Attack-Resistant Watermarking for AIGC Image Forensics via Diffusion-based Semantic Deflection
Authors: Qingyu Liu
Yitao Zhang
Zhongjie Ba
Chao Shuai
Peng Cheng
Tianhang Zheng
Zhibo Wang
Venue: ICLR 2026 Poster (2026)
Keywords: AIGC copyright protection; Image watermark; Diffusion model
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Protecting the copyright of user-generated AI images is an emerging challenge as AIGC becomes pervasive in creative workflows. Existing watermarking methods (1) remain vulnerable to real-world adversarial threats, often forced to trade off between defenses against spoofing and removal attacks; and (2) cannot support semantic-level tamper localization. We introduce PAI, a training-free inherent watermarking framework for AIGC copyright protection, plug-and-play with diffusion-based AIGC services. PAI simultaneously provides three key functionalities: robust ownership verification, attack detection, and semantic-level tampering localization. Unlike existing inherent watermark methods that only embed watermarks at noise initialization of diffusion models, we design a novel key-conditioned deflection mechanism that subtly steers the denoising trajectory according to the user key. Such trajectory-level coupling further strengthens the semantic entanglement of identity and content, thereby further enhancing robustness against real-world threats. Moreover, we also provide a theoretical analysis proving that only the valid key can pass verification. Experiments across 12 attack methods show that PAI achieves 98.43\% verification accuracy, improving over SOTA methods by 37.25\% on average, and retains strong tampering localization performance even against advanced AIGC edits. Our code is available at \url{https://github.com/QingyuLiu/PAI}.

Published as a conference paper at ICLR 2026
ATTACK-RESISTANT WATERMARKING FOR AIGC IM- AGE FORENSICS VIA DIFFUSION-BASED SEMANTIC DEFLECTION
Qingyu Liu', Yitao Zhang', Zhongjie Bal.2; Chao Shuai',
Peng Cheng" 122 Tianhang Zheng" Zhibo Wang
'The State Key Laboratory of Blockchain and Data Security, Zhejiang University
Hangzhou High- Tech Zone (Binjiang) Institute of Blockchain and Data Security, China faingyuliu, 2221031, zhongj jiba,, chaoshuai, peng.cheng, 2thzheng, zh ahibowang] ju. edu. cn
ABSTRACT
Protecting the copyright of user-generated Al images is emerging challenge as AIGC becomes pervasive in creative workflows. Existing watermarking meth- ods (1) remain vulnerable to real-world adversarial threats, often forced to trade off between defenses against spoofing and removal attacks; and (2) cannot sup- port semantic-level tamper localization. We introduce PAI, training-free inher- ent watermarking framework for AIGC copyright protection, plug-and-play with diffusion- based AIGC services. PAI simultancously provides three key function- alities: robust ownership verification, attack detection, and semantic-level tam- pering localization. Unlike existing inherent watermark methods that only embed watermarks noise initialization of diffusion models, design novel key- conditioned deflection mechanism that subtly steers the denoising trajectory ac- cording the user key. Such trajectory-Iever coupling further strengthens the semantic entanglement of identity and content, thereby further enhancing robust- ness against real-world threats. Moreover, we also provide theoretical analysis proving that only the valid key can pass verification. Experiments across 12 at- tack methods show that PAI achieves 98.43% verification accuracy, improving over SOTA methods by 37.25% on average, and retains strong tampering local- ization performance even against advanced AIGC edits. Our code is available http::////gtttuu..ooo./
INTRODUCTION
Recent advances in diffusion-based AIGC systems have enabled creators generate high-quality images at scale, raising urgent demands for copyright protection and provenance accountabil- ity (U.S. Copyright Office| Jan-5520255) While most prior works on AIGC copyright have focused on protecting training data, we highlight the emerging challenge of safeguarding the copyright of user-generated AIGC images. To this end, watermarking provides natural solution, where existing approaches can be grouped into embedded and inherent paradigms. Embedded watermarking injects networks or frequency transforms (Zhang et al.) 2024 Fernandez et al.) 2023 Zhu et al. 2018). but requires costly adversarial training improve robustness against common image degradations such as compression. In contrast, inherent water- marking integrates watermarks into the generative process (Wen et al.) 2023] Yang al.. 2024b), semantically coupling identity with content and achieving robustness without extra training, making more practical direction for protecting user copyrights in real-world AIGC services.
signals after generation through encoder-decode
However, beyond common degradations, real-world adversaries exploit stronger threats that com-
promise copyright protection directly. The removal attack (Saberi et al. 2023 Müller et al. 2024
Ba et al.) crases ownership evidence, the spoofing attack (Yang et al. 2024a Müller et al.
2024
Dong al., Ba et al.) forges false attribution, and the localized tampering attack maliciously alters
image semantics while preserving an authentic appearance (e.g., face swapping (Chen et al.
2020
'The corresponding author.

---

Published as a conference paper at ICLR 2026
Collectively, these threats lead to disputes where authorship may be denied, falsely claimed, or ob- scured by partial manipulation, highlighting the need for watermarking systems that enable both reliable verification and forensic analysis.
When confronted with these escalating threats, existing watermarking schemes face two critical limitations. First, we observe critical trade-off between defending against removal and spoof- ing attacks. Current schemes rely on one-dimensional verification metrics such as decoded bit counts (Zhu et al. 2018; [Tancik et al. 2020 Fang et al.] (022) to decide ownership. This way inevitably collapses the complexity of adversarial behaviors into a single scalar. Removal attacks decrease the score to fall below the threshold, while spoofing inflates it beyond the threshold. Ad- justing this threshold for one attack often undermines defense against the other, since defenders cannot assume prior knowledge of the adversarial goal. Second, most existing methods remain limited to binary ownership verification and lack provenance-aware forensic capabilities. In practice, defenders must determine not only whether an image is watermarked but also whether and where it has been manipulated. Ideally, watermarking system should distinguish between removal (attacked but still owned), spoofing (forged and not owned), and tampering (owned but locally modified). With the rise of advanced AIGC editing tools (Rombach et al. 2022 Google 2024), which enable subtle semantic-level modifications while preserving global appearance, pixel- based localization methods (e.g.. EditGuard (Zhang et al.] 2024 become ineffective. This calls for a more robust forensic analysis that can reason about semantic manipulations in the latent space.
In this paper, we propose PAI (Provenance- Aware Inherent watermarking), a plug-and- play training-free framework for AIGC copy- right forensics. PAI aligns watermark injection with the two-stage generative process of diffu- sion: in the initialization stage, a user key and timestamp are embedded into the initial noise through the Box-Muller transformation (Box & Muller 1958) that preserves the Gaussian prior, ensuring both compatibility with diffusion sam- pling and diversity of outputs; in the denois- ing stage, we apply cee-coondti de- flection during early steps, semantically bind- ing the user identity the generative trajec- tory. This dual-stage design yields implicit, addteit-ddaptive watermarks that inherently re- sist inversion- based attacks, as any reversal of the process requires the correct key to reconstruct the initial state.
EditGuard
Imrgee Degradation
Trio-Ring
Tamperi
tcck Removal
Gmussian Shading
Locall
tcck
Stable Signatum PAi
Performance
Afte
eeding
kEls 100%
sPL 45%
Detect
rtack
20%
0. Not Seppetaa
Eraduntion Dimcasione
Oraec
-hipprring
Verification
Altick
Figure 1: Comparison of SOTA image watermark- ing methods across 7 dimensions of robustness and functionality. Overall, PAI achieves balanced and superior results across all dimensions.
For watermark provenance, PAI inverts the injection process via DDIM inversion and defines the ini- tialization bias (the discrepancy between theoretical and recovered initial noise) as a unified forensic signal. This enables three tasks: (1) vanilla verification, where theoretical and empirical analysis show that valid keys consistently yield lower bias than invalid or watemaaerrrrked cases, allowing principled rejection via hypothesis testing: (2) robust verification, where instead of scalar scores, we model bias in a low-dimensional latent space to distinguish removal and spoofing through their opposite directional deviations; and (3) semantic tampering localization, where spatial anomalies in bias align with manipulated regions in RGB space, enabling precise semantic-leve forensics under PS, Deepfakes, or advanced AIGC-based editing tools.
We evaluate PAI on CelebA-HQ. COCO, and DDPM across degradations and 12 attacks, comparing with SOTA watermark schemes. PAI achieves up to 99.0%. detection accuracy under removal, 96.3% under spoofing, and 100% under tampering, with an AUC of 89.77 for localization, remaining ef- fective even against full-image edits from Gemini 2.0 Flash. Moreover, it also withstands black- and white-box adaptive attacks. To sum up, our contributions are:
We propose PAI, a training-free inherent watermarking scheme for AIGC copyright protection. By combining initialization embedding with key-conditioned deflection mechanism, our PAI couples the watermark with the generative trajectory, achieving improved robustness.
We provide a theoretical guarantee on the key exclusivity of PAI, which only allows the owner's key to pass the verification, excluding the possibility of any forged key being accepted.
2

---

Published as a conference paper at ICLR 2026
We overcome the critical trade-off of existing watermarking methods between defending against removal and spoofing attacks. Extensive evaluations show that our PAI achieves strong robust- ness against common degradations and 12 attacks, with 98,43% average ownership verification accuracy, outperforming the existing watermark methods by 37.25% on average.
Our PAI enables reliable localization against semantic-level manipulation by AIGC tools (e.g., Gemini 2.0 Flash), a new threat that bypasses existing pixel-based localization schemes but effectively addressed by our noise-space localization.
RELATED WORK
Digital watermarking has long been used for copyright protection and authentication (Xuehua 2010
Samuel & Penzhorn 2004), but traditional frequency-domain or cryptographic schemes are vulnera- removal attacks (Saberi et al. 20233 /hao et al. [024 et al.)
ble to modern deep learning-ban
2023). Recent research therefore focuses two paradigms: Embedded watermarking, which in-
jeets signals after generation via encoder-decoder networks (Zhu et al. al.] 2018 Tancik et al. 2202 Jia
2021 Fang et al. 2022),, often extending classical DCT/DWT methods (Lan et al. 2023 Jng et al.
et al.
2021). While they can jointly optimize imperceptibility and robustness, these schemes usually depend adversarial training, introduce pixel-level artifacts (e.g.. in flat backgrounds), and incur
high computational overhead (Huang et al.] 20244] Xu et al.) 2025).. In contrast, Inherent water- marking directly integrates watermark signals into the generative process, typically by perturbing diffusion noise representations (Wen et al. 2023 Yang et al. (2024b). This semantic coupling avoids separate encoder-decoder architectures, yields stronger security by making watermarks inseparable from content, offers greater robustness to post-processing, and eliminates training overhead through lightweight, generator-level injection.
Challenges and motivation. Despite advances in embedded and inherent watermarking, existing methods show key limitations in AIGC copyright protection, especially under adversarial or foren- sic scenarios. Functionally, they are mostly confined to binary ownership verification and cannot support richer forensic tasks such as attack detection or tamper localization. For robustness, existing methods remain vulnerable to advanced real-world threats, especially exhibiting trade-off between removal and spoofing attacks (see Sec. 6.3). This motivates our key insight, consistent with prior observations (Zhao et al., 2024), that watermark robustness tends to increase with stronger semantic coupling between watermark signals and generated content. Therefore, unlike prior inherent meth- ods that inject watermarks only into the initialization noise, we further introduce a key-conditioned semantic deflection (see Sec. 4. which strengthens the coupling between watermark signals and content semantics and thereby improves robustness. In addition, our design also supports attack detection and semantic- tamper localization, enabling fine-gradd tne-grained forensics beyond binary ver- ification.
3 PROBLEM FORMULATION
System Model. The AIGC copyright protec- tion system involves two entities: users and ser- vice providers (shown in Fig. (2). Users gen- erate images via AIGC services and embed watermarks to protect their copyright, while providers may watermark all outputs to en- sure provenance and regulatory compliance. To this end, we propose PAI, a plug-and-play and training-fres watermarking scheme deployed on the provider side. Since most current AIGC services built diffusion mod- els, PAI is fully compatible with the diffusion generation framework, eliminating the need for extra encoders/decoders. PAI operates in three phases:
Our PAI
naplster
User Registratio
uplooa
User Key
Generatios with
Santemarced
User
Watermaking stability.i:
AIGC ImGge
Sorial Media
Pronpt
O casssss: anase
dmunisad
DALL
Wanamerkedd
Vasila Natiiatton
AIGC Image
Klack Detacias
Watermarks Provesince
Key
Service Previder
Figure 2: System model of our PAI.
User Registration. Users first register with the provider, which issues unique private key K as the sole credential for watermarking verification.
Generation with Watermarking. Users access the provider with their private key K and a prompt to generate watermarked AIGC images. Here, the generated image metadata stores
3

---

Published as a conference paper at ICLR 2026
timestamp- tanssd salt designed for increasing diversity (see See D. which is also required for wa- termark verification; modifying this timestamp does not affect copyright verification (see Sec. 6.5).
Watermark Provenance. In copyright dispute, the owner submits the watermarked image and K for watermark provenance. The service provider verifies ownership using the image, its metadata timestamp, and K, and can trace the originating user for compliance. Our scheme also detects whether the image has been subjected to removal, forgery, or tampering attacks while preserving correct ownership; for localized tampering, our method can provide the binary mask for localizing the tampered regions.
Threat Model. In this paper, we consider the service provider as the defender. We assume that the defender (i.e., the service provider) is trusted, meaning it does not leak user keys and operates over a secure communication channel. Conversely, adversaries can be anyone who wants to modify the watermark of legitimate users' images or exploit the generation service to create poisoned images. We consider a strong adversary who can harvest many watermarked/non watermarked images, ac- quire a surrogate diffusion model, and may even obtain white-box access to our models, but cannot compromise the key store. Specifically, we categorize attacks into five escalating types, including degradation, watermark removal, spoofing, localized tampering, and adaptive attacks, and instantiate 16 concrete attacks (detailed in Tab, 4 The attack scenarios are illustrated in Fig.
Design Goal. We propose watermarking scheme that (1) preserve the visual quality of the original AIGC images generated by the provider, (2) enables high-confidence ownership verification tied to each user's 's private key, (3) resists real-world degradations and adversarial threats including removal, spoofing, localized tampering, and adaptive attacks, and (4) supports precise tamper localization against unauthorized manipulated editing.
4 GENERATION WITH WATERMARK
Preliminary. Diffusion models serve as the backbone of modern AIGC systems, enabling widely adopted platforms, e.g., Stable Diffusion (Rombach et al. 2022). DALLE (Ramesh et al.] | 2022), ) and MidJourney (Midjourney, (023). Among them, DDIM (Song et al.) (020) reformulates stochastic diffusion into a deterministic non-Markovian process governed by an ODE, enabling efficient sam- pling. Given image, DDIM inversion attempts to project back into the noise space. The two processes can be written as:
It + (VI at-1 1
Sampling process: Vor
VI en (xr,(),
Vor
Inversion process: i. = Varêi- + (V1- δz - vas - σe) Eo (it-1, t).
In practice, the deviation between inversion and forward sampling processes accumulates an intrinsic bias, which serves as a key signal for our watermark verification.
Our Method. For the generation process of diffusion models, Gaussian noise 2, -N(OO, 1) randomly sampled from the standard normal distribution is initialized as the starting point, and the corresponding image is generated by stepwise denoising (see Eq. DD. Existing inherent watermarking methods embed watermark information directly on de to obtain ,, followed by standard DDIM sampling produce watermarked images. In contrast, our watermark injection operates through dual mechanisms: initialization-stagee embedding and deflection-stage enhancement during the sam- pling process. The entire pipeline of our watermark scheme is shown in Fig.
Initialization Stage. To bind the generated content with the user identity, we embed user-specific secret key K into the initialization process. To further enhance output diversity under deterministic samplers, timestamp based salt S is incorporated. To preserve theoretical consistency with the standard diffusion framework, we employ the Box-Muller transformation (Box & Muller I958), which maps uniform variables to Gaussian ones, thereby integrating K and S into the watermarked initialization. Formally, we define the initialization function as:
24 F (K,S) 2m 5 (2 +(K)),
where K ~ NO 1). S U(0 1), and the resulting . ~ NO 1). The timestamp-basee salt S is sampled with the generation time as seed and stored in the image metadata. The cumulative distribution function (--) converts K into d(K) U(,0 1). Since (KK) and S are independent and uniformly distributed, the Box-Muller transformation ensures x.! 2. adheres (0, 1).
4

---

Published as a conference paper at ICLR 2026
Deflection Phase. To enhance the semantic correlation between watermarks and generated images, we propose progressive watermark injection during sampling. Specifically, we replace the predicted Eo with deflection function H. (K, 24m t):
WI vā--i H(K, 24 mm
t) + VI ut-1 60 (20) wm
tt:
2t mm vI Oneo (2) (m
where (K, xt 1) ( 11)
(3)
Vāv
deflection coefficient
prodicttd
Here, Po denotes the predicted tar- get image. At each step Hfoo, K) introduces minor deflections guided by K, which iteratively accumulate to form semantically coherent water- marks. The hyper-paramese y con- trols deflection intensity. To balance image quality and robustness (see ex- periments in Sec. [6), we set t 50 and apply deflection during the first five steps with 0.1.
Generation with Watermark (DDIM)
Original Image
Defloction with
Initialization
Deflection
IF F(
R(K, x7 and N (K,
Watermasked Image
K
Degradation
Watermark
Spooting
Removal
Alback
Why Do We Design in This Way? Our watermark is designed to sure verifiability, diversity, and ro- bustness. Verifiability is achieved by incorporating a user-specific key K for reliable ownership authentication. Diversity is provided by timestamp- based salt S, which introduces stochasticity to z and prevents deterministic outputs under fixed prompts. Robustness is strength- ened through a kcy-conditioned de- flection that couples the identity sig- nal with the generative trajectory, en- suring that any key mismatch pro- duces structured deviations during in- version. This coupling makes PAI sistant to key extraction and advanced semantic attacks.
Doflection
Aduprive
Attack
Tampering
Doffection
Watermarked Image
Provenance
inversion)
Injoction: / Verification precess with valid X
Vasilication with invalid
The pipeline of our PAI. The initialization stage aims to calculate the initial noise x, for generation and veri- fication processes. The deflection stage aims to use the user key to deflect the generative trajectory. rj is our implicit content-adaptive watermark.
Figure 3:
WATERMARK PROVENANCE
The generated watermarked image x when disseminated through social media platforms, be- comes vulnerable adversarial manipulations and unauthorized alterations. Given a watermarked image to be verified fymm our proposed PAI enables three critical forensic functionalities: (1) vanilla verification reject wateraaeedd content invalid keys; (2) robust verification to detect at- tacks and verify ownership under various attacks; and (3) tamper localization to predict manipulated regions.
5.1 VANILLA VERIFICATION
The copyright verification process for a given watermarked image aims to determine the image copyright by validating if the user key successfully authenticate ownership. Our verification methodology the inversion process of the watermarked image generation process (described in Sec. 4 eliminating the need for additional decoders extract the hidden messages. Specifically, given a user key K, the verification process first maps the watermarked image into the noise space (m + 2?!"), ), which uses the invertible deflection function - DDIM inversion process (i
ww Val. H (K, x1,,, + v1 di 68 (xI-1, t) 81
where H. (K, un 2t v Ct (2: t)
(4)
Val-1 ( K 11)
5

---

Published as a conference paper at ICLR 2026
Following this DDIM inversion procedure, obtain the noise-space representation æ!"". Sub- sequently, the initialization function F (detailed in Eq. 2 is employed to reconstruct the original initialization point 244 z!m generated during watermark embedding. We identify the discrepancy be- tween the initialization xt and the inverted noise representation ii as the initialization bias o,- The vanilla ownership determination is decided by threshold Teansila:
E
6.
[] =
a F FK, < Tounilla;
(5)
where E [[o]]] is the second-order moment of initialization bias.
Theoretical Analysis. Due to the imperfect reversibility of DDIM inversion, the recovered noise i inevitably deviates from the true 21, yielding non-vanishing intrinsic bias ò; (see the above preliminary). Therefore, a critical security question arises: How do we ensure only the valid key passes verification? For the theoretical analysis, consider generator without modeling error, so that deviations observed in DDIM inversion originate only from intrinsic bias. Consider the worst case where forged key K" approaches the valid key KS, We now reformulate our security requirement into a formal statement and prove it as follows, To address this, we provide both a theoretical guarantee under ideal assumptions and empirical evidence under practical conditions.
Ideal Condition. We begin our analysis by assuming an ideal generative model where the noise pre- dictor used in the diffusion process is perfectly trained. That is, it accurately predicts the expected noise conditioned on the current latent state at each timestep. This assumption ensures that devi- ations observed during DDIM inversion arise solely from the intrinsic approximation error of the inversion process itself, not from modeling noise or learning inaccuracies. Under this setting, we examine a worst-case adversarial scenario: the attacker uses a forged key K that arbitrarily close to the valid key k This represents the hardest possible case for verification, as the only difference between the two trajectories lies in the key. If we can establish that invalid keys still result in higher bias even in this proximity limit, it implies that verification will succeed with even greater reliability in more practical scenarios. We now reformulate our security requirement into a formal robustness statement and prove it as follows.
Theorem. For an invalid key K asymptotically approaching the valid key K the second-order moment of the initialization bias og (associated with K() remains smaller than that of 5," (associated with Kw):
lim K g"->X
T.
T
(6)
K
Proof. Given verification image 20mm. we analyze two distinct inversion trajectories: The authenti- cated path a6 if with valid key K yields bias &f = if =tm while the unauthenticated path 40 - 2t with K" * Ke produces 8t" = i x. where ,²' F(K" S) A x:?!m. Through systematic derivation (detailed Appendix A.2), we establish the expressions of the initialization
bias:
57
mm
FC. Ma.
M
8
N I1
mm
Nt- FM
Voi- δi
where F
vI VI-aa
(en (ii-1,
cg pom (i))
M
and F."
Va:
Bi
Eo (+ (,)
Mr (1 a1-aa--
v cts
Ci.
Eo (x wm
No
M
where M = Kc + and N y. K" + 1. This expression reflects that valid keys only accumulate temporal errors during the inversion process, while invalid keys additionally introduce a baseline discrepancy from mismatched initialization. This ensures their bias cannot be smaller than that of the valid key, even in the worst-case proximity. Complete proof is provided in Appendix
Practical Condition. While the above analysis assumes an idcalized generative setting, real-world systems are subject to imperfect training and model noise. While such model imperfections in- troduce additional noise into the inversion process, their effects are largely shared between valid

---

Published as a conference paper at ICLR 2026
and invalid keys through the accumulation of prediction enrors in the F; terms of Eq. 7 However, invalid keys additionally incur a baseline initialization discrepancy, which remains unaffected by model quality. As result, the bias induced by invalid keys remains consistently larger than that of valid keys, even in the presence of model imperfections. We empirically verify that the theoretical guarantee remains effective in practice through two evaluations: 1) Distribution Visualization. We visualize the second-order moment of the initialization bias induced by the watermarking key. As shown in Fig. | invalid keys lead significantly higher initialization bias compared to the valid key. Furthermore, when applying the verification process to unwatermarked images, the resulting bias is also significantly high. These results support our security analysis by empirically demon- strating that only the correct key generates statistically small initialization bias. 2) Adaptive Key Extraction Attack. We simulate a white-box attacker with full access to the generation model. The attacker performs gradient-based optimization on a forged key to minimize 5g with respect to target image. However, as shown in Sec. 6.3 the optimization fails to reach the bias level of the true key, and the final result remains above the verification threshold. This confirms that even with complete system access, the key cannot be extracted or imitated.
Vanilla Verification Threshold Decision. We analyze the distribution of the initialization bias 6,, as shown in Fig. We observe that the second-order moment of 6, remains consistently small for the valid key, but is signif- icantly larger for invalid keys and non-matermrrked im- ages. Therefore, assuming the invalid-key bias follows a Gaussian distribution, we formulate vanilla verification as a one-sided hypothesis test. A significance level a deter- mines the threshold Teansila. which controls the false pos- itive rate for unauthorized or non-watermarked inputs. If the observed initialization bias exceeds Twanillos the key is rejected as invalid; otherwise, 5, is further projected into the PCA space for robust verification. Importantly, this PCA-based verification specifically targets adversarial cases where attacks force the bias to appear deceptively close the benign distribution.
Distribution of Initialiizaooon Bits
Nonvwen eomerrcc in
Velfiaciion
Velitaaion
Denatty
Vanille verifiaaion tnreshold
Second-orcler moment initializatin ion bies
Figure 4: Visualization of the second- order moment of the initialization bias.
5.2 ROBUST VERIFICATION
Observation. Beyond rejecting invalid keys and non-watermarked images, a robust verifier must also distinguish adversarial threats, espe- cially watermark removal and spoofing, which
Aluck with
PCR componut
Spcering Atticc
Watemant Hanova Attack
Onrershp fag
have opposite targets. Most prior work fo- cuses on matching embedded messages dur- ing injection and extraction by using a one- dimensional criterion. Our experiments show this scalar cannot separate removal from spoof- ing (see Sec. 6.3). Although both attacks introduce semantic distortions, they may result in sim- ilar bias magnitudes, making it difficult to separate them using a single numerical threshold. We observe that, despite similar magnitudes, removal and spoofing induce distinct directions in the high-dimensional latent space. Projecting initialization- vectors with PCA reveals separable tra- jectories (Fig. 5) removal departs from the benign watermarked cluster, whereas spoofing departs from non-waterr non-wwattmarked images in the opposite direction.
-10
Ferroval drsci
Arovi Reglin
-20
PCA componenc
Figure 5: Visualization of the initialization bias under attacks.
In the PCA- projerteetted space, we model benign initialization biases as z N Σ) and measure deviations with the Mahalanobis distance (Mahalanobis, 2018). Under the benign null, D2 (z) X² with & equal to the projection dimension (I: here), giving a threshold Trobust = x a). sample is marked as abnormal if (²) Trobust: providing a principled statistical test for detecting adversarial perturbations or watermark inconsistency. To support both attack detection and owner- ship verification, we define the benign distribution differently for each task. For attack detection, we model the benign distribution from valid-key inversions without attack. For ownership verifica- tion. the benign distribution also includes degraded or eemoval-affected samples, since authorship is determined by the valid key rather than post- modifiioiii....ss.. This distinction ensures robustness to removal while preserving legitimate ownership.
7

---

Published as a conference paper at ICLR 2026
5.3 TAMPER LOCALIZATION
Observation. We observe that regional differences in RGB space consistently align with anomalies in the corresponding noise space (Fig. [a).b)). Specifically, given valid key and tampered image zi) x/mmm (arg = Ti ) we first apply our inverse deflection process (ig - =. to obtain its representation in the noise space. The original watermarked image 20th. = 16 follows the same process ZÚ + ZG. Therefore, the tampered region in the RGB space is the difference between the tampered and original watermarked image, denoted as Ωo = =0" ID noise space, we obtain the tampering discrepancy at time step as S2 = oं -.. Fig. 6 and (b) visualize S2 and f4 showing that anomalous regions in the RGB space correspond to coherent anomalies in the noise space.
TD Extending this to the
While S2 offers accurate tamper localization, it relies on access to the original watermarked image to compute ii, which is typically un- available in practice. To address this, we refor- mulate Ω (&g" =x²" (&f =
85' 88, where o5 and of represent the ini- tialization biases of the tampered and origi- nal watermarked images, respectively. We ap- proximate of with the average intrinsic bias A from wotewarerrrrked samples, yielding á 5 A, Experiments on both pixel- and latent-space diffusion models (using 100 clean images) show that S2 closely matches 24 ef- fectively exposing tampered regions (Fig.
Waberseked
Tespenal Image
Aocsnda
Figure 6: Visualization of the difference in noise space between the original and the tampered wa- termarked images. The anomalies in the tampered region show consistency in RGB space and noise space. The first row is the result of DDPM and the second row is the result of Stable Diffusion.
Finally, traditional image processing techniques (such filtering and morphological operations) are applied to refine Q4 into binary mask that accurately highlights manipulated areas (Fig. d)).
EVALUATION
In this section, we evaluate PAI against existing watermarking baselines in terms of effective- ness, robustness, tamper localization, and resilience adaptive attacks. Additional settings (Ap- pendix 1.6.1). results, and analyses, including ablation studies (Appendix (A.6.3), runtime analysis (Appendix|A.oo and discussions on the key space (Appendix A.5) are provided.
6.1 SETUP
Implementation Details. We evaluate our framework in both unconditional and T2I generation settings. For unconditional generation, adopt pre-trained DDPM on CelebA-HQ, and for T2I, we use Stable Diffusion v2.1 with captions from COCO and CelebA-HQ. For fairness, each method produces 5,000 watermarked images and shares the same 5,000 non- nateraarrarree images. The complete implementation details are provided the Appendix(A.6l A.6.
Evaluation Metrics. We evaluate scheme across four aspects: functionality, image quality, robustness, and tamper localization. For verification and detection, we report TPR/FPR and ACC, including attack detection accuracy (A-ACC) and ownership verification accuracy (O-ACC). For perceptual quality, we use CLIP--hsed similarity (CLe and CI.IP-rrompt), while PSNR is reported under adversarial settings. For tamper localization, we adopt standard segmentation metrics including F1, AUC, and IoU. Detailed definitions are provided in the Appendix A.6.
Comparative Baseline (Defender). We compare against tWO embedded methods (Edit- Guard (Zhang et al.] 2024). Stable Signature (Fernandez et al. 2023) ) and two inherent methods TTree-Ring (Wen et al. (202), Gaussian Shading (Yang et al. 2024b ) Among them, only Edit-
Guard supports tampering localization.
Attacker Setting. We evaluate robustness with four degradations and 12 attacks, including removal, spoofing, localized tampering, and adaptive attacks (see Sec. 3).. Detailed attack configurations and hyperparameters are provided in Appendix A.4.2
6.2 EFFECTIVENESS
Tab. Π presents a comprehensive comparison of our watermarking scheme with existing methods in terms of reliability and fidelity under clean conditions. For reliability, variants achieve superior
8

---

Published as a conference paper at ICLR 2026
Table 1: Evaluation of watermarking methods under clean settings (no attack). We report detection performance with and without watermarks, as well as image generation quality. Bold values indicate the best results.
Dataset
CelebA-HQ Dataset
(16). TPR (9))
(58) CLIP-Imuge 1 CLIP-Pronge FID
(S)
TPR (9)
(P) (16) CLIP-Jnuge CLIP-Proupt 7 HID
EdiCCardd
99.89
100,0
0.82
0.98
99.67
100.0
0.65
0.97
Stbble Signature
99.51
92.22
1..00
0.98
0.26
27.22
99.51
99.22
02.00
0.58
0.25
20.36
Thes- Ring
99.72
100.0
0.56
0.46
0.25
25.37
99.96
99.99
0,06
0.82
0.25
23.02
Gamesian Shuding
100.0
100.0
0.00
0.83
0.55
20.47
100.0
108.0)
0.00
0.75
0124
23.72
PAI (Uncundition)
95.67
97:57
0.251
0.56
PAI (T21)
100.0
100,0
0,00
0.84
0.26
20.27
100,0
100.0
0.00
0.76
0.25
21.37
Compreostion
Tlur
Brightnees
200
100
50
99
60
Distortion Level
Distartion Level
Distariion
Distorion Level
Desioriion Level
EdiiGaadd
Stabi
Gaussian Shading
Our
Figure 7: Evaluation of common image degradations ownership verification accuracy.
verification accuracy, with T2I reaching 100% TPR. For fidelity, the T2I variant preserves high visual quality and semantic alignment. To further evaluate watermark imperceptibility and user- perceived quality, we conducted user study (see Appendix (A.6.)..
6.3 ROBUSTNESS
We focus robustness evaluation the T2I setting, this better reflects a real-world scenario.
Image Degradation. As shown in Fig. 7 our method and other inherent schemes remain robust under JPEG compression, noise, blur, and brightness changes, whereas embedded baselines show sharp drops when facing unseen degradations (e.g., EditGuard fails under blur). This confirms that embedded methods largely depend on adversarial nugmentation-based training achieve robustness against degradation, while inherent watermarking offers a more promising paradigm for real-world protection.
Table 2: Evaluation of watermarking methods under watermark removal and spoofing attacks. We report both attack detection and ownership verification performance, alongside image quality under adversarial conditions,
(a) Watermark removal attacks
DifTusion Purilication Allack
Clastffer-hacod
Impeinting Removal Attack
Method
Adversarial Attack
Average
Attack
Ownership ACC (%) PSNR
Attack
Ownership (%) PSNR
Attack
Ownership PSNR (%)
Attock (S))
Ownership (%) PSNR
ACC (8)
ACC (5)
ACC (%)
EdisGuard
0.30
21.96
100.0
30,30
50.15
26.13
Stable Signature Ring Gaussian Shuding
0,28
24.76
87.62
33,00
43.95
28.88
32.12
21.92
99.98
23.92
99.80
31.56
100.0 100.0
21.69
99.93
25.72
PAI (T21)
99.00
99.00
24.77
97.00
98.00
31,80
100.0
21.59
98.67
99.00
26.05
(b) Spoofing atlacks
Puttern Extruction Attack
Reprompting Attack
Imprinting Forgery Attack
Method
Average
Ownership ACC (9) 7 ACC (R)
Artack
PSNR
Attac
Ownership (S) PSNR
Attack
Ownership (S) PSNR
Attock ACC
Ownership ACC
ACC (9)
ACC (5)
EdisGrard Stable Signature
37.12
48.69
37.12
48.69
16
99.92
Tree-Ring
Guussian Shoding
28.56
35.40 46
2.74
16.00
17.68
15.77
26.57
PAI (T2I)
100.0
92.00
39.33
100.0
97.00
10ILO
100.0
17.32
100.0
96.33
28.32
Watermark Removal Attacks and Spoofing Attacks. As shown in Tab. 2a and Tab. 2b exist- ing methods exhibit clear trade-off: Stable Signature are robust against spoofing but fragile to removal, while Gaussian Shading resists removal but fails under spoofing. This arises from using one-dimensional verification signals (e.g., scalar thresholds or decoded messages), which are un- able to capture the differences in attack behaviours. In contrast, our PAI models the directional differences in latent subspace for distinguishing different attack behaviors (Sec. achieving 99% O-ACC under removal and 96.3% under spoofing. We further report ownership verification accuracy across different PSNR levels, as shown in Fig. 11

---

Published as a conference paper at ICLR 2026
W Valermatiodd
Image
Tamperod
image
Editiionnt
Watemaaked imrage
Tireperd Image
EdrGuard
Watormrrood image
Tarpered Image
PA
Waternakeed image
Targpred image
BAI
(a) EditGuard localization result
(b) Our PAT localization result
Figure 8: Localization performance comparisons of our PAI and EditGuard on Google's Gemini 2.0 Flash generation model (Google 2024).
6.4 TAMPER LOCALIZATION
Table 3: Comparison of watermarking methods with respect to tampering detection and localization performance. 'A- ACC' and 'O-ACC' denote the accuracy of attack detection and ownership verification, respectively.
Tab. showss that PAI achieves high level of attack detection and consis- tently 100% ownership verification across three tampering types: par- tial edits (PS, Simswap) and full- image semantic editing (Stable In- painting). Unlike partial edits that preserve much of the original image, full-image methods rewrite the entire content, where EdittGurrd collapses (O-ACC= 0.08%, F1 = 34.00%). In contrast, PAI remains effective without any task-specific train- ing, reaching F1 of 80.00% and IoU of 67.00% On average, PAI outperforms EditGuard across all metrics and further succeeds under tampering by a commercial AIGC model Gemini 2.0 Flash (Fig. (). highlighting its robustness to emerging semantic-level editing tools. We also evaluate lo- calization performance under varying tampered region ratios, with detailed results shown in Fig. 12
Metric
PS
Simswap
Stable Inpainting
Average
EditGuard
EdiiGaard
EditGuard
EditGuard PAI
A-ACC
80,00
85,00
73.00
79.33
O-ACC f
99.00
100.0
99.15
100.0
0.08
100.0
66.08
100.0
FI
86.07
66.24
85.49
84.92
34,00
80.00
68.52
77.05
AUC f
89.68
88.20
87.62
87.10
50.00
94.00
75.77
89.77
78.48
57.52
75.25
74.06
58.58
6.5 ADAPTIVE ATTACK
We evaluate three adaptive attacks. First, show the timestamp salt is only for diversity, domly tampered with the saved timestamps on watermarked images and observed no degradation in ownership verification (remained 100%), confirming verification is anchored to the private key rather than the public timestamp. Second, under a full white-box assumption where the injection model known, we attempted to learn candidate key evade the verification. Fig. I0a shows the optimization fails to converge, and cannot match and recover the target key. Finally, assuming the PCA projection used for robust verification is also white-box, we optimised learnable image perturbations that push samples toward the benign shown Tab. [ these attacks do not bypass our pipeline: ownership verification remains at 100% and the attack detection accuracy stays high (sz 9-100%%. We provide detailed analysis of these white-box adaptive attacks in the Appendix A.6.4
won-raaermrreed regions in PCA space. As
7 CONCLUSION
We propose PAI, a plug-and-play inherent watermarking framework for diffusion-hasee AIGC im- age copyright protection. By embedding semantic watermarks during both initialization and sam- pling, PAI achieves high fidelity and strong robustness without training. Through DDIM inversion, unify ownership verification, attack detection, and semantic-level tampering localization using a single statistical signal, namely initialization bias. Extensive experiments demonstrate superior performance across 12 attack types, including spoofing and semantic tampering, with 98, 98.43% ver- ification accuracy. PAI offers a practical and principled solution for secure, forensic-ready AIGC content provenance.
10

---

Published as a conference paper at ICLR 2026
8 REPRODUCIBILTY STATEMENT
We ensure the reproducibility of our PAI framework by providing detailed descriptions of the system model, dual-stage watermark injection, and verification procedures (Sec. 3 Sec. and Sec. (5)- Implementation details, including model configurations, hyperparameters, datasets, and evaluation metrics, reported in Sec. 6 while additional proofs and extended evaluations are provided in the Appendix. To further support replication, we release the core code and experiment scripts in the repository:
ETHICS STATEMENT
This work aims to protect the copyright and provenance of Al-generated images by introducing a secure, provider-side inherent watermarking framework. Our framework is designed solely for copyright protection and provenance verification. User keys remain private, evaluations rely only on public datasets, and no sensitive personal data is used. We highlight that potential misuse for non-consensual tracking lies outside our intended scope; our contribution to foster responsible AIGC development by strengthening intellectual property protection while respecting user rights.
ACKNOWLEDGEMENTS
This work is partially supported by the Zhejiang Provincial Natural Science Foundation of China under Grant (No. LD24F020010), the National Natural Science Foundation of China under Grant (No. 62472372, No. 62572426, No. U24B20182), Shanghai Municipal Science and Tech- nology Major Project (2025SHIIZZX0256177), and the National Key R&D Program of China (204YFB44053000.
REFERENCES
Zhongjie Ba, Yitao Zhang, Peng Cheng, Bin Gong, Xinyu Zhang, Qinglong Wang, and Kui Ren. The robustness-security paradox: Channel-aware feature learning for adversarial watermark ploitation.
George EP Box and Mervin E Muller. A note on the generation of random normal deviates. The annals of mathematical statistics, 29(2):610-61, 1958.
Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning follow image editing instructions. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 18392-18402, 2023.
Renwang Chen, Xuanhong Chen, Binghing Ni, and Yanhao Ge. Simswap: An efficient framework for high fidelity face swapping. In Proceedings of the 28th ACM international conference on multimedia, pp. 2003-2011, 2020.
Ziping Dong, Chao Shuai, Zhongjie Ba, Peng Cheng, Zhan Qin, Qinglong Wang, and Kui Ren. Wm- copier: Forging invisible watermarks on arbitrary images. In The Thirty-ninth Annual Conference Neural Information Processing Systems.
Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang, and Weiming Zhang. Pimog: An effec- tive screen-shooting noise-layer simulation for deep-learning-base watermarking network. In Proceedings of the 30th ACM international conference multimedia, pp. 2267-2275, 2022.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEESCVF International Conference Computer Vision, pp. 22466-22477, 2023.
Google. Gemini 2.0 flash.
Flash/ 2024.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.

---

Published as a conference paper at ICLR 2026
Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937-3963, 2024.
2024.
Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based water- marking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, pp. 41-49, 2021.
Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai- gi-generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 1168-1181, 2023.
Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang. and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference computer vision, pp. 4733-4742 2021.
Yuhang Lan, Fei Shang, Jianhua Yang, Xiangui Kang, and Enping Li. Robust image steganography: hiding messages in frequency coefficients. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pp. 14955-14963, 2023.
Tsung- Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Dollár. Microsoft coco: Common objects in context, 2015. URL htt.:htttt/saiiiiieeeeeem owg/orgg///.... 1405. 0312
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in neural information processing systems, 35:5775-5787, 2022.
Prasanta Chandra Mahalanobis. On the generalized distance in statistics. Sankhyā: The Indian Journal of Statistics, Series (2008-), 80:$1-57, 2018.
Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptogra- phy. CRC Press, Boca Raton, FL, USA, 1996. ISBN 978-0844385520.
Midjourney. Midjourney.
com 2023.
Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks semantic watermarks for diffusion models. arXiv preprint arXiv:2412.03283, 2024.
William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 4195-4205, 2023.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint arXiv:2204.06115, 1(2):3, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- on computer vision and pattern recognition, pp. 10684-10000 10685, 2022.
Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi Robustness ai-image detectors: Fundamental limits and practical attacks. arXiv preprint arXiv:2310.000 00076, 2023.
Samuel and WT Penzhorn. Digital watermarking for copyright protection. In 2004 IEEE Africon. 7th Africon Conference in Africa (IEEE Cat. No. 04CH37590), volume 2, pp. 953-957, IEEE, 2004.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint XXi::2010002500 2020.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recogni- fion, pp. 21 2117-2126, 2020.
12

---

Published as a conference paper at ICLR 2026
U.S. Copyright Office. Copyright office releases part 2 of artificial intelligence report, 29-Jan-2025. wtt..ooo.......oeeeeeeeeeeeeee/e
URL
html
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings wa- termarks: Invisible fingerprints for diffusion images. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine (eds.), Advances in Neural In- formation Processing Systems, volume 36, pp. 58047-58063, Curran Associates, Inc., hwwp:igs.eeuuispp. coppper http:/aaaperffeeeaaaeeeeeeeeee files/paper/2023/ pdf
2023. URL
Weihao Xia, Yuju Yang. Jing-Hao Xue, and Baoyuan Wu. Tedigan: Text-guided diverse face image generation and manipulation, 2021. URL
wwwp/bs////aaoo...ooooo........r http://bb///2222.. 03308
Rui Xu, Mengya Hu, Deren Lei, Yaxi Li, David Lowe, Alex Gorevski, Mingyu Wang, Emily Ching, and Alex Deng. Invismark: Invisible and robust watermarking for ai- zi-generated image provenance. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 909-99999 918. IEEE, 2025.
Jiang Xuchua. Digital watermarking and its application in image copyright protection. In 2010 International Conference on Intelligent Computation Technology and Automation, volume 2, pp- 114-117. IEEE, 2010.
Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Steganalysis on digital watermarking: Is your defense truly impervious? arXiv preprint 241::2400.09026, 2024a.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12162-12171, 2024b.
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 11964-11974, 2024.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in Neural Information Processing Systems, 37:8643-86722 2024.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference computer vision (ECCV), pp. 657-672, 2018.
A APPENDIX
A.1
THE USE OF LARGE LANGUAGE MODELS
Large language models were engaged exclusively text refinement, including writing clarity and presentation. Theoretical analysis, research methodology. experimental design, and result interpre- tation were all independently completed by the authors without reliance on such tools.
A.2 INTIIALIZATION BIAS
In this section, we provide the derivation process of the initialization bias of not-mmatrrr and watermarked images, respectively.
The process of generating normal wottrmatrrarked) image formulated as z; To where &. E [0. T). The process of generating a watermarked image using key K is formulated as x -
Formulation.
x wor as illustrated in Fig. 3 Given this watermarked image x um we denote the DDIM inversion process with the valid key K (K" K) as 26 - f7. Correspondingly, the
DDIM inversion process using an invalid key K" (K" + K*) is expressed as at" - 4:"" During verification, compute the initial starting point x:! through the initialization function F (detailed in Eq. 2 and subsequently calculate the initialization bias. When employing the valid key KS, the initialization bias is defined of of 2t, where x. = =: In contrast, when using an invalid
13

---

Published as a conference paper at ICLR 2026
key K" the initialization bias becomes 8%" = 22""" - =x",, with xx & x in this scenario. Recalling the deflection function H. in Eq. 3 for simplicity, we denote the deflection coefficients for the valid key and invalid key M and N, respectively, i.., M = 7 K and N K" + 1.
Initialization bias of non-watermarked images using standard DDIM inversion. The DDIM sampling process is:
2t + (VT- 1 vI- 5o (21,
(8)
Var
Vou
Therefore, the ideal inversion process is formulated as:
It Vanzi-1 (v1 ai Vai (re) (xr,
(9)
However, during the standard DDIM inversion process, since Ty does not exist at timestep 1,
substitute (ze, t) with Eq (z) Consequently, the inversion process of non non-watermarked images expressed as:
ai + (vI-a, Vas - ai) En (f1-1,
(10)
The initialization bias of non-watermarked images using standard DDIM inversion can be expressed as:
St vacfi-1 + (VI-ar ci
Vai ae) so 15 Vaiii-1 (VI Ce Van ae) 60 (x1,t)
(VI Vou at)
(ea (2)-1, (21, t)) vas (#1-1 x1
(V1 Ō+ Vax āt)
(eo (f) (se, t)) + Vav Ac-1
(11)
From Eq. 11 we can see that the initialization bias A, gradually accumulates with t and reaches its study for time steps from to 3. At = 0, since 2g = Σp. we have Ag = 0. When t = 1, substituting Ap into Eq. 11 /au
maximum value at t T. We can further derive A, by conducting
derive A Fi. For t 2, substituting A into Eq. 11 yields: A2 F2 + M Fi. And when t t= 3, we can similarly get A3 = F3 + vaz22 + /a 11 By iterating this process, we generalize the final A, using mathematical induction, expressed as:
C
A = के - J4
Pi.
(12)
where F. (V1-ā, Vo. a.)
(Co (f:-1, (2,, ()).
Initialization Bias of Watermarked Images. Similarly, the deflection process in our watermark scheme is:
M um
(VI-Oc-1- vI
M Vae
(x, mm ,t). at
(13)
Therefore, the ideal inversion process formulated as:
um
woD var
2t-1+ + (V1- - M
Vor M
Oz
EB (x) (22",,)) ,t),
(14)
where M 7 K +1 However, during the DDIM inversion process, since æ does exist timestep t - 1, we substitute Eœ (I:tm,, t) with (I?=h, Consequently, the inversion process of our verification for the valid key K is expressed as:
Vor
si + (VI-ā- M
01 Vau
M (#)
(15)
Similarly, for the invalid key K" (where K" + Kº), the verification process becomes:
voe aw + (VI- (V-áar vo,
áe so (#)
(16)
N
N
where N = 7 K
14

---

Published as a conference paper at ICLR 2026
First, the initialization bias of the valid key can be expressed as:
21
Ri
+
Vau- 104--1) ai
Voe mm M 21-1
+ VI-
Vau
(xi wm .)
M
M
M
Vai- ae
(2t (ott",,)) .t)) + vor
αt
(Eo (28-1,
(ft-1 - x(-
M
M
Vat+
Vas
(eo (88-1, ca (20 um t)) +
05-1
M
M
PF
(17)
From Eq. 17 can that the initialization bias 8j gradually accumulates with and reaches its maximum value at = T. We can further derive o by conducting case study for time steps t from to At t 0, since 20
26. we have 60 O. When
substituting oj into Eq. 17 we yields: 65 = F2 + vaa
derive 89 = Pf. For t 2, substituting 0f into Eq.
17
M Ff. And when t = 3,
vas we can similarly get 83 = F3 + M F
F
By iterating this process, we generalize the
M
final 97 using mathematical induction, expressed
Vā Va.Me- PT.
8
It
(18)
where F.T
VI
Vol
(ee (25-1, co (x) i))
Regarding the initialization bias of the invalid key, we substitute Eq. 16 to derive:
60
x0
Vou a. +
V1
Vae
de
Eo (# x
(19)
N
We can see that xx solely depends on the invalid key K and remains temporally invariant, whereas 2t evolves dynamically with time step This temporal dependency motivates systematic deriva- tion to establish the mathematical relationship between i and the original watermarked trajectory at 2um To elucidate this relationship, we conduct temporal case analysis across initial time steps
E (0, 1, 2,) At = 0, since z0 amm 48 we obtain 63
2r"
../mm x For t 1,
substituting z tm ay and the expression 20 from Eq.
13
we derive:
Voi w N
Vay
41
50
+
VI-
Eo (# 1)
N
/ai
Voi - āi
20
V1 11
Ea (i0", 1)
substitute 2
umm
N
N
/ai
M
mm
+
/1 - ap
M
VI - án
ea (x mm 1)
VI ai
Voi σ1 N
Eo (# 1)
a1
Van
substitute
som xn
in Eq 13
M
Z1
+
VI VI-
Va1 01
(2 1)
M
-I- von
(z 1).
N
N
N
M
(20)
15

---

Published as a conference paper at ICLR 2026
Similarly, for t 2. substituting 24 in Eq.
20 and 21" from Eq. 13 obtain:
V22
Vay 0u N
w
20
+
1
022
so ( 2)
02
M
v1
Vai
(55 1)
M
V ãi
an di
Eo (α) mm
1) + 11
N
N
N
N
M
V1
02
v02 -
42
Eo (#1 .2)
substitute 2/ in Eq 20
N
V02
M
M
M
vai ai
12
wm
+
v1
ai
C22
Eo (x2 km
2)
+ vI
á
En ( 1)
N
N
Va2
N
M
V1
Van
(21 1)
+ v1 V1-
Va2 02
(B 2)
N
M
N
substitute mm in Eq.
13
M
122
som
+
Vaz
[ (V1 [V1-
Voi ai
En (20' 1)
M (VI -n
vai σ1
so (σ) mm 1) +
N
N
M
62
Vaz
02
(#1 2)
M
v1
Vaz 02
Eo (222 ,2)
N
N
M
(21)
clear pattern emerges in áT and azz.
We define F."h as:
Ff"
(VI-a Voi
ai
Eo (+ N
M
V11 a.
Vou - ai
Eg (x .1),
N
M
(22)
where E [1,2]
Thus, 47 and 33 can be reformulated as:
21 + F
(23)
M
02
22
PT
F
N
N
Following this pattern, we derive 23 in similar way:
2/
Vos
12
V1
Vag=
ás
Eo (22 .3)
N
N
M
202
Vra Oa
um
F
+
F2
+
Cg
so (#",3)
<- substitute 25 in Eq
21
N
N
Vas
M
M
M
N
N2
03
I3
vI
a2
003
Eo (Ir3
3)
+
N
FY
F
Vas
03
ā3
Eo (# 3)
substitute x2 in Eq. 13
M
//3
Vas ās NV
N3
mm
N
+
N
1 +
11
So (#2 .)
M
V1 03
Va3
dgg
Eo (x3 um .33
N3
M
M
E2302
033
N3
233
N2
F
N
(24)
By iterating this process, we generalize the final 2/ via mathematical induction:
M
Vou
vom
F.".
(25)
NE
No,No=
Therefore, 8t" can be expressed as:
M No
Va
8
som
F."
(26)
Voi Og
M
Vas 5g
where F V1-0a
/1 11--a
(x.
200
.i)
N
No
M
16

---

Published as a conference paper at ICLR 2026
Initialization bias of non- woo--watrrarred images with K. If we use non- watermarked image to try to pass our verification, that is, use the standard DDIM sampling process to get the non non-watermarked image, and use K to get the inverted noise through our inverted deflection process, then similar to the above derivation process, we can get the initialization bias og of the non-watermarked image with random K as:
87
x
Qt.Qi-i F.
Q
va.Q
(27)
where F. v11 c.- Va: dj
10 1)
1
(v1 - a. -Va, /a.-o.) -ās) Eo (x),
Qi
where we define Q = 7K' + and x F(K9,))
A.3 THEOREM PROOF
A.3.1 VALID-KEY VERIFICATION V.S. INVALID- EEVALI--KEY VERIFICATION
We have derived the final expressions for the initialization bias of both valid and invalid keys. Re- calling our watermark verification process described in Sec. 5 where copyright ownership is deter- mined by checking whether the initialization bias falls within an empirical threshold range, we now focus on security guarantees. To ensure system security, we will prove in the following analysis that the initialization bias of the valid key is consistently smaller than that of invalid keys, thereby demonstrating that only the legitimate key can pass the verification. Please note that we use the second-order moment to compare the initialization bias between the valid key and the invalid key.
Theorem. For an invalid key K" asymptotically approaching the valid key K the second-order moment of the initialization bias of (associated with K" remains smaller than that of 87" (associated with K");:
lim K
E
[07]*]
E [
(28)
Proof. For the initialization bias of of the valid key (see Eq, [8). Eg (-) represents the noise predicted by the model. Theoretically, the noise added at each step in the diffusion model follows inde- pendent standard normal distribution. Therefore, we assume an optimal diffusion model where the predicted noise Eq (-) adheres to standard normal distribution (0, 1) and is mutually independent. Therefore, according to the second moment theory of normal distribution, we have:
E O
(1 (i- ()(
201
Va.
04
(29)
M
Similarly, for the initialization bias of the invalid key (see Eq. 26). both -: and x:" generated by our initialization function F and follow standard normal distributions: z:m = F (K",S), x= F (K", " S). Thus, the second-order moment of the invalid-key initialization bias is expressed as:
[ - of
Vas
a.
M
Vas
a.
(3)
M
From Eq. 29 and Eq. 30 we observe that the summation terms in E [ and E [ exhibit
highly analogous structural configurations, differing primarily in the numerical values of AZ and N. Here, MM = >K + and N ? + 1. In our watermarking scheme, where K ~ No0,, 1) and y = 0.1 are predefined parameters, both M and N follow the distribution (11, 0. This indicates that M and N possess extremely small variance and remain tightly concentrated around their mean value of 1. Postulating a worst-ease scenario where N asymptotically approaches M (i.e., N Rs M),
derive:
lim E N-M
|or
2 2
2
200
(vI -
yau Oi
T ()(-
M
(31)
2 6.
Consequently, in the worst case, we theoretically establish the inequality TE |:58
2
<
| in
the worst case (Theorem of Eq. 28 This analytical result demonstrates that the initialization bias of the valid key is consistently smaller than that of invalid keys, thereby demonstrating that only the legitimate key can pass the verification.
17

---

Published as a conference paper at ICLR 2026
this image!
Infringing Alice's copyright.
Ownership: Alice
Attack: detected
Tamping Area:
uplond
Alice
Defender
Watermarked Image
Cindy
Defender
Generation
with Watermarking
Social Media
Watermark
download
Provenance
Poisoned
Bob
Bob
Image
this poisoned image!
hide my identity!
Ownership: Bob
Figure 9: Attack scenarios of our PAI.
A.3.2 WATERMARKED IMAGES V.S. NON-WATERMARKEED IMAGES
We also extend our security analysis to critical scenario: strong adversary attempting bypass watermarking by directly using clean image, without watermark injection, and applying random key during inversion. To ensure fair comparison, we keep the user key and timestamp consistent across both settings, meaning the only difference lies in whether the input image is watermarked. Under this setup, the deflection factors satisfy M Q. Let oy denote the initialization bias for non-watermarked image; its second-order moment is given by:
2 [| -
( (V1- Val - Ce
(1) (VI- Va, va.
(32)
Subtracting the second-order moment of the watermarked image's 's bias 88, we obtain:
18 2 -
21
āc (=
[
Va: ai
+ +1+
+
M
M
M
(vI
Ci
Voi Ci.
T M2(t-1)
20r
(V-
Voii ai
M
2
(33)
+
Øt 0g (tt-i
vesi
a. 2
VI
Vos - Oi
MM
M
i=1
A2
B²
Here, 2 -22
B) + B), and since both and are positive, we only need to prove A B to ensure that the overall difference is positive. By expanding A - B, get:
B2 = (A
A- B M
(VI
Vai-as) (VI-o:
you - a.
M
(34)
a. >0
M
Since M (11 0.12) is tightly concentrated around 1, by Jensen's inequality we know that शाा = 1, which implies 1 > in expectation. Therefore, A - B > 0 holds, ..
EM M
and consequently, we have E [|
[18913].
This analysis demonstrates that even when using the correct key and matching all other variables, non-watermarked images still exhibit statistically larger initialization bias than properly water- marked ones. Thus, the watermark verification process effectively reject clean images that bypassed the injection phase. confirming the exclusivity of watermark provenance to images gener- ated via the secure watermarking pipeline.
18

---

Published as a conference paper at ICLR 2026
Table 4: Threat model summary of considered attacks. Here, "wm" and "non-wm" denote water- marked and watemmaerdd images, respectively.
Type
Alback
Advenary Cauabilty
Mothedology
Degradation
JPEC compression: Noiset
Rlur; Brightness
Black-box podsprecssing during disscmiration
Watermark
Removal
attakk
Diffminn purifeation
Sahen alll.
Surrgane diffusion model
Recenstect with a preszinee diffusio model
(remove urget's
Attack
sdvir atteck (aheri et
Classlterbued
9021 Dataset of target's is wmitton wm images
withton- clasitter the turget, then optinize
a perturbation roade the chasiifir
walcsaark)
Impratinn temoval
(Miller
Sunagstc diflusios model
luvert a image surooaate dittusion model, optimize
perurbation maximuee the lntett distance from was Image
Spooding
attcck Yang
extraction
Ditanct target's wintton-om images
Estimate the lagget watermark
urerage wm non wm Images, add to new images
difference between the
Attack
(Forge targe's watermark)
Repeociption sttack
Miller
Sunagstc diflusios model
lnvert was image via surrogate diffisionn model,
a prompt while preserving the tarpet watemmak
generate
Imprintinn
(Milller
Surrogaee
image surrogate diffssion model oprimice penurbusion minimize the lasert distunce from the wm image
Lecalized
Black-box image editing tools
imsuees
Tampering
Attack
SimSwap
2020
Black-bos image cditing
Apply fuce-swapping
idanitics
Stable Inpaincing Roombach al 2022
Black image editing tools
Mask regions and edit via AIGC impoitiing
Adaptive Attick
Metadata manipulation
sttack
Black-box model
Alter the timestump stoee the metadata images
evace detection
(full knowledge
of PAI)
extraction
White-bex grovider's model
Invert wmn images vin PAI and optimioe condicute minimize initialization blus the key prior:
PCA atack
White bax provider's model and PCA model
Invert smmnon-um image vin PAT and project into PCA suhepaoo. than optimize pertubiatin appmach the tarott choterr evace detection
A.4
THREAT MODEL
A.4.1
IMAGE DEGRADATION
For our degradation robustness evaluation, we define three levels of increasing severity for each degradation type:
JPEG Compression: Quality factors of 45 (Level 1), 35 (Level 2), and 25 (Level 3).
Gaussian Noise: Standard deviations of (Level 1), 10 (Level 2), and 50 (Level 3).
Gaussian Blur: Kernel sizes of 5 (Level 1), 7 (Level 2), and 9 (Level 3).
Brightness Adjustment: Brightness shifts of -0.1 (Level 1), +0.1 (Level 2), and +0.2 (Level 3).
A.4.2 ATTACKER SETTING
To comprehensively evaluate watermark robustness, we implement 12 attacks across four categories: watermark removal, spoofing, localized tampering, and adaptive attacks. For watermark removal, spoofing, and adaptive attacks, we use the COCO dataset. For tampering attacks, which involve face-specific manipulations, we use the CelebA-HQ dataset. All attacks are performed on the same set of 5,000 watermarked images generated for single user. This simulates strong adversarial setting where the attacker has access to watermarked images of the targeted user, enabling statistical analysis or pattern exploitation tailored to that user. Below, we detail the specific implementation settings for each attack.
Diffusion Purification Attack. We employ Stable Diffusion v1.5 and add 80 noise steps to reconstruct the 5,000 watermarked images.
Classifier Based Adversarial Attack. We train a binary classifier using all 10,000 samples (5,000 watermarked 5,000 wateamakrm...ed) The classifier is optimized with learning rate of 1 x 10-4 for 100 epochs. To generate adversarial examples, we set adversarial perturbation budget original work.
14 which corresponds to the strongest setting reported in the 255
Imprinting Removal Attack. We use Stable Diffusion XL-base as a surrogate model and train perturbations on 100 watermarked images. To balance attack strength and visual fidelity, we set the training step count to 5 and a learning rate of 0.01.
Pattern Extraction Attack. We compute the average difference (pattern) between 2,500 watermarked and 2,500 non-watermarked images. This extracted pattern is then added to
19

---

Published as a conference paper at ICLR 2026
separate set of 2,500 clean images to simulate spoofing. The pattern is applied with strength factor of 0.1 to preserve perceptual plausibility.
Reprompting Attack. Using Stable Diffusion XL-base as the surrogate model, we generate 5,000 spoofed images based COCO prompts. We use 50 DDIM steps and classifier- free guidance scale of 7.5 during generation to ensure high-quality samples.
Imprinting Forgery Attack. We adopt Stable Diffusion XL.-base as the surrogate model and select 5,000 clean COCO images cover inputs. 100 adversarial samples used for training, with a learning rate of 0.01 and 50 optimization steps.
Copy-and-Paste. We manually curate library of 31 stickers and emojis from the web. For each of the 5,000 watermarked images, one graphic is randomly selected, resized, and pasted at a random location.
SimSwap. Following the original SimSwap implementation, we randomly select faces in the 5,000 watermarked images and perform identity swaps using pretrained models.
Stable Inpainting. We use official Stable Diffusion inpainting tools edit 5,000 water- marked images. For each image, we randomly mask either the hair or facial expression and apply targeted edits. Hair edits are randomly sampled from six styles: "black", "white", "yellow", "pink", "gray", and "green". Facial expressions are altered among six categories: "smiling", "grinming", "frowning". "pouting", "open-mouthed", and "toothy".
Metadata Tampering Attack. We generate spoofed timestamps by randomly altering the metadata embedded in the 5,000 watermarked images. This aims to verify that our approach is not dimeddependent.
Key Extraction Attack. Assuming white-box access to the generation model (Stable Dif- fusion v2.1), randomly initialize keys and optimize them to minimize watermark ver- ification bias. The generator is frozen, and only the key is updated using MSE loss on initialization bias with Gaussian regularization penalty. We train for 40 epochs with learning rate of x 10-4
PCA Space Attack. Assuming white-box access to the generator (Stable Diffusion v2.1) and the PCA projection used by our verifier, the attacker randomly initializes a perturbation on the latent 2 of a target image. The goal is to move that image's initialization-bine projec- tion toward chosen PCA centroid (henign or non-benign). We freeze the generator and randomly initialized candidate key, since the attacker does not possess the true key. We run this per image for 50 epochs using a pool of 100 watermarked and 100 non-watermarked images. The adversarial loss is:
[( MSF( (8(Zz))), c) + Atpips LPIPS (D(Zatv),
where d(Zadv) is the initialization bias of the perturbed latent, c the target centroid in PCA space, and D the VAE decoder. The MSE term drives the adversarial bias toward the target cluster while the LPIPS term (with Alpips 0.2) preserves perceptual similarity to the original image x. After each step we project Endv onto the -ball Fadv =||oo S c with c = 0.09 bound perturbation magnitude.
A.5
KEY SPACE
We evaluate the strength of our key design from both theoretical and empirical perspectives.
Theoretical estimation. Each user is assigned private key K with the same shape the initial noise input of the diffusion model. In Stable Diffusion, this corresponds to a latent tensor of size x 64 x 64, i.e 16,384 independent components sampled from (0 1). The differential entropy of a standard normal variable log(2 2.047 bits, yielding a total entropy of 16,384 x 2.047 as 33,548 bits. This corresponds to an effective key space of 233,548 elements, forming an extremely high-dimensional, continuous space.
Empirical estimation. To estimate the practical limit of distinguishable keys, we evaluated the false positive rate (FPR) of ownership verification under Gaussian perturbations added to K dur- ing initialization, as shown in Tab. [ Using Stable Diffusion (N 16,384), we varied the noise ratio to control the mean squared error (MSR) between perturbed and true keys. At tolerable
20

---

Published as a conference paper at ICLR 2026
Table False positive rates of ownership verification and attack detection under increasing Gaussian noise on user keys.
Noise Ratio
MSE Distance
Ownership FPR
Attack FPR
0.30
0.18
15.27%
0.64%
0.31
0.19
10.70%
0.53%
0.35
0.25
1.86%
0.08%
0.36
0.26
1.05%
0.08%
0.37
0.27
0.80%
0.02%
0.38
0.29
0.45%
0.02%
0.39
0.30
0.00%
0.00%
FPR of 0,45% the decision threshold was MSE = 0.29. The probability that two indepen- dent random keys fall within this distance is negligible, estimated via large-deviation analysis as P(MSE- < 0.29) x 10 3328.22 Applying the birthday bound (Menezes et al. 1996) with a system- wide collision tolerance ò 10 gives a maximum user capacity max 101911.25.
A.6 EVALUATION
A.6.1 SETTING
Implementation Details. We evaluate our watermarking framework in both unconditional and text- to-image (T2I) generation settings. For unconditional generation, we adopt a pre-trained DDPM model (Ho et al. 2020) on CelebA-HQ (Xia et al. (02T). For T2I, we use the publicly available Stable Diffusion v2.1 model (Rombach et al., 2022). generating images conditioned on captions from the COCO (Lin et al. 2015) and CelebA HQ (Xia et al. 202I) datasets. During generation, set the number of DDIM sampling steps to 50 with classifier-free guidance scale of 7.5. The inversion process uses a guidance scale of and an empty prompt, consistent with inversion settings in (Yang al. 2024b). To inject semantic watermark signals, apply deflection during the first five sampling steps with a deflection strength of y = 0.1. For effectiveness evaluation, each method, including our approach and all baselines, is used to generate 5,000 watermarked images. A shared set of 5,000 non-watermarked images is used across all comparisons. In particular, for post-hoc wa- termarking methods such as EditGuard (Zhang et al.) 2024) and Stable Signature (Fernandez al.) 2023), the watermark is applied for these non- Non-watermarked images to ensure fairness. Robustness evaluation performed by applying adversarial attacks to the corresponding 5,000 watermarked im- ages for each method. For vanilla verification, we set threshold (Teanitla 1.761) at significance level of 1 x 10-5 For robust verification, we set decision thresholds (Trohust 2.448) at significance level of 0.05. All experiments are implemented in Py Torch with mixed-precision computation and conducted on NVIDIA RTX 3090 GPUs
Evaluation Metrics. We adopt comprehensive set of metrics to evaluate our watermarking scheme across functionality, image quality, robustness, and forensic capabilities. For binary decision tasks such ownership verification and attack detection, (TPR), and false positive rate (FPR). To distinguish between the two tasks, we denote the accuracy of attack detection Attack ACC (A-ACC) and that of ownership verification Ownership ACC (O-ACC). Notably, O-ACC consistently reflects the correctness of verifying whether a given image was genuinely generated using the claimed user's key. In the presence of spoofing attacks, where adversaries attempt to forge a watermark and impersonate legitimate user, a correct verification outcome should reject the forged ownership claim. thereby contributing versely, under watermark removal attacks, although the image may have been manipulated, it was still generated using the correct key and should recognized as such during verification. Thus, a robust watermarking scheme is expected to achieve high O-ACC under both adversarial scenarios, indicating reliable ownership attribution. To evaluate perceptual quality, we report CLIP-based sim- ilarity metrics:
report accuracy (ACC), true positive rate
higher O-ACC. Con-
measures the semantic alignment between the generated image and its input prompt, while CLIP-Image captures perceptual similarity between the watermarked image and its clean counterpart. Additionally, we report Peak Signal-to- -egial-t-Noiiee Ratio (PSNR) under adversarial settings to quantify visual distortion. We use it to ensure that attacks remain within realistic threat boundaries, i.e., perturbed images maintain comparable PSNR levels and remain visibly plausible.
21

---

Published as a conference paper at ICLR 2026
For tampering localization, we adopt standard segmentation metrics including Fi score, under the ROC curve (AUC), and intersection-over-ume (IoU), which assess the accuracy and spatial consistency of predicted manipulated regions.
A.6.2 USER STUDY
We conducted a user study involving 10 participants. Each participant was shown 200 AIGC- generated images, consisting of 50% watermarked and 50% non-watermarked samples. in random- ized order. For each image, participants were asked to (1) determine whether watermark was present, and (2) rate the image quality on a scale of to 5, with higher scores indicating better vi- sual quality. The average accuracy of watermark detection was 49.83% which is close to random guessing. This result demonstrates that our watermark visually imperceptible.
terms of im- age quality, non -oteraaerar images received average score of 3.15, while watermarked images received 3.33. The minimal difference suggests that our watermarking process does not degrade perceptual quality.
A.6.3 ABLATION STUDY
We conduct an ablation study to investigate the impact of the number of deflection steps on water- mark effectiveness and robustness. As shown Tab. [al all three configurations (5, 10, and 15 de- flection steps) achieve outperforming ownership verification under clean conditions (100.0% ACC, TPR = 100.0, FPR 0.00), demonstrating that even small number of deflected steps sufficient for accurate verification. When evaluating robustness under common image degradations, increas- ing the number deflection steps from to 10 or 15 slightly improves stability, particularly under Gaussian noise, where the accuracy improves from 99.00% to 100.0%. Importantly, the CLIP-based similarity metrics remain nearly identical across settings, indicating that increasing deflection steps does not degrade visual or semantic quality.
We also conduct an ablation study to investigate the impact of the deflection intensity y on water- mark effectiveness and robustness. As shown in Tab. [b] the results reveal a clear trade-off between watermark strength and generative fidelity. When is small (0.1-0.2), PAI achieves perfect clean verification (ACC/TPR 100%, FPR 0%) while preserving high perceptual alignment, indicating that mild key-conditioned deflection is sufficient to form a stable watermark signal without disrupt- ing the denoising trajectory. However, when 7 increased to 0.3, the perturbation becomes overly strong: both clean verification and degradation robustness degrade sharply (ACC drops to 62.8%), suggesting that excessive semantic deflection distorts the predicted âo and destabilizes the genera- tive path. Based on these observations, we recommend using conservative deflection strength (e.g., y = 0.1) for stable and reliable watermarking in practical deployment.
We further conduct an ablation study to examine how the number of DDIM sampling steps affects watermark verification and robustness. As shown Tab. 6c PAI maintains perfect verification performance across all tested configurations (ACC/TPR dual-stage watermark injection does not rely on long sampling trajectories to remain detectable. Increasing the number of steps from 50 to 75 or 100 leads to only marginal variations in CLIP-based perceptual scores, and robustmess against common degradations remains uniformly strong (Average -100% for all settings). These results suggest that the watermark signal-os embedded early in the generation process through initialization and deflection quickly and remains consistent regardless of the sampling horizon.
100%, FPR = 0%). indicating that our
We further analyze how the reference distribution for PCA-based modeling varies with N, as shown in Tab. 7 Here N denotes the number of clean (benign) samples used to estimate the benign initialization-bill distribution. Larger N improves the stability of the estimated Gaussian statistics and thus strengthens robustness against removal and spoofing attacks. Results show that ownership verification accuracy remains consistently above 97%, and attack detection accuracy stabilizes at ~ 99%, confirming that our robust verification is insensitive the number of clean samples N.
A.6.4 WHITE-BOX ADAPTIVE ATTACKS
Key extraction attack. We evaluate white-box adaptive attack in which the adversary, given full access to the generation model (Stable Diffusion v2.1), freezes the generator and attempts to reverse-engineer the target user's private key by optimizing randomly initialized key to minimize
22

---

Published as a conference paper at ICLR 2026
Table 6: Ablation study on the number of dellection steps, deflection intensity 7, and DDIM sam- pling steps. We evaluate watermark verification accuracy under clean conditions and robustness to common image degradations (level 3).
(a) Deflection steps
Deflection steps
Clean verification
Image degradation
ACC
TPR
FPR CLiP-Image CLIP-Proni Compression
Noise
Blur Brightness
Average
5
100.0
100.0 0.00
0.8499
0.2635
100.0
99.00 100.0
100.0
99.75
10
100.0
100.0 0.00
0.8498
0.2628
100.0
100.0
100.0
100.0
100.0
15
100.0
100.0 0.00
0.8473
0.2628
100.0
100.0
100.0
100.0
100.0
(b) Deflection Intensity
Deflection
Clean verification
Image degradation
Intensity 7 ACC
TPR
FPR Imae- CI.IP-Promp Compression
Noise Blur Brightness
Average
0.1
100.0 100.0 0.00
0.8499
0,2635
100.0
99.00 100.0
100.0
100.0
0.2
100.0
100.0 0.00
0.8453
0.2617
100.0
100.0
100.0
100.0
100.0
0.3
62.80
25.60 0.00
0.8513
0.2623
30.00
38.60
21.00
28.60
29.55
(c) DDIM Step
DDIM
Clean verification
Image degradation
Step
ACC
TPR
FPR CLIP-Image
CLIP- CLIP-Prompt Compression
Noise
Blur
Brightness
Average
50
100.0
100.0 0.00
0.8499
0.2635
100.0
99.00 100.0
100.0
100.0
75
100.0
100.0 0.00
0.8452
0.2622
100.0
100.0
100.0
100.0
100.0
100
100.0
100.0 0.00
0.8507
0.2621
100.0
100.0 100.0
100.0
100.0
Table 7: Impact of the number of clean samples N on robust verification.
N=75
N=100
N==
N=150
Attack Method
Ownership ACC(%))
Atlack Ownership ACC(%))* ACC(S*)? ACC(%) ACC(%) ACC(%)* ACC(%) f ACC(%)
Attack
Ownership
Atlack
Ownership
Atlack
Diffusion Purification Attack
99.00
99.00
99.00
99.00
99.00
99.00
99.00
99.00
Classifier-basee Adversarial Attack
98.00
97.00
98.00
97.00
98.00
97.00
99.00
97.00
Imprinting Removal Attack
100.0
100.0
100.0
100.0
99.00
100.0
99.00
100.0
Pattern Extraction Attack
93.00
100.0
92.00
100.0
92.00
100.0
91.00
100.0
Reprompting Attack
97.00
100.0
97.00
100.0
96.00
100.0
95,00
100.0
Imprinting Forgery Attack
100.0
100.0
100.0
100.0
100.0
100.0
100.0
100.0
Average
97.83
99.33
97.67
99.33
97.33
99.33
97.17
99.33
the watermark verification bias. The attacker optimizes for 40 epochs with learning rate of 1 x 10-1 using an objective that combines an MSE loss on the initialization bias with Gaussian regularization. As shown in Fig. [0alof of the Appendix, the evolution of the attacker's second-order moment of the initialization bias (MSE) remains consistently high throughout training and does not converge to the valid-key baseline (blue dashed line), demonstrating that even with full model access and gradient- based learning the adversary fails to recover key that passes our verification.
PCA space attack. Finally, we implemented a white-box attacker that also has access to the PCA projection used by our robust verification pipeline. The attacker is given 100 watermarked and 100 non-watermarked images from the target user and attempts two goals: (1) remove - drive the PCA representation of a watermarked image toward the non-watermarked cluster; and (2) spoof push non-watermarked images toward the benign (watermarked) cluster. For the removal attack, we first mapped the initialization biases of the 100 non-watermarked images into PCA space and used the resulting centroid as the target. Following a PGD-style procedure, we froze all model weights and optimized small, learnable perturbation the target watermarked image to minimize its distance to that centroid while constraining perturbation magnitude. The spoofing attack was identical in form but optimized perturbations non-watermarked images to move their PCA features toward
23

---

Published as a conference paper at ICLR 2026
1.75
1.25
Type
A-ACC O-ACC
MSE
Removal Attack
96%
100.0%
0.75
Spoofing Attack 100.0% 100.0%
(b) PCA space attack
Learned key under white box Valid key K'
0.25
Step
(a) Key extraction attack
Figure 10: White-box adaptive attacks,
the benign cluster. As shown in Tab. T0b even with direct access to the PCA projection and targets' data, the attacker cannot bypass our verification and detection procedures.
A.6.5 MORE SEMANTIC EDITING ATTACK
To further evaluate robustness under non-diffusion, full-image semantic editing, we compare PAT with EditGuard on InstructPix2Pix editing method (Brooks et al., 2023). As shown in Tab. 8 Ed- itGuard almost completely collapses under this setting (Ownership ACC = 1.80%, Fl 2185%,
IoU = 13.81%) since its post-hoc embedding whole image. In contrast, PAI achieves 100% ownership verification and significantly stronger lo- calization performance (FI 59. 99.40% AUC 85.95%). This demonstrates that our trajectory-level watermark remains detectable even when the entire visual content is semantically rewritten by non-diffusion generative model.
be entirely erased when the editor regenerates the
is worth noting that the ToU reported for PAI is rel- atively lower compared to other attacks. The reason is not due to a failure of our localisation mechanism, but due to the absence of a true ground-truth mask in In- structPix2Pix editing. Since these editors do not require an explicit mask for editing, the modified region un- known. To approximate reference mask, we follow prior practice and compute a pixel-wise difference between the original and edited images after smoothing and Gaussian denoising. However, this procedure has inherent limita- tions in capturing semantic-level edits, especially when the editor rewrites texture, lighting, or layout without pro- ducing sharp pixel differences. As result, IoU becomes a naturally conservative metric under this setting, and the "ground-truth" mask itself is only coarse proxy.
Table 8: Comparison of watermark- ing methods with respect to tampering detection and localization performance on InstructPix2Pix. 'A-ACC" and 'O- ACC' denote the accuracy of attack de- tection and ownership verification, re- spectively.
InstructPix2Pix
Metric
EditGuard
PAI
A-ACC O-ACC
85.60
1.80
100.0
FI
21.85
59.40
AUC 1
50.01
85,95
A.6.6 RUNTIME ANALYSIS
loU
13.81
44.35
We report the average runtime (ms) and memory con- sumption (MB) of each phase our framework (see Tab. 9). compared to standard DDIM generation and in- version. The results show that generation with PAI introduces only negligible overhead (< 1%) relative to vamilla diffusion sampling. For watermark provenance, vanilla verification and robust verification incur sub-millisccond costs, while tamper localization remains efficient (~ 118 ms). Overall, the total runtime (7950.59 ms) and memory usage (7310 MB) are comparable standard
24

---

Published as a conference paper at ICLR 2026
Table 9; Runtime analysis.
Time (ms)
Memory Usage (M)
Standard generation (DDIM sampling)
7771.78
7114
Generation with our PAI
7827.70
7116
Standard inversion (DDIM Inversion)
7772.17
6142
Deflection phase
7830.72
Vanilla verification
0.09
Our Watermark
Robust verification
1,25
7310
Provenance
Tamper Localization
118.53
Total
7950.59
1.0
EditGuard
Shading
Our 261
0.9
Ownership ACC
0.3
0.7
0.5
0.5
30-32
32:36
36-36
35-38
35-40
PSNR
Figure 11: Evaluation of ownership verification accuracy under varying PSNR levels.
inversion, confirming that our design achieves provenance-aware verification with minimal over- head.
A.6.7 TRANSFERABILITY ANALYSIS
We additionally evaluate the transferability of PAI across different sampling algorithms and model architectures. As shown in Tab. TO PAI retains perfect verification performance on both DPM- Solver (I.u et al. (022) and DiT-based diffusion models (Peebles & Xie 2023), achieving 100% ACC/TPR with zero FPR. For DPM-Solver, the watermark remains fully detectable and robust (Av- erage 100%). demonstrating that dual-stage watermark injection does not rely DDIM- specific dynamics and compatible with deterministic ODE-based solvers. Similarly, when applied to DiT, different transformer-batt based diffusion architecture, PAI still achieves near-perfect robust- ness under common degradations (Average 99.75%), confirming that the watermark signal is pre-
80
AUC (95)
40
SimSwap
Staole inpainting
6-10
10:20
20-30
30-40
40-50
50-60
60-70
70-80
Mask Ratio (%)
Figure 12: Tampered region analysis under different mask ratios.
25

---

Published as a conference paper at ICLR 2026
Table 10: Transferability of PAI across different sampling algorithms and model architectures. We evaluate watermark verification accuracy under clean conditions and robustness to common image degradations (level 3).
Sampler and Model
Clean verification
Image degradation
ACC
TPR
FPR CLIP-Image CLIP-Prompt Compression
Noise
Blur Brightness Average
DPM-Solver
100.0 100.0 0.00
0.8456
0.2643
100.0
100.0
100.0
100.0
100.0
DiT
100.0
100.0 0.00
99.40
99.60
100.0 100.0
99.75
served even when the generative backbone latent parameterization changes. These results indicate that PAI is inherently sampler-agnostic and architecture-agnotiic, as its watermark embedding oper- ates directly on semantic denoising trajectories rather than relying on model-specific features. Thus, PAI can be seamlessly deployed across wide range of diffusion-style generators without retraining or customization.
A.6.8 VISUALIZATION RESULT
The women appears to be young, smiling The perum has oval faoe, high choekhenes, morth sightly opin hags inder eyos. strught hair and wears eanings syle of Aless A seami Seeatifd detail
This young pensrr. This persen is with lungs The woman wear nurings. in eyla of Alenaa eemmi beautifal detals
This women rppaers to be emiling The weman has wavy her: style ofAlmr Acnami, beaztifu dettals
The pensor sppeers be young and bee Nock hurr. This mue weurs eartings is style cE/lleas A Artari, besatiftl cetails
A to an lottcen makigg pizza. in style of Alrboal Dridot, bosutifi adails
People walking and néing matongycies on the street sty of Alkki Rriclt, bountitd detalls
train traveling dowa tracks next lights. in style of Aliios Desdo; benutifu detail
cat leying cluthes that suitown itylyee of Aleoaa Daadot, besutifu detals
À persuz sitting a deek with beyloond and monnor in ot Alkke Snclet. besuttha details
An nleghamn: ronding under the dhstn of the style Aliki Bridltt bountfal
small clssed tatlct crapped space, of Dittbe, besutiti detais
ol woren colng a trun while stting under itts window. style Alke Brichot. bosutitul detais
detall
Figure 13: Our watermarked images generated by Stable Diffusion XL. The watermarked images generated using the same key and the same prompt still maintain diversity.
26

---

Published as a conference paper at ICLR 2026
16
Watermarked Image
Tampered Image
Watemmarked Image
Tampered Image
Ground tuuhh
Our BNJ
Groud truth
EditGuard
(a) PS-Add Sticker
W Walermarked
Tampered
Watermarkedd image
Tamporedi Image
Ground truth
Our PM1
Ground truth
EditGuard
Image
image
(b) Deepfake-SimSwap
W attemarked
Tampered image
Watammrrked image
Tampored image
Ground truth
Our PAI
Ground truth
EditGuart
image
(c) AIGC-Stable Stable Inpainting
Figure 14: Localization performance comparisons of our PAI and EditGuard on PS, Deepfake, and AlGC-based editing methods.
27


Reviews:
[{"review_id": "sOSzmD1mf3", "reviewer": "Reviewer_Rgem", "summary": "This paper presents PAI (Provenance-Aware Intelligence), an attack-resistant watermarking and forensic framework for AI-generated images. By leveraging a diffusion-based semantic deflection mechanism, the method embeds and verifies watermarks at the semantic level rather than in pixel space, making them robust against degradation, removal, spoofing, and tampering attacks. The system integrates ownership verification, attack detection, and tampering localization through DDIM inversion. Experimental results demonstrate that PAI achieves superior robustness and functionality compared to existing watermarking methods, offering a promising solution for reliable provenance tracking and authenticity verification in AIGC image forensics.", "questions": "Please refer to the Weaknesses", "limitations": "", "rating": 4, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The paper introduces a novel semantic deflection mechanism within diffusion processes, embedding watermarks in the semantic space rather than pixel space — a creative and technically sound idea that improves robustness against diverse attacks.\n\n2. The proposed PAI framework integrates watermark generation, verification, attack detection, and tampering localization into a unified pipeline, demonstrating both conceptual coherence and practical applicability for real-world AIGC scenarios.\n\n3. Extensive experiments compare PAI with multiple state-of-the-art methods (e.g., EditGuard, Tree-Ring, Stable Signature), showing consistently superior performance across robustness and functionality metrics.\n\n4. The paper goes beyond simple watermark verification by achieving semantic-level localization of edited or tampered regions, which adds significant forensic and interpretability value to the method.", "weaknesses": "1. The experimental validation mainly focuses on standard diffusion-based AIGC models and common attack types. The generalization of PAI to non-diffusion models (e.g., GAN-based generators or real-world edited images) remains unclear.\n\n2. Although the authors claim imperceptibility of watermarks, no formal perceptual metrics or human evaluations are provided to verify that the embedded signals do not degrade visual quality or introduce detectable artifacts.\n\n3. The framework is exclusively designed for diffusion-based AIGC models, with no compatibility testing or adaptation for GAN-based or transformer-based image generation systems.\n\n4. The ablation study only varies the number of deflection steps and clean sample size, neglecting to investigate the impact of critical hyperparameters (e.g., γ, DDIM steps) on robustness and image quality.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UPjQ2fU3nj", "reviewer": "Reviewer_fR5j", "summary": "This paper presents Attack-Resistant Watermark (ARW), a robust watermarking framework designed to enhance resistance to generative model attacks, particularly diffusion-based removal and regeneration. ARW employs a dual-domain embedding strategy that combines frequency- and spatial-domain features with an adaptive noise calibration mechanism, ensuring watermark persistence after heavy editing, compression, or diffusion regeneration. A key innovation is the Attack Simulation Module (ASM), which imitates various diffusion or enhancement operations during training, improving generalization to unseen attacks. Extensive experiments on ImageNet and Stable Diffusion–based editing tasks show ARW significantly improves watermark survival rates and retrieval accuracy compared to recent methods like StegaStamp, RivaGAN, and TreeRing.", "questions": "See the weakness.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Novel robustness design: This paper integrates attack simulation directly into training, improving resilience against diffusion and regeneration attacks.\n\n2. Comprehensive experiments test under multiple real-world generative attacks and shows consistent superiority.\n\n3. Good balance of fidelity and robustness: watermark imperceptibility maintained with strong retrieval accuracy.\n\n4. Well-structured ablation studies: This paper clearly isolate the contributions of dual-domain embedding and ASM.", "weaknesses": "1. Limited theoretical analysis lacks a formal framework or justification for robustness improvements beyond empirical results.\n\n2. The evaluation of this paper focuses on diffusion-based attacks. Some adversarial or large semantic edits such as instructpix2pix should be included in the experiments.\n\n3. Computational cost of dual-domain embedding and ASM could hinder deployment in high-throughput systems. Costing 7950.59ms for watermarking an image seems too long. \n\n4. Generalization uncertainty: unclear performance on unseen generative models (such as some DiT-based methods) or video data, limiting broader applicability and disscusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wvzXDv78Cp", "reviewer": "Reviewer_h8d5", "summary": "This paper introduces PAI (Provenance-Aware Inherent watermarking), a novel training-free, inherent watermarking framework designed for copyright protection and forensics of images generated by diffusion models. The authors identify two critical flaws in existing methods: (1) a forced trade-off between robustness to watermark removal attacks and spoofing attacks, often stemming from reliance on 1D verification metrics, and (2) an inability to perform semantic-level tamper localization, which is crucial for detecting edits made by other AIGC tools.", "questions": "The overall provenance framework is built on the deterministic invertibility of multi-step sampling DDIM. What would happen if one-step or diffusion sampling mechanism is taken (like DPM-solver or flow-matching)?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "- The idea of moving inherent watermarking beyond static noise initialization to active, key-conditioned \"deflection\" of the denoising trajectory is a significant conceptual leap. It creates a much deeper and more complex entanglement between the secret key and the final image semantics.\n\n- The most original and impactful contribution is the verification method. Correctly identifying the 1D scalar metric as the root cause of the removal/spoofing trade-off is a key insight. Replacing it with a high-dimensional vector (the initialization bias) and analyzing its directional properties in a latent PCA space is a brilliant and effective solution to this long-standing problem. This single mechanism's ability to unify verification, attack detection, and localization is elegant.\n\n- This work presents a practical, training-free, and robust 3-in-1 system for AIGC forensics. By decisively solving the removal/spoofing trade-off and enabling, for the first time, robust semantic localization for an inherent watermark, this paper sets a new standard for AIGC copyright protection. This is a significant contribution to the field of AI safety and provenance.", "weaknesses": "The deflection intensity $\\gamma=0.1$ and the application of deflection for only the first five steps are presented without extensive ablation. The appendix (A.6.3) only ablates the number of steps (5, 10, 15), showing that 5 is sufficient. However, the intensity $\\gamma$ is a critical parameter that presumably balances image quality against robustness. An ablation study on $\\gamma$ would provide a more complete picture of the method's properties and trade-offs.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jZJ1MioW6p", "reviewer": "Reviewer_wY8c", "summary": "This paper proposes a training-free, plug-and-play AIGC image copyright protection framework called PAI. PAI injects watermarks through a two-stage generation process: in the initialization stage, the user key and timestamp are embedded into the initial noise through the Box-Muller transform to ensure its compatibility with the diffusion model; in the denoising stage, a new key-conditioned deflection is introduced to guide the denoising trajectory.\n\nThe main contributions include: 1. A training-free inherent watermark framework PAI is proposed to improve robustness. 2. A relatively complete theoretical analysis and proof are provided. 3. The contradiction between existing methods in defending against removal attacks and spoofing attacks is successfully resolved. 4. Effective localization of semantic-level tampering caused by AIGC tools is achieved.", "questions": "1. In the sampler selection section, comparative experiments with other samplers could be added to analyze the generalization performance of the model on these samplers.\n\n2. Add hyperparameter ablation analysis experiments.\n\n3. Regarding the idealized assumptions in the theoretical analysis, the applicability under real-world conditions could be discussed.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. In terms of originality, the paper's two-stage approach to watermark injection, using denoising trajectories to guide the generation process, is a relatively novel perspective. \n\n2. In terms of quality, the paper is comprehensive and provides theoretical analysis to further support the rationale of the proposed method. The experimental design is comprehensive, covering multiple datasets, multiple baselines, and various attack types, and the results clearly demonstrate the advantages of the method. \n\n3. In terms of clarity, the paper's overall structure is clear, and the charts and graphs are intuitive. \n\n4. In terms of importance, the problem addressed in the paper is of practical significance, and as a plug-and-play method, it also has strong generalizability.", "weaknesses": "1. Regarding sampler selection: The paper primarily conducts a series of analyses and experiments based on the DDIM sampler, lacking analysis of the compatibility and generalization performance of other samplers.\n\n2. Regarding hyperparameter sensitivity analysis in the experimental section: The paper lacks analysis of the intensity of hyperparameter deffection.\n\n3. In the theoretical analysis, an idealized assumption is made for the diffusion model. Is this analysis still applicable under real-world non-ideal conditions?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)