Guidance Watermarking for Diffusion Models
Authors: Enoal Gesny
Eva Giboulot
Teddy Furon
Vivien Chappelier
Venue: ICLR 2026 Poster (2026)
Keywords: watermarking
image generative AI
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose an in-diffusion watermarking method that guides the generative process using any watermark detector.

Abstract: This paper introduces a novel watermarking method for diffusion models. It is based on guiding the diffusion process using the gradient computed from any off-the-shelf watermark decoder. The gradient is guided further using different image augmentations, increasing robustness to attacks against which the decoder was not originally robust, without retraining or fine-tuning. The methodology effectively allows to convert any post-hoc watermarking scheme into a scheme embedding the signal during the diffusion process. We show that this approach is complementary to watermarking techniques modifying the variational autoencoder at the end of the diffusion process. We validate the methods on different diffusion models and detectors. The watermarking guidance does not significantly alter the generated image for a given seed and prompt, preserving both the diversity and quality of generation.

Published as a conference paper at ICLR 2026
GUIDANCE WATERMARKING FOR DIFFUSION MODELS
Enoal Gesny', Eva Giboulot', Teddy Furon' Vivien Chappelier 'Inria, Rennes, France
*LABEL4.A1 Rennes, France (enoal. gesny) 0 @inria............
ABSTRACT
This paper introduces novel watermarking method for diffusion models. is based on guiding the diffusion process using the gradient computed from any off-the-shelf watermark decoder. The gradient computation encompasses different image augmentations, increasing robustness to attacks against which the decoder was not originally robust, without retraining or fine-tuning Our method effectively convert any post-hoc watermarking scheme into an in-generation embedding along the diffusion process. We show that this approach is complementary to watermark- ing techniques modifying the variational autoencoder at the end of the diffusion process. We validate the methods on different diffusion models and detectors. The watermarking guidance does not significantly alter the generated image for given seed and prompt, preserving both the diversity and quality of generation.
INTRODUCTION
Diffusion models have been the touchstone of the recent advancements in image generation. Once challenging tasks, such as text-to-image generation, image-to-image translation, super-resolution, or inpainting, are now performed with ease and flexibility. Various optimizations (Song et al. 202T Rombach et al., 2022a Dao 2024) and the proliferation of accessible interfaces (Ramesh et al. 2022
Zhang et al. 2023] von Rütte et al., 2024) have made this technology accessible to users without technical know-how and high-end hardware. Generative AI now creates high-quality, diverse, and photorealistic images that are perceptually indistinguishable from real images.
Regulating entities have identified the risks posed by such technology (USA, 2023 China 2023
Europe 2023). Notably, there is an essential demand regarding the identification and traceability of Al-generated content (Fernandez et al. 2024b). Among existing solutions (such metadata (C2AA 2024) and forensics (Corvi et al., 2023) digital watermarking stands out as a key technique.
Watermarking embeds imperceptible identifiers into images, making them detectable by private decoders. This mature technology has many applications. including copy protection, audience measurement, content identification and monetizing, broadcast monitoring (DWA). It has recently been adapted to the identification of generated content. Among many scenarios listed by the NSA (2025). one is warn users of social networks or Internet search engines that these images are not real, another is to filter out Al-generated images from the training sets of future generative Als to avoid model collapse (Bohacek Farid 2025). In both cases, the watermark detector analyses billions of images. The requirement of utmost importance is provably low false alarm rate, i.e. the probability of flagging a real image as Al-generated.
Numerous designs have been proposed for text (Kirchenbauer et al. 2023 voice (San Roman et al. 2024), and generated image (Fernandez al.) 2023). For this latter media, the strategy ranges from post-generation watermarking to clever modifications of the generation delivering content that is 'intrinsically" watermarked (Wen et al. 2023 Yang et al. [2024b] Huang et al. 2025 Fernandez et al. 2023 The first method is referred to post-hoc and the second as in-generation watermarking.
This paper presents a principled methodology for converting any post-hoc watermarking into an in nn-generation scheme for any diffusion model. The idea is guide the diffusion process towards generating images that are intrinsically deemed watermarked by any arbitrary watermark detector. We summarized the method in Figure Our contributions the following:

---

Published as a conference paper at ICLR 2026
Guicanoe process
20
VAE
DETECTIO
T
VaLLoss:
Finich diffusion
Aggregation
3it
tt
2
1-1v
Oww
VAE
Woternaried imago Generntion
Watermatfked ina
Detection
Figure I: System-level diagram of the proposed guidance-based watermarking method.
1. Our method is the first to embed the watermark during the diffusion process itself with the use of guidance
2. It does not necessitate any retraining of the diffusion model.
3. It inherits from the robustness of the watermark detector, but can also improve it against targeted attacks without retraining the detector.
4. It strikes balance between complete modification of the semantic content (seed-based schemes) and the addition of an invisible signal (VAE-based and post-hoe schemes).
RELATED WORK
2. DIFFUSION MODELS
Diffusion has emerged as powerful framework leveraging iterative denoising to generate high-quality images. Starting from forward process gradually corrupting data with Gaussian noise:
(5 z0) II <(< 2-11,, with <(2: =1-1) N(z v B12-1,,,
(1)
where 3g controls the noise schedule, the Denoising Diffusion Probabilistic Model (DDPM (Ho et al. 2020 learns a reverse process to iteratively denoise through parameterized transitions:
po(2 2e) (2 (2,, t), (2 t)).
Denoising Diffusion Implicit Models (DDIM (Song et al.
2021) extends this framework by intro-
ducing Man-Marko sampling, enabling deterministic generation through an ODE-like process:
dr ta ca(=), ()) + (0)
2 v
04
where 0g = -II'-1 3.). For the sake of simplicity. we omit the user prompt conditioning <g. Sub- sequent advancements improve efficiency through latent space optimization balancing computational cost with perceptual quality (Dhariwal & Nichol 2021; Nichol & Dhariwal (021). Modern image generators are Latent Diffusion Model (LDM) working latent space Z. From the initial vector Zr E Z drawn as white Gaussian vector, the variational auto-encoder (VAE) transforms the final latent 2g Z into an image Ty VAE(2g) in the image space X.
2.2 GRADIENT- BASED GUIDANCE
Gradient-based guidance mechanisms in diffusion models enable precise control over generation by incorporating external signals through backpropagated gradients during the denoising. Introduced by Dhariwal & Nichol (2021). this approach modifies the sampling trajectory using auxiliary objec- tives, such as classifier scores or perceptual losses. For instance, Jeanneret Destaenc,,canneret et al. (2022) implement
gradient-based guidance steer the diffusion process toward generating counterfactual examples to
2

---

Published as a conference paper at ICLR 2026
explain the prediction of a given classifier. Given query image, the goal is to make the diffusion model generate an image as close as possible to the query but classified differently.
Our work is inspired by this trend, considering that watermark decoder is indeed a classifier. Yet, we do not have a query image to start with, but a user prompt. We include an augmentation layer to gain robustness, concept irrelevant for counterfactual examples.
2.3 WATERMARKING IMAGES GENERATED BY DIFFUSION MODELS
Post-hoc Traditional image watermarking embeds watermark signal into an original image (Cox 2008). In zero-bit watermarking, the detector decides whether the watermark is present or absent, while in multi-bit watermarking, the decoder retrieves the hidden binary message from the image under scrutiny. Recent advancements leverage the capabilities of a pair of deep neural networks to embed and detect/decode the watermark: The foundational HiDDeN framework of [hu al. (2018) established such an end-to-end pipeline inspiring subsequent adaptations such as TrustMark (Bui al., 2023), VideoSeal (Fernandez et al., 2024a), or InvisiMark (Xu al.) 2025). The training
minimizes a loss combining perceptual distance between the original and watermarked images with a multi- or zero-bit classification loss. An augmentation layer distorts the watermarked image before passing it to the detector/decoder in order to improve the robustness.
Traditional watermarking is a communication channel through host content, whose theoretical pillar is based on the work of Costa (1983) establishing the capacity of a side-informed communication scheme. Its main message is that the original image should not be seen as a source noise limiting the capacity of the hidden communication channel, but side-information known while emitting the watermark signal. Yet, it is difficult in practice to be sure that the host image is not interfering with the watermark; especially in zero-bit watermarking (Comesana et al. 2010 Furon 2017).
Post-hoc means that the generated image is the original image forwarded to a traditional watermarking scheme before being returned to the user. The main weakness is that it is not specific to generative AI. A Atthough these methods demonstrate progress in robustness, they operate as external add-ons rather than integral components of the generative process.
In-generation Stable-Signature pioneered the in- in-generation approach by merging the final step of the Stable Diffusion model, i.e. the VAE, with post-hoc watermark embedding (Fernandez et al.) 2023). To do so, fine-tunes the VAE using a loss combining a perceptual distance between the images generated by the new and the original VAE together with a loss on the decoded message when the generated image goes through given pre-trained watermark decoder.
In stark contrast, Wen et al. (023) claim that there is such thing an original image in GenAI watermarking. The user will never see the image generated without a watermark. The model is sampling images not related to any reference image; therefore, controlling the distortion introduced by the watermark, like in post-hoc watermarking or Stable Signature, is a meaningless constraint.
A second difference is that Wen et al. (2023) embed the watermark signal before the diffusion process: Free-Rings crafts seed in the latent space with a secret pattern. A third difference is that Tree-Rings first defines the way to sample watermarked images, and then designs a possible detector. From an image under scrutiny, the detector first estimates the seed by inverting the diffusion process and computes the distance to the secret pattern. The image is deemed watermarked if this distance is below a given threshold. It offers fair robustness against geometric attacks by enforcing some structure in the secret pattern. Yet, our appendix shoows that the false alarm rate is not under control.
Yang et al. (2024b) improve this idea in several aspects: First, Gaussian Shading takes care of crafting seeds following a Gaussian distribution as required by many diffusion models. It is multi- bit watermarking with excellent robustness against valuemetric attacks thanks to a repetition error correcting code. However, it is not robust to geometric attacks.
Huang et al. (2025) notice that the semantic content of the generated image changes with the strength of the Tree- Ring watermark. Their proposal, RoBIN, postponed the watermark embedding to an intermediate step within the diffusion process. This makes a compromise between maintaining the semantic of the image (unlike Tine-Ring) while not caring about the norm of the additive watermark
3

---

Published as a conference paper at ICLR 2026
Daased Roal
Sacrew Boad
00
Figure 2: Differences of (log)-spectrum of generated images with and without watermarking, Left: Embedding by the VAE (Stable Signature /eennandz et al.) (2023)). Right: Embedding during the diffusion (Ours), (A]eddii(Adetaiiii the computation of these spectrums. Stable-Signature embeds signal in a specific frequency band, whereas our method distributes the signal over the full spectrum.
Signature/Fernandez
signal (unlike post-hoc and Stable Signature). The main problem is that, similarly to Tree-Ring, the false positive rate is high and does not come with a theoretical guarantee.
3
MOTIVATIONS
We borrow from Stable Signature the idea that the decoders traditional watermarking schemes quite robust thanks to the augmentation layer considered during their training. Moreover, some designs take great care of controlling the false alarm rate (see, for instance, (Fernandez et al. 2023 Fig. 12)). Therefore, these are good and sound starting points.
However, Stable Signature requires fine-tuning the VAE, which acts like an advanced upscaling: upscales the latent representation in-generation watermarking technique focuses the watermark power on the high-frequency details. Figure illustratts this fact on the left. The spectrum difference with and without Stable Signature watermarking shows the watermark energy spread in high frequencies. This explains the relatively low robustness of Stable Signature against low-pass filtering processes like JPEG compression. In contrast, our technique spreads the energy of the watermark all over the spectrum.
large image and adds nigh-freeuency details. Therefore, this
We also borrow from in-generation schemes the idea that watermarking should not seen as addition of a low-amplitude signal over an original image (Wen et al. [2023] Yang et al., 2024b). As such, PSNR is not an appropriate metric for GenAl watermarking. Yet, we agree with Huang et al. (2025) that the semantics of the generated image should not fluctuate due to the watermark.
In a nutshell, our goal is to sample images deemed as watermarked by pre-trained detector. This conditioning of the sampling is made without any reference to original image and early as possible to plant the watermark in the semantic of the generated image.
OUR METHOD GUIDES THE DIFFUSION TO EMBED A WATERMARK
4.1
ASSUMPTIONS
The image generator is Latent Diffusion Model defined by a latent space Z, number of diffusion steps T with an associated scheduling (ot)εT[T with [[]] [1,..., T), a noise estimate model
co : 2 [T] + 2, and the function VAE 2 + X' converting latent vectors to images. The diffusion generates image To from seed 2y through the following abstract update process:
Vt [T]] 21-1 = Diffusion (22, Eg, t), Zo = VAE (2o).
(4)
We keep the diffusion update mechanism Diffusion abstract since our method does not depend on the specific choice of solver for the diffusion process: It estimates the noise of latent 2, using co timestep f, outputting a denoised latent _ from this estimated noise.
The pre-trained watermark decoder/detector M raw logits. This function is deep neural network easily differentiable thanks to backpropagation. For decoding, the decoded bits are the sign of the logits: m (ig)( element-wise (Bui et al.
the extraction function X R M to compute
4

---

Published as a conference paper at ICLR 2026
2023
Fernandez et al. 2024a Xu et al. 2025). M is thus the watermark length. From binary
message m E {0, 1 the antipodal modulation outputs the vector Um = --11)" component-wise in IR For detection, the image is deemed watermarked if the cosine similarity cos( (z(2) um is
above a threshold, with Vm E RRM a reference secret vector as in Fernandez et al. (2022)
A crucial assumption is that the extraction function provides random feature ((X) with an isotropic distribution in RM when applied on a random non- non-watermarked image X, be it synthetic or real. This approximately the case in Stable Signature Fernandez et (2023) whiten ((X) with PCA.
4.2 DIFFED-DI FOR WATERMARKING
Our method resorts to conditional sampling introduced by Dhariwal & Nichol (2021) I for DDIM and extended to other solvers by Lu et al. (2022). The differentiable detector Φ along with a differentiable loss function L 2 + R++ guides the diffusion process. At each iteration, the estimated noise is modified by incorporating information from the gradient of the loss:
E(z,, t) := <0(2,, t) - wV/ āt V log L(x))
(5)
where a scalar denoting the strength of the watermark guidance. This parameter must be carefully calibrated to ensure sufficient watermark detectability while maintaining image quality. The diffusion update is effectively replaced by 2 = Diffusion (Ze, E,t.
4.3 CHOICE OF THE LOSS FUNCTION
The loss function defined above is symbolic. In practice, it should depend the message be hidden (multi-bit) or the secret vector umm (zero-bit) and on the vector extracted from the image generated from the latent 2t. In other words, from latent 2,. to gain access the loss and its gradient, we complete the diffusion process from & to 0 and use the VAE, before applying the decoder/detector to the resulting image To, which we loosely denote as za(2)) To unify decoding (multi-bit) and detection (zero-bit), we propose the loss function L 2 x R E
L(2,, Um) == u (zo(2)))
1 - cos( (Io(Z))) Um))
(6)
(x ll2
Our goal is to minimize the angle between um and o (x)() In multi-bit watermarking, the decoding is exact this loss is lower than - -
In zero-bit watermarking, this loss can be related the following quantity, known the p-value in statistics under some assumptions detailed in App.
(1) (1(0-1)) 2
( 1
1 (M
p =
with cos(0):= L(2,, um and [a(a, b) is the regularized incomplete beta function. The sign is positive if cos(0) > O, negative otherwise. If probability of false alarm PFx is required, the watermark detected if the computed p-value lower: < PFA- Hence, minimizing the loss amounts minimizing the p-value for watermarked image, which in turn increases the probability to be correctly detected.
4.4 ROBUSTNESS AGAINST IMAGE TRANSFORMATIONS
Until now, we controlled the diffusion to minimize the decoding loss for the untouched generated image A first enhancement minimizes the loss for an image modified with a chosen set T of image transformations T X - X, a.k.a. augmentations, ensuring robust watermark. At each diffusion step, we compute the loss for an individual transformation 7' redefined as L(z,, Tmi 1 - cos( (T (x)(z))) u. We compute the gradient for each new loss and aggregate them:
(=x) == ex(2))
a,Ag ((V log L(ze, umi T)) T (TTT))
(8)
The choice of aggregator Agg is crucial. The gradient directions might not agree for different transformations, leading to subpar performance if using simple averaging. There exists extensive
5

---

Published as a conference paper at ICLR 2026
literature addressing this problem in multi-task learning (Liu et al. 2021 and byzantine federated learning (Guerraoui et al. 2024). We settled on the well-known PCGrad algorithm (Yu et al. (020).
One advantage of this approach is that T can contain transformations for which the original feature extractor & is not inherently robust. Section 5 shows this enhances the robustness of our method against these transformations without the need to retrain the watermark detector.
4.5 FAST AND CONTROLLED GUIDANCE FOR WATERMARKING
Our method is too computationally expensive, requiring T(T + 1)/2 diffusion and gradient propaga- tion steps. This section suggests two simplifications. First, we turn on the watermarking guidance a step Tw. 0 < Tw < T'. Second, we simplify the gradient propagation along the backward diffusion by an identity transform. In other words, V 20 replaces Vs, in equation 8
Finding a suitable guidance strength is cumbersome as it depends on the watermark decoder e and the image generator. We propose to clip the gradient norm in order to control the amount of watermark signal added at each diffusion step:
( t) ;= eØ(2t, t) wv1 - ai max (7), I
with g = clip, (V log (zx))
with 1) and 7 to be chosen by the user - see Appendix
EXPERIMENTAL RESULTS
5.1 EVALUATION SETTING AND METRICS
Diffusion models We evaluate our method on three open-source diffusion models: Stable Diffission 2 (Rombach et al. 2022a), Flux-1.0 dev (Black Forest Labs| 2024), and Sana (Xie et al. 2024). We use their implementation available on HuggingFace. Of note, SD2 uses the ExleeriisreteSSheddu solver, whereas Sana and Flux use the Flow.Mucchaleeriiseetttesse method is agnostic to the diffusion mechanism. The images are generated from 1,000 prompts from the Gustavosta/Stable Diffusion-Promyy meant to reflect more closely prompts used in real environment. In Appendix D.2 we also report our experiments for 200 captions from the COCO dataset (Lin et af. 2014). Image size is set to 512 512, except for Flux, for which chose 256 x 256 due to computation constraints.
This outlines that our
a series of prompts extracted from generated images which
Watermarking detectors We use the detectors from two state-of-the-ae art methods: Stable Signature (SSig g, [ernandez al. (2023)), ), and VideoSeal (VS. Fernandez et al. (2024a)). Their watermark lengths M equal 48 (SSi g) and and 256 (VS). We chose these schemes because they can be used as multi-bit decoders or zito-bit detectors (See Sect. 4.1). Appendix C experimeenallyy verifies that the returned p-value is valid.
Baselines We consider the in-generation schemes Tree-Ring (Wen al. 2023) for zero-bit detection, and Gaussian Shading (Yang et al.) (2024b) for multi-bit decoding (256 bits). We set the maximum ring diameter of Tree-Rings to 18 and for SD2 and Sana respectively and use and 10 latent channels for the embedding. Appendix C shows that the p- value computed by the original implementation of Tree-Rings is incorrect, and describes some corrections to get reliable p-values. Unfortunately, we did not succeed to fix RoBIN Huang et al. (2025) detector so we exclude it from our benchmark. We also compare with state-of-the-an post-hoc watermarking schemes VS as well as the in-generation strategy of sSig fine-tuning the VAE.
Our embedding We denote by G-VS and G- E-SSig i our watermark embedding guiding the diffusion with the decoders above. The augmentations used in the gradient computation are: Identity, JPEG compression with QF 50 and 80, brightness +0.2, contrast x2, and central crop 50%. These are augmentations used the training of the decoders, our guidance is thus aligned with their robustness. The watermark guidance parameters are found by a grid search to provide the best trade-off between watermark detectability and image quality. Appendix details their values.
Available
Huggingface at https: ngg face. co/datasets /utttatsstttttaaee We filtered NSFW prompts for this work.
Stable-Die ffus Prompts

---

Published as a conference paper at ICLR 2026
LDM
WM
FID (
CLIP (1)
PSNR (
LPIPS (1)
||
Capacity(1)
Pp @ 10 PPa (Poa) @ Pb =
0.330
SD2
G G-98ig
2.3
0.332
19.6
0.22
27.7 (+19.3)
0.99 (+0.5)
16.3 (+12.2) 105.6 (+61.8)
SD2
G-VS
2.2
0.332
18.5
0.28
212.2 (+37.7)
1.0 (+0.0)
Flux
0.271
Flux
63ig
9.3
0.271
25.4
0.07
26.6 (+16.6)
0.99 (+0.46)
16.6 (+12.8) (+24.3)
G-VS
0.269
(+16.0)
1.0 (+0.0)
Sana
4.3
0.346
Sana
581g
0.347
28.6
0.02
26.5 (+17.00
(+0.41)
(+10.6) 96.4 (+49.22)
Sana
3-93
4.1
0,346
23.5
0.07
207.5 (+28.8)
1.0 (+0.0)
Table I: Comparison of image quality for several diffusion models and robustness metrics for our G-SSig and G-VS. parenthesis, difference with their siblings SSig and vs. The robustness metrics are average over set of attacks: Identity, JPEG compression with QF 50 and 80, brightness +0.2, contrast x2, and central crop 50%.
Quality The quality of the generation is gauged by the CLIP score between prompts and im- ages (Hessel et al. 2021). and the Fréchet Inception Distance (FID) (Heusel et al., 2017) between generated images and 5, 000 images from the COCO dataset. The watermark should not spoil these metrics. We also provide the PSNR and LPIPS score (Zhang et al., 2018) between the images generated with and without watermark, although these metrics are not suitable for generative AI (Sec. 2.3
Robustness or multi-bit decoding, the robustness is measured via the Random Coding Union (RCU) bound (see Eq.(1 in (Polyanskiy et al., 2010)). We embed random binary messages and measure the Bit Error Rate p at the decoding side. Assuming a Binary Symmetric Channel with crossover probability p. the RCU is lower bound on the maximum number of bits that can be reliably transmitted for a given watermark length M and a word decoding error probability e set to 10-3 3, This allows for a fair comparison of decoders with different watermark lengths. For zero-bit detection, the robustness is measured by the detectability PD of the watermark at extremely low PFA- We expose our method reach this regime without many samples in Appendix [ For completeness we also report
for each method and model. The following figures and tables are extracted from full body of experimental results given in App. D.I
5.2 IMPACT ON THE QUALITY OF THE IMAGE GENERATION
The semantic and image composition with or without a watermark are very close for a suitable guidance strength. The visual differences are slightly different tone, colors, shape (see Fig. B This is different from the noise-like watermark signal of post-hoc or SSig and also from the drastic change of composition of Tree-Ring (Wen al. 2023 Fig. 2). Yet, too much guidance strength leads to artefacts as depicted in App.
The left part Table I provides the quantitative assessment of the quality of generated images. As expected, the PSNR is relatively low whereas no differences are observed with respect to the FID and CLIP score. This confirms that the watermarked images are qualitatively similar to the non-watermarked images despite local differences for the same prompt and seed.
Figure 3: From left right: 'A vibrant autumn forest with red, orange, and yellow leaves and winding path' generated by Sana (1) without watermarking, (2) watermarked with our G-SSig, (3) difference (2)-(1), (4) watermarked with Stable Signature SSig, (5) difference (4)-(1)
7

---

Published as a conference paper at ICLR 2026
5.3 COMPARISON WITH IN-GENERATION SCHEMES
Table compares our performances with two in in-generation schemes: Gaussian Shading for multi-bit decoding and Tree-Rings for zero-bit detection. By design, Gaussian Shading is quite robust to valuemetric attacks (an image processing which perturbs the pixel values) but absolutely not robust to geometric attacks (like shift, crop, rotation, ...... As for our method, we inherit from the robustness of the pre-trained decoder. For instance, both G-VS and G G-SSig are robust to such a strong crop because the decoder saw during its training. This allows our method to substantially surpass the performance of other in-generation schemes. The same holds for zero-bit detection. By design Tree-Rings robust against rotation but not crop.
WM scheme
Identity
Contrast (x2)
JPEG (Q=50)
Gaussian Blur 3
Rotation 90
Crop 50%
multi-bit decoding (capacity in bits)
Gaussian Shading
221
G-SSig
G-VS
222
219
197
220
194
206
zero-bit detection (- (-Fogio(PFA)) @ Pp 0.9)
Tree Tree-Rings
11.7
6.5
4.3
9.1
0.8
0.4
G-98ig
21.9
19.8
14.7
16.6
17.4
11.4
G-VS
154.6
130,6
89.2
150.3
100.7
101.9
Table 2: Comparison with two in-generation schemes for Stable Diffusion v2.
Adversarial Attacks Adversarial attacks have demonstrated strong effectiveness against traditional in genenetrttion, seed-based watermarking schemes. Figure shows the results of three representative
attacks, VAE purification (Liu et al. 20200; Abdelnabi & Fritz [202], ) regeneration (Nie et al. 2022).. and the average attack (Yang et al. 2024a), applied to respectively 500, 500 and 50 images generated with V-VS, Tree-Rings, and Gaussian -haaiing..
We perform VAE purification by applying in succession the encoding and decoding function of the original VAE of the diffusion model used to generate the image. The regeneration attack is performed by encoding the watermarking image, adding noise to the latent corresponding to a given step and finishing the diffusion process. For each image, use 2,4.6,8 and 10 steps. The average attack is performed under a gray-box setting: for each watermarking scheme and a fixed key, we compute the average residual between set of watermarked and non-watermarked images. Our guidance-based method is content-dependent as shown in Appendix [D.3] unlike Gaussian-Shading and Tree-Rings. Consequently, the average residual for the guidance- based approach has lower amplitude than for the other two methods. To ensure fair comparison, we enforce a constant PSNR across methods by normalizing the attacking signal. All other attacks are performed over images with variable keys.
Figure shows that G-VS is always more robust than Free-Rings, and particularly for the average attack. It also demonstrate empirically that Gaussian-Shading tion and VAE purification due to the redundancy of the signal, but not at all against the average attack whereas G-VS robust against the three studied attacks.
a little more robust against regenera-
5.4 COMPARISON WITH POST-HOC WATERMARK EMBEDDING AND SSTG
Multi-bit performance The right part of Table I shows the robustness metric averaged over the following benchmark attacks: Identity, JPEG compression with QF 50 and 80, brightness +0.2, contrast x2, and central crop 50%.
Zero-bit performance we report the detectability at a low PFΛ = 10-10, In this regime, we double the performance of SSig. Since VS is already perfectly detectable this regime, we provide more fine-grained analysis in Figure 5 The (log)-ROC curves demonstrate large gap in performance in favor of the guidance methods whatever the model and the method: for any arbitrary РFА. the detectability is always significantly higher. For instance, always observed for G-VS compared to VS in the low PFΛ regimes. The case for SSig is even more clear cut: G-VS stays perfectly detectable even at PFA where SSig g has zero detectability.
absolute gain between 20% and 10% is
8

---

Published as a conference paper at ICLR 2026
41
Amiage GVS
Avenige GAV
Beggteeriin I9V8
Bit Ncumary
Begetaniio C-V3
Joga
VILE GVS
Amaage TeaeRnge
Avenge Groeinstedngg
Begeteerin The-lligg
Regremetio Saalii--wwwiigg
VAE
VAE Guason Stoolla
00
19
do
Figure 4: Adversarial attacks applied to Sana images watermarked with Tree-Rings, Gaussian- Shading G-VS. Regeneration attacks and VAE purification computed over 500 images while the average attack is computed over 50 images. The mean -log (P Pp = 0.9 and the mean bit accuracy are reported respectively for Tree-Rings and Gaussian-She -haasian-Shadig...
9D32
Sona
3.0
Fiut
1001 VS
G.00cc
05
1.2
Fhet DAN
01-
Figure 5: Probability of detection Pn of post-hoe and corresponding guided methods as a function of the PFA for different models. The curve is shown all studied augmentations, with 1000 images generated form the Gustavosta/Stable Diiilll---iffi------ Prooppss prompts for each augmentation.
Unknown augmentations So far, the watermarking schemes were benchmarked against known attacks, i.e. attacks used augmentations during the training of the decoder. We investigates whether our method can improve the robustness against unknown attacks by encompassing them in the gradient computations. This avoids retraining a decoder with new set of augmentations. It happens that SS ii is not robust against 90-degree rotation or median filtering. Figure shows that we drastically improve the performance by encompassing these attacks. In the original work, Stable- Signature was shown to be easily removable by passing the image through the original VAE simple purification attack. We show in Figure that our method is robust to such attacks "for free". Indeed, since the gradient has to be back-propagated through the (unwatermarked) VAE, such attacks are implicitly within the transform set.
5.5 COMPUTATION COST
As hinted in Section 4.5 is possible to apply guidance only during the last diffusion steps while remaining effective. The table 3 reports the performance of guided diffusion when applied for different numbers of steps. We report results with VS. as it is the best baseline detector, but we focus on comparing the computation cost with other in-gen watermarking methods. Overall, comparable performance to post-hoc methods can be achieved with 15 guidance steps, whereas 10 and guidance steps are sufficient to outperform Gaussian- Gaussian-Shading and Free-Ringg respectively. should be noted that seed-based methods require an inversion of the diffusion process for detection, increasing its cost compared to post-hoc hoc methods. For both Gaussian -hadiing and Tree- free-Rings, only inverse diffusion steps required for good detection Sana and Flux. However SD2 requires 50 steps. Unlike these methods, ours does not require extra steps for decoding making it up to 50 times faster at detection time.

---

Published as a conference paper at ICLR 2026
Sana
1.3
Eiaity 55%
Hoture 50 1806
0.5
Eieittyy 10-55g
Mecheelther 5 125g,
Bassee (3:00g
0.5
Fille (1 5ig
0.4
0.0
(Ps)
Figure 6: Zero-bit detection Stable-Signature with SID2 and Sana. The guidance patches weakness of the decoder by encompassing an unknown attack in the gradient computation. The curves were computed over 200 images from hatpoosssss/tatalll-iiiiiiioooo
for each attack.
SD2
Sama
Flux
1.0
VAB RD2 Shi.
1.0
VAB Saze.
VAB Faux Bite
0.8
VAl SUX G-880p
0.5
WAll Sanc. U-S8a,
0.8
0.6
0.6
0.4
0.2
0.2
0.0
0.0
0.0
10
20
30
10
10
(Pea))PPaa)
Figure 7: Probability of detection PD of post-hoc and corresponding guided methods as a function of the PFx for different models, under the attack using the original VAE to remove the watermark. The curves were computed over 200 images from
Stable-Difffsioon
for each attack.
WM scheme
Capacity(t)
-logio (PFA) PD = 0.9(t) Steps(L)
G-VS
207.5
96.4
325
G-VS
last 15
178.0
70.0
130
G-VS
last 10
117.7
36.9
70
G-VS
last 5
15.3
6.2
35
VS (post-hoc)
178.7
47.2
25
Tree-Rings (in-gen)
0.70%/1100
25 +det
Gaussian Shading (in-gen)
119.0
0.37*/28.5
25 +det
Table 3: Comparison of the performances for several robustness metrics depending on the number of guidance step with Sana. The number of diffusion steps assume standard generation for Vs. The parameters are the same used in Table (ebeeenreeeeeee in Table Steps refers to the number of diffusion steps. +det indicates the additional diffusion steps required for detection. Since Gaussian- Seuussan-Shadinn and Tree-Rings are not robust to crop, provide the PTA @ PD with (left) and without (right) the cropping augmentation.
6 CONCLUSION AND LIMITATIONS
This work introduces new watermark embedding for latent diffusion models converting any post-hoc watermarking to in- nn-generation without retraining of the model. Our method inherits the robustness from the baseline and can also improve it against attacks never seen by the decoder.
Limitations include robustness that depends on the visual content of the image to be generated, and a generation time that needs 2 to 13 more steps; however the decoding time is 50 times faster compared to other in- generation schemes such as Tree-Ring (Wen et al. 2023) and Gaussian Shading (Yang al. 2024b).
10

---

Published as a conference paper at ICLR 2026
REPRODUCTIBILITY STATEMENT
All models, datasets, and detectors used in this work are detailed in Appendix httpp:h/p/// /ttp://ittttuu com/ EnoalG G/Ggianccinnneeeeeeeeeeeaaaaaaee Wat enttekiiignn-- for Ser--Diffuiion Models is the repository of the official implementation. The implementation relies on PyTorch and the diffusers library, with fixed random seeds. All hyperparameters used in the experiments are listed in Table while other choices are specified at the beginning of Section
ACKNOWLEDGMENTS
Experiments presented in this paper were carried out using the Grid' 5000 tested, supported by scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https: www. http://wwwwww/..//////// fr). This research is part of the PEPR Cyber Compromis project, ANR-22-PECY-0011
REFERENCES
Content credentials: Strengthening multimedia integrity in the generative AI era.
https: petpp://medte //meiia CREDEENTILLS PDF 2025. USA National Sccurity Ageney, Australian Signals Dircctorate's s Australian Cyber Security Centre, Canadian Centre Cyber Security, and United Kingdom National Cyber Security Centre.
defense gcv/2025
Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In 202/ IEEE Symposium on Security and Privacy (SP), pp. 121-140, 2021, doi: 10.1 109/ SP40001 0021000083.
Black Forest Labs. Flux. http://pp...ttaa.c.cco//c.ooeeea
2024.
Maty Bohacck and Hany Farid. Nepotistically trained generative image models collapse. In ICLR 2025
Workshop Navigating and Addressing Data Problems for Foundation Models, 2025. URL https
http::eeee///totoeeeeeeoee Serenneewwiw..ett/ffurrrllddddi FXLX8
Tu Bui, Shruti Agarwal, and John Collomosse, TrustMark: Universal Watermarking for Arbitrary Resolution Images, November 2023. http:t
18297 1rX1v:2311.18297 [cs].
C2PA. C2PA: The coalition for content provenance and authenticity. https::/c2aa.coo 2024.
China.
Chinese AI governance rules.
http::/www..ec....ccc20000300000
htm 2023.
Pedro Comesana, Neri Merhav, and Mauro Barni. Asymptotically optimum universal watermark embedding and detection in the high-snr regime. IEEF Transactions Information Theary, 56(6)) 2010. doi: 10.1109/TT..200.. 20.02202.........
Riccardo Corvi, Davide Cozzolino, Giada Zingarini, Giovanni Poggi. Koki Nagano, and Luisa Verdoliva. On detection synthetic images generated by diffusion models. ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5. IEEE, 2023.
M. Costa. Writing on dirty paper (corresp.). IEEE Trunsactions on Information Theory, 293))439-441, 1983.
doi: 10.1 1983. 1056659.
Ingemar Cox. Digital watermarking and steganography. Morgan Kaufmann series multimedia information and systems. Morgan Kaufmann Publishers, Amsterdam Boston, 2nd ed edition, 2008, ISBN 978-0-12-372558
Tri Dao. Flashattention-22 Faster attention with better parallelism and work partitionnin. The Twelfth Intena- tional Conference on Learning Representations, 2024. URL https:://ppezeeviirt for/forum? 1d=
m2n2Xyh9Ec
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs on image synthesis. In A. Beygelz- imer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (cds.), Advances in Neural Information Processing Systems, 2021. URL /tttps://opeereviice net. www.:nne/EoouniidAAii.....
Digital Watermarking Alliance DWA. Digital watermarking applications.
https: /
digita ta watermarkingal
wtgp/iigiallwwaermmaaaeae appl
cati apptaaaailiiinnnnn
11

---

Published as a conference paper at ICLR 2026
Europe. European Al Act. Ltta:///arrffcccllteeeeeeeeeeeee
2023.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking Images in Sulf-Superviedd Latent Spaces. In IEEE (ed.), ICASSP 2022 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 1-5, Singapore, Singapore, May 2022. IEEE, IEEE. URL httpps://ing ia. ha wcwence -
Pierre Fernandez. Guillaume Couairon, Hervé Jégou, Mathhij Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF international conference computer vision, 2023.
Pierre Fernandez, Hady Elsahar, Zeki Yalniz, and Alexandre Mourachko. Video Seal: Open Efficient Video Watermarking, December 2024a. URL. /ttp:/pp://axt..oo////////1101.0 [es].
arXiv:4412.09992
Pierre Fernandez, Anthony Level, and Teddy Furon. What lies ahead for generative ai watermarking. In 2nd Workshop on Generative Al and Law (GenLaw '24), ICML, 2024b.
Toddy Furon. About zero bit watermarking error exponents. In ICASSP2017 IEEE International Conference on Acoustics, Speech and Signal Processing, New Orleans, United States, March 2017. IEEE. URL https //irria hal sci ence/ha 01
Rachid Guerraoui, Nirupam Gupta, and Rafael Pinot. Byzantine machine learning: A primer. ACM Computing Surveys, (6,,) 2024.
Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: A reference free evaluation metric for image captioning. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings the 202/ Conference Empirical Methods Natural Language Processing, pp. 7514-7528, Online and Punta Cana, Dominican Republic, November 2021. Association for emnnl-mmin.5995 1666:///222.emmlmmmma.....
Computational Linguistics. doi: 10. 18653/v1/2021
org 22222221.100 www.emmm......3.3.3. 5957
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by time-scale update rule converge local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Jonathan Ho, Ajay Jain, Pieter Abbeel. Denoising diffusion probabilistic models. Advances neural information processing systems, 33:6840-6851, 2020.
Huayang Huang, Yu Wu, and Qian Wang. Robin; Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37:3937-3963, 2025.
Guillaume Jeanneret, Loic Simon, and Frederic Jurie. Diffusion models for counterfactual explanations. In Proceedings of the Asian Conference Computer Vision (ACCV), pp. 858-876, December 2022.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. watermark for large language models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 17061- 7764--17884 PMLR, 23-29 Jul 2023, URL https: http:::://ppcceee http://ppcceeeeenneeeeeeeeces.ee m.r. press/ /202 http///kcchhnbbuere255. html
Tsung-Yt Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and Lawrence Zitnick. Microsoft coco: Common objects context. In Computer vision-ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, pp. 740-755 Springer, 2014.
Bo Liu, Xingchao Liu, Xiaojie Jin, Peter Stone, and Qiang Liu. Conflict-averse gradient descent for multi task learning. Advances in Neural Information Processing Systems, 34:18878 18890, 2021.
Wenqing Liu, Miaojing Shi, Teddy Furon, and Li Li. Defending adversarial examples via dnn bottleneck reinforcement. In Proceedings of the 28th ACM International Conference on Multimedia, MM '20, pp. 1930-1938, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 978 9781450379885. doi: 10.1145/33941711 111/4//399411..411333 3464444
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Solveol A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-5787, 2022.
12

---

Published as a conference paper at ICLR 2026
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models, 2021. URL http://prrrreee..eeeeoooorrmmama NEX
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification, 2022. Utthttps:: http://aaxvvv//a///////../...a org/ abs 2205. 07760
Yury Polyanskiy, H Vincent Poor, and Sergio Verdú. Channel coding rate in the finite blocklength regime. IEEE Trunsactions Information Theory, 56(3):2307-2399 2010.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.0612) 1(2)3, 2022.
Robin Rombach, Andreas Blatmmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10644, 2022a.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjom Ommer. High- Resh-teeoottion Image Synthesis with Latent Diffusion Models. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10674 10685, New Orleans, LA, USA, June 2022b. IEEE. ISBN 978-
1-6654-6946-3. doi: 10. D0.109992P2552288222222222 2022.00042 URL httpa:// /eeeeex///epp//eee ore. eeee /
(ocument//8888440
Harold Ruben. Probability content of regions under spherical normal distributions, iv; The distribution of homogencous and non-homogencous quadratic functions of normal variables. The Annals of Mathematical Statistics, Ann. Math. Statist, 33(2))542-570, 1962.
Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre Défossez, Teddy Furon, and Tuan Tran. Proactive detection of voice cloning with localized watermarking. In ICMI. 2024-41s International Conference on Machine Learning, volume 235, pp. 1-17, 2024.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021. URL /tttps://openreviieee net forum? id=
St StlgiarCHLP
USA. Ensuring safe, secure, and trustworthy AL uploads/ /2////2002///s//// /Knuurinuriiii -a- Safe- Secure wnw.-aattttttttttaaaaa..... July 2023. Ac- cessed: [july 2023].
gov content.
Dimitri von Rütte, Elisabetta Fedele, Jonathan Thomm, and Lukas Wolf. FABRIC: Personalizing diffussio models with iterative feedback, 2024.
Yuxin Wen, John Kirchenhauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Shirry-seventth Conference on Neural Information Processing Systems, 2023. URL
hittps:// httt::://pparereee.netttt net.
2id.mmmmdd--5- /rmbbN]
Enze Xie, Junsong Chen, Junyu Chen, Han Cai, Haotian Tang, Yujun Lin, Zhekai Zhang, Muyang Li, Ligeng Zhu, Yao Lu, and Song Han. Sana: Efficient high-resolution image synthesis with linear diffusion transformer,
2024. htLp:ttt: http:///rxxvvvv. wttp////////////aa///////eaeeee/ 2410. 1062....622
Rui Xu, Mengya Hu, Deren Lei, Yaxi Li, David Lowe, Alex Gorevski, Mingyu Wang, Emily Ching, and
Alex Deng. Invismark: Invisible and robust watermarking for ai-generated image provenance. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 909-918, 2025. doi: 10.1 N0.1109/AACV6114...000
Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks? Ad- vances in Neural Information Processing Systems 37, URL /ttp:p/:ee/pp..ematttieeceeeeeee
Stg//ooopuSID:2/1111111
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lostee lossleess image watermarking for diffusion models. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12171, 2024b.
Tianhe Yu. Saurabh Kumar, Abhishek Gupta. Sergey Levine, Karol Hausman, and Chelsea Finn. Gradi- ent surgery for multi multii-askk learning. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.). Advances in Neural Information Processing Systems, volume 33, pp. 5824 5836. Curran Associates, paper wwtpppppppee/paaaaa /2020/
Inc., 2020. URL. httppppss/ppoooceeennnn/o/oe
cc. cc/ppper.pppppcccc.ee
13

---

Published as a conference paper at ICLR 2026
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to lext-to-image diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 3836-3847, 2023.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586-595, 2018.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks, In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018.
14

---

Published as a conference paper at ICLR 2026
A COMPUTATION OF THE SPECTRUM IN FIG. 2
From batch of N RGB images {x(1) whose size is L L x 3, compute their 2D FFT j==1
representations channel-wise: X (;;:a) FFT(x(0) (=;;,)), (1,2,3). The spectrum S
RLXL is computed as follows:
c(C,c) log
ME i=
( (4,c))))) v((,)) [L]2
(10)
3N
This spectrum is computed for the following batches of images generated with the same prompts: generated images without watermark (Seoee), generated images with Stable Signature (S generated images with guided watermarking for the decoder of Stable Signature (Sguidance). Figure
displays on the left the difference SStableSig
Sawer, and on the right side Sguidunce Seaver
B ABLATION STUDIES FOR HYPERPARAMETERS AND SIMPLIFICATIONS
B.I HYPERPARAMETERS
The algorithm relies on three hyperparameters to control the guidance. After computing the gradient, clip fraction of the most extreme values to limit their influence the diffusion process. Similarly, the gradient norm exceeds a threshold, we rescale it to that threshold. The parameter w is scalar denoting the strength of the watermark guidance The values of these hyperparameters are reported in Table
The parameter must be chosen carefully to balance detectability and image quality. Figure illustrates that artifacts are generated when the w value is exaggerated. Our choice sets this parameter smaller values given in Table 4 used hereafter for the experimental assessment of the robustness. Figures 18 19 and 20 show images generated with this reasonable choice of w values. Figure P illustrates the influence of the parameters and т. Increasing improves bit accuracy but also amplifies the deviation from the non wanweatrmareee image, as reflected by a lower PSNR. The parameter r clips extreme values to prevent visual artifacts, increasing T results a higher PSNR with only a minor reduction in bit accuracy.
B.2 IMPACT OF THE SIMPLIFICATIONS
Let Simplification I refer to the reduction in the number of diffusion steps used, as presented in Table Table complements these results by reporting the corresponding image quality metrics.
Let Simplification 2 denote the replacement of V., by V., in Eq. equation 8 The purpose of this simplification is to reduce the computational cost of the method. Table reporrss results obtained on 200 Sana images watermarked with G-VS, both with and without simplification 1. The generated images exhibit lower quality metrics because the signal injected at each diffusion step is less stable than in the simplified version, due to full backpropagation through the diffusion process. Detection metries are also reduced. Owing to the instability of the injected signal, the overall semanntcs of the image is altered. As shown in Appendix D.3, guidance watermarking is content-dependent; therefore, when global semantics drift, the watermark signal added at each diffusion step no longer follows the original diffusion trajectory. As result, parts of the signal progressively erased during the diffusion process, reducing final detectability.
LDM
% Clip (r)
Max norm (17)
Stable-Diffusion 2
10%
0.3
250
Flux
10%
0.5
500
Sana
10%
0.5
600
Table 4: Values of the hyperparameters used for each model.
15

---

Published as a conference paper at ICLR 2026
250
300
400
600
1200
2000
Figure 8: Example of images generated with our G -Sig and G-VS for different values of w. The other parameters are referenced in table 4 From Top to Bottom: with Stable Diffusion 2 with G-SSig and Sana with G-VS, The values of w are intentionally exaggerated to highlight visible artifacts. Our choice appears framed in green.
69
0.56
56em De Avouray
26
2100
Mon Dir
0.7
0..44
0.--
HI: Accenary Clp
Acenary
20
0.52
PSNR Clip 10
201
600
1000
1200
0150
25
10
12.6
10
WX Stale
Clio
Figure 9: Ablation study on the effect of WM Scale and Clip% for Sana G-VSimages. On the left, the figure reports how Bit Accuracy and PSNR vary as a function of the WM Scale, both with and without clipping. On the right, Bit Accuracy and PSNR are shown as function of for fixed w.
C FALSE ALARM ANALYSIS
The most important feature of watermarking, as far zero-bit detection is concerned, that the probability of false alarm equivalently, the p-value are certified, contrary to forensics approaches where the false alarm rates are only empirically evaluated.
The watermarking literature considers two definitions of the probability of false alarm. Suppose that the watermark detector first extracts from an image a feature ((x) and compares to secret vector u by score function s(((x) u). We assume here that the higher the score, the more likely the image watermarked. This score is converted into a p-value that the probability that an image not watermarked with this secret key (hypothesis Ho) produces a score greater than ((((r), u). The image z is decmed watermarked the corresponding p-value lower than the required probability of false alarm: p < PFA
16

---

Published as a conference paper at ICLR 2026
WM scheme
PSNR
LPIPS
CLIP
G-VS
23.5
0.07
0.348
G-VS
last 15
28.3
0.02
0.348
G-VS
last 10
30.6
0.01
0.347
G-VS
last
35.8
0.004
0.348
Table 5: Quality metrics of images generated with Sana using G-VS for different numbers of guidance steps.
LDM
WM
CLIP (t)
PSNR (t)
LPIPS (L)
Capucity(7)
(PPa) PD
Sana
G-VS
0.346
23.5
207.5 (+28.8)
96.4 (+49.2)
Sana
w/o simplification
0.170
0.67
140.7
49.1
Table 6: Comparison of image quality and detectability metries for 200 Sana G-VS images, with and without Simplification 1.
first way compute this p-value model the distribution of ((X) where X denotes a random un- un-watermarked image:
(x(x, u) P(s(o(X), s(ó(z), u)|X random image).
(11)
That is, we assume that the detector uses fixed key, and we control the probability of false alarm for this specific key. This approach is relevant in applications where the secret vector is unique, like in copy protection. Yet, it is challenging to accurately model the distribution of ((X) due to the vast diversity of images.
A second way is to consider that the image is fixed, but that the secret vector is random. This is typically relevant for applications like traitor tracing, where a secret key randomly drawn for each user.
Pu (r, u) P(s((()) (6(x), u)] random secret vector).
(12)
This approach is usually more accurate the distribution of the secret vector is known exactly.
This appendix determines to which extent these approaches are suitable for the watermarking schemes considered in this paper.
C.1 APPROACH 1: X RANDOM IMAGE
C.I.1 STABLE SIGNATURE, TRUSTMARK, AND VIDEOSEAL
Our method resorts to pre-trained watermark decoder extracting feature <xxx E R- from an image æ. This feature then compared to reference secret signal u E RRM by a cosine similarity. The computation of the p-value equation 7 makes the assumption that ((X) is centered random vector with an isotropic distribution in space M when is a random wotermarrar image.
Original implementation A first experiment investigates (1) the unbiasedness and (2) the isotropy of the decoder's output by estimating its bias and covariance matrix. The output of each detector is computed over 10 images from the ELSA-D3 dataset. The images are resized with a bilinear filter to the size expected by the detector: 512 x 512 for Stable-Signature, 245 x 245 for Trustmark and 256 256 for VideoSeal.
((x(1))
(13)
Σ
- -bb(')))b))(((f"))) - -b))
(14)
with (1)) being the i-th image. A second experiment bombards the decoder with real images (un- watermarked) and computes the cosine scores. Then, with a varying threshold ranging from -I 1, compares the theoretical equation 7 and empirical probabilities of false alarm.
17

---

Published as a conference paper at ICLR 2026
Preledda 1911
Trerkett
7idmmm
-.200
(a) Biases (sorted) by
Thuteet
Vilmen
400
(b) Correlations Σg diag
Figure 10: Estimated biases and covariance matrix computed over n 10 images of ELSA-D3 for each detector. The biases are sorted in ascending order.
Figure 10 shows that the official implementations of the three studied detectors Stable-Signature (without correction). Trustmark and Videoseal do not comply with the assumption: the outputs of their detector are either highly biased, highly correlated or both. Such biases are already reported and corrected the original Stable- Suuble-Signature paper Fernandez et al. (2023), but no study of other detectors was performed to the best of our knowledge.
The implication may lead an unfair benchmark of the watermark. Figure I1 first plots the empirical vs. the theoretical probabilities of false alarm over 10" scores (10 random reference signals u and 10 images). At first sight, there clear match. However, the situation might differ for a fixed reference signal. The worst case to dishonestly set и = sign(ba) ) VM, then the robustness of the watermark happens to be big but the probability of false alarm is not valid at all: the empirical probability is around 10-2 when these decoders claim a theoretical probability of false alarm 10-6
Correction with whitening Stable Signature suggests way correct this with whitening process (errnandz et al. (0033). We apply this patch to TrustMark and VideoSeal. The experiments our work always performed with whitened version of these official detectors. We now describe the whitening protocol. For each detector, the feature vector is computed over n = 10 images from the ELSA-D3 dataset. We then compute the empirical bias equation 13 and covariance matrix equation 14 Finally, we compute the Cholesky decomposition Eg L The whitened detector then defiedd as:
(x) 1 (()((())) -b)-
(15)
Our validation computes the empirical and theoretical probabilities of false positive two datasets of one million images: ELSA-D3 and MIRFLICKR. Figure [eports the results. The empirical probability of false alarm now matches the theoretical one, whatever the reference signal used. The limitation of this study is that the agreement with the theoretical model is only verified up to probability of false alarm in the order of 10-6 A lower level would require a number of images that is out of reach. Note, however, that the agreement is very precise, well below the estimation
uncertainty / 2n log(a/2) with probability 1- 1-a
C.1.2 TREE-RING, ROBIN AND GAUSSIAN- SAUSSIGN-SHADING
In Free-RRng (Wnn et al. 2023), RoBIN Huang et al. 2025) and Gaussian -haaiiinnn-iiigggg (Yang et al. 2024b), the watermark detector is not learned but "hand-crafted From image the reverse diffusion process estimates a seed ε,, its Fourier transform ((2r) compared to the secret signal over given mask region M in the Fourier domain symmetric around (0, 0). The final score is
18

---

Published as a conference paper at ICLR 2026
Hostmack
Valoowal
17
117
107
10'11
33'"
317
0Mpic Baake
10'5
Orian
33
odped Bost
Organ. Viat
Ocgiol Vest
Tlanscie
(a) ELSA-D3
1177
13
10'11
33"
70-4
10-11
33-4
Waan---Taad -Tados
Widaail- 20ldaa--BB. Slcc
Organ.
Milrrrd VViet
30
10"4
3114
ur
10
10-1
12-2
30
10
12"
107
Thoreind The
(b) MIRFLICKR
Figure 11: Empirical probability of false alarm of whitened and non-whitened detectors computed over n = 10t images on two datasets, as function the theoretical probability of false alarm equation ?? Random: measured over 10 random reference vector Worst case: reference vector set according to the bias bg. Sound detectors should output values matching the dotted black lines.
19

---

Published as a conference paper at ICLR 2026
computed Euclidean distance: =Ō² - NE [((r): u,l, where d² is the estimated power of F(2r) (see details in Wen et al. (2023))
Now, to turn a score 8 into p-value, the authors of Tings assume that from random non- watermarked image X, the reconstructed seed ZT and hence Fourier transform follow the i.i.d. Gaussian distribution (real or complex, respectively) of variance o², Therefore, the score is distributed as a noncentral X with degree of freedom à = [M (the number of components selected by the mask region M) and non-centrality À = à EiEM |u: p-value.
This rationale allows to compute the
However, our simple experiments show that the p-value px is not valid. Here is the outcomes of our investigation:
Even when Zr is drawn according to the i.i.d Gaussian distribution, the p-value is not rigorous since their pdf is not flat (see Fig. 12 Top). First, the degree of freedom is not k = [M] due to the Hermitian symmetry in the Fourier domain. Indeed, one should compute the Euclidean distance over a half of the mask region. Also, the original implementation, the reference signal does not comply with the Hermitian symmetry. Once patched, the Bottom).
p-value uniformly distributed as it should (see Fig.
When the reverse diffusion estimates a seed from a real image, the empirical p-value is not uniformly distributed, be it computed with (Fig, 12 Bottom) without (Fig, 12 Top) our patch. This shows that the assumption (estimated seed i.i.d. Gaussian distributed), on which the computation of the p-value is based, does not hold. Moreover, the computed p-values are abnormally low.
The same comment applies to (RoBIN Huang et al. (2025) with even more divergence because the reconstructed latent at step is even less Gaussian distributed with components heavily correlated, which completely spoils the computation of the p-value.
On the other hand, Gaussian-Shadinn Shading does compute the score directly on the estimated seed. Using a secret key and a stream cipher, converts the estimated seed into a binary sequence ú. Following the statistical guarantees offered by the stream cipher, can be assumed safely that each bit in the binary sequence is independent and uniformly distributed. This allows the computation of sound p-value using the score:
M Σ 1=1
8ú, u)
Ui
(16)
Under Ho, each element of the sum i.i.d. Bernoulli distributed B(0.5), hence a the p-value given by:
px = ()( s(ū, (((, +1)
(17)
where (a(a,b) is the regularized incomplete beta function.
This discussion reveals the difficulties bound to this first approach: the soundness of p-values px computed for post-hoc schemes can only be guaranteed up to a level here 10-6 which depends on the amount of un- un-watermarked images we can test. Furthermore, we cannot offer sound p-values px for in-gen watermarking techniques, except for Gaussian-Shading.
C.2 APPROACH 2: U IS A RANDOM VECTOR
The second approach keeps the image fixed and the secret vector random. In other words, the computation of the p-value Pe only holds for the image r under scrutiny. The advantage is that the secret vector U distribution is known and easy sample from. In the worst case, it is thus possible to estimate the p- p-value equation 12 through Monte-Car methods. In the best case, a closed-fom formula exists, and this is indeed the case for the considered watermarking techniques.
20

---

Published as a conference paper at ICLR 2026
1.5
0.5
0.3
image
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.9
Figure 12: Empirical pdf of the p-values of Tree-Ring. Top with original code. Bottom with patch. Blue with seed randomly drawn from Gaussian distribution, Orange with a seed reconstructed from an image (1,300 images from MIRFlickR).
C.2.1 STABLE SIGNATURE, TRUSTMARK, VIDEOSEAL, AND GAUSSIAN-SHADIIA
In the case of post-hoc schemes and Gaussian-Shacee extracted from the image (xx) and the secret vector u. Moreover, the secret vector and the feature share the same statistical model. The reasoning is thus completely identical, and we find back the same p-vuuues formulas and 17). In other words, px u) Pu (2., u).
the score is symmetrical between the features
C.2.2 TREE-RING
We only treat the where Tree-Ring the ring method for the watermark signal see Section 3.3 in Wenn et al. (023). Let the secret vector be composed of J rings. Each ring duplicates the random variable Ug the ry components
first half disk, and duplicates its conjugate transpose ty on the second half disk to comply with the Hermitian symmetry. The random variable U, is sampled from complex standard Gaussian ry CN(O;; L, Let é be the seed estimated by Free-Ring from an image z. The detection score is computed as:
J
D3
8)2
ΣΣ
A
U,
DJUU
-
(18)
i=
F=1
ΣP End D₁
1Ayl
with X9
E and
c= Σ
Σ
(19)
Dj
This shows that, for a fixed seed é, the distribution of s(2, U) is a weighted sum of non-central chi-square random variables plus the offset The probability of false-alarm is obtained by computing the left, finite tail, this distribution. This can be done up to any degree of accuracy using Ruben's method (Ruben 1962 (5.26)))).
21

---

Published as a conference paper at ICLR 2026
D MORE RESULTS
D.1 BIT-ACCURACY AND p- VALUES
Figures and 14 present a comparison between our guidance-based watermarking method and the original approach across all combinations of three models (Stable-Diffusion 2, Flux, Sana) and two watermarking techniques (Stable-Signature, VideoSeal). Stable-Signature is an in-generation watermarking method working by fine-tuning the VAE the end of the diffusion. VideoSeal is post-hoc method. Our guidance approach improves the detectability using Stable-Signature detector without fine-tuning the VAE. It transforms VideoSeal into in in-generation method, achieving high performance and robustness. All results were computed over 1,000 images per method, using the guidance parameters reported in Table We perform the guidance using augmentations known by the detector. The transform set was: Contrast x2.0, Brightness 0.2,, Crop 50%, JPEG 50, JPEG 80. We use the differentiable pscudo JPEG transform from the library Kornia.
To ensure a fair comparison across all combinations, evaluate the robustness of each method against the transformation sets defined for Stable-Signature and VideoSeal. This time, we use the real JPEG lossy compression as implemented in library Augly. Our guidance approach consistently outperforms the original method when using either the Stable-Shi Siibn-Si or VideoSeal detector.
D.2 COCO DATASET
In the main paper, experiments were performed for realistic set of prompts, usually leading to pretty detailed images, which are quite amenable to watermarking. To stress-test our approach, we repeated the experiment dataset contains far simpler and less diverse prompts. leads to images with, on average, a lot less content and details which is a good test of the limit of the watermarking approach. We report these results in Figure 13 Once again, we reliably outperform the baseline post-hoc schemes, though by smaller margin for Sana. If we study images which lead the worst detectability on our guidance method, we find images that are characteristically difficult to watermark: little content, almost no texture and flat-colored skies see Figure
200 captions from the standard COCO dataset(Lin et al.) 2014). This
D.3 DEPENDENCY ON THE CONTENT
Figure shows the mean difference between watermarked and non-watermarked images for G-VS, Rings, and Gaussian-Shading following the procedure suggested in Yang et al. (2244)).Nooo that scaled ten times the signal from G-VS for better visualization. This averaged signal is typically used to perform average attacks or copy attacks against seed- based watermarking schemes. Distinct patterns emerge when averaging the extracted signals of Gaussian-Shading and Tree-Rings for a fixed key, whereas the signal extracted from the guidance method quickly converges to zero everywhers resembles. This observation empirically indicates that the guidance watermarking is content-dependent, in contrast to seed-based methods.
E METHODOLOGY COMPARISON WITH OTHER WATERMARKING SCHEMES
Figure 21 illustrates the methodological differences between watermarking approaches at both embedding and detection stages. Post-hoc methods embed the watermark after image generation using dedicated embedder. Since guidance transforms post-hoc watermarking scheme into an in-generation one, both ultimately rely on the same detection procedure. The output image fed to detector, which returns vector o(x.). This vector is then compared to the secret vector um to compute various detection metrics.
In contrast, seed-based methods watermark the seed itself and use it with the diffusion model to generate the final image. At detection time, a reverse diffusion process is applied to the image to recover approximation of the watermarked seed, denoted 2/.. As reported in Table 3 this reverse process requires performing several diffusion steps. Once again, the estimated seed compared to a secret vector unz - e.g. the ring patterns for Tree-Rings- yield the detectability metries.
22

---

Published as a conference paper at ICLR 2026
Aucurat
02
Mean
VS
SSig SSig
VS
Castros
Beittoem
Connnc #5
sPact ia
Cantres
Brgiesen 8.3
Cantatlop
IPER
JPis a
1.0
A0S9
Mean Aucurnty
Sloma Bi:
02
VS
SSig C-SSig
G-VS
Mesili
Godtrer 20
B Bightoaa.zz Rd
ChoterChpp 85
IPES 18
JPBG
Handty
Rillooet ts
Gatter de
JIBES sb
11100G
Mean Bit Aceunory
Xi Accurary
0XD
SSig G SSig
VS
Costrok-20 20
Dosunt 5
JPSS 9
JTBC
Begitwnn 3.3
IPEZ
JPEC m
Figure 13: Mean Bit Accuracy for combinations of diffusion model and watermark decoder. Higher is better.
23

---

Published as a conference paper at ICLR 2026
VS G-VS
SSig
G-SSig
Inkal Pe
log (Paa)
PLLO
Pou He (hoebaa)
Mostes
Contred 20
Brigitenn 82
Oator
JPBG s0
JPBG 4g
Hontty
Contmat 10
Dighttes 05
Costet
JPEc
JyBG
VS G-VS
SSig
G-SSig
30
Ingao Py
(Prs)
Wustey
Codtral
Briddton
CosterCoop B.
JPB
IPB s0
Costrnst
Bridiress
Castet 03
JPEG
JPBG
VS G-VS
SSig G-SSig
300
Abutdd
Castrat 20
Drihttow
Crala U.6
JPB 59
JPBG
Heattey
Contrast 2.
Dridtress
Canter 055
JPEG
JPEG
Figure 14: lo (PrA) for all combinations of diffusion model and watermark detector. Higher
is better. Thresholds are - logio Pp = 0.9 for the baseline method (red) and guidance (brown).
24

---

Published as a conference paper at ICLR 2026
8032
100 DMNG
3.-
1.0
1.2
105
Figure 15: Repeated experiment for 200 images generated form the COCO captions of Figure
Figure 16: Examples of MSCOCO images generated by Sana with our G G-SSig giving birth high p-values.
Guidance and post-hoc detections are instantaneous, requiring only a single call to the detector, whereas seed-based methods require higher detection cost due to the additional diffusion steps needed. The trade-off is that our guidance methods requires more diffusion step during the embedding phase than seed-based methods.
F COMPUTATIONAL RESOURCES
All experiments conducted using NVIDIA A100 and L40S GPUs with 40 GB and 45 GB of memory respectively. We generate between 200 and 300 images per hour, depending on the choice of GPU, model, detector, and hyperparameters used for guidance. Significant efforts were made optimize memory usage and batch sizes in order to fully utilize available GPU resources and reduce energy costs. The code is available on the repository XYZ (provided upon acceptance).
25

---

Published as a conference paper at ICLR 2026
G-VS (x10)
Gaussian- Shading
Tree-Rings
5
10
20
50
Figure 17: Averages of the residues for Sana using three in-generation watermarking schemes, G-VS, Caussian-Shadiin Shading, and Tings, for different numbers of extracted residues. For G-VS, the averaged signal is multiplied by 10 to make it visually discernible.
26

---

Published as a conference paper at ICLR 2026
Stable-Diffusion
G-VS
G-SS
Figure 18: Images generated by Stable-Diffusiin without and with our watermark embedding for
G-VS, and GSSii.. The resulting images remain semantically very similar to each other.
27

---

Published as a conference paper at ICLR 2026
FLUX
G-VS
G-SS
ETI
Figure 19; Images generated by Flux without and with our watermark embedding for G-VS, and G-SSig. The resulting images remain semantically very similar to each other.
28

---

Published as a conference paper at ICLR 2026
Sana
G-VS
G-SS
Figure 20: Images generated by Sana without and with our watermark embedding for G-VS, and G-SSig. The resulting images remain semantically very similar to each other.
29

---

Published as a conference paper at ICLR 2026
Embedding
Watermarked image
Detection
Guidenne
Offiviie
VIE
Scoring
Secerse Sifucie
Soottig
Figure 21: System-level diagram of the comparison of different watermarking methods.
30

---

Published as a conference paper at ICLR 2026
G LICENCES
We ensure that datasets, pretrained diffusion models and watermarking detectors used in this work are credited and used under the terms of their respective licenses.
DATASETS
We use the 2014 COCO dataset Lin et al. (2014) for the prompts and the images to compute of FID. We the Stable-Difussio-PPrmmps dataset from Hugging Face for realistic prompts. We ELSA-D3 and MIRFLICKR for the whitening.
COCO
Source: htttss:/ccocoaaasss..ooo #home
License: CC BY 4.0
Slable-DiffusoonPrrompt
Source:
License: Unknown
ELSA-D3
Source: License: BCBY4.0
htt.g///.../ggggoo....o/aaattaat D3
MIRFLICKR
Source: http:///cee..laaaaaaa/rtt/f///o/
License: CC BY 4.0
PRETRAINED DIFFUSION MODELS
We the pre-trained diffusion models generate images Rombach al. (202bb;; Black Forest Labs (2024); Xie et al. (2024), watermarked images with our guidance and watermarked images with other methods. We used their Hugging Face implementation. All models used in this work were modified in accordance with the terms of their respective licenses to incorporate our guidance method.
images/Rombach
Stable-Diffusion 2.se
Source:
1 http:://uggingface ctt.aacbccco//aaaiiicaacaaca.aaa lityai/
License: CreativeMI. Open RAIL++ License (v24 novembre 2022)
FLUX 1.0 dev
Source: Stt.gh/gggg///anaaarrrooooooooer
License: FLUX.1 [dev] Non- Non-Comeercial License
Sana
Source: 600M_512px
httpp://hnggnngeeee.oo/ffffttttt htrp:///eofffiiiittteeeeeeeee Sana
License: NVIDIA License
31

---

Published as a conference paper at ICLR 2026
WATERMARKING DETECTORS
We use the watermark detectors Fernandez et al. (2023): Bui et al. (2023); Fernanezz et al. (2024a) to
generate watermarked images with our guidance and with their original embedding methods.
Stable-Signature
Source: http:///ggtttaa.ooo/oooooooetaaa stggaetttttaaaeeesetstiitu
License: CC BY-NC 4.0
TrustMark
Source:
License: MIT License
VideoSeal
Source: http:///wgp...ttboo//////o/osses
License: MIT License
ATTACKS
We the Python library Kornia for image attacks, it provides differentiable versions of many transformations, a requirement for the guidance method. We rely on the AugLy library to apply real JPEG compression, as opposed to Kornia's differentiable upproximation, in order to perform exact evaluations.
Kornia
Source: httpps///gtthbb.ccc///oom//oooo
License: Apache-2.0) License
Augly
Source: http:://ghthaaac//cccccoeeee/aaa
License: MIT License
32


Reviews:
[{"review_id": "GLgwO9fb0B", "reviewer": "Reviewer_7E16", "summary": "The paper introduces a method that embeds digital watermarks directly during the diffusion sampling process. The approach leverages gradients from pretrained watermark decoder to guide the diffusion model toward generating images that the decoder recognizes as watermarked. It embeds the watermark during generation using a cosine-based loss that aligns decoder features with a target watermark vector, and aggregates gradients across image augmentations to enhance robustness to unseen attacks. No need to retrain the decoder.", "questions": "1. All experiments are conducted on latent diffusion model. I'm wondering its effectiveness  on pixel-based diffusion models.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The method is general and retraining-free. It can transform any existing post-hoc watermark decoder into an in-generation embedding scheme without retraining either the decoder or the diffusion model.\n2. The method is empirically validated on multiple diffusion models and decoders.\n3. The method has a unified formulation for multi-bit and zero-bit watermarking.", "weaknesses": "1. The approach requires a pretrained differentiable watermark decoder (e.g. stable signature). Its performance and the statical guarantees are bound by the robustness and isotropy of that decoder's feature space. If the decoder is biased or unavailable, the framework can't work.\n2. The attack scope is narrow. The experiments focus on standard image augmentations (JPEG, crop, brightness). Other relevant attacks like regeneration attacks, adversarial attacks should also be tested.\n3. No ablation on guidance scheduling. The method mentions turning on guidance only for the last diffusion steps (section 4.5). But there is little analysis on how the choice of step $T_w$, clipping thresholds, or gradient aggregation method affects detectability or quality.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CtcIkXs0sm", "reviewer": "Reviewer_wPqL", "summary": "This study introduces a technique utilizing guidance to incorporate watermarks into the diffusion-based image creation workflow. By sourcing the guidance from an existing watermark decoder, it adapts after-the-fact watermarking approaches into on-the-fly methods that work seamlessly with various guided generation systems. The evaluations assert that it achieves durable watermarking while preserving the visual fidelity and meaning of the images.", "questions": "1.\tThe proposed method relies on a public, off-the-shelf decoder to compute gradients. Does this imply that an attacker, upon obtaining a watermarked image, could actively erase the watermark by computing and applying an 'adversarial' or 'reverse' guidance gradient aimed at minimizing the decoder's output (i.e., a white-box adaptive attack)?\n2.\tRegarding the 'fast guidance' experiments in Section 5.5, were the results (e.g., \"G-VS last 15\") obtained by applying *both* the 'step reduction' (simplification 1) and the 'gradient approximation' ($\\nabla_{z_{0}}$ instead of $\\nabla_{z_{t}}$, simplification 2) strategies simultaneously? If so, what is the respective contribution of each simplification strategy to the observed performance degradation?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Employing guidance strategies to enable in-generation watermark integration within diffusion frameworks opens up a compelling avenue for exploration. \n2. The system's capacity to merge established after-the-fact watermarking methods with guided  generation processes offers significant utility in application. \n3. Overall, the manuscript is structured effectively and easy to follow.", "weaknesses": "1.\tFor embedding watermarks in individual images, the approach imposes an excessively high computational burden. Conducting complete denoising operations to derive guidance at every noise level far surpasses the time required for standard generation (as evidenced in Appendix E). This greatly hampers its applicability to extensive image production scenarios.\n2.\tThe tuning complexity prevents the method from being a true 'plug-and-play' solution. As illustrated in Appendix B, Figure 6, setting the guidance strength ($\\omega$) too high can introduce severe visual artifacts into the generated image, necessitating careful calibration for different models and decoders.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cXIS2B9wwG", "reviewer": "Reviewer_WTJb", "summary": "This paper proposes a new image watermarking method that enables converting an existing post-processing watermarking method into an in-generation watermarking method using only an existing decoder, without introducing significant changes to the watermarked image.", "questions": "1.\tFor bold results presented in Table 1, would it be possible to also report the corresponding watermark decoding bit accuracy values? This could align the metric with most existing works and facilitate comparison.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1.\tCompared to existing post-generation and in-generation watermarking methods, the proposed approach offers improvements in watermark bit capacity.\n2.\tFrom the methodological point of view, the paper provides a practical means of converting post-processing watermarking approaches into in-generation ones.", "weaknesses": "1.\tIt’s unclear what motivates the authors to propose this method. The writing of the introduction should be revised to explicitly show this.\n2.\tIt is unclear whether the method performs semantic watermarking or adds fixed content-unaware perturbations, as similar in-generation watermarking methods like Tree-Ring and Gaussian Shading have been found out to be adding fixed perturbations [1]. Since the proposed method is also an in-generation watermarking method, the authors should use a fixed watermarking key and test under [1]’s removal method to show whether or not the proposed watermark is content-aware.\n\n[1] Yang et al., “Can simple averaging defeat modern watermarks,” in NeurIPS 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "V1I0Ami35O", "reviewer": "Reviewer_jcck", "summary": "This work proposes a guidance module that could be applied during the diffusion process to embed a watermark. It relies on a pretrained watermark decoder/detector (such as Stable Signature) to compute the loss that is needed for the guidance. The main idea is to add a gradient term to the noise during each diffusion step and the gradient term is computed with respect to the watermark. It gives experimental results to show the effectiveness of this method.", "questions": "- I am confused about the Motivations section. If your motivation is that the spectral signature could be exploited to remove the watermark, why not address this issue in your evaluation?\n\n- Explain more on why the right pattern is better than the left in Figure 1.\n\n- A system view (probably a system/pipeline figure) is necessary to understand their method and the additional module/steps they bring into the watermark embedding/detection pipeline, e.g., compared to the baseline Stable Signature.\n\n- It is not very clear how detection/decoding is performed. Maybe (7) gives some info on detection, but what about decoding? How do we get the watermark message from an image?\n\n- In Table 1, is any image attack used in the evaluation for robustness? If so, what are they? If not, you should add robustness comparison with SSign and VS in the Table 2.\n\n- The basic image distortions in Table 2 seem not sufficient, more to add: e.g., gaussian blur, rotation.\n\n- Confused about your claim: \"ours does not require extra steps for decoding making it up to 50 times faster at detection\ntime.\" I think this is also because the decoding procedure is not clearly explained in the paper. For GuassinShading/TreeRings, we need to convert an image to latent noise for detection. Are u claiming that your method does not require such conversion? If so, how do you directly extract watermark from an image?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "+ The guidance module could strengthen existing pretrained baseline watermarking method such as Stable Signature and VideoSeal, as shown in their experiments in Table 1. More importantly, it extends baselines to be more robust agains unknown augmentations.\n\n+ Experimental results on various diffusion models are provided: SD2, Flux, and Sana.", "weaknesses": "- With all those formulas floating around, it is challenging to grasp the whole picture of this work and the additional contribution they bring to existing watermarking pipeline. (See my suggestion below)\n\n- Choice of the guidance strength hyperparameter adds complexity to the watermarking application.\n\n- It is not completely fair to claim that your work \"does not necessitate any retraining of the diffusion model\" and compare against TreeRing and GaussianShading (both trainning-free), when your method actually relies on a well-trained watermark detector (e.g., Stable Signature).\n\n- The robustness results are not consistently better than GaussianShading in Table 2.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)