion methods on downstream watermarking methods under various
image distortions,
DM Methods
NFE
Clean
Adv.
Jpeg
R.Crop
R.Drop
Resize
G.Blur
M.Blur
G.Noise
S&P
Bright
Bit
Accuracy of Gaussian Shading Watermark
DDIM
50
0.9999
0.9777
0,9889
0.9781
0.9736
0.9975
0,9873
0.9983
0,9609
0.9354
0.9567
0.9999
0.9376
0,9703
0,8859
0.8808
0.9905
0.9585
0.9934
0.9398
0.9105
0,9085
SD
EDICT
50
1,0000
0.9637
0.9786
0.9656
0.9568
0.9969
0.9807
0.9985
0,9390
0.9124
0,9450
BELM
50
0.9991
0.9465
0,9847
0.8960
0.8958
0.9939
0.9617
0.9956
0,9355
0.9275
0.9278
AMED
1,0000
0.9656
0.9807
0.9528
0.9462
0.9970
0,9808
0.9989
0,9587
0.9346
0,9410
LCM-LORA
0,9999
0.954]
0,9819
0.9352
0.9308
0,9924
0,9668
0.9955
0,9311
0.9030
0,9504
DMD2
0.9988
0.9287
0,9760
0.8446
0.8241
0.9792
0,9209
0,9836
0,9252
0.9007
0.9336
FARI(OUUS)
1,0000
0,9834
0.9935
0.9777
0,9761
0.9990
0.9957
0.9992
0,9836
0.9649
0.9612
DDIM
50
1,0000
0.9755
0,9892
0.9752
0.9669
0,9980
0,9860
0.9991
0,9590
0.9373
0,9447
0.9987
0.9359
0.9755
0.8841
0.8637
0.9748
0,9173
0.9819
0,9280
0.9069
0,9284
SD V2.
EDICT
50
1,0000
0.9585
0,9773
0.9639
0.9558
0,9963
0,9805
0,9983
0.9396
0.9104
0,9395
BELM
50
0,9990
0.9411
0.9847
0.8923
0.8938
0,9933
0,9602
0.9952
0,9333
0.9269
0,9334
AMED
1,0000
0.9662
0.9813
0.9559
0.9495
0.9970
0,9805
0.9989
0,9585
0.9357
0.9384
ExaciDPM
150
L,000
0.9670
0.9831
0.9675
0.9599
0.9974
0,9815
0.9987
0,9653
0.9241
0.9354
FARI(OUrS)
L0000
0.9824
0.9941
0.9771
0.9700
0.9992
0.9956
0.9994
0.9815
0. 0.9659
0,9588
@ le-3 of Tree- Ring Watermark
DDIM
50
1.000
0.949
0.989
1.000
1.000
0.999
0.996
1.000
0.636
0.946
0.972
1.000
0.863
0.905
0.602
0.649
1.000
0.994
1.000
0.891
0.990
0.737
EDICT
50
1.000
0.942
0,975
0.998
1,000
0.999
0.992
0.997
0.605
0,954
0.962
BELM
50
0.933
0.592
0.768
0.032
0.054
0.889
0.873
0.865
0.384
0.852
0.608
AMED
1.000
0.909
0.947
0.936
0.999
0.995
0.618
0.912
0.835
LCM-LoRA
1.000
0.875
0.914
0.996
0.991
0.999
0.987
0.999
0.331
0.812
0,850
DMD2
1.000)
0.760
0.116
0.971
0.995
0:913
0.678
FARI(OUS))
1,000
0.997
1,000
1,000
1,000
1.000
1,000
1.000
0.980
1.000
0.992
DDIM
50
1.000
0.962
0.993
1.000
1.000
1.000
0.997
1.000
0.726
0.982
0,960
1.000
0.896
0.896
0,709
0.845
1.000
0.993
0.999
0.903
0.991
0.729
SD v2.1
EDICT
50
1.000
0.946
0.980
0.984
0,985
0.997
0.990
0.998
0.681
0.969
0,933
BELM
50
0.882
0.543
0.721
0.001
0.000
0,803
0.787
0.801
0.417
0.812
0.541
AMED
1.000
0.926
0.966
0.957
0.983
1.000
0.998
1.000
0.656
0.983
0.795
ExacIDPM
150
0.906
0.847
1.000
0.999
0.835
0.915
FARI(OUS))
1.000
0.997
0.999
1.000
1.000
1.000
0.999
1.000
0.979
0.999
0.993
The acceleration methods also show limitations. The AMED-Solver (Zhou et al. 2024a), which fine-tuned adversarially in a similar manner to FARI, performs competitively. However, because its mechanism is limited to predicting a single median timestep. its solution space is too constrained handle complex, real-world distortions, leaving gap the optimal performance. The distillation methods, LCM-LoRA (Luo et al. 2023) and DMD2 (Yin et al. 2024a), while highly effective for accelerating generation, do not transfer their success to the distinet task of one-step inversion. We posit that this is because predicting the reverse ODE direction from highly structured image is fundamentally different challenge than predicting it from pure noise.
4.3 GENERALIZATION
In this section, we explore FARI's generalization ability to different generation conditions. By default, we use the SD v model (Rombach et al., (022) for these experiments and employ the standard 50-step DDIM inversion (Song et al. (021) as the baseline. Experiments with different samplers and NFE in generation process can be found in Appendix [
Guidance Scales. Given diverse user preferences for prompt adherence, higher guidance scales enforce the original prompt more strictly, while lower scales allow greater creative freedom. Our experiments span a wide range of 2.5 to 12.5. As shown in Figure FARI's performance degrades only marginally under these settings.
Noise Intensities. To further test the robustness, conduct experiments using different intensities of distortions. The results are shown in Figure a--i). FARI consistently outperforms the stan- dard DDIM baseline, and its advantage becomes even more pronounced as the distortion intensity increases.
Noise types. Although our model is trained with rich set of augmentations, real-world distortions may include types unseen during training. To evaluate FARI's generalization ability against such unseen distortions, we compare the mean squared error (MSE) of the reconstructed noise under three
8

---

Published as a conference paper at ICLR 2026
TIME NE ARTAAAA
COIM
BRN
TEHIS
TOOK
TAR1 TARITR
TE
EARE
CRIM
DABI
BR01
TENEMTR
TARI
TIM
DOOKTT
FARI
EARITR
DARITATES
TARITA
SARITR
50 (0) JPEG
03
85
E3
(b) Random
(c) Randdo Drop
(d) Resize
Guassian Blur
DOIN
DOIM
Emoi
Pulchily
Dagiens Polla Briglanee
Figure 4: The results of experiments on various guidance scales and noise intensities.
distinct conditions: 1) No Noise, where the model trained without any adversarial augmentations, serving baseline; 2) Blind to Noise, where FARI is trained on all distortions except for the one being tested; and 3) All Noise, our standard training procedure. The results, presented in Figure (left), show that FARI achieves notable improvement robustness even against distortions has never encountered during training.
1.00
1.07
Blind to Notse
TPR-Bl A Accurazy
19R.81e-66 PRit Accuracy
0.05
0.95
0.90
0.90
0.6
0.8
Bit Avc.
GS Bit Acc.
TPR
TR TPR
04
104
2.399
0.0
Makio
Inversiee
Figure 5: Left: Performance of FARI when trained under different noise settings, measured in mean
squared enror (MSE), where lower values are better. Middle: The effect of different LoRA ranks FARI's performance. Right: The impact of using a higher NFE for end-to-end training on FARI's final performance.
4.4 ABLATION STUDY
In this section, we present ablation studies of FARI's training settings.
LoRA Ranks. We experimented with different LoRA ranks. (midee)) shows that even with a rank of 1, the performance is considerable. Increasing the rank yields only marginal performance gains, confirming that a low rank is sufficient for our method.
More NFF for Training. We also attempted end-to-end training version. As shown (right, using more steps not only sacrifices speed but also fails to improve performance, instead causing a slight degradation. We posit two reasons for this: first, single step may already be sufficient to accurately approximate the low-curvature inversion trajec- tory; second, the non-trivial accumulation of errors during multiple forward passes may harm the final reconstruction. This confirms that our choice of a one-step inversion is optimal.
multi-step (NFE 1) in-
DISCUSSION
Extended Application and Future Work. We also briefly investigated FARI's performance on im- age reconstruction, given its nature inversion method. The specific results are available in the Appendix D Furthermore, the reduction NFE opens up another possibility. The adversarial re- moval of inversion-based watermarks has traditionally been difficult extremely resource-intensive

---

Published as a conference paper at ICLR 2026
due to the need for gradient propagation through the entire multi-step inversion process (Müller et al. 2024). Our one-step method may alleviate this, as it dramatically shrinks the computational graph. This will be direction for our future work.
Limitations. Despite its strong performance in speed and robustness, FARI has two main limita- tions. First, its sacrificed precision clean image inversions makes it unsuitable for direct appli- cation image editing (Hertz et al.
(002). Second, like all inversion-basee watermarks, FARI is dependent ODE-based sampling (Song al.) 2021 Lu et al., 2022a) and will fail if SDE sampler (Ho et al. 2020 Song et al.
2020) is employed.
6 CONCLUSION
Starting from the demands of watermark extraction, this paper identifies the critical bottleneck as the cumulative error arising from external distortions the transmission channel. This leads to question the necessity of traditional high-NFF inversion methods; they are not only slow and inef- fective at mitigating these external errors but also computationally prohibit end-to-end adversarial training. Subsequently, ric asymmetry: the inversion trajectory possesses a significantly lower curvature than its generation counterpart. This inherent compressibility allows to efficiently distill the entire multi-step pro- cess into a single step. By doing so, FARI unlocks a robust adversarial training regime, creating an inverter that achieves state-of-the-arr robustness and speed for practical, large-scale watermark verification.
propose FARI, a framework built upon our key discovery of geomet-
REPRODUCIBILITY STATEMENT
The resources required to reproduce the experiments of this paper are provided in the supplementary materials. This includes the complete source code for proposed method, FARI, along with de- tailed instructions for setting up the environment and running the training and evaluation scripts. The implementation details for all baseline methods and experimental settings are described in Section
4.1 and Appendix B
ACKNOWLEDGMENTS
This work was supported in part by the National Natural Science Foundation of China under Grant 62472398, Grant U2336206, Grant U2436601, and Grant 62402469.
REFERENCES
Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compression with scale hyperprior. arXiv preprint
2018.
Yuzhuo Chen, Zehua Ma. Han Fang, Weiming Zhang, and Nenghai Yu. Tag-wm Tamper- aware generative image watermarking via diffusion inversion sensitivity. arXiv preprint arXiv:2506.23484, 2025.
Zhengxue Cheng.
Heming Sun. Masaru Takeuchi. and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 7939-7948. 2020.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 338-354, 2024.
Trung Dao, Thuan Hoang Nguyen, Thanh Le, Duc Vu, Khoi Nguyen, Cuong Pham, and Anh Tran. Swiftbrush v2: Make your one-step diffusion model better than its teacher. In European Confer- ence on Computer Vision, pp. 176-192, Springer, 2024.
Wenkai Dong, Song Xue, Xiaoyue Duan, and Shumin Han. Prompt tuning inversion for text-driven image editing using diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 7430-7440, 2023.
10

---

Published as a conference paper at ICLR 2026
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first international conference machine learning, 2024.
Daniel Garibi, Or Patashnik, Andrey Voynov, Hadar Averbuch-Elor, and Daniel Cohen-Or. Renoise: Real image inversion through iterative noising. In European Conference on Computer Vision, pp- 395-413. Springer, 2024.
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprint arXiv:2410.07369, 2024.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or.
Prompt-to to-promptt image editing with cross attention control. arXiv preprint arXiv:2208.01626, 2022.
Jonathan Ho and Tim Salimans. arXiv:2207. 12598, 2022.
Classifier-free diffusion guidance.
arXiv preprint
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, pp. 9840-6851. Curran Associates, Inc., 2020.
Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7069-7078, 2024.
Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. ICLR, 1(2):3, 2022.
Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Videoshield: Regulating diffusion- video generation models via watermarking, 2025. URL https:
//arxiv.orq abs 2501. 14195
Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937-3963, 2024.
Xuan Ju, Ailing Zeng, Yuxuan Bian, Shaoteng Liu, and Qiang Xu. Direct inversion: Boosting diffusion-based editing with 3 lines of code. arXiv preprint arXiv:2310.01506 2023.
Sangyun Lee, Beomsu Kim, and Jong Chul Ye. Minimizing trajectory curvature of ode-based gen- crative models. In International Conference on Machine Learning, pp. 18957-18973. PMLR, 2023.
Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. Gaussmarker: Robust dual-domain watermark for diffusion models. arXiv preprint arXiv:2506. 11444 2025.
Ruibin Li, Ruihuang Li. Song Guo, and Lei Zhang. Source prompt disentangled inversion for boosting image editability with diffusion models. In European Conference Computer Vision, pp. 404-411. Springer, 2024.
Haonan Lin, Yan Chen, Jiahao Wang, Wenbin An, Mengmeng Wang. Feng Tian, Yong Liu, Guang Dai, Jingdong Wang, and Qianying Wang. Schedule your edit: simple yet effective diffu- sion noise schedule for image editing. Advances in Neural Information Processing Systems, 37: 115712-115756, 2024.
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, pro- ceedings, part 13, pp. 740-755. Springer, 2014.
Luping Liu, Yi Ren, Zhijic Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds, arXiv preprint 202. 2022.

---

Published as a conference paper at ICLR 2026
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan LI, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. In Advances in Neural Information Processing Systems, volume 35, pp. 5775-5787, 2022a.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv preprint arXiv:2211.01095, 2022b.
Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. arXiv preprint arXiv:2309. 16952, 2023.
Simian Luo, Yiqin Tan, Suraj Patil, Daniel Gu, Patrick Platen, Apolinário Passos, Longbo Huang, Jian Li, and Hang Zhao. Lem-lora: A universal stable-diffusion acceleration module. arXiv preprint arXiv:231 005556, 2023.
Daiki Miyake, Akihiro Iohara, Yu Saito, and Toshiyuki Tanaka. Negative-prompt inversion: Fast image inversion for editing with text-guided diffusion models. In 2025 IEEE/CVF Winter Con- ference on Applications of Computer Vision (WACV), pp. 2063-2072. IEEE, 2025.
Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 6038-6047, 2023.
Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. arXiv preprint arXiv:2412.03283, 2024.
Trong-Tung Nguyen, Quang Nguyen, Khoi Nguyen, Anh Tran, and Cuong Pham. Swiftedit: Light- ning fast text-guided image editing via one-step diffusion. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 21492 21501, 2025.
Zhihong Pan, Riccardo Gherardi, Xiufeng Xie, and Stephen Huang, Effective real image editing with accelerated iterative diffusion inversion. Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 15912-15921, 2023.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Con- ference Computer Vision and Pattern Recognition (CVPR), pp. 10684-10695, June 2022.
Tim Salimans and Jonathan Ho. Progressive distillation for fast sampling of diffusion models, arXiv preprint 2tt.::2202.0052222 2022.
Dvir Samuel, Barak Meiri, Haggai Maron, Yoad Tewel, Nir Darshan, Shai Avidan, Gal Chechik, and Rami Ben-Ari. Lightning-faa fast image inversion and editing for text-to-image diffusion models. arXiv preprint arXiv:2312.12544 2023.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representations, 2021.
Yang Song. Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:201 1, 13466, 2020.
Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. arXiv preprint arXiv:2303.01469, 2023.
Eukasz Staniszewski, Lukasz Kuciński, and Kamil Deja. There and back again: On the relation between noise and image inversions in diffusion models. arXiv preprint arXiv:2410.235.00 2024.
12

---

Published as a conference paper at ICLR 2026
Bram Wallace, Akash Gokul, and Nikhil Naik. Edict: Exact diffusion inversion via coupled trans- formations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog- 2023.
nition, pp.
Fangyikang Wang, Hubery Yin, Yue-Jiang Dong, Huminhao Zhu, Hanbin Zhao, Hui Qian, Chen Li, et al. Belm: Bidirectional explicit linear multi-step sampler for exact inversion in diffusion models. Advances in Neural Information Processing Systems, 37:46118 16118944419, 2024.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 2023.
Zijin Yang. Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pp. 12162- 12171, June 2024.
Zijin Yang, Xin Zhang, Kejiang Chen, Kai Zeng. Qiyi Yao, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading++: Rethinking the realistic deployment challenge of performance-losiles image watermark for diffusion models. arXiv preprint arXiv:2504. 15026, 2025.
Tianwei Yin, Michaël Gharbi, Taesung Park, Richard Zhang, Eli Shechtman, Fredo Durand, and Bill Freeman. Improved distribution matching distillation for fast image synthesis. Advances in neural information processing systems, 37:47455 47447, 2024a.
Tianwei Yin, Michaël Gharbi, Richard Zhang, Eli Shechtman, Fredo Durand, William T Freeman, and Taesung Park. One-step diffusion with distribution matching distillation. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 6613-6623, 2024b.
Guoqiang Zhang, Jonathan P Lewis, and W Bastiaan Kleijn. Fxact diffusion inversion via bidi- rectional integration approximation. In European Conference on Computer Vision, pp. 19-36. Springer, 2024a.
Lijun Zhang, Xiao Liu, Antoni V Martin, Cindy X Bearfield, Yuriy Brun, and Hui Guan. Attack- resilient image watermarking using stable diffusion. Advances in Neural Information Processing Systems, 37:38480-38855 38507,
2024b. 2024b.
Qinsheng Zhang and Yongxin Chen. Fast sampling of diffusion models with exponential integrator. arXiv preprint arXiv:2204. 22t.:::2224.......... 2022.
Wenliang Zhao, Lujia Bai, Yongming Rao, Jie Zhou, and Jiwen Lu. Unipe: A unified predictor- corrector framework for fast sampling of diffusion models. Advances in Neural Information Processing Systems, 36:49842-4444 498699 2023.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in neural information processing systems, 37:8643 8672, 2024.
Zhenyu Zhou, Defang Chen, Can Wang, and Chun Chen. Fast ode-based sampling for diffusion models in around 5 steps. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 7777-7786, 2024a.
Zhenyu Zhou, Defang Chen, Can Wang, Chun Chen, and Siwei Lyu. Simple and fast distillation of diffusion models. Advances in Neural Information Processing Systems, 37:40831 --88600,, 2024b.
13

---

Published as a conference paper at ICLR 2026
A DISCUSSION ABOUT RELATED WORKS
The body of work related to our method is extensive, primarily encompassing inversion techniques and diffusion model acceleration. We discuss these in separate categories below.
A.1 INVERSION TECHNIQUES
A significant portion of inversion research focuses on improving the quality of image editing by enforeing trajectory symmetry. NTI (Mokady et al. 2023) first performs a standard DDIM inver- sion and then optimizes null-text embedding for each step. This emhedding sequence is then used during regeneration to ensure the new path closely follows the reverse of the inversion trajectory, achieving high-fidelity reconstruction. PTI (Dong al. 2023) extends this by linking the embed- ding to the target prompt to enhance editing quality. Furthermore, NPI (Miyake et al., (025)) replaces the optimized null-text sequence with the prompt embedding itself, eliminating the need for opti- mization and greatly improving efficiency. Direct Inversion (Ju et al.) (023) also follows this path by decoupling the source and target diffusion branches. Notably, these methods do not actually change the result of the initial inversion; their focus is on the reconstruction phase. Therefore, their performance in a watermarking scenario is nearly identical to that of standard DDIM inversion, and we do not include them in our quantitative comparisons.
Another representative class of inversion methods, including AIDI (Pan et al. 2023). SPDInv (Li eet al., 2024), ReNoise (Garibi al., 2024), GNRI (Samuel et al. 2023). and EXactDPM (Hong
let al. 2024), directly optimizes the inversion trajectory using fixed point iteration or gradient de- scent. While these can indeed reduce the inversion error, they are often unstable. This instability is exacerbated by the initial value offset common in watermarking, which can cause the optimization to proceed in an incorrect direction or fail entirely. We found that while ExactDPM is the slowest, is the most stable among them and also targets watermarking as a downstream task. Consequently, we select it as a representative of this category for comparison.
A third class of methods addresses the inherent lack of invertibility in the sampling process itself. Techniques like EDICT (Wallace et al.] 2023). BDIA (Zhang et al., (024a), and BELM (Wang et al. 2024) modify the sampler to achieve a smaller theoretical error bound. However, their design carries an implicit assumption that the entire process free from external error. This holds true for reconstruction but is clearly violated in watermarking, where the image is subject to various distortions after generation that can push it out of the method's convergence domain. Furthermore, these methods can be more sensitive when handling images generated with high guidance scale.
Recently, an interesting work in this area is SwiftEdit (Nguyen et al. 2025), which also achieves one-step inversion via model fine-tuning. However, it still considers the problem from an editing perspective, focusing on adapting to real images and enabling subsequent edits. While it achieves fast, high- results editing tasks, it relies on base models that are already one-step genera- tors (e.g., SwiftBrush v2 (Dao et al. 2 and has not demonstrated generalization to multi-step generators. This implies the trajectory it learns to fit is already a straight line, which is a simpler task. Additionally, its code and weights are not publicly available, precluding direct comparison.
A.2 DIFFUSION MODEL ACCELERATION
Given the lack of fast and stable inversion methods, we also include several diffusion model acceler- ation techniques in our baseline comparison. For the task of acceleration, we focus on methods that retain capabilities similar to the original model, rather than fully retraining a new one for faster gen- eration. These methods can be divided into two categories. The first is based on higher-order solvers with lower truncation error, such as DPMSolver (Lu et al., 2022a). However, their performance ceil- ing is limited in extreme few-step scenarios. A noteworthy exception is the AMED-Solver (Zhou) (ct al. 2024a), which is based on the mean value theorem for vector fields. It trains an additional small model to predict the median point of the trajectory, whose velocity can be used the average velocity for the entire path, enabling sampling in as few as two steps.
The second category is distillation, where student model learns to replicate the output of multiple teacher steps in a single step. This, however, often requires substantial training resources and time, which we argue is excessive if used solely for inversion. We select two representative baselines from
14

---

Published as a conference paper at ICLR 2026
this rich field. LCM-LoRA (Luo al. 2023) is similar to method in that it stores the distilled parameters in a LoRA Hu et al. 2022 module. However, its purpose different: it is designed to adapt to various user- user-personalize ized models, enabling accelerated sampling without requiring separate distillation for each fine-tuned model. DMD2 (Yin et al. 2024a), on the other hand, uses distribution matching distillation. It does not directly learn the teacher's ss output but rather its target distribution, allowing the student's performance to surpass the ceiling of the original teacher model. Another relevant work SFD (Zhou et al.) 2024b), which observes the smooth modification of the gradient field and, inspired by this, focuses training resources on essential timesteps. While known for its fast training speed for a distillation method, it is still slower to train than FARI and its one-step performance is inferior to our chosen baseline, DMD2. Our results show that distillation methods do not perform exceptionally well on the inversion task. As we posited, while the prediction target is similar, the input is fundamentally different: predicting direction from highly structured image is a distinct challenge compared with predicting it from pure noise.
B DETAILED EXPERIMENTS SETTINGS
In this section, we provide the specific details of our experimental setup.
Models and Generation. We conduct v1.5 and v2.1 (Rombach et al. 2022). The generation process utilizes the di Liffusers library in Python, with pretrained weights sourced from the Hug- ging Face Hub repositories wtt.taaisstaleedieeeeeeeeee 2--bbase, respectively. All images are gener- ated at a resolution of 512 x 512 pixels. For testing, we use 50-step DDIM sampling with a fixed guidance scale of 7.5, which are common settings for the downstream watermarking tasks.
experiments on Stable Diffusion (SD)
and
Watermarking Methods. For both the Tree-Ring (Wen et al. al., 2024) watermarks, We use Tree-Ring in its rand mode, with the watermark embedded in the fourth channel of the latent space. For Gaussian Shading, we adopt the default settings (feh 4, fn 8, fw 8, for 256-bit capacity) and use stream cipher to encrypt the watermark message.
2023 and Gaussian Shading (Yang the official open-source code provided by the authors GitHub.
Baselines. For DDIM (Song et al. 2021, , we use our own implementation, which is equiv- from di diffuses. It is critical to note that
alent to using the DDIMI neersSScuueeeeeeeeeee the timestep spacing must be set to "trailing" instead of the default "leading" The "leading" ng" setting introduces a significant eтror at low NFEs because it sets the first prev.timested to O. Since the scheduler calculates the current timestep by subtracting a step size from prev.t trrevttimee immettp,, this can result in negative timestep. which is then clipped to O. This effectively makes the first step a non-operation (from t = 0 to t = 0). The "trailing" setting avoids this error. While both settings yield similar results at high NFEs, the difference is substantial at very few steps, especially when NFE=1. Furthermore, our one-step DDIM inversion baseline, similar to FARI, uses 0 when predicting epsilon, using / T introduces large еггоr.
For EDICT (Wallace al. 2023) and BELM (Wang et al. 2024), we use the implementation pro- vided by BELM. The NFE is set to 50 steps, and EDICT's hyperparameter is set to 0.93 as recom- mended in the original paper. For ExactDPM (Hong et al. 2024), we use the official implementation with the Backward Euler method for inversion. To ensure a fair and efficient comparison, we disable the additional decoder inversion. We its inversion step count 10, but note that it requires an iterative optimization process that often takes over 150 iterations, depending on the distortion type and intensity.
As the official weights for AMED-SSlver (Zhou et al.) 2024a) were not provided for our target models, we retrained it ourselves. Crucially, we performed an end-to-end adversarial training for the inversion task, similar to our FARI training, and aligned its parameter count with FARI. Since it requires a minimum two steps for sampling, we set its NFE to 2. For LCM-LoRA (Luo et al.) 2023) and DMD2 YYn al. 2024a), to use two steps (within its allowed 2-8 range) and use a single step for DMD2, which has one-step sampling capabilities.
the officially provided weights. We set LCM-LoRA
15

---

Published as a conference paper at ICLR 2026
Training and Evaluation. For FARI's training, mizer and a learning rate of le-4. When retraining the AMED-Solver from scratch, we adjusted the prompts associated with the AIS-COCO-2011
batch size of 4 with the Adam opti-
learning rate to 1e-3. For training dataset, dataset (Lin et al. 2014); while the original dataset lacks prompts, we utilize the captions provided in the official Tree-Ring repository. For testing, (SDP) dataset.
the test split of the Stable-Diffsson-PPonnn
The types of distortions used in our training and testing are illustrated in Figure 6 Geometric distortions, such as rotation and scaling, were excluded, as we consider their handling to be more related to the intrinsic robustness mechanism of the watermark itself rather than the inversion process.
Distortions.
a
(b)
(c)
(d)
(f
g
(h)
iI)
Figure 6: Visualization of the distortion set used in our experiments. (a) Clean image or identity transformation. (b) JPEG, QF = 25. (c) 60% area Random Crop (R. (R.Crop). (d) 80% area Random Drop (Rorro)). (e) 25% Resize and restore (Resize). (f) Gaussian Blur, (G.Blur). (g) Median Blur, A = 7 (M.Blur). (h) Gaussian Noise, = 0, 0.05 (G.Noise). (i) Salt and Pepper Noise, p 0.05 (S&P). (j) Brightness, factor = (Bright).
C DETAILS ABOUT THE CURVATURE EVALUATION.
In Section 3.1 measure the curvature of the generation and inversion trajectories as a function of the timestep. The experiment is conducted on the Stable Diffusion v2.1 model (Rombach et al., 2022). generating 100 images. Both the generation and inversion processes are set uncondi- tional to eliminate interference from other factors. The curvature is approximated using a formal definition of discrete curvature.
Specifically, for trajectory of latent variables (æ: { we consider three consecutive points #r+ ar, and 2--1- We first define the two corresponding velocity vectors et 0t-1 24 and U--1 E.+1- We then approximate the are length 5; as:
$1 || ||2 ||2/112
(12)
The discrete curvature ny timestep t is then defined the angle 0, between the velocity vectors, divided by the are length s,:
Kg 0,
(13)
St
where the angle 0, is given by:
vi+1 12
0g arccos
(14)
|
12112211122
16

---

Published as a conference paper at ICLR 2026
We also conducted two additional experiments, with the results shown in the Figure For ditional generation, we use prompts from the Doeole-Dfffsioo-PPPe Prommtss dataset. All other settings remain identical to main experiments. First, used conditional generation to create image, and then compared the curvature of the original generation trajectory against two types of inversion: that conditionally-alinnel and that was unconditional. 'hee results show that the cur- vature of both inversion trajectories is consistently lower than that of the generation trajectory. It important note, however, that lower curvature does not necessarily equate to higher inversion accuracy. Second, we measured the curvature of a regeneration trajectory (from the inverted noise). The results indicate that the regenerated path also has a lower curvature than the initial generation path. This further validates our conclusion that the residual wwwfrrquueccy semantic information in reconstructed noise partly helps to reduce trajectory curvature.
To strengthen the generalizability of our findings, we conduct additional on the COCO dataset and using Stable Diffusion v3.5 Medium (SD v3.5M) (Esser et 2024). The results are presented in the Figure 8
Curvature over Sampling (SDP dataset)
Curvature over Sampling
generation condition
10
generation
Inversion condition
inversion
2.5
Inversion condition
regeneration
2.0
Curvature
Curvature
1.5
1.0
0.5
400
600
800
1000
0
200
400
600
800
1000
Timestep
Timestep
Figure 7: Left: The curvature of the conditional generation. unconditional inversion, and conditional inversion trajectories over the diffusion timesteps. Right: The curvature of the generation, inversion, and regeneration trajectories the diffusion timesteps.
Curvature over Sampling (COCO dataset)
Curvature over Sampling (SD v3.5 M)
3.0
generation condition
generation inversion
condition
0.20
2.5
inversion w/o condition
Curvature
2.0
Curvature
0.15
0.10
0.05
0.5
0.0
0.00
200
400
600
800
1000
200
400
600
800
Timestep
Timestep
The curvature of the the conditional generation, unconditional inversion, and condi- tional inversion trajectories over the diffusion timesteps, measured using SD v2.1 on the COCO dataset Right: The curvature of the generation and inversion trajectories over the diffusion timesteps, measured using SD v3.5M.
Figure 8: Left:
D EXTENDED APPLICATION ON IMAGE RECONSTRUCTION AND EDITING
Although FARI is specifically designed for watermark extraction, its remarkable speed prompted us investigate its potential for image reconstruction and editing. We therefore conducted exper-
17

---

Published as a conference paper at ICLR 2026
iment comparing the peak signal-to-noise ratio (PSNR) of images reconstructed by FARI against those reconstructed by DDIM (Song et al. 2021). EDICT (Wallace et al. 2023). BELM (Wang et al.) 2024), and ExactDPM (Hong et al. 2024). The results presented Table 2 While dis- abling adversarial training (FARIC(") boosts FARI'S precision on clean inversions, a gap remains when compared leading editing-oriented methods. Regarding image editing, many techniques require attention map or feature sharing during the intermediate steps of the inversion and regen- eration process to ensure high consistency. As our one-step method lacks these intermediate steps for intervention, it is not directly compatible with mainstream soug-and-pla diffusion- based editing frameworks (Hertz al. 2022). We hope our work can serve as inspiration for subsequent research in this area.
Table The performance of inversion methods on image reconstruction.
DDIM
EDICT
BELM
ExactDPM
FARI
FARIC
PSNR
17.33
25.26
24.04
20.02
10.61
14.60
E MORE EXPERIMENTAL RESULTS
E. DISCUSSION ABOUT TRAINING TIME AND INFERENCE TIME
Training Time Figure illustrates the training dynamics of FARI, showing the exponentially weighted moving average (EWMA) of the loss curve alongside the performance on the Gaussian Shading (Yang al. 2024) and Tree-Ring (Wen al., 2023) watermark tasks. The entire training process, including the online construction of data pairs, takes approximately 70 minutes on a single NVIDIA RTX A6000 GPU. Notably, FARI surpasses the performance of the 50-step DDIM baseline on both watermarking tasks around the 300th training step (approximately 20 minutes), highlighting efficiency of our method.
0.95
1.00
0.90
T 3/B/lle--BBBAA/// Accuracy
0.85
MSE Loss
0.95
MSE Loss
GS Bii Acc.
0.80
TPR
DDIM GS Baseline
0.75
0.90
DDIM TR Bascline
0.70
0.85
200
400
600
800
1000
Traing Step
Figure 9: The loss tendency and tested performance on downstream watermarking tasks over the training step.
Inference Time The use of a LoRA (Hu et al.) 2022) modules affects the denoiser's inference efficiency, with the average time per function evaluation on an NVIDIA RTX A6000 GPU increasing from 0.0247 s to 0.0358 s. While this introduces latency, the total time remains less than that of two-step inversion. To eliminate this overhead during inference, a practical solution to merge the LoRA weights by W' = Wo + AW Wo + BA. This can be achieved by creating an extra fused copy of the coRA-injected module, allowing the system to switch between the original module for image generation and the fine-tuned robust module for one-step watermark inversion. Alternatively, for systems with sufficient VRAM, a simpler but more memory-intensive approach is to load entirely separate model with the weights pre-merged.
18

---

Published as a conference paper at ICLR 2026
E.2 MORE RESULTS ABOUT GENERALIZATION
Samplers. Users may employ samplers different from the one used during training. To test
FARI's generalization to this possibility, we conducted sampling using variety of common ODE solvers (Song et al. [202 /Zhao et al. 20233 Liu et al. 2022 Zhang & Chen 2022] Lu et al., 2022a)
The results, shown in Table indicate that FARI outperforms the DDIM inversion baseline across
all tested samplers.
Table 3: Generalization to different samplers. For each cell, the values represent TR TPR / GS Bit Acc.
DDIM
UniPC
PNDM
DEIS
DPMSolver
Song et al. 2021
Zhao et al. 2023
Liu et al. 2022
Zhang & Chen 2022
Lu et al. 2022a
DDIM FART
0.966 / 0.9780
0.886 0,9550 0.951 / 0.9637
0.967 / 0.9757
0.963 / 0,9744 0.997 0,9826
0.884 / 0,9549
0.997 / 0.9841
0.997 0.9984
0.951 / 0.9664
Inference Steps of Generation. To optimize the training speed, we used fixed 20 steps for image generation during our training process. While this may be a low number of inference steps for the selected models, we present results with greater number of generation steps in Table[ The results demonstrate that FARI, despite being trained under these efficient conditions, generalizes well to higher-quality generation settings and consistently outperforms the baseline.
Table 4: Generalization to different NFES of generation. For each cell, the values represent TR TPR / GS Bit Acc.
25
50
100
DDIM
0,965 0.9752
0.966 / 0.9780
0.964 0.9768 0.997 0.9843
FARI 0.997 / 0.9826
0.997 / 0.9841
Other Models. We evaluate FARI's performance on SD v3.5M (Esser et al., 2024) and SDXL- Turbo (Podell et al. 2023 Since SD v3.5M does not support DDIM sampler, implement inver- sion for this model via naive Euler Method. SDXL-Turbo inherently supports one-step generation, so we compare the performance of one-step DDIM inversion against FARI.
Given that SD v3.5 has 16 latent channels, we set fch = 2 and fn = fw = 8 for Gaussian Shading, resulting in a capacity of 512 bits. For Tree-Ring Watermark, we only the last four channels for watermark embedding. The corresponding results are shown in Table 5 and Table 6 demon- strating FARI's strong generalization capability. FARI exhibits substantial improvements on both downstream watermarking approaches, especially for Tree-Ring. In the presence of distortions, naive inversion fails maintain the viability of Tree- Tree-Ring watermarking, demonstrating that FARI significantly broadens the practical applicability of inversion- basedd watermarking techniques.
improvemennt
Table 5: Performance of naive inversion and FARI on SD v3.5M.
Methods
NFE
Clean
Adv.
JPEG
R.Crop
Drop
Resize
G.Blur
M.Blur
G.Noiee
S&P
Bright
Bit Accuracy of Gaussian Shading Watermark
Naive FARI
20
0.9994
0.9178
0.9440
0.9654
0.9403
0.9437
0.8728
0.9609
0.7778
0.8736
0.9818
0.9995
0.9515
0.9671
0.9713
0.9469
0.9756
0.9384
0.9852
0.8765
0.9191
0.9833
@ 1c-3
Tree-Ring Watermark
Naive FARI
20
0.958
0.161
0.020
0.364
0.543
0.000
0.000
0.001
0.009
0.003
0.512
1
0.998
0.978
0,994
0,998
0.995
0.995
0.952
0.996
0.917
0.968
0.985
More Datasets. To further validate generalization across datasets, we additionally select 1,000 prompts from new dataset (DiffusionDBB)). Combined with the existing SDP and COCO datasets, we conduct cross- dataset validation. The results are shown in Table 7 presented in the format of TR TPR/ GS Bit Acc., with 50-step DDIM the baseline.
ond
19

---

Published as a conference paper at ICLR 2026
Table 6: Performance of naive inversion and FARI SIXII-Turbo.
Methods
NFE
Clean
Adv.
JPEG
R.Crop
R.Drop
Resize
G.Blur
M.Blur
G.Noise
S&P
Bright
Bit Accuracy Gaussian Shading Watermark
DDIM FARI
0.9755
0.8576
0.9142
0.7449
0.7552
0,9370
0.8841
0.9346 0.9922
0.8935
0.8229 0,9354
0.8315 0.9102
0.9998
0.9511
0.9903
0.9115
0.9161
0.9871
0.9370
0,9801
TPR #1-3 of Tree-Ring Watermark
DDIM FARI
0.561
0.201
0.672
0.000 0.743
0.000
0.065
0.001
0.221 0.928
0.412 0.949
0.271
0.163
0.855
0.967
0.933
0.893
0.683
0.837
0.763
Table 7: generalization results. Performance is reported as TR TPR/ / GS Bit Acc.
Training Dataset
Test Dataset
SDP
COCO
DiffusionDB 0.962 0.9763
DDIM Baseline (50-step)
0.966 0.9780
0.964 / 0.9785
SDP
0.997 / 0.9852
0.995 / 0.9839
COCO
0.997 0.995 0.9832
0.997 0.9846
DiffusionDB
0.997 / 0.9861
Removal Attacks. To evaluate FARI's robustness against watermark removal attacks, we test three regeneration attacks and one adversarial optimization attack. We evaluate three different regen- eration attacks. For /Zhao et al. (2024), we set the noise steps to 300. For Cheng et al. (2020) and Ballé et al. (2018), we set the quality parameter to 3 (representing the highest attack strength). For the adversarial optimization attack (Lukas et al. 2023), we use the following settings: e = 4/255, Adam optimizer, learning rate of 0.0I, and 5 optimization steps per image, all of which are con- sistent with the default configuration. Note that the attack implementation does not involve Gaus- sian Shading (GS). Since the GS verification process is non-differentiable and relies on sign-based verification, we optimized by minimizing the MSE distance between the reconstructed noise after optimization and the negative of the original noise. This cause more elements in the recon- structed noise to flip their signs and proved to be effective (otherwise, the bitwise accuracy will be 1.0000, which means the attack useless). The corresponding results are shown in Figure [0] FARI provides improvements in robustness. However, the ability to resist attacks remains largely depen- dent on the underlying design of the base watermarking method, as FARI serves as a plug-and-play inversion approach to enhance their detection performance.
E.3 MORE ABLATION STUDIES
Trained Modules. We experimented with training different modules of the denoiser. By default, only fine-tune the linear layers within the attention-related modules. In an Extended LoRA FT setting, we fine-tune all linear and convolutional layers using LoRA. We also tested full fine-tuning as an upper bound. The results shown in Table Although training more modules yields marginal improvement, the increase is not significant. We therefore opted for the more parameter- efficient default setting.
Gaussian Shading Watermark
Free-Ring Watermark
1.00
1.0
0.96
0.8
Accuracy
0.96
TPR-@le33
0.6
0.94
0.4
0.92
DIDI (50 steps)
0.2
(50 stops)
FARI step)
FARI
0.90
2hex31144
dheng2020
bmndg00s
Laked022
0,0
Chon2014
Attack Method
Attack Method
Figure 10: Performance of DDIM inversion and FARI under different attacks.
20

---

Published as a conference paper at ICLR 2026
Training Strategies. We compared several training strategies, including non-adversarial base- line. We also tested regular distillation, where the model learns to mimic the output of a 50-step DDIM inversion real images, as well step-wise adversarial tuning similar to diffusion pre- training (regular finettuning) (Ho et al., 2020). For regular distillation, the performance ceiling effect is obvious if we were to directly learn from DDIM's inversion of distorted image. There- fore, our actual learning objective is defined as the L2 distance between the noise produced by the student model on an augmented image and the noise produced by the baseline DDIM on the corre- sponding clean image. For regular fine-tuning, the evaluation is conducted using 50-step inversion. The results Table|Jconfirm our claims: adversarial training is vital for FARI's robustness, the reg- ular distillation approach is limited by its teacher's performance ceiling, and the step-wise objective of regular fine-tuning fails learn global robustness.
Table 8: The Performance of FARI on different trained modules.
Table 9: The Performance of FARI on different
training strategies.
TR TPR
GS Bit Acc.
TR TPR
GS Bit Acc.
Attention LoRA FT Extended LoRA FT Full FT
0,997
0,9841
FARI w/ adversarial training
0,997
0,9841
FARI w/o adversarial training
0.919
0,9788
0.996 0.998
0,9849
Regular distillation
0.995
0,9823
0,9860
Regular fine-tuming
0.963
0.9774
Choice of t. training with different t values. The results are shown in Table TO The results demonstrate that t = O serves better initialization for optimization than larger i values.
Regarding the choice of value in Equation 9 we conducted ablation study by
Table 10: Ablation study on different t values in Equation
t t=
0.9772 100
t= 500
t= 999
GS Bit Acc.
0.9841
0.9835
0,9809 0.995
TR TPR 0.997
0.996
0.988
E.4 GENERAL EVALUATION AND VISUAL RESULTS
To demonstrate FARI's broader compatibility with inversion-based watermarking methods beyond Gaussian Shading (Yang et al. 2024) and Tree-Ring (Wen et al. (023). we directly measure and
report the MSE of FARI's reconstructed latent noise in Table I1 with visual results shown in Fig- ure II
Table 11: The MSE of inversion methods under various image distortions.
DM
Methods
NFE
Clean
Adv.
Jpeg
R.Crop
R.Drop
Resize
G.Blur
M.Blur
G.Noise
S&P
Bright
DDIM
50
0.2003
0.9285
0.8740
0.8734
0.8834
0.7671
0.9706
0.6920
1.1860
1.2963
0.8139
0.7108
0.9016
0,8981
0.9646
0.9621
0.8294
0.8987
0.8157
0.9067
0.9316
0.9074
EDICT
50
0.2646
1.0477
1,0400
1.0407
1.0547
0.8569
1.0756
0.7654
1.2852
1.3735
0.9370
BELM
50
0.6593
1,7223
1.0230
1.4621
1.4384
0.9181
1.1744
0.8789
1,2193
1,2065
1.2305
SD
AMED!
0.3577
0.8375
0,8022
0.8756
0.8800
0.7116
0,8733
0.6439
0,9562
1.0033
0.7917
LCM-LORA
0.4488
0.847]
0.7773
0.8264
0.8331
0.7296
0.8614
0.7126
1,0413
1.0904
0.7517
DMD2
0,7934
0.9201
0.9478
0.9472
0.9392
0.8673
0,8999
0.8578
0.9367
0.9587
0.9266
FARI(Our))
0,2033
0.6699
0.6138
0.7385
0.739
0.5650
0.7037
0.5486
0.7146
0.7920
0.6135
DDIM
50
0,2051
0.9657
0.9070
0.9395
0.9614
0,8012
1.0167
0.7080
1.1861
1.2946
0,8769
0.6314
0.9573
0,8634
0.9934
1.0049
0.8861
1.0091
0.8471
1.0543
1.0456
0.9116
SD v2.1
EDICT
50
0.2659
1.0458
1.0419
1.0383
1.0476
0.8560
1.0745
0.7646
1.2700
1.3691
0.9503
BELM
50
0.6706
1.1705
1.0213
1.4556
1.4313
0.9263
1.1767
0.8872
1.2099
1.1954
1.2190
AMED
0.3538
0.8357
0.8729
0.8791
0,7095
0.8726
0.9522
0.7915
ExacIDMM
> 150
0.2495
1.1306
1.0733
1.2565
1.2645
0.9105
1.1577
0.8165
1.2495
1.4110
1.0359
FARE(OUrS)
0.6862
0.7461
0.7530
0.7216
0.5638
0.7294
0.6418
21

---

Published as a conference paper at ICLR 2026
Image'
Noisc Reconstruction Error 0.6 MSE (1)
Image'
Nosse Recomstruction Error 0.67 MSE (J)
Distortion Type
(50-step)
(1-steg)
Distertion Typo
DDIM (50-step)
(1-step)
Clean
0. 7.2866
0.6914
0.2112
M.Blur
0,7153
0.8769
0.5391
Jpeg
1.0654
0.9619
0.7168
G.Noise
1.1816
1.0420
0.7427
Resize
0.8169
0.9277
0.5893
S&P
1,4023
1.1074
0.8511
G.Blur
0.9302
1.0234
0.6012
Bright
1,3564
1.1670
0.9448
Figure 11: FARI reduces reconstruction error, especially under distortion. Naive DDIM single-step inversion produces visible artifacts. Error scaled by 0.6 avoid oversaturation.
F LLM USAGE STATEMENT
A large language model (LLM) was used assistive tool for the writing and editing of this paper. Its primary function was to polish and rephrase sentences for improved clarity, readability, and academic style. The authors have reviewed and take full responsibility for all content presented.
22


Reviews:
[{"review_id": "JFmjeMlqiF", "reviewer": "Reviewer_vuw4", "summary": "This work builds off the literature on inversion-based watermarking that use diffusion forward and backward processes to encode and then recover watermarks. The authors find a critical weakness in many watermarking approaches: the inversion process which is both weak and slow. They then propose a methodology that uses LoRA and an adversarial suite to not only make their watermarking more robust but much faster.", "questions": "1. What is the performance relative to VINE?\n2. Please try attaching Gaussian Shading + Tree-Ring with SDXL-Turbo backbone. I wonder about the robustness/speed/image quality comparison.\n3. I wonder about the generalizability as we seem to test/train on a singular dataset. I think that there is a need to explore other kinds/styles of images.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The approach identifies a key weakness in existing watermarking literature.\n2. I believe that the approach is new to my knowledge, particularly the insights about curvature and low-NFE approximation. \n3. One step inversion is commonly done (DDIM) but the authors note that these approaches have limitations.\n4. Empirical results seem promising", "weaknesses": "1. Existing works commonly use models such as SDXL-Turbo (one-step generation) to achieve faster watermarking speeds [1]. I believe that these methods may be faster and have potentially better quality.\n2. We should compare against some more SOTA attacks (regeneration, combination of many attacks)\n3. The concept of using an adversarial testing suite + introducing trainable parameters is not that new.\n4. Requires training (weakness compared to DDIM which seems very good in its base version looking at Table 1). Given the simplicity and existing speed benefit (of DDIM single step) I find it a bit harder to motivate the use of this method.\n\n\n[1] Lu, Shilin, et al. \"Robust watermarking using generative priors against image editing: From benchmarking to advances.\" arXiv preprint arXiv:2410.18775 (2024).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NzgzFACgrF", "reviewer": "Reviewer_8NsM", "summary": "This paper implements a learning-based inversion for Diffusion Models using LoRA, and names the method FARI. Also, by using the fact that the inversion trajectory has a small curvature, it reduces NFE to 1. This allows performing inversion with very low runtime after a single training. The paper applies this to the Tree-ring watermark, a famous application of diffusion inversion, and achieves faster inference time and good accuracy compared to many baselines.", "questions": "If there are any changes from the original settings proposed in the Tree-rings watermark paper, please summarize them.", "limitations": "", "rating": 2, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. This work seems quite original, as this tries learning-based inversion of diffusion models, and such approches are seldom found in the existing works. (But I have a concern for this; which will be discussed in Weakness)\n\n2. Table 1 shows that the proposed method works well on Tree-Ring Watermarks (Wen et al., 2023).", "weaknesses": "1. The proposed method uses a learning-based inversion with LoRA. I personally do not think learning-based inversion methods basically give good fidelity. This is because of the basic information difference between calculating an image from (image + noise) and calculating (image + noise) from an image. This is why many cited inversion papers use mathematical methods instead of training a new one (Wallace et al., 2023; Pan et al., 2023; Hong et al., 2024; and so on). Again, I basically think the paper's approach makes accurate noise estimation difficult. However, in the main experiment in Section 4.2, the current Tree-Ring watermark might be just too strong. This could be why FARI showed good watermark detection performance (TPR and bit accuracy) in Table 1 (I also suspect the experiment is just too easy, because all other baselines also have very high bit accuracy). But, reconstructing the noise $z_T$ well is a more fundamental goal and is more flexible for applications, but such experiments were not conducted in the manuscript. For example, if we want to put more information into the watermark than the current Tree-ring (e.g., a tree-ring watermark with high information density, like a circular barcode), then good noise reconstruction will be more important. To show this, many papers compare MSE or NMSE for noise reconstruction. Without this comparison, and based on my research experience and personal belief, it is hard to believe that FARI got good results in Table 1 because it is good at noise reconstruction. I suggest adding another table, like Table 1, that shows the round-trip MSE loss for noise reconstruction and image reconstruction. Also, it would be good to add qualitative results, not just quantitative ones. For example, pass the estimated noise $\\hat{z_T}$ through the Decoder and compare it to the original $z_T$, and add error maps. Honestly, I think this new Table and Figure showing the inversion error directly is more important than the current Table 1.\n\n2. The models used for experiments are not the latest. Rectified Flow is a more advanced diffusion model with reduced curvature, and I understand that SD3 (the successor to SD 1.5 and SD 2.1) is a Rectified Flow model. For practical use, it would be good to see experiments on models like SD3.\n\n3. L231 states it is memory-efficient because of LoRA. But, it will use the same amount of RAM even if you train a separate network. It should be called disk-efficient because it saves some neural network weights. But saving a little disk space on SD weights is not a big advantage.\n\n4. Overall, the font size in the figures is small. Also, some subsections are just one big paragraph, which makes it hard to read. Figure 2 could be made larger by increasing its width. For tables, there are better formats like https://github.com/jonbarron/tabilize/blob/main/tabilize.ipynb. This is used often and would be good to consider.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XcTOedw9NX", "reviewer": "Reviewer_3yip", "summary": "This paper proposes a solution to the bottleneck of inversion-based watermarking in diffusion models: the diffusion inversion process is slow, unreliable, and particularly lacks robustness against external distortions. The authors' core observation is that the curvature of the DDIM inversion trajectory is significantly lower than its forward generation trajectory, making the inversion path highly compressible and suitable for approximation with very few NFEs. Based on this, the paper proposes a one-step inversion framework named FARI. The method achieves this one-step inversion through lightweight adversarial LORA fine-tuning, which unlocks end-to-end robustness training. Experiments show that with only about 20 minutes of fine-tuning, FARI's one-step inversion surpasses the robustness of the 50-step DDIM inversion baseline while dramatically increasing speed.", "questions": "Questions\n\n1.  Regarding unconditional inversion (refer to the Weakness): If the inversion is performed unconditionally (CFG=1.0) while generation uses strong guidance (e.g., CFG=7.5). How does this unguided inversion robustly map back to the correct $z_T$? Does the adversarial training implicitly learn to \"undo\" the CFG effect, and have the authors explored alternatives?\n\n2.  Regarding inversion curvature: The paper's core claim is the lower curvature of the inversion trajectory, which is attributed to \"low-frequency information retained in the accumulated error.\" This explanation feels more like an intuitive observation than a formal analysis. Could the authors provide a more in-depth, formal theoretical analysis explaining why the inversion trajectory systematically exhibits lower curvature?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Novel Insight about Trajectory Curvature: The paper's main contribution is its core observation—that the DDIM inversion trajectory's curvature is significantly lower than the generation trajectory. The authors correctly identify this geometric property as a key \"enabler,\" showing that the inversion path is inherently highly compressible and thus well-suited for one-step approximation via techniques like distillation. This is a non-obvious and highly original insight.\n\n2. Practical Implementation: The use of lightweight LoRA for fine-tuning is a very practical and elegant solution. It requires minimal training time (i.e., ~20 minutes) and allows the \"plug-in\" robustness enhancements to be applied during the inversion, without affecting the original model's weights, thus perfectly preserving generation quality. This effective design is highly practical for real-world usage.", "weaknesses": "Weakness\n\n1. Technical Novelty: While the geometric insight is novel, the methods used (e.g., trajectory distillation, adversarial training, LoRA fine-tuning) are all established techniques. The paper's contribution lies more in the clever application and combination of these existing tools rather than a fundamental breakthrough in inversion or distillation methodology itself.\n\n2. Reliance on Unconditional Inversion: The FARI inverter is trained and executed in an unconditional setting (i.e., guidance scale = 1.0) to avoid the irreversibility issues of CFG. However, most images are generated using a much larger CFG. This mismatch between guided generation and unguided inversion is a potential source of error and a limitation on the method's generality, even if adversarial training empirically compensates for it.\n\n3. Limited Applicability: The method and the inversion-based watermarks it relies on are fundamentally tied to ODE-based deterministic samplers (e.g., DDIM). The authors acknowledge this in the limitations section. It is incompatible with SDE samplers, which limits its universality in the broader diffusion model applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qJICVvgcA1", "reviewer": "Reviewer_yTFb", "summary": "This paper presents a method for one-step robust inversion in the context of diffusion model-generated images. This method leverages LoRA fine-tuning with the insight that the inversion trajectory has lower curvature than the forward step, making it easier to reproduce with fewer steps. They specifically speed up the inversion process with minimal loss of quality for watermark extraction, demonstrating that their method outperforms the existing baseline of DDIM in both speed and quality when used with the Tree-Ring and Gaussian Shading watermarks. They also show that this improvement is maintained in adversarial settings where the images have been perturbed naturally. Finally, they study the robustness of their method to varying attack and guidance parameters and perform an ablation study over some of their hyperparameters.", "questions": "1. It should be clarified whether the LoRA branch is purely for robustness or is necessary for the one-step inversion process as a whole. What this means is, if we remove the LoRA parameters and their associated fine-tuning from Equation (10), does the inversion process still work? If it does not work, clarifying that LoRA is necessary for the entire process, rather than just for robustness, could be valuable.\n\n2. For Equations (9) and (10), I have a few questions and concerns:\n\n2.a. It is specified that $t$ is set to 0 instead of $t=T$ as one would normally do for inversion when following the piecewise linearity assumption. Rightfully, you highlight that for a one-step process, the piecewise linearity assumption does not hold, but that does not really justify your choice of $t=0$ rather than any other $t$ value, like $t=T$ or $t=1$. Also, from my understanding, $t=0$ is never used when training the denoising network (since $t=0$ is the last step), so it would be out-of-distribution. Also, you then mention that empirically, you use a small $t \\sim 0$ value, but never specify what it is, how it is chosen, and why it is not just zero as you specified in Equations (9) and (10). Perhaps an ablation study over different values of $t$ could help clarify the choice.\n\n2.b. You mention that the piecewise linearity assumption is broken, and you mention that Equation (10) is equivalent to Equation (2). Yet, in Equation (2), the $\\epsilon$ component is dependent on $z_t$, but for Equation (10), you substituted it with $z_0$. This would only be possible if the piecewise linearity assumption held, allowing you to substitute with minimal error. This substitution is not explained nor justified. My intuition is that the LoRA training helps mitigate the error caused by this substitution.\n\n3. Please clarify, either in the text or the figure caption in Figure (1), both what the unit of measurement is for curvature and how this curvature was measured. Has this been computed over one sample, one hundred samples, 1000 samples? Since this is your motivating result, it should be clear how it was derived. Showing curvature statistics across multiple seeds, model architectures, and datasets could help solidify your observation as a general one.\n\n4. This is minor, but the figure text can sometimes be quite small to read, especially for small figures like Figure 3.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "While the process itself is not particularly original, the curvature observation appears novel. The use case of faster inversion for watermarking and how it enables better adversarial training is significant.\nThe results showcase a tangible improvement over the existing baseline and other adapted methods. \nThe paper is well-written.", "weaknesses": "1. While the paper is well-written, it suffers from a lack of clarity around key points, such as the exact purpose of the LoRA branch, and it glosses over some important substitutions in the equations. \n\n2. The experimentation could benefit from an evaluation of FARI against stronger watermark removal methods [1,2], rather than only natural distortions.\n\n3. The experiments use the metric of TPR at $10^6$ FPR, but they only evaluate with $10^3$ samples. This appears to be a mismatch, either the FPR is extrapolated or the sample size needs further description. Likewise, they are using four significant digits, even though the measurement is based on an evaluation with only 1000 samples. This would be dependent on how many bits were used per-key, but the number is not specified. Was each prompt sample used with different watermarking keys repeatedly? If so, how many? Either the FPR is meaningless, or the exact number of samples used needs clarification. These issues cast a shadow of doubt on the credibility of your results. The exact experimentation and evaluation setup needs to be clarified to justify that your results are meaningful.\n\n[1] Zhao, Xuandong, et al. \"Invisible image watermarks are provably removable using generative ai.\" Advances in neural information processing systems 37 (2024): 8643-8672.\n\n[2] Lukas, Nils, et al. \"Leveraging optimization for adaptive attacks on image watermarks.\" arXiv preprint arXiv:2309.16952 (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)