NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models
Authors: Nir Goren
Oren Katzir
Abhinav Nakarmi
Eyal Ronen
Mahmood Sharif
Or Patashnik
Venue: ICLR 2026 Poster (2026)
Keywords: Watermarking
Diffusion Models
Generative AI
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: NoisePrints is a distortion-free, seed-based watermarking method that enables efficient and robust authorship verification for diffusion models without model access.

Abstract: With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these challenges, we propose $\text{\emph{NoisePrints}}$, a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.

Published as a conference paper at ICLR 2026
NOISEPRINTS: DISTORTION-FREE WATERMARKS FOR AUTHORSHIP IN PRIVATE DIFFUSION MODELS
Nir Goren Oren Katzir'
Abhinav Nakarmi
Eyal Ronen* Mahmood Sharif
Or Patashnik!
1 Tel Aviv University Univerrity of Michigan
ABSTRACT
With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is partieu- larly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, exist- ing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these chal- lenges, we propose NoisePrints, a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero- pero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple ofate-of-the-ar diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access model weights.
INTRODUCTION
Generative diffusion and flow models (Ho et al., 2020 Song et al.) 2020: Lipman et al. 2022)
have rapidly transformed visual content creation, enabling the synthesis of high-quality images
and videos from simple text prompts (Rombach al. 2021 Saharia et al. 2022 Ramesh al. 2022). While these models open new creative opportunities, they also raise pressing questions of copyright, authorship, and provenance (Zhu et al. al.] [0188) Yu et al. 2021 Liu et al., 2023). In partieular, proving authorship of generated content is essential for creators who wish to protect their work, establish ownership, resolve disputes over originality (Arabi et al.) 20255] Huang et al.) (2025). This challenge is particularly pressing for independent creators and smaller organizations, who lack the trusted infrastructure of major AI providers and therefore require alternative mechanisms, such as watermarking, to prove that content was generated by their models.
Watermarking has emerged as promising direction for enabling authorship verification in generative models. In this setting, watermark refers to a verifiable signal that links generated content to its origin. Most existing methods achieve this either by embedding artificial patterns into the output or by recovering hidden information through inversion of the generation process (Gunn et al.) 2024
Arabi al. 2025) Yang et al. 2024b; Wen et al. 2023 Ci et al. 2024p. However, these approaches often require access to the model weights and inference code, which may not be available when the model is proprictary or privately fine-tuned. Others modify the generation process in ways that alter the output distribution, or rely computationally expensive inversion procedures, making verification impractical at scale. These limitations hinder the adoption watermarking in scenarios where efficient and model-agnostic solutions are most needed.
In this work, we propose NoisePrints, a lightweight watermarking scheme that does not embed additional signals or alter the generation process, thereby preserving the original output distribution.

---

Published as a conference paper at ICLR 2026
Instead, we leverage the random seed that initializes the diffusion process proof of authorship. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content (Lukasz Staniszewski et al. 2025). This property enables verification by directly checking the correlation between the initial noise and the generated content, without requiring access to the diffusion model or costly inversion procedures. To secure this construction, we incorporate a one-way hash function into the noise sampling process, which makes it infeasible to recover a valid seed from the content. Moreover, we employ cryptographic aero-knowledge proof's to establish ownership without exposing the seed, thereby increasing the difficulty of watermark removal. Finally, we design protocol for resolving disputes over authorship claims that handles both watermark injection attempts and geometric transformations of the original content.
To assess the reliability of NoisePrints, we evaluate its security and robustness. We show that the probability of randomly sampling a seed that produces noise correlating with given image above the verification threshold is vanishingly small, and provide intuition for why such correlations persist. We further examine robustness under wide range of attacks, including post-processing operations, geometric transformations, SDEdit-style regeneration (Meng et al. 202T), I), and DDIM inversion (Song et al. 2022), , and introduce a dispute protocol that complements the verification protocol. Finally, compare our approach with existing watermarking methods, highlighting efficiency, robustness, and practicality, and discuss extensions such as soowkeeweedge verification for real-world deployment.
Our results establish seed-based watermarking as a practical and robust solution for proving authorship in diffusion- diffusion-generated content. The method requires changes to the generation process, preserves output quality, and remains reliable across diverse models and adversarial conditions, providing creators with lightweight tool to assert ownership in the growing landscape of generative media.
2 RELATED WORK
Watermarking in diffusion models can be organized along three design axes: timing (post-hoc vs. during sampling), location (pixels, latents/noise, or model parameters), and verification (direct decod- ing vs. inversion). We focus on sampling-time watermarking in the noise/latent space, embedding the mark directly in the generation trajectory. Unlike most prior works, which depend on inversion, our approach achieves lightweight, inversion-free verification without requiring access to model weights.
Post-hoc Watermarking Post-hoc methods embed a watermark into an image after it is gener- ated. Early approaches used frequency- domain perturbations or linear transforms (Cox al. 1997] O'Ruanaidh & Pun 1997 Chang et al., 2005), while more recent works train deep networks to hide and extract invisible signals (Zhu al.] 2018; Zhang et al. 2019 Tancik al. 2020). These methods are simple to deploy, since they require no changes to the generative model. However, they are fragile and can be defeated by regeneration or steganalysis attacks (Zhao et al., 2024; Yang et al.) 2024a).
In-generation Watermarking Another line of work modifies the generative pipeline itself, often by fine-tuning the model so that watermarks are embedded directly into the produced images (Zhang
let al. 2019 Zhao et al.] 2023] Fernandez et al. [202]] Lukas & Kerschbaum, 2023) Cui al.
Sander et al. 2025 Zhang et al.] 2024). These methods achieve strong detectability under common image transformations, but incur non-trivial training cost and require model weights, limiting portability and practical deployment.
2024
Closer our approach are methods that manipulate the noise used to initialize the denoising process, thereby embedding the watermark in the noise. Detection relies on inversion (e.g.. DDIM inversion (Song al., 2022)) to estimate the noise that generated the image and check whether it contains the watermark. Early schemes embedded patterns in the noise, but this introduced distributional shifts (Wen al. (023). Later works addressed this either by refining the embedded patterns (Ci et al.) 2024,] Yang et al. 2024b) or by sampling the noise with pseudorandom error- correcting code (Gunn et al. 2004] Christ et al. 2024). Another recent approach (Arabi et al., 2025) treats initial noises as watermark identities and matches inverted estimates against database, using lightweight group identifiers to reduce search cost while still relying on inversion.
While these methods avoid the cost of training or fine-tuning a generative model, they transfer the computational overhead to the verification stage, since inversion requires repeatedly applying the diffusion model. This becomes especially prohibitive for high-dimensional data such video. Dependence on inversion also limits their applicability to few-step diffusion models, where accurate recovery of the initial noise can be more challenging (Garibi et al. 2024 (aamull et al. 2025). Finally,
2

---

Published as a conference paper at ICLR 2026
verification requires access to the generative model itself, which becomes restrictive if the model is private and its owner is either untrusted or unwilling to handle detection. Our method avoids these drawbacks: it neither embeds patterns nor alters the generation process, making it fully distortion-fre free, and it avoids reliance on inversion, enabling lightweight verification at scale.
Attacks, Steganalysis, and Limits Regeneration attacks, which regenerate watermarked image through a generative model to wash out the hidden signal while preserving perceptual quality, can reliably erase many pixel-space watermarks, challenging post-hoc approaches (Zhao et al. 2024). For aontent-agnostic schemes that reuse fixed patterns, including noise-space marks, simple steganalysis by averaging large sets of watermarked images can recover the hidden template, enabling removal and even forgery in a black-box setting (Yang et al. 2024a). At a more fundamental level, impossibility results show that strong watermarking, resistant to erasure by computationally bounded adversaries, unattainable under natural assumptions, underscoring the need to specify precise threat models and robustness criteria (Zhang et al. 20255..
3
METHOD
3.1
PRELIMINARIES
We present our method in the context of latent diffusion models (LDMs) (Rombach et al. 2021 Podell al. 2024 Labs 2024), which have become the standard in recent diffusion literature. LDMs generate content by progressively denoising a latent and decoding it into pixel space with a variational autoencoder (VAE). An LDM consists of diffusion model that defines the denoising process, and (ii) a VAE (E, D), where E' encodes images into latents and D decodes latents back into pixels.
Generation begins from a seed s. To ensure that the noise generation process cannot be adversarially manipulated to yield a targeted noise initialization, we first apply a fixed cryptographic hash hs)) and use the result to initialize the PRNG. We require
be deterministic, efficient, and cryptographically secure (collision resistant, pre-image resistant, and producing uniformly distributed outputs). The PRNG produces Gaussian noise e(h(s) ~ (0, Z), which the diffusion model iteratively denoises into a clean latent 2o. For the denoising process, we use deterministic samplers. Finally, the decoder D maps 2n to the output æ, such that the seed s uniquely determines the result via its hashed initialization of the PRNG.
In practice, the VAE is often public and reused across models (c.g., Wan (Wan et al. 2025) and Qwen-Image (Wu al. 2025) share VAE, and DALL-E 3 (Betker et al. (2023) uses the same VAE as Stable Diffusion (Rombach et al. 2021 In this work we consider both diffusion and flow models. Both start from Gaussian noise <(h(s) and define trajectory to a clean latent, making our verification framework applicable in either case, as demonstrated on Stable Diffusion (Rombach) al. 202T) and Flux (Labs) 2024). We assume the diffusion model is private and inaccessible to verifiers, while the VAE is accessible to them. allowing verifiers to embed candidate content into the shared latent space. Notably, we do assume the VAE weights are publicly shared, and only assume black-box access to the VAE encoder. For brevity, we refer to the diffusion model simply as the model.
3.2 THREAT MODEL
We consider setting where a generative model is controlled by model owner who keeps the weights private and may expose the model only through restricted interface (e.g., API access). The owner may be small organization or even private individual, and not necessarily a fully trusted entity. Content can be generated either by the owner directly, or by a user who queries the model through the API. In both cases, the party who generated the content may later wish to prove authorship of the output without requiring access to the model itself. Since the model owner may not be willing, able, or trusted to handle authorship issues (now or in the future), the responsibility for verification is delegated to an independent third party. The verifier is the only trusted party for handling authorship claims, and its role is to exccute the public verification procedure. The model weights remain private and are never shared.
To enable authorship verification, the content producer records the seed s used to initialize the sampling procedure. The generated content z is public, but remains secret until the producer wishes to prove authorship. At that point, the producer provides the pair (x, s) to a verifier. The verifier can then check this claim using only public primitives (PRNG specification, encoder F,, and
3

---

Published as a conference paper at ICLR 2026
seed
Inputs
Verifier Inpots
DDIM
Diffision
Model
A(+)
PRNG
Model
C
key
pattern?
Gaussian Noise
Gesented Image
No intervaation in the generation
Fist
Modei-fice
Slow
Requi es the madel
NoisePrint Content Generation
NoisePrint Verification
Other Methods' Verification
Figure Noise introduces no intervention in the generation process and therefore does not alter the distribution of generated images. For verification, we compare the noise derived from the seed with the given image. In contrast to other approaches that rely on DDIM inversion and compare the predicted initial noise to key (i.e.. pre-embedded watermarking pattern) decide authorship, our method is lightweight and model-free.
threshold calibration), without access the model itself. This property ensures that verification is both lightweight and model-free, avoiding the need to share private weights.
It is important that the seed does not leak the public during verification, it could potentially allow an adversary to claim ownership over the content in the future or execute more targeted and effective adversarial attacks. In order mitigate this risk, it would be beneficial if is not revealed even to the verifier. To support this, the scheme can be extended with zero- eero-knowledge proofs that establish ownership without revealing s, which we recommend for practical deployments. For clarity, we first present our method without this extension.
We consider an adversary that knows the generated content x, and all public primitives: PRNG specification, encoder E, and verification threshold т. The adversary does not know the weights of the diffusion model and the seed used by the rightful owner. The adversary may pursue two goals:
Watermark Removal. Modify x into è so that the correlation with the rightful owner's seed drops below the threshold т, making the content unverifiable.
Watermark Injection. Produce image that is visually similar to x, and fake seed s' such that (ž, s') passes verification, thereby claiming ownership of content similar to æ. An adversary may perform only removal (removal-onty), only injection (injection-oni oonyc,, or a combined attack that both suppresses the original correlation with and establishes correlation with forged seed s'. To pursue the removal goal, we assume the adversary may employ the following types of attacks, all of which must preserve perceptual similarity to a:: (i) basic image processing operations (c.g., compression, blur, resizing), (ii) diffusion based image manipulation (c.g., SDEdit which reintroduces noise at intermediate denoising steps and DDIM inversion based optimization), (iii) geometric transformations (e.g., rotations, crops).
These attack families follow prior work (Arabi et al. 2025 Gunn al., 2024 Yang al. 2024b)
on robust watermarking and reflect both common manipulations that occur in practice and stronger generative edits that adversaries might attempt. Although we demonstrate robustness against one adversarial removal attack (DDIM inversion based optimization), we acknowledge that perfect robust- ness against ad adversarial, scope our claims to practical robustness under bounded, perceptual- -aaptuull-reeervinggg manipulations. To measure the perceptual similarity between the original image and the attacked one, we use SSIM, PSNR, and LPIPS (Zhang et al. 2018).
edits is unattainable (Zhang al., (025), and therefore
3.3 NOISEPRINTS WATERMARKS
Our key observation, upon which we build our method, is that in diffusion and flow models the initial Gaussian noise E(s) leaves a persistent and surprisingly strong imprint on the generated content. Despite the high dimensionality of the space, the latent representation of the final image exhibits a significantly higher correlation with its originating noise (s) than with an unrelated noise sample. A related observation was noted by Lukasz Staniszewski et al. (2025), though in a different context. We further discuss this phenomenon in Appendix A where relate it to optimal transport and propose an explanation for why such correlations naturally persist. This finding allows us to treat the initial noise natural watermark. By producing e(h(s)) from the seed and measuring its correlation with æ, we obtain a reliable authorship signal, which we call a NoisePrint. Unlike many prior watermarking approaches, NoisePrint does not alter the generative process and hence the output
4

---

Published as a conference paper at ICLR 2026
distribution remains intact, rendering the watermark completely fistortion-free. Figure gives overview of our method alongside a comparison to prior approaches based on inversion.
Next, we describe verification protocol. This protocol remains robust under simple image processing and diffusion- manipulations. To address more challenging cases such as geometric transformations and injection-only attacks, we further introduce dispute protocol.
Verification Protocol Let ((x) denote the latent embedding of an image obtained using the public VAE encoder. For a given seed 8, the initial Gaussian noise E(h(s)) is produced deterministically by seeding the public PRNG (after hashing s) and drawing the required number of variates. We define the NoisePrint score as the cosine similarity between the embedded image and the noise:
ó(5, 8) A (E(z), =(h(s)))
(1)
[E (1=(1)))]l2
A claim (zr, s) is verified by comparing ox s) to a threshold T calibrated to achieve a desired false positive rate under the null hypothesis that E(x) and e(h(s)) are independent. If ó(x, 2 T, the
verifier accepts the claim as valid. We summarize the verification protocol in Alggorith
While this procedure is effective under simple image processing and diffusion- based manipulations, as demonstrated in [Section 5.2, it does not address cases where the adversary applies geometric transformations or injects a watermark into an existing image. Geometric transformations can misalign the image embedding with its originating noise and therefore decrease the correlation, while injection attacks pose a challenge because an adversary may fabricate a different seed-image pair that also passes verification. To handle geometric transformations and injection-only attacks, introduce a dispute protocol.
We propose a dispute protocol for cases where an adversary claims ownership over a modified version of the original content, and passes the basic verification protocol due to injecting their watermark into this modified version. The protocol requires each claimant E {A, B} to submit a triplet (z;, 8;, gi) Ii E 9 from a public family of transformations (e.g., rotations or crops). For claim (z, s) and transformation y E G, we define the extended NoisePrint score:
Dispute Protocol
Si) consisting of their content, their seed, and an optional transformation
(Elg x), E(h(s)))
é(z, s; g;
(2)
[[ x)Il2 (1()))))
The verifier then applies 9i to the opponent's 's content and evaluates:
o s; id) T and Φ(z 9:: 2 T, j
(3)
where id the identity transformation. We refer to the first inequality as self check and the second as cross check. If one claimant satisfies both inequalities, that claimant is recognized as the rightful owner; if both or neither do, the dispute remains unresolved. The protocol is outlined in/Algorithm 2
The protocol resolves injection-only attempts. Suppose adversary produces H and fake seed s' such that (ū, s') passes the verification test, while the true NoisePrint from the rightful seed s remains detectable. In the dispute, the rightful owner submits (z, s. id) and passes both the self and cross checks. The injector, however, fails the cross check on x with s', since is independent of x under the null used to calibrate the threshold. Hence, injection without removal cannot overturn ownership, and any successful injector must also remove the true NoisePrint
The dispute protocol also resolves geometric removal attempts. If an adversary applies some transformation to suppress the correlation of (x,8), the rightful owner can recover alignment by submitting (2r, s, [g]), with [()) G being the inverse transformation that would align the two. In doing so they would pass both checks, while the adversary cannot provide a valid seed for any geometric transformation g E G of the original image. Note that it is not necessary for the inverse transformation (g)) to fully recover the original image when applied on the transformed image, as long as the respective latents are re-aligned. See for example the set of transformations in Appendix H]
3.4 ZERO-KNOWLEDGE PROOF
In this subsection, we provide short background on krowlnnoledge proof (ZKP) and describe the goal of our 7.KP. Implementation details and benchmark results are provided in Appendix C
5

---

Published as a conference paper at ICLR 2026
Zero- -ero-knowledge proofs (ZKPs) allow prover P to convince a verifier V that a statement is true without revealing to V anything beyond its validity. Consider a public circuit C. Suppose prover wants to convince verifier that y x(s where y and are public and is a private witness known only to P. A ZKP lets P produce a proof that convinces V that y was correctly computed In case, all computation is performed over a finite
as x(); for some 8, without revealing field. Besides sero-knowledge, a ZKP must satisfy: (i) Completeness: if true, an honest prover can generate a proof accepted by the verifier (with high probability); and (ii) Soundness: if false, even a malicious prover cannot generate a proof accepted by the verifier (with high probability). For more formal explanation of ZKPs, see (Thaler al. 2022).
In our case, the private witness s is the seed, and the public input x is the image. The circuit C' uses s to derive the initial noise, which is then used to compute an inner product with æ. From this, the cosine similarity between the noise and the image is calculated. Finally, the circuit outputs I if the similarity exceeds the public threshold т, and otherwise.
In addition, we use the ZKP to bind the proof to specific user by partitioning the seed into two parts. The first part is a public string describing the image and ownership (e.g.. "An image of a cat generated by the amazing cat company"), and the second part is private secret random value. The concatenation of the public string and the private random value is used as input to the cryptographic one-way hash function h, whose output is then used to derive the initial noise for image generation. The resulting 7KP uses the string as public input and is thus "bound" to the string and honest owner.
4 SECURITY ANALYSIS
The main security requirement in our setting is that it should be computationally infeasible for an adversary forge valid claim without access to the true seed. In the case NoisePrints, this amounts to showing that it is extremely unlikely to find a random seed s' such that the corresponding noise e(s') exhibits high correlation with a given image x. We emphasize that this analysis addresses only the probability of a random seed coincidentally passing verification, and does not cover manipulations of the content. Robustness against such attacks is evaluated empirically in |Section 5.2]
False positives under seed guessing Let = E(x) E IRd be the embedding of the candidate content, and let s ~ (0, Ia) be independent random noise vector obtained from random seed. The NoisePrint score is: 6 = (z, / [|| Without loss of generality we can assume that both and e lie on the unit sphere. Thus ø simply the inner product between two independent random unit vectors in Rdd In high dimensions, by the concentration of measure phenomenon, such vectors almost orthogonal, hence their inner product is tightly concentrated around zero. The condition 6 2 has a geometric interpretation: it means that the random noise falls into a spherical cap of angular radius (rccos(7) around z. In Appendix we analyze this probability and show that:
Pr[ø 2 r| --
ايل ( 1 S exp (5(5)))))
where (p, q) is the regularized incomplete beta function. The exponential decay in d implies that the false positive probability becomes negligible in high-dimensional embeddings. This property naturally aligns with modern generative models: current image diffusion models already use thousands of dimensions, while video diffusion models employ embedding spaces an order of magnitude larger, making accidental collisions astronomically unlikely.
Threshold selection Given a target false positive rate 8, one can set the verification threshold as:
(5) In our case we target an extremely low rate of 5 = 2 128 128 meaning an adversary would need to try roughly 2 seeds to produce a false positive, which is computationally infeasible and provides cryptographic-level security. We find a" using numerical solver.
a², where a" solves 1 (-) = 8.
EXPERIMENTS AND RESULTS
This section presents evaluation of our approach across various generative models. We begin by assessing the reliability of verification in the absence of attacks, measuring the true positive rate (TPR) at fixed false positive rate (FPR). We then turn to robustness, examining how well NoisePrints withstand the range of attacks available to an adversary, and benchmarking our method against existing watermarking techniques. Since these baselines were designed under different

---

Published as a conference paper at ICLR 2026
threat model, we highlight two important distinctions: their verification requires access to the model weights. and involves substantially higher computational cost. Additional experiments, analyses, and results are provided in Appendices
and L
5.1 RELIABILITY ANALYSIS
We evaluate the reliability of verification with our approach across multiple models. Specifically, we generate images with Stable Diffusion 2.0 base (SD2.0, Rombach et al. (202T), SDXL-base (Podell et al. 2024), Flux-dev, and Flux-schnell (Labs 2024) using prompts from Gustavo (2022). For video generation, we use 1an2.1 (Wan et al. 2025) evaluated on subset of prompts from VBench2.0Zhemm et al. (2025). For each generated image we compute its NoisePrint ((xr,)) s), where 8 is the seed used to generate I, and report the mean and standard deviation. We then analytically determine a threshold per model for fixed FPR of 2 128 (as in Section 4), and report the percentage of images that pass this threshold. Results are summarized in Table IJ NoisePrint values exceed the threshold by large margin across all models, even an extremely low FPR of 2 2- A single consistent outlier appears across three models, corresponding to a prompt discussed in Appendix G
Table 1: Reliability analysis across different models. For each model, we report the latent image dimension d (the dimension of the VAE latent space), the mean and standard deviation of the NoisePrint score d(z, s). the analytically derived threshold r for FPR = 2 128 and the resulting pass rate (images detected as watermarked).
Model
Latent Dim. (d)
Mean NoisePrint e + Std
Threshold (T)
Pass Rate
SD2.0
16,384
0,482 0.088
0.101739
1.00
SDXL
65,536
0,431 + 0.070
0.051000
0,99
I-schnlll
262,144
0.197 + 0.056
0.025500
0.99
Flux.
262,144
0.202 + 0.055
0.025500
0.99
Wan2.1
1,297,920
0.0678 + 0.0247
0.011460
1.0
5.2 ROBUSTNESS ANALYSIS
We analyze the robustness of our method using SD2.0 (Rombach et al. 2021), comparing it to prior works: WIND (Arabi al. 2025). Gaussian Shading (GS) (Yang et | (022b)) and Undetectable Watermark (PRC) (Gunn et al. 2024). We consider the attacks mentioned in (Section 3.2) For each attack, we report the empirical true positive rate (TPR) In addition, we measure TPR (at a fixed FPR) as a function of PSNR, LPIPS, and SSIM between the attacked image and the original. We also provide qualitative examples, visually demonstrating the effect of each attack on two sample images. Results are shown in Figures 2 and with additional experiments on SDXL (Podell al. 2022), Flux-schnell
function of the false positive rate (FPR).
(Labs] 2024). and the video
model Wan (Wan et al. 2025) in the Appendix (Figures to to 14 and
to
Note that baseline methods require access to difffusion model weights, and their verification is substantially more computationally expensive as shown in Table 2) By replacing inversion with lightweight cosine similarity, our method achieves an end-to-end verification speedup of x x14-x213 over inversion- based baselines (WIND, PRC, GS), depending on the model.
Basic Image Processing Attacks We consider six common image corruptions, each applied at three severity levels: (i) brightness change (intensity multiplied by 2, 3, 4); (ii) contrast change (contrast multiplied by 2, 3, 4); (iii) Gaussian blur (Gaussian kernels of radius 2, 4, pixels); (iv) Gaussian noise (additive noise with standard deviations 0.1, 0.2, 0.3); (v) compression (JPEG quality factors 25, 15, 10); and (vi) resize (down- and up-sampling with scale factors 0.30, 0.25, 0.20).
As shown in Figures 2 10 and above 0.9 at the lowest HPR (2 28 for attacked images that retain reasonable perceptual similarity
method matches or outperforms prior methods, achieving TPR
Table 2:
Runtime of different components for verifying various watermarking methods. All methods require
one VAE encode. Baselines (WIND, PRC, GS) additionally perform inversion, while our method replaces it with cosine similarity. Results are mean + standard deviation over multiple runs single RTX 3090 GPU.
Model
VAE Encode (all)
Inversion (WIND, PRC, GS)
Cosine Similarity (Ours)
SD2.0 (50 steps)
0.037 0.004 s
3.234 1: 0.075 s
0.182 1 0.045 ms
SDXL (50 steps)
0.152 + 0.007 s
12.704 1: 0.303
0.090 1 0.018 ms
Flux-dev (20 steps)
0.158 + 0.007 s
33.594 = 0.245
0.098 + 0.005 ms
Flux mexx-echeell (4 steps)
0.155 = 0.006
6.673 = 0.055
0.100 + 0.011 ms
Wan2. 1-.3B (25 steps)
6.463 = 0.102 s
91.473 = 0.164
0.097 + 0.010 ms
7

---

Published as a conference paper at ICLR 2026
Brightness Change Attacks
Cara
WIND
1980
G5
x2.0
x3.0
X4.0
TPPA//P9922 12 55M
1796/79942 POWN (48)
TFPE
69
440 FPR
SSIM
PSNR
LPIPS
$2.0
46.3
Original
LPMPS: 9.37
LPMS:340 A32
LPP'S: 0,60
Original (8)
LPPS: 0.21
LPMPS: E482
UPPS::3
Gaussian Blur Attacks
F=2
F=6
TRPAAFFINL vp 50RM
TRRAAPMRA vp PSNIT (18)
TRRUAPPA2 LIPPS
PESEPPTT -JM
24in w.c.erp.........
FPR
FPR
FPR
S50M
PSNR (dR)
LPIPS
md
mg 55M 3310
Pg
S8M LPMSS 9.42L
5SVV:
SCa: o
50M4 825
Original (A)
LPPPS: 3323
LPIPS, 0.422
Original (8)
LIPS: 0/63
LPPS: 881L
LNPP: 51
Gaussian Noise Attacks
Our
TPRAAAPM SSM
TRRUEM
TARUIAM
T7P
201 20
FPR
FPR
FPR
PSNR (IR)
LPIPS
SONG ZIP
5IM B082
5SN 395 LPIPS1L.00
cSie 0.00
550R 0.35
55N0 BUTT
Original (A)
B827
Original (B)
Figure 2: Robustness of different methods against common post-processing attacks. We evaluate brightness changes (top), Gaussian blur (middle), and Gaussian noise (bottom) varying levels of severity.
and quality. Under severe degradations such as Gaussian blur (r = 6) and Gaussian noise (a = 0.3), WIND appears more robust, with TPR near 1.0. However, these corruption levels the images are heavily distorted and diverge from the outputs of well-trained model (see sample images), making robustness in this regime
meaningful. Even milder corruption levels our method maintains TPR above 0.9, though artifacts remain evident. For instance, with Gaussian noise at o 0.2, the images show strong artifacts and PSNR drops to 14.8- 14.9, while TPR @ FPR= 2 128 is already close to 1.0 1.0, showing our method remains effective even when perceptual quality is compromised.
Following prior work (Zhao et al.) 2024 Arabi et al. 2025). ) we evaluate diffusion-basee regeneration (SDEdit-style) attacks (Meng et al. 2021 Nie et al. 2022) by adding Gaussian noise the latent of watermarked image and then denoising back to clean image. We test three noise levels: 0.2, 0.4, and 0.6. To simulate the private weights scenario, we apply SDEdit using different base model, specifically SDXL., while the images were originally generated
Regeneration Attack
8

---

Published as a conference paper at ICLR 2026
with SD2.0. As shown in Figure 3] our method performs extremely well against this type of attack, surpassing prior methods. Importantly, regeneration attacks tend to preserve the perceptual quality of the original image, as evident from both the qualitative samples and the similarity metrics, making them a more realistic and concerning threat model than basic image corruptions.
Inversion based adversarial attack While generic attacks such as image transformations or off- the-shelf regeneration can partially weaken the watermark signal, a stronger adversary could directly target our verification protocol, namely the correlation between noise and image. To explore this scenario, we introduce an optimization-base and deliberately decorrelates from it while preserving perceptual fidelity to the original image.
inversion attack that estimates the initial noise vector
Specifically, the adversary estimates the initial noise IT used to generate the original image via DDIM inversion, and then optimizes the image latents zg (initialized to z) using the loss = |00 - x=|2 + w cos( ,T); where w is a hyperparameter. We run 100 optimization steps with w E (0.3, 0.4, 0.5), where larger w values encourage greater divergence from the original image. We consider two variations of the attack: (i) the attacker uses a different model (SD1.4) for initial noise estimation, and (ii) the attacker has access to the original generative model (SD2.0). DDIM inversion is performed with an empty prompt. 50 steps, and no classifier-fres guidance (CFG).
As shown in Figures 3 and 10, both attack variations significantly more effective than regeneration or image-trana transformation attacks. They preserve perceptual similarity to the original image, with only moderate degradation in quality, Nevertheless, method outperforms all other baselines by large margin, despite the attack being tailored to break our protocol, demonstrating resilience even under targeted adversarial conditions.
Geometric Transformations We evaluate method under geometric transformations, which dis- rupt the alignment between a generated image and its initial noise. Our dispute protocol addresses this by allowing each party to submit a transformation that re-aligns the opponent's 's image. Accordingly, we test performance when transformed images are restored using an estimated inverse transform. We focus transformation types, rotation and crop & scale, and find that, after re-alignment, 100% of images pass the verification threshold at FPR = 1128
2-1228 See Appendix H for details.
CONCLUSION, LIMITATIONS, AND FUTURE WORK
We presented NoisePrints, a method for authorship verification requiring only the seed and generated output, without access diffusion model weights. Our approach does not alter the generation process and is hence distortion-free Compared to prior watermarking methods, it is significantly more efficient, particularly for higher-dimensional models (e.g.. video). We showed robustness under diverse manipulations, including diffusion- attacks, where it outperforms existing methods.
Although our analysis focused specific threat model, approach is broadly applicable. It is compatible with the owner-only setting of WIND (Arabi et al.] 2025), supporting direct seed-image verification when the seed is known or serving lightweight pre-filter in their two-stage pipeline when it is not )see more details in Appepdixx I). More generally, our method can complement other watermarking schemes as fast first-pass filter, reducing reliance on costly inversion or optimization in real-world deployments.
At the same time, our approach has limitations. It requires the verifier be able to encode images through the model's VAE, which requires the cooperation of the model provider in case the VAE private. unsuitable for real/fake detection, since adversarial patterns could be injected into real images to mimic correlation with chosen noise. Our verification assumes restricted set of geometric transformations, leaving open the possibility of stronger manipulations. Finally, like with other methods that perform verification against key that relates to the original noise pattern, method is not suitable for claiming authorship or tracing the origin of image or video variations that resemble the original only in their semantic content.
Looking forward, it would be interesting to extend our approach to real images, exploring how correlation-based methods could support real/fake detection in open-world scenarios. In this context, the spatial distribution of correlation may provide additional cues, for example by highlighting inconsistencies between foreground and background regions.

---

Published as a conference paper at ICLR 2026
SDEdit (SDXL) Attacks
WIND
PRC
6=0.6
pr1ggn 2
2- 2
2-12-22-2 2
FPR
FPR
FPR
SSIM
PSNR
saM 1.800
PSMG
BAN 2L
PSMR:
8-113
PSAR:
o
NAM 6
Original
Original (8)
Inversion Attack (SD1.4) Attacks
Dure
WIND
PRC
65
SD14, W=0.3
SD1.4, W-0.4
SD1.4, WF0.5
TIR 118
TPRGGAPRE PRMMR
1P
1P%
PSNR (dB)
LPIPS
1eed LPMPS 0O17
wel.
SOLA 1H85
POUR: 27.3
PIND INE
PINn LPIPS-A.155
PAME: 25,
33 LPIS:
Orginaal
Original
LPPS:G..1
Figure 3: Robustness of different methods against regeneration inversion attacks (using different model).
ETHICS STATEMENT
This work introduces watermarking scheme for generative models aimed improving authorship verification. Our method empowers creators, especially those without access to proprietary models, to establish ownership of their content. believe this advances transparency and accountability in generative Al while minimizing risks of misuse. The approach does not alter the generation process, does not directly apply to real/fake detection, and is therefore unsuitable for monitoring or restricting legitimate content. We openly acknowledge that no watermarking system is perfectly robust and that our method should be viewed as technical aid rather than legal guarantee of authorship.
REPRODUCIBILITY STATEMENT
We provide full details of our method, including the verification protocol, threat model, and zero- knowledge proof construction, Sectiiii 3 All algorithms are described explicitly, and pseudocode for both verification and dispute protocols is included in Appendix D Experimental settings, datasets, models, and evaluation metrics are specified in /eeciin Implementation details the zero- knowledge proof are in Appendix C Further implementation details are provided in Apppeddix K To facilitate replication, we will publish code for reproducing all experiments and for generating the rero-knowleds proof. Together, these descriptions and resources should allow independent researchers to reproduce our results.
REFERENCES
Peter Acklam. An algorithm for computing the inverse normal cumulative distribution function. Peter's Page. Available online http://home. online. no/" piacklanhote//mvoor.. 2003.
10

---

Published as a conference paper at ICLR 2026
Kasra Arabi, Benjamin Feuer, R. Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two-stage robust watermarking for images, 2025. URL httpt::/aaxxx.c.oo /ts/ba//////aaaaooa////////aaaaa /212
04653
James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al. Improving image generation with better captions. Computer Science. https://cdn. openai. com/papers/dalll pdf. 2(3):8. 2023.
Chin-Chon Chang. Piyu Tsai, and Chia-Chen Lin. Svd-based digital image watermarking scheme. 26(10):1577-1586 July 2005. ISSN 0167-8655.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pp. 1125-1139, PMLR, 2024.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification, 2024. URL httphhtts//ax.....rr//////////// /2wp:////g/////4...///// 14055
I. J. Cox, J. Kilian, F. T. Leighton, and T. Shamoon. Secure spread spectrum watermarking for multimedia. Trans. Img. Proc., 6(12):1673-1687 December 1997. ISSN 1057-7149, doi: 10.1109/83.500120. URL http:::::: /oi.
Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. Diffusionshield: A watermark for copyright protection against generative diffusion models, 2024.
URL
wttp:///ggggbbba/b/oeee/e 23366 04642
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models, 2023. URL
abs/ abs/2303 15435
Daniel Garibi, Or Patashnik, Andrey Voynov, Hadar Averbuch-Elor, and Daniel Cohen-Or. Renoise: Real image inversion through iterative noising, European Conference on Computer Vision, pp. 413. Springer, 2024.
Lorenzo Grassi, Dmitry Khovratovich, Christian Rechberger, Arnab Roy, and Markus Schofnegger.
Poseidon: A new hash function for Kero-Knowledge proof systems. In 30th USENIX Security Symposium (USENIX Security 21), pp. 519-535. USENIX Association, August 2021. ISBN 978-1- 939133-24-3, URL (preeenatiio/ggeee
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprint arXi::2410.07366, 2024.
Gustavo, Stable diffusion prompts. 2022. URL https: http:/aacceco//atttttteeeeeeeeee
Gustavosta/Stable--iEFF PPrompptts
Prompts Dataset on Hugging Face. Accessed 2025-
09-14.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-6851, 2020.
Baixiang Huang, Canyu Chen, and Kai Shu. Authorship attribution in the era 1lms: Problems, methodologies, and challenges. ACM SIGKDD Explorations Newsletter, 26(2):21 43. 2025.
Valentin Khrulkov, Gleb Ryzhakov, Andrei Chertkov, and Ivan Oseledets. Understanding ddpm latent codes through optimal transport, 2022. / 2270://72222200777777
Ahmed Kosba, Dimitrios Papadopoulos, Charalampos Papamanthou, and Dawn Song. MIRAGE: Succinet arguments for randomized algorithms with applications to universal zk- ak-SNARKs. 29th USENIX Security Symposium (USENIX Security 20), pp. 2129-2144 USENIX Association, 2020.
Black Forest Labs. Flux. httpp:://itti wwtpb/...ommaaaaaaaa Late
forest--o--oo latestt-aab/fllus
2024.
Hugo Lavenant and Filippo Santambrogio. The flow map of the fokker equation does not provide optimal transport. Applied Mathematics Letters. 133:108225, 06 2022. doi: 10166/./j.aml. 2022. 108225.
11

---

Published as a conference paper at ICLR 2026
M. Ledoux. The Concentration of Measure Phenomenon. Mathematical surveys and mono- graphs. American Mathematical Society, 2001. ISBN 9780821837924. URL https::////.... httpp::/tp//ottt /bboks
google. co www.:ocsl/ookkaaaea
cWL6rqwC
Yaron Lipman, Ricky T. Q. Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling. arXiv preprini arXi::2210.02747, 2022.
Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow, 2022. URL /tt.///tee///a......oo//////////
03003
Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking diffusion model, 2023. URL httts:://aaata org/ abs /200/33555000 2202.2205022222222
Nils Lukas and Florian Kerschbaum. Ptw: Pivotal tuning watermarking for pre-trained image generators, 2023. htt.ittps///arxiw.orrgg http///abb/334..73333
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yal Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. In International Conference on Learning Representations, 2021.
M. E. Muller. A note on a method for generating points uniformly on n-dimensional spheres. Communications of the ACM, 2(4):19 20, 1959.
Andreas Müller, Denis Lukovnikov, Jonas Thictke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models, 2025. URL htttps://aaat
hog/abs/2411 03283
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML), 2022.
J. O Ruanaidh and T. Pun. Rotation, translation and scale invariant digital image watermarking, In Proceedings of the 1997 International Conference on Image Processing (ICIP '97) 3-Volume Set- Volume 1- Volume 1, ICIP '97, pp. 536, USA, 1997. IEEE Computer Society. ISBN 08 1818881 1837.
Alex Ozdemir, Fraser Brown, and Riad S Wahby. Circ: Compiler infrastructure for proof systems, software verification, and more. In 2022 IEEE Symposium on Security and Privacy (SP), pp- 2248-2266. IEEE, 2022.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resotution image synthesis. In The Twelfth International Conference on Learning Representations, 2024. URL
net wwwpar/vwwww.eetooouue..do......
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint 200:22004.00125, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models, 2021.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, S Sara Mahdavi, Rapha Gontijo Lopes, et al. Photorealistic text-to-image diffusion models with deep language understanding. arXiv preprint arXiv:2205.1 /1400 2022.
Dvir Samuel, Barak Mciri, Haggai Maron, Yoad Tewel, Nir Darshan, Shai Avidan, Gal Chechik, and Rami Ben-Ari. Lightning-fan fast image inversion and editing for text-to-image diffusion models, In Proceedings of the International Conference on Learning Representations (ICLR), 2025.
Tom Sander, Pierre Fernandez, Alain Durmus, Teddy Furon, and Matthijs Douze. Watermark anything with localized messages. In International Conference on Learning Representations (ICLR), 2025.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- fional Conference on Learning Representations, 2020.
12

---

Published as a conference paper at ICLR 2026
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models, 2022. URL https://axxiv.. org/
hwtp/////////o/o//////////////t/ abs/ 2010..00 02502
Matthew Taneik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2117-2126, 2020.
Justin Thaler et al. Proofs, arguments, and zero-knowledge. Foundations and Trends@ in Privacy and Security, 4(2-4):117-66) 2022.
Team Wan, Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianxiao Yang. Jianyuan Zeng, Jiayu Wang, Jingfeng Zhang. Jingren Zhou, Jinkai Wang, Jixuan Chen, Kai Zhu, Kang Zhao, Keyu Yan, Lianghua Huang, Mengyang Feng, Ningyi Zhang, Pandeng Li, Pingyu Wu, Ruihang Chu, Ruili Feng, Shiwei Zhang. Siyang Sun, Tao Fang, Tianxing Wang, Tianyi Gui, Tingyu Weng, Tong Shen, Wei Lin, Wei Wang. Wei Wang. Wenmeng Zhou, Wente Wang, Wenting Shen, Wenyuan Yu, Xianzhong Shi, Xiaoming Huang, Xin Xu, Yan Kou, Yangyu Lv, Yifei Li, Yijing Liu, Yiming Wang. Yingya Zhang, Yitong Huang, Yong Li, You Wu, Yu Liu, Yulin Pan, Yun Zheng, Yuntao Hong, Yupeng Shi, Yutong Feng, Zeyinzi Jiang, Zhen Han, Zhi-Fan Wu, and Ziyu Liu. Wan: Open and advanced large-scale video generative models. arXiv preprint arXiv:2503.22 20314, 2025.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Finger- prints for diffusion images that are invisible and robust, 2023. URL
arxiv.org//
abs/ / 2305 20030
Anna PY Woo, Alex Ozdemir, Chad Sharp. Thomas Pornin, and Paul Grubbs. Efficient proofs of possession for legacy signatures. In 2025 IEEE Symposium on Security and Privacy (SP), pp- 3291-3308. IEEE, 2025.
Chenfei Wu, Jiahao Li, Jingren Zhou, Junyang Lin, Kaiyuan Gao, Kun Yan, Sheng ming Yin, Shuai Bai, Xiao Xu, Yilei Chen, Yuxiang Chen, Zecheng Tang. Zekai Zhang, Zhengyi Wang, An Yang. Bowen Yu, Chen Cheng, Dayiheng Liu, Deqing Li, Hang Zhang, Hao Meng. Hu Wei, Jingyuan Ni, Kai Chen, Kuan Cao, Liang Peng, Lin Qu, Minggang Wu, Peng Wang. Shuting Yu, Tingkun Wen, Wensen Feng, Xiaoxiao Xu, Yi Wang, Yichang Zhang, Yonggiang Zhu, Yujia Wu, Yuxuan Cai, and Zenan Liu. dowen-imaee technical report, 2025. URL httttt:t///aaaa www.wworrrroooooo org/ abs wtwpaaa////aeeeoggg/ggg///eaaa//
2508
02324
Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Steganalysis on digital watermarking: Is your defense truly impervious?, 2024a. URL http://s://axww.oog////a/aa
09026
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performaacc-llosleess image watermarking for diffusion models, arXiv, 2024b. URL
https://arxiiv http://b///2/400 2404 04956
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In IEEE International Conference on Computer Vision (ICCV), 2021.
Hanlin Zhang, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. Watermarks in the sand: Impossibility of strong watermarking for generative models, 2025.
URL htt.hhttp///// hnttps://aaxivv org. 2333 04378
Kevin Alex Zhang, Lei Xu, Alfredo
and Kalyan Veeramachaneni. Robust invisible video watermarking with attention, 2019. URL URL htttt:tt/ta//tttttt org/ wttpga///////..a///////// 09289
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In CVPR, 2018
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition, pp. 18864-199744 2024.
13

---

Published as a conference paper at ICLR 2026
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, llya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai, 2024. URL
01953.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang. Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models, 2023. URL / 2203. 10137
Dian Zheng, Ziqi Huang, Hongbo Liu, Kai Zou, Yinan He, Fan Zhang, Yuanhan Zhang, Jingwen He, Wei-Shi Zheng. Yu Qiao, et Vbench-2.0: Advancing video generation benchmark suite for intrinsic faithfulness. arXiv preprint arXiv:2503. 2025.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Computer Vision - ECCV 2018: 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part XV. pp. 682-69 697, Berlin, Heidelberg, 2018. Springer- Verlag. ISBN 978- 3-030-01266-3, doi: 10. 10011007797---000-00200000 978 078-3-030-01226-000
htttttpss: /ttp::://doo..or///00000
Lukasz Staniszewski, Lukasz Kuciński, and Kamil Deja. There and back again: On the relation between noise and image inversions in diffusion models, 2025. pttttps:/arxlv.org 2bs/2410.23530
14

---

Published as a conference paper at ICLR 2026
A APPENDIX
A OPTIMAL TRANSPORT DISCUSSION
Optimal transport studies the problem of moving probability mass from one distribution to another while minimizing& transport cost function. Given a source distribution 1 and a target distribution v, the optimal transport map 7 minimizes the expected cost Ez~a [c(x; [x))] where c(:,)) is the cost function, which is often set to be the quadratic cost c(z, y) = I yll². The optimal transport map provides the most efficient way to transform samples from the source to match the target distribution, which connects naturally to the generative modeling objective of transforming noise into data samples.
Khrulkov al. (2022) demonstrate that the mapping between noise and data of the probability flow ODE of diffusion models coincides with the optimal transport map for many common distributions, including natural images. While not guaranteed in the general case (Lavenant Santambrogio (022).
they also provide theoretical evidence for the case of multivariate normal distributions.
Flow matching models are trained with conditional optimal transport velocity fields, and the learned velocity field is often simpler than that of diffusion models and produces straighter paths (Lipman (ct al., 2022). Liu et al. (2022) prove that rectified flow leads to lower transport costs compared to any initial data coupling for any convex transport cost function c, and recursive applications can only further reduce them.
By the identity || - ||~||² + |1ll 2(x; y). decreases in transport cost correspond to increases in the dot product. The norm of high dimensional Gaussian noise samples concentrate tightly around Vd, and assuming the target is a KL-regularized high dimensional VAE latent space, latent norms encouraged also have this property. Thus increase in average dot product should translate to near-proportee prapororpooii increase in average cosine similarity. We refrain from asserting a universal bound on the expected cosine for arbitrary targets, but on image/video data we empirically observe cosines that yield statistically decisive results with error probabilities compatible with cryptographic practice.
B EXACT SPHERICAL-CAP PROBABILITY FOR A GAUSSIAN VECTOR
Let X ~ ((, Ia) be d-dimensional standard Gaussian and let e E IRd be a unit vector. We are interested in the tail probability
Prfcos x,,) 2 a].
[-1,
Because the Gaussian is rotationally invariant, may assume e1 without loss of generality. Theorem (Exact spherical-cap probability). For any 2 2 and [-1,
Pr[cos(X v) a] 1
d-1
(6)
2
where [p. 9) is the regularized incomplete beta function
Proof. Define the random direction U = =X/||XI| E 1d which uniform on the sphere. Then
cos v)
X U1.
X
The first coordinate U, of a uniform point on 5d-1 has the density Muuller 1959 Eq. (3.2))
I($) V
fa(t)
d-1 (1 - 8)
-
iec the Beta($3) 1بم 1)
distribution mapped affinely from [0, 1] to [-1, Integrating fa(t) from a to
1 and expressing the result with the regularised incomplete beta function yields Equation 6
In ScIPy this is acipy.specii...................p betainet (p, q, x).
15

---

Published as a conference paper at ICLR 2026
Theorem 2 (Exponential bound). For any d and [0, 11.
Prfcos(X X, 2 2r] S expl 1-----1
Proof. Let U = X/||X||| 8d-1, which is uniform on the sphere, and set f(u) (u,e). v). The map/ f 5 + R is 1-Lipschitz (with respect to the geodesic or Euclidean metric restricted to the sphere) and has median by symmetry. By Lévy's isoperimetric (concentration) inequality on the sphere (Ledoux] 200T, Ch. 2), for every 1 2 0.
Pr(S(U) 2 1 s exp (d=1) P). 2
Taking T yields the claim.
C ZERO-KNOWLEDGE PROOF
In this section, we provide the implementation details and benchmark results of our eerollnoweedge proof (ZKP)).
C.I IMPLEMENTATION DETAILS
In our implementation, we had to overcome two main challenges:
1. ZKP proof systems currently do not allow for efficient proofs on floating -pintt number computations.
2. Proofs with input sizes required for our use case (vectors of sizes larger than 2 are infea- sible in our proof system due high memory requirements both for the initial compilation of the circuit and for the proof generation.
We overcome these challenges by using fixed -oont integers instead of floating points, and splitting the proof for the full vector derivation and inner product computation into smaller proof's of intermediate inner product computation (for vectors of size s 700) and then using another circuit to combine all of the intermediate values to find the cosine angle and check it against the threshold. This approach allows us to easily scale up our proofs to larger noise sizes as required for video generation.
We the CirC (Ozdemir et al. 2022) toolchain to write circuit in front-end language called 7# and then compile it to an intermediate representation called RICS. We then use CirC to produce a ZKP the RICS instance using the Mirage (Kosba et al. 2020 proof system. In particular,
Woo et al. 2025 's modified version of CirC.
As mentioned above, our circuit takes as private witness seed and derives vector i of length L (which in our implementation was chosen to be of size 266000 xs 218). The circuit then takes as public input flattened image latent represented by a vector V2 of size L. It then computes their dot product and their individual magnitudes. Finally. using these values, it computes the cosine angle C'A and checks if it above public threshold value 7.
In more detail, the circuit uses private seed and a public seed Spub to derive the vector in as follows. First, the circuit computes p < his || Spub). where h is collision-resistant hash function. Then the circuit expands p by iteratively applying pseudorandom number generator (PRNG) to produce stream of pseudorandom numbers.
These pseudorandom values are then used as inputs lookup table (Acklam 2003) that approxi- mates the inverse cumulative distribution function of the Gaussian distribution, thereby transforming the uniform pseudorandom numbers into baussian-distribun samples. The resulting values from the lookup table evaluation constitute the entries of V1.
Unfortunately, our framework's memory requirements make computing vector of size x 218 infeasible even in a server-class machine. To solve this issue, we construct two circuits instead one. Our key idea is to make the first circuit prove the correctness of the dot product and magnitude using only L/n entries at a time, for some n such that L/n is small enough. The prover can then generate proofs using this circuit cover all I. entries. The second circuit then combines dot products
16

---

Published as a conference paper at ICLR 2026
and n magnitudes to produce a cosine angle check if it is above public threshold value t. As part of the proof, the prover commits to all intermediate inner product values. Both circuits verify these commitments to ensure that the intermediate values calculated and verified by the first circuit are also the ones used by the second circuit. Next, we describe both circuits in detail.
C.2 ZKP CIRCUIT FOR COMPUTING DOT PRODUCT AND SQUARED MAGNITUDE
We provide the pseudocode of our first circuit in Figure 4 This circuit takes input a private seed to derive a noise vector (e*)kE]L/n) To do so, along with 8, it uses public seed 8pub (representing ownership information) and a public counter e (identifying one of n circuits) to compute p + lo(s || Spub || c). The circuit then iteratively computes PRNG(p) to generate pseudorandom numbers. As numbers in CirC are elements a prime field of size z 255 bits and we only need 33 random bits for our Gaussian noise sampling algorithm, each such pscudorandom number is divided into k = 7 parts, so that (g k) = L//n. They are then used to sample elements from the normal distribution using lookup table ND which produces the noise vector (c*)ke[L/n)) After the values are derived, the circuit calculates their inner product with the public input vector that represents the L/n-th portion of an image in the form of vector (Uk) kE[L/n]- The circuit calculates both the dot product and the squared magnitude of (ex)xe(1./n)) Finally, the circuit verifies that the public commitment com, combined with private randomness r, correctly commits to the dot product and squared magnitude (which values will be used by the second circuit). The commitment is instantiated using a hash function on the concatenation of the values. Since ZKP circuits operate over finite fields, negative integers cannot be represented directly, the actual implementation uses an additional sign vector to encode them.
DPM(c, Spab, (Ux (e))),)(//),,. com;8, dot prod = O sq mag 0
4- h(s Spub () for {L......) g}:
+ PRNG(p)
//parse p as (pe)eE(R)- for E (1, [k. ki):
E(G,) + ND(;)) dot prod dot prod + e(i)) ((.))
sq sq.mag +- sq mag + e(is)
endfor endfor
assert(com = commit(dot || sq-mag || r)
return 1
Figure 4: Circuit for computing dot product and square of the magnitude. The circuit is instantiated with function ND that on a random input simulates sampling an element from normal distribution.
C.3 ZKP CIRCUIT FOR COMBINING ALL DOT PRODUCTS AND SQUARED MAGNITUDES
The pseudocode for the second circuit is shown in Figure 5 To start, the circuit takes as public input commitments (com:))ejo)) and as private inputs randomness (ri)sejn), dot products (dol_proid (ro..pro))eem and squared magnitudes (sq-mag, )e())) checks all com; are valid. If so, using these values, the circuit calculates the final dot product F FDP and the final squared magnitude FSM, which represent all elements. Next, instead of computing the magnitude mag of the entire noise vector from FSM, which requires complex square root computation, the circuit takes it as private input and checks if is valid (which requires just a simple multiplication). Similarly, instead of computing the cosine angle C.A, the circuit takes it as private input and checks its correctness with the help of the public magnitude the image vector img-mag. Note that since a field does not recognize real numbers, round down these values the nearest integer and scale both cosine angle CAA and threshold to be 32-bit fixed-preed -reciiicii integers. Similarly to the earlier circuit, we handle negative values with an additional vector that represents the sign.
17

---

Published as a conference paper at ICLR 2026
ie(m) mag, t; (ra)ie]))
(dot.prod))ie(w) (st (gg-mg))))em)) mag, C')):
FDP
FSM
for i P ( ,n):
if comy # commit((dot.prad; sq.mag.)::a):
return 1
FDP FDP + dot dot.propoo prod,
FSM = FSM sq_magi
endfor
// verify magnitude of noise vector mag assert((mag)² <= FSM <= (mag + 1)2)
I/ verify cosine angle CA
floor + mag- imggmma CA ceil t mag- -ing mag. (CA+ + 1)
assert(floor floor <= FDP. 2 <= ceil)
Asseet(CCA) t)
return
Figure 5: Circuit for combining all dot products and squared magnitudes.
C.4 BENCHMARK RESULTS
We benchmarked ZKPs show that they indeed efficient and practical. Our testbed is machine equipped with an AMD Ryzen Threadripper 5995WX 1,8GHz CPU and 256GB RAM. The proof generation time for the first circuit is 765 ms (which can be run in parallel for all parts of the vector), whereas for the second circuit it is 920 ms. The proof verification times for the first and second circuits are 415 ms and 115 ms, respectively.
Since we use Mirage as our backend proof system, it produces a prover and verifier key required for proving and verifying, respectively. The prover key for both circuits is less than 200 MB, and the verifier key is less than MB in both cases. The proof size is at most 356 bytes.
D NOISEPRINT ALGORITHMS
Algorithm 1: Verification for NoisePrint
Input: content x, seed threshold Public Primitives: encoder E, PRNG spec, hash function h
if (0x s) 2 then return Accept else return Reject
Algorithm 2: Dispute Protocol
Input: claims A A.A and (ID, $B,98) 9B) Public Primitives: encoder E, threshold PRNG spec, set of transforms G. hash function
for i E {A, B} do gi not provided then 9: id
SELFPASS( (0(2; 81; id) > 7] CROSSPASS(1) + (o(a, 8y; gi) 2 T). i
VALID(i) + SELFPASS(i) A CROSSPASS(i)
VALID(A) and not VALID(B) then return A else if VALID (B) and not VALID(A) then return else return Unresolved
18

---

Published as a conference paper at ICLR 2026
E
VAE EFFECT ON COSINE SIMILARITY
practical consideration in our framework that correlation is measured in latent space, whereas the generated content is ultimately observed RGB space. This raises the question of whether decoding a latent to an image and then re-encoding it back into latent space affects the measured correlation. To evaluate this, we report the correlation values before and after VAE decode-encode cycle, using the native VAE of each model. As shown in 3 the differences are minor across all tested models, indicating that the VAE introduces only negligible distortion and does not significantly affect the correlation.
Model
Pre-VAE Mean + Std
Post-VAE Mean + Std
SD2.0
0.4922 + 0.0904
0.4818 0.0876 0.4283 + 0.0608 0. 0.1989 + 0.0543
SDXL Flux. 1-schnell
0.4545 + 0.0598 0.2102 +: 0.0535
Table Cosine similarity of generated latents with original noise before and after passing through the VAE and back.
F CORRELATION QUALITATIVE ANALYSIS
Our method builds on the observation that the noise used to generate an image is highly correlated with the image itself. Figure 6 shows examples, one from Flux (Labs) 2024) and from SDXL (Podell et al., 2024). with spatial correlation maps smoothed by a Gaussian filter. Regions exceeding predefined threshold are highlighted by an overlaid mask. As can be seen, the correlation is stronger in the foreground regions. We hypothesize that this effect arises from sharper structures and richer textures in foreground regions, where high-frequency details are more directly influenced by the noise, whereas smoother backgrounds dilute the signal.
Figure 6: Spatial correlation between initial noise and the generated image latents. Left: Flux-dev,
right: SDXL.
G FAILURE EXAMPLE
We observed failure case with a specific prompt ("concept art of minimalistic modern logo for a European logistics corpo- ration"). For 2 out of the models tested, the generated images had exceptionally low entropy and contained large uniform regions, making much more difficult to retain a detectable watermark. In both SDXL and Flux.I-schnell the resulting correlation fell below the threshold chosen for a 121 false positive rate, despite being generated by the claimed seed (Fig- ure 77 A related result by Lukasz Staniszewski et al.] (2025) demonstrates that DDIM inversion tends produce latents that more significantly deviate from the original noise vector that was used to generate the image in parts of the latents that correspond plain areas the image. While such cases are rare, they highlight that verification may fail in low-variance generations. Importantly, this can be anticipated, and users can be warned at generation time if the output falls into this regime.
V
(a) SDXL
(b) schnell
Figure Failure cases.
19

---

Published as a conference paper at ICLR 2026
H GEOMETRIC TRANSFORMATIONS ATTACK
We next provide more details about the experiment that showed robustness to geometric attacks (Section 5.2 last paragraph).
As mentioned earlier, we consider two transformation types: rotation and crop scale. For rotation, each image is rotated by random angle in the range [-45, 45] degrees. For crop scale, the image is cropped rescaled to its original size. In both cases, the applied transformation is estimated using OpenCV's est iiaattafffffiim..mmm.m ieeeiniPPaa www.ieeeeittiiie artial21 function, and its inverse is used to re-align the image. To account for potential misalignment the borders, compute cosine similarity calculation to the overlapping spatial region (see Figure 8).
random location with a crop factor in [0.6, 0.9), and then
connsfommderivee mask that restricts the
Given set of images, apply these attacks and report the mean and standard deviation of the NoisePrint score, as well as the percentage of images that pass the verification threshold at FPR 2-128 As shown in Table 4 both rotation and crop & scale transformations accurately estimated in all cases, resulting in 100% of images passing the verification threshold.
Original
Transformed
Re-aligned
Original
Transformed
Re-aligned
Figure 8: Estimation and alignment of geometric attacks. In green: the masked area used for cosine similarity.
Table 4: Quantitative results under geometric transformations. We report the mean and standard deviation of the NoisePrint score and the pass rate at FPR 2 128 for both rotation and crop & scale transformations. In all cases, the transformations are accurately estimated and every image passes the threshold.
Transform
Mean NoisePrint d Std
Pass Rate
Rotation
0.3825 + 0.0648
1.0
Crop & Rescale
0,4191 0.0649
1.0
I TRACEABILITY RESULTS
We evaluate NoisePrints in the traceability setting presented in WIND Arabi al. (2025), where the model owner embeds unique watermark per generated image to subsequently verify whether given image was generated by their model and identify the specific key that was embedded during generation from pool of keys. Table ( reports detection rates for method and WIND across 100 images matched against 100,000 different seeds under various corruptions and adversarial attacks using Stable Diffusion 2.0. Both methods demonstrate high robustness under corruptions; however, our method exhibits superior resilience to the DDIM inversion-based adversarial attack.
Table 5: Tracability results: Fraction of images matching with the correct noise sample out of 100,000 (Stable Diffusion 2.0) Attack legend: Bright- Brightness x3, Contrast Contrast x3, Blur Gaussian Blur 4, Noise Gaussian Noise 2, Inv DDIM inversion using Stable Diffusion 1.4 with 0.4. JPEG JPEG compression Q 25, Resize Resize x0.25, SDEdit SDEdit with
SDXL, 0.6.
Metrie
Clean
Bright
Contrast
Blur
Noise
Inv
JPEG
Resize
SDEdit
Ours 1.000
0.990
1.000
0.990
1,000
0.980
0.990
1.000
1.000
WIND
1.000
0.990
1.000
1.000
1.000
0.560
1.000
1.000
0.980
20

---

Published as a conference paper at ICLR 2026
J COSINE SIMILARITY DISTRIBUTION
In Figure 9 we visualize the cosine similarity distribution of generated images with their respective Initial noises and of generated images with random Gaussian noises. This illustrates the large gap that allows for clear separation between the two distributions.
Cosine Similarity Distribution: Initial Noise Random Gaussian
Rancom Gaussian
Intiaa Nelse
Notse Cosine 0.4818
0.12
Faction of Samples
0.08
0.02
6.2
0.3
0.5
0.6
Cosine Similanity
Figure 9: Histograms of cosine similarity between initial noise and generated images and cosine similarity between random noise and generated images (Stable Diffusion 2.0).
K IMPLEMENTATION DETAILS
For most of our experiments, we use torch. randn as the PRNG, passing a torch. Cenerator that initialized with the seed. For the knowledgee proof implementation, we use a simple Linear Congruential Generator to get pseudorandom numbers, which are then transformed into samples as explained Appendix C We use an implementation of Poseidon Grassi et al. 202T) as our one- way hash function.
21

---

Published as a conference paper at ICLR 2026
L
ADDITIONAL ROBUSTNESS RESULTS
We provide additional robustness results for our method across different models:
Figure reports results on SD2.0 under our inversion attack, where the model used for performing inversion is the same the one used for image generation (SD2.0).
2.
Figure presents additional results on SD2.0 with basic corruption attacks.
3.
Figures 12 and 13 shows results on SDXL with basic corruption attacks.
4.
Figure 14 provides results on SDXI. under SDEdit and inversion attacks, with SDXL, also
used to perform the attacks.
5.
Figure 13 provides results on SDXL under the imprint removal attack presented in Müller al. (2025). this attack, the initial noise Fr that was used to generate the original image latents is estimated with DDIM inversion using proxy model (Stable Diffusion 2.0).
Then, the image latents ag (initialized to I) are optimized such that the resulting latents from DDIM inversion stray away from this initial noise estimation of æT. The optimization happens through gradient descent, minimizing the loss L = [ (zg) (- Il? with 1o-1 (2+) being the inversion result when starting from 2g. We evaluate the method's effectiveness after 30, 40, and 50 optimization steps. As can be seen, this attack is highly effective against watermarking methods that rely inversion for detection, and is able cause detection rates to significantly drop with only minor degradations to image fidelity. In contrast, our method displays very high robustness against this attack, since does not rely on inversion and is less affected by the method's adversarial optimization goal.
6. Figures 16 and 17 presents results on Flux-schnell with basic corruption attacks. Note that Flux-schnell few-step model operating with only four denoising steps. Accurate inversion is more challenging in such models, making our inversion-free approach a significant advantage.
7. Figure 18 shows results Flux-schnell under SDEdit and inversion attacks, with SDXL used to perform the attacks.
8. Figure 19 provides results on the video model Wan, where we adapt image attacks to the video domain. Our method demonstrates strong robustness video while remaining efficient. shown Table 2 relying on correlation rather than inversion particularly beneficial for video due its high dimensionality.
Inversion Attack (SD2.0) Attacks
Ous
WIND
PRC
TPRO 50.5
(cm)
TPR-SER00)
TPR 17G--RR---- 220
XX0 01R 4
FPR
FPR
FPR
SSIM
PSNR (0B)
LPIPS
50200
S02 W0L3
ved.3
5D2 0.55
SSN: 0J32
SSI 0.8
Original (A)
(877
LPIPK 6.90
LIINK 6112
Originl (8)
(PPS1
LPPA 621c
LPPI 287
Figure 10: SD2.0: Comparing robustness of different watermarking methods against inversion attack.
22

---

Published as a conference paper at ICLR 2026
JPEG Compression Attacks
Out
WIND
PRC
=225
211
TRR.gFPart
TPROFRRR2 PSHR (68)
TRR@FFRR22
TORg -20
38 XX
XX
C3 18
FPR
FPR
FPR
SSIM
PSNR (8)
0-25
0-25
SON 0.854
SSM:: 0.57
55 8.8.7
S5M:174
Original (A)
LPIK: 177
LPIPS 200
LAIE: 0.35
Original (8)
LPPS: 6.122
Resize Attacks
X0.3
x0.25
x0.2
TPP:grPP-2211 551
TPagee M942 PSMi (48)
TPnggmiB-2-11 LMMS
THR8FFI-22 12
TPRR
TPR
SSIM
PSNR (dB)
IPIS
+0.25 PANRI 18 da
+0. PakRi 28.5
25
PANRS 27-
PANRi 28 de
PANN 25.5 65
POUR 151488
Original (A)
Original (8)
Contrast Attacks
Olix
WIND
FRC
65
TPP
20gg 11
200
FPR
FPR
FPR
SUII 412 LPIPS: 0.38
SSM: 6.13
BS B40 8.005:8.31
SSM MSMM88300 8300 LP15S: 6.305
Original (A)
1PPS:3115
Original (8)
LPPPS: 8.166
Figure 11: SD2.0: Comparing robustness of different watermarking methods against additional basic
corruption attacks.
23

---

Published as a conference paper at ICLR 2026
Brightness Change Attacks
Ours
WIND
PRC
08
x2.0
x3.0
x4.0
TPR
02
FPR
FPR
FPR
SEN: 0.18
SCN 0.55
SCN 0-45 LMPS: 0379
SSMI 6:55
5S 8500
2SM: 2517
Original (A)
LMP5:1.22
LPPP: 2468
Original (8)
LMPS: 8220
LMIPS: 6.55
LMPS::
Gaussian Blur Attacks
F=2
F=4
F=6
TPRggrP----1a 55M
TPRIgT PiB va PSNI (U5)
TPPnger7--2--10 LMPS
-22
TRROFFR-2 -23
TPRR
2-2g 22
031
FPR
FPR
FPR
S5IM
PSNR (dB)
LP8PS
ON
PARRI 222
PARNI 20.4
PORK
POUR
Original
Gaussian Noise Attacks
0lnx
WIN
0=0.11
0=:02
G=0.3
TPR-SPPE22210 TPRage PR:2-11 TPR-FFRE2--11
TPR FPW-2
TPR
0.2
PSNR
LPIS
MUNI 0228
WSN 5328
SENI 944 1374
SSMI 0.29
USM FOR 11.
Original (A)
Original (8)
LMPS: 6.15
LAPS:
Figure 12: SDXL: Evaluating robustness against basic corruption attacks.
24

---

Published as a conference paper at ICLR 2026
JPEG Compression Attacks
Out
WIND
PRC
G8
Q-25
Q-15
Q=10
FPN/FFFoc2 -20
FPR
FPR
FPR
SCNN: 0801
SSNI BAB
SSNT0 LMPS: 0,207
25M:6-92
55 6002
SSMI 887
Original (A)
LMPS: 3.12
LPMP:: 0.157
Original (8)
LMPS: 8.72
UMMP:: LMP55:8.279
LMPS5:
Resize Attacks
X0.3
x0.25
TR 55M
TPaigT PiB va PSNI (U5)
TPinge7t--2-12 LMPS
-22
TRROFFR-22 -213
TPPR
2.22 22 2
GH
28 24
120
1.5
FPR
FPR
FPR
S5IM
PSNR (dB)
LP8PS
+0.25 PANI di
20 PARRI 2.1
K0.
+525
+02
PARRI 20-4
PORE:
POUR
Original
Contrast Attacks
Ous
WND
x2.0
x3.0
x4.0
TARE 2-10
TFR 2
TPC -2
PSNR
LPIPS
MUN 0.853
SSII 464
SENI 0.312 $30
SUMI E8IS
SUN (48)
SIN 0 206 IPPS:E.35
Original (A)
Original (8)
LAPSI 6.5G4
Figure 13: SDXL: Evaluating robustness against additional basic corruption attacks.
25

---

Published as a conference paper at ICLR 2026
Inversion Attack (SDXL) Attacks
Ours
WIND
SDXL, W=0.3
SDXL, W=0.4
SDXL, W=0.5
FP0-3-2 211 SSM
TPRGFRR-2-11 PSNR
TPR-SFR--22 LPPS
1PR
0.2
00
SUMM 25.3
124
PENR: 647
SSIn: 28.1
POUR
Original (A)
LPPS-1.156
5328
Original (9)
LMPS: 0.57
SDEdit (FLUX) Attacks
OLN
WIN
FLUX,
2R0.5
TAR:SFPRE
TPAgG PRC: PONR (150)
TPRO -28
200 2 2
20yy 2 2ogge
110 0.70 K76
D4 D5 PSNR (dB)
630 130 115
FPR
FPR
FPR
SSIM
LPES
FLUM
SON: DE
FLUX CSLE
55M:0882
FLUK c3-
RLU cBA
C88 SSM:1815
POUR
Original (A)
LPMP::
LPMP::330 2030
LMIPS: 0379
Original (B)
8.175
L.255
Figure 14: SDXL: Evaluating robustness against SDEdit and inversion attacks.
Ieprint-Removal Attacks
Oute
WIN
G5
30 Steps
40 Steps
50 Steps
TPR
FPR
SSBU 123
SSN 830 LAPS: 0333
SSM: 0.26
SS 6.179:0.177
S5M:8
Original (A)
LPPIS 089
LPIPS: 3334
Original (9)
UMPIS 0.39
Figure 15: SDXL: Evaluating robustness against Imprint Removal attack of Müller et 20025
26

---

Published as a conference paper at ICLR 2026
Brightness Change Attacks
Ous
x2.0
x3.0
x4.0
TPR
FPR
FPR
FPR
SCN:: 0
SO1R 2511
SCN 0:435 LAPS: 3453
25N:6812 6.13
55 6A7
25M: 600
Original (A)
LMPS:
LPPS-
Original (B)
LMPS: E.55
UMiPS: 6.333
LMMS::
Gaussian Blur Attacks
F=2
F=4
F=6
TRRgrPP--2-ia 5SM
TPagee Pia2-1i va PSNit (45)
TPiigert--2--1 LMPS
TP--- PR--------- 2-1---2-23
TRROFFR-2- -21
TPRR
2-2g 2
202 22
075
180
PG
318
301 31
09 58
FPR
FPR
FPR
S5IM
PSNR (dB)
IPIPS
-f
HENE 2E4
PANRI de
PARRI 281
PSHRI
PORE
POUR 83
Original
Gaussian Noise Attacks
0=0.1
0=0.2
G=0.3
TPR:SEPM:222 1-1
TPR -124
TPR FPW-2
0.2
03
FPR
PSNR
MUN 0328
ISN 1337
SEN 333 LIG
SSMI 0:23
USM: 810 LPIPS: 1.251
Original (A)
LPP5-1551
Original (8)
LMPS: 6.78
Figure 16: Flux. 1 --cchelll: Evaluating robustness against basic corruption attacks.
27

---

Published as a conference paper at ICLR 2026
JPEG Compression Attacks
Ous
-22
Q-15
Q=10
2220
FPR
FPR
FPR
SCN:: 0.82
SSN 0.774
SSN 6222
25M:6622
55 6407
25M
Original (A)
LPPS: 0111
0.177
LMPS: 0248
Original (B)
LMPS: 6.192
UMPS::1.24 1.24
LMMS5:8.39
Resize Attacks
x0.3
x0.25
x0.2
TRRggTP--2-1n 5SM
TRPLyene--2 us PSNnt (45)
1PP1) LMMS
2-222
TPROFFR-2- -23
TFR-FFRR-2-11
TPR
2-2g
138 21 X1
2:00
FPR
FPR
FPR
S5IM
PSNR (d9)
LPIPS
K0
+0.2 PANI da
102 PARRI 2.2
.0.
25
402
PAREE
PONR 28
POUR 255
Original
Contrast Attacks
x2.0
X3.0
x4.0
TPR FFF-22
0.2
33
SSIM
PSNR
WSN 417
SSNI 333 130
SSMI 0.72
SS E304
USM: 477
Original (A)
1PP5-11170
Original (8)
LMPS: 6,377
LPIPS:
Figure 17: Flux.1 1- 1-schnell: Evaluating robustness against additional basic corruption attacks.
28

---

Published as a conference paper at ICLR 2026
Inversion Attack (SDXL) Attacks
SDXL, W=0.3
SDXL, w=0.4
W=0.5
TRR.9FR802 SSM
TPA@FRRM2 PSWR (63)
TPR@FFRR2
TRRO8FR-22 -21
T1P
2
0T3 676 17 K74
AC MEE 20
FPR
FPR
FPR
SSIM
PSNR (dB)
LPIFS
SOKL w-13
SDK. a:14 PSMI: da LP195-1117
SDNL ants
S0KL.vmd.
50X,
50X 8800
SSM: 0.1
6AM
PSNI 68 LPP5:11152
PSUR 65
Original (A)
LPMS: 0.20
Original (9)
LMPS:: 0.354
LMIPS:
LP125:
SDEdit (SDXL) Attacks
SDXL, 2m0.2
SDXL, 2m0.3
SDXL, 2=0.4
TPagee PVN- -018 va PSNIt (48)
TP--g770-2211 LMPS
TPR
TPR
SSIM
PSNR
LPIP5
SDKL, 201 SSM:
SDNL, PSNR: 20.5 dB LPPS-220
SDKL p014
SDXL p=1.2
SOAL ed.1
SON, #tA PSUR 9.179
PSRR: 53
SSM:
PSNR 21.3
25.1
PSNR: 26. UAMS:
Original (A)
115
128
Original (9)
UMMS: 6:399
Figure 18: Ischhell: Evaluating robustness against SDEdit and inversion attacks.
Brightness Attacks
Gaussian Noise Attacks
x2.0
x3.0
x4.0
0=0.1
0F0.2
0:003
199
TAR
FPR
FPR
FPR
FPR
Gaussian Blur Attacks
H.264 Compression Attacks
P=
CRF=20
CRF-32
CRF
TPR
TPR
prgeeeop 2014
www.
FPR
FPR
FPR
FPR
FPR
FPR
Contrast Attacks
Resize Attacks
X2.0
x3.0
x4.0
H0.3
x0.25
H0.2
1992
T9R
FPR
FPR
FPR
Figure 19: Wan 2.1: Evaluating robustness against basic corruption attacks for video.
29

---

Published as a conference paper at ICLR 2026
USE OF LLMS
We used ChatGPT to assist with the preparation of this paper. Specifically, we used it to correct grammar and improve sentence-level clarity. We carefully checked all of its outputs. In addition, used it to help identify related work. All such references were manually verified to exist and were cross-checked against their official sources. All ideas, technical content, and analysis are our own.
30


Reviews:
[{"review_id": "3pyj9Z90hH", "reviewer": "Reviewer_cyNm", "summary": "This paper proposes NoisePrints, watermarking framework for diffusion models that uses the random seed of the generation process as a proof of authorship. By leveraging the strong correlation between the initial noise and the final output, the proposed method secures the generation process with a cryptographic hash and optional zero-knowledge proof, which enables verification without accessing diffusion model weights. Experiments on image and video diffusion models demonstrate that NoisePrints achieves robust and efficient authorship verification under common content manipulations.", "questions": "1. If the watermarked images gone through semantic level modification, such as style transfer, can the watermarked detection accuracy still maintain?\n2. According to some studies [1], large diffusion models exhibit partial memorization of training images. In such cases, different seeds may yield visually or latently similar outputs, breaking the one-to-one correspondence between the seed and the generated content. This could lead to higher false positive rates in NoisePrints verification, since unrelated seeds might still produce embeddings that correlate above the verification threshold. Can the author provide evaluation results of proposed method in such case?\n\n[1] Memory triggers: Unveiling memorization in text-to-image generative models through word-level duplication\n[2] Understanding (un) intended memorization in text-to-image generative models.\n[3] Extracting training data from diffusion models.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The writing of the paper is clear and well-structured.\n2. The proposed method is simple but effective, especially in terms of robustness against different types of attacking.\n3. Experiments are conducted on multiple diffusion models (including both image and video generation) and against various types of attacks, demonstrating the generality of the method.", "weaknesses": "1. A main concern is the applicability of the method, in the scenario considered in this paper, the verification of the watermark relies on public structure VAE. However, in practice, it is possible that some diffusion models may update or fine-tune their VAEs across versions. It is not clear that under this circumstance, whether the proposed method is still effective. \n2. The motivation for the considered scenario requires stronger justification. In real-world applications, a more common concern is that model owners aim to trace who is responsible for the malicious or unauthorized use of their models, or that data owners wish to verify whether their data have been improperly used to train a model. In contrast, if a regular user simply generates an image using the model, it is unclear why they would need to prove authorship of the generated content, or why others might contest such authorship.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OmpXjgRIZs", "reviewer": "Reviewer_8Bov", "summary": "The paper tackles the challenge of proving authorship over visual AI-generated content, especially for cases where the diffusion model is private and traditional watermarking approaches (which need model weights or modify outputs) are impractical or inefficient. The authors propose NoisePrints, a lightweight, distortion-free watermarking scheme that utilizes the random seed used to initialize the diffusion process as a watermark proof, exploiting the strong correlation between this seed’s noise and the generated content. The verification only requires the seed and output, with no changes to the generation process and no access to model internals. NoisePrints is validated on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.", "questions": "1. As mentioned in the limitation: The verification scheme relies on access to the public VAE used by the diffusion model. When the VAE is not public or is heavily modified, the approach may be less applicable. How the author plans to address such issues? \n2. Can the authors better articulate the complexities and nontrivial aspects of their method in terms of the task of this paper.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "**Originality:**\n\nNoisePrints introduces a technically novel approach by using the stochastic seed of diffusion models as a watermark, enabling efficient and model-agnostic authorship verification. The scheme also integrates cryptographic techniques, such as zero-knowledge proofs, to assure privacy and security in third-party verification scenarios.\n\n**Quality:**\n\nThe paper demonstrates strong methodological rigor, offering a comprehensive security analysis and empirical validation across diverse models and datasets. Experiments show the watermark’s high robustness to output manipulations and adversarial attacks, while significantly reducing computational overhead compared to inversion-based methods.\n\n**Clarity:**\n\nThe writing is clear and logical. Core ideas, threat models, and algorithms are well explained, with protocols articulated stepwise, making the contributions accessible to both technical and broader audiences.\n\n**Significance:**\n\nBy removing the need for model internals and ensuring distortion-free watermarking, NoisePrints directly addresses real-world needs for copyright and provenance management in private and proprietary diffusion models. Its privacy-preserving design and scalability make it highly significant for the trustworthy deployment of generative AI and digital content protection.", "weaknesses": "- In the introduction (from line 52), the discussion of the method does not clearly convey the technical challenges involved. As a result, readers may be left with the impression that the approach is straightforward to implement, which could undermine the perceived significance of the contribution. The authors should better articulate the complexities and nontrivial aspects of their method.\n- Tables 1 and 2 lack visual highlights or markers for the best-performing methods, making it difficult for readers to quickly identify key results. Clear visual cues, such as bolding or color highlights, are recommended to enhance table readability and emphasize the main findings.\n- Sections 3.3 and 3.4 are dense with technical details and formalism, posing accessibility challenges for readers without deep expertise in diffusion models or cryptography. These sections would benefit from additional intuitive diagrams and plain-language protocol summaries to broaden accessibility.\n- Figure 1 suffers from inconsistent font usage and the inclusion of citation notes within module labels, which detracts from the professionalism and clarity of the visual. The authors should standardize fonts and reconsider the figure layout for improved visual coherence.\n- Figures 2 and 3 are overly large and contain dense information, resulting in plot axes that are difficult to read. The authors should revise these figures to more logically group and present the data, possibly by dividing them into multiple panels and increasing the size and clarity of key elements.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ec48XoU6UD", "reviewer": "Reviewer_j9Rv", "summary": "This paper addresses the copyright verification problem for private models and proposes a novel method named NoisePrints. The core idea is to leverage the inherent correlation between the initial Gaussian noise seed used during generation and the final output image, treating this correlation as a natural and verifiable watermark. The authors also innovatively incorporate zero-knowledge proofs, enabling ownership verification in this scenario without exposing the random seed. Experimental results demonstrate that NoisePrints can effectively resist both common image processing operations and specific forgery attack, exhibiting excellent robustness.", "questions": "1. **Regarding Weakness 1**: NoisePrints already assigns a unique seed to each user as an identity identifier. This foundation could be directly extended to construct a simple multi-bit scheme, for instance, by allocating a subset of seeds to represent specific user IDs. However, the authors have not evaluated NoisePrints from this perspective. To comprehensively benchmark against state-of-the-art methods like Stable Signature[2] and Gaussian Shading[1], it is necessary to evaluate its performance in terms of traceability accuracy within a multi-bit framework.\n2. **Regarding Weakness 3**: The description of the Dispute Protocol's usage scenario should be reorganized to align with the experimental setup and resolve the logical contradiction when facing geometric attacks.\n3. **Regarding Weakness 4**:  To resolve the contradiction in the threat model, I recommend removing the requirement for a public VAE. Instead of relying on model providers to reuse a public VAE—which conflicts with the scenario of fully proprietary models—the model owner could entrust their private VAE to the fully trusted verifier. This approach would better align with the stated principle that \"the verifier is the only trusted party\" and that \"model weights remain private and are never shared,\" while still enabling the verification procedure.\n4. **Regarding Weakness 5**:  I recommend that the authors augment the threat model with specific strategies to mitigate the risk of seed exposure in the naive protocol version.\n5. **Regarding Weakness 6:** The paper attributes geometric robustness to the NoisePrints method itself. However, the described mechanism relies entirely on the Dispute Protocol's ability to apply an inverse transformation to \"correct\" the image before verification. Could you clarify how this approach demonstrates inherent robustness of the watermark signal, as opposed to being a general pre-processing strategy that could theoretically be applied to any watermarking scheme? Furthermore, does this mean that NoisePrints' geometric robustness is ultimately limited to attacks that are both invertible and whose inverse transformation is known and included in the public set 𝒢?\n6. **Regarding Weakness 7:** The paper demonstrates the functional correctness of the ZKP implementation. However, its security guarantees are primarily cryptographic. A critical remaining question is: how does the *watermark robustness* fare when the image undergoes attacks *before* the ZKP-based verification is performed? Specifically, if an attacked image `x'` (e.g., after JPEG compression, blurring, or a geometric transformation) is submitted for ZKP verification, will the circuit still correctly output `1` (indicating a valid watermark) when provided with the legitimate seed `s`? We recommend that the authors conduct a simple but essential robustness evaluation for the ZKP scenario to confirm that the strong robustness demonstrated in the standard setting is preserved when verification occurs within the ZKP circuit.\n7. **Regarding Weakness 8:** The authors should consider evaluating more practical forgery attacks, such as those proposed in [3].\n\n8.  The paper does not mention a specific method for mapping bits $PRNG(h(s))$ to Gaussian noise $\\epsilon(h(s))$. How is this step concretely implemented?\n9. It is unclear from the experimental description whether a single VAE was used for all verification tasks, or whether the native VAE corresponding to each generative model was employed. Could the authors clarify this point?\n\n[1] Yang, Zijin, et al. \"Gaussian shading: Provable performance-lossless image watermarking for diffusion models.\" *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*. 2024.\n\n[2] Fernandez, Pierre, et al. \"The stable signature: Rooting watermarks in latent diffusion models.\" *Proceedings of the IEEE/CVF International Conference on Computer Vision*. 2023.\n\n[3] Müller, Andreas, et al. \"Black-box forgery attacks on semantic watermarks for diffusion models.\" *Proceedings of the Computer Vision and Pattern Recognition Conference*. 2025.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper presents a method with an elegantly simple design. Its requirement of only a public VAE for verification makes it highly efficient, resulting in significantly faster performance than existing approaches.\n2. The approach eliminates the need for training and preserves output quality, offering a plug-and-play integration capability for diverse diffusion-based architectures.\n3. The incorporation of a zero-knowledge proof circuit is a notable strength. It enables secure third-party verification without exposing the secret seed, effectively mitigating a key risk in ownership attestation.", "weaknesses": "1. The proposed NoisePrints is a single-bit watermarking method, which is primarily designed for ownership verification. In contrast, many existing methods are multi-bit, offering the extended capability of tracing the specific user responsible for the generation.\n2. The proposed scheme faces the same practical deployment challenge as Gaussian Shading[1] (GS). To remain distortion-free, it relies on a randomly sampled seed for each generation, which necessitates securely logging and managing a vast database of `(x, s)` pairs. This requirement creates significant operational overhead and scalability concerns in real-world systems.\n3. A logical inconsistency is identified regarding the applicability of the Dispute Protocol. According to Section 3.3, the protocol is activated exclusively when \"two parties submit conflicting authorship claims that both pass the verification test.\" This precondition is inherently incompatible with the threat model of a geometric removal attack, as defined in Section 3.2. In such an attack, the adversary's success is measured by causing the legitimate claim `(x, s)`to fall below the verification threshold τ, thereby making the \"both pass\" condition unattainable. Consequently, the protocol, as currently formulated, offers no recourse for the rightful owner in this common adversarial scenario.\n4. A significant tension exists between the stated threat model and the technical prerequisites of the proposed method. The introduction emphasizes the challenge of watermarking for private models where \"model weights remain private and are never shared.\" However, the verification protocol requires the model provider to use a publicly available VAE encoder. This creates a dependency that contradicts the scenario of a completely self-contained, proprietary model, as a provider wishing to keep their entire pipeline private would be unable to use NoisePrints.\n5. A critical security flaw exists in the naive protocol (without ZKP). The requirement for the content producer to expose the seed `s` by submitting the pair `(x, s)` makes the scheme vulnerable to forgery. An adversary who steals this pair can exploit the public VAE to create a perturbed image `x'` that is perceptually similar to `x` but lies outside the verification boundary for the legitimate owner. The adversary can then present the pair `(x', s)` and successfully claim ownership, all without requiring access to the private U-Net. This breaks the security model under a stolen seed scenario.\n6. The claimed robustness against geometric attacks is conceptually problematic. The resilience is not an inherent property of the NoisePrint signal but is entirely dependent on the Dispute Protocol's ability to apply a corrective inverse transformation. This process merely reverses a specific, pre-defined manipulation (e.g., rotation, scaling) prior to verification. It does not demonstrate that the watermark itself can survive true geometric distortion, which typically causes irreversible, non-aligned spatial scrambling. The same logic could theoretically be applied to any basic image processing attack (e.g., contrast adjustment, blur) if an effective \"inverse operation\" could be found and applied. Therefore, the credit lies with the corrective pre-processing within the protocol, not with the fundamental robustness of the NoisePrints method.\n7. The evaluation of the Zero-Knowledge Proof (ZKP) implementation is relatively preliminary.\n8. The threat model for the \"Watermark Injection\" attack appears to lack practical motivation. The scenario in which an adversary creates a forged image that is *visually similar* to the original while also embedding an *identical* watermark seems contrived. In practice, an adversary seeking to claim ownership would more plausibly create a *different* image (e.g., a novel artistic creation) and falsely associate it with a forged seed, rather than meticulously replicating the original content with the same watermark. The authors should either provide a stronger justification for the considered injection attack scenario or redefine it to reflect a more realistic adversarial goal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SAYYSprNAn", "reviewer": "Reviewer_b44h", "summary": "This paper provides some insights on how the embedding of the generated image is related to the random seed, and thereby proposes a watermark verification method. The method only verifies the dependency on the embedding and the random seed and no weight information is needed.", "questions": "Please address my concerns in (W1) and (W3). I understand that it would be difficult to derive theories for (W2), but is it possible to provide an empirical distribution (histogram) on the test statistics under H0 and H1 respectively?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper provides an interesting angle to analyze the relationship between the random seed and the generated image. Theoretical result is also provided for H0 (though I understand there is difficulty in analyzing the underlying distribution under H1).", "weaknesses": "(W1) Practicality of the scenario: The paper assumes a setting where the model provider is different from the model user, and the user seeks to protect their IP. However, there are some concerns: (1) If the model provider is untrustworthy, why would the user choose to use that model in the first place? (2) If the model provider is trustworthy, what advantages does this approach offer over existing white-box methods, especially considering potential robustness concerns raised in (W3)?\n\n(W2) Theoretical justification: When $E(x)$ and $h(s)$ are independent, the derived distribution appears reasonable. However, the distribution is unclear when $E(x)$ and $h(s)$ are correlated, leaving a gap in the theoretical analysis.\n\n(W3) Robustness and empirical evaluation: Based on the theoretical results, it seems that the test’s power strongly depends on $E(x)$. This suggests vulnerability to attacks that substantially alter $E(x)$. In the examples in the paper, the embeddings remain relatively close to the originals. For more aggressive attacks, such as redrawing the image, the test’s power could degrade significantly. While the algorithm is lightweight, it would be useful for the authors to provide a comparison that examines the trade-off between computational cost and performance under stronger attacks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)