Watermark-based Attribution of AI-Generated Content
Authors: Zhengyuan Jiang
Moyang Guo
Yuepeng Hu
Yupu Wang
Neil Zhenqiang Gong
Venue: ICLR 2026 Poster (2026)
Keywords: Image Watermark
Watermark-based Attribution
AI-generated Content
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Several companies have deployed watermark-based detection to identify AI-generated content. However, attribution--the ability to trace back to the user of a generative AI (GenAI) service who created the given AI-generated content--remains largely unexplored despite its growing importance. In this work, we aim to bridge this gap by conducting the first systematic study on watermark-based, user-level attribution of AI-generated content. Our key idea is to assign a unique watermark to each user of the GenAI service and embed this watermark into the AI-generated content created by that user. Attribution is then performed by identifying the user whose watermark best matches the one extracted from the given content. This approach, however, faces a key challenge: How should watermarks be selected for users to maximize attribution performance? To address the challenge, we first theoretically derive lower bounds on detection and attribution performance through rigorous probabilistic analysis for any given set of user watermarks. Then, we select watermarks for users to maximize these lower bounds, thereby optimizing detection and attribution performance. Our theoretical and empirical results show that watermark-based attribution inherits both the accuracy and (non-)robustness properties of the underlying watermark. Specifically, attribution remains highly accurate when the watermarked AI-generated content is either not post-processed or subjected to common post-processing such as JPEG compression, as well as black-box adversarial post-processing with limited query budgets.


Reviews:
[{"review_id": "the6s3nOBq", "reviewer": "Reviewer_hwBd", "summary": "This paper looks at attribution of ai-generated image. The paper proposes to use a personalized watermark for each user when generating images with AI. After that, the paper theoretically derives lower bounds on watermark detection and user attribution performance, and select watermarks for users to maximize these lower bounds. Empirical analysis shows that the proposed method inherits both the accuracy and (non-)robustness properties of the underlying watermark.", "questions": "N/A", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper looks at watermark detection and specifically attribution to the users, which is under explored in the literature.\n- The paper provides theoretical analysis on the upper and lower bounds on the detection rate.\n- Empirical results seem to suggest that the proposed method preserves utility and robustness.", "weaknesses": "- The motivation of attribution of ai-generated images to user is unclear. I can understand why detection of ai-generated images is important and that is a main motivation of inserting watermark for ai generated content. But it's unclear to me why attribution to users is an important, practical concern. Some discussion on this would be important.\n- Section 7.1, comparison with non user specific watermark is missing. It would be interesting to study whether such robustness to post-processing is preserved / enhanced / weakened by using a user specific watermark compared to a general watermark.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PqH7M38ILV", "reviewer": "Reviewer_p6Ev", "summary": "The paper proposes a user-oriented watermark assignment approach such that the images a user generates are assigned to the image and is then attributed to the user when needed. The approach is a good one.", "questions": "Look at the cons.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 1, "presentation": 2, "contribution": 1, "strengths": "Pros: In practical scenarios, provenance of data and its attribution can be assigned to a user.", "weaknesses": "Cons: \n1. The paper does not discuss privacy at all. Such attribution discloses privacy and thus other sensitive information. The watermarks can lead to replay attacks - malicious users can attribute the watermark of one user to an image that they did not generate. \n2. The paper does not look into simple mechanisms - such as hashing schemes - why such hashes of enough size not be used as watermarks? There have been work in security community. So the watermark selection problem for scalability across users would not be a problem. That is a straightforward solution, unless the authors convince the readers why it is not a problem.\n3. If there is a watermark can be extracted, or should not be extracted but hidden - there is a body of work in steganography.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uP1xaGL1bW", "reviewer": "Reviewer_Yi1D", "summary": "The paper presents a watermark attribution method for AI-generated images. In addition to the detection of watermark, it is able to attribute which user a watermarked image is generated from. In terms of evaluation, both detection rate (of whether or not a watermark has been injected) and attribution rate (of whether or not the correct user has been identified). Theoretical development is also provided.", "questions": "Is the proposed method plug-and-play? In other words, does it have to be tied to certain image-generating processes, such as diffusion? If I understand correctly, the answer seems to be no. But please clarify.\n\nIt is not clear to me how the binary watermarks are injected to the encoded images. Would a non-binary watermark work as well?\n\nAny requirements on the number of images generated by each user? In other words, if we certainly know that multiple images are from the same user (but don't know who the user is), would the proposed method be able to incorporate such information and hence improve the TAR?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The paper presents a cool idea, and it is well written. The proposed idea seems to be easily implemented. Theoretical results are provided to support the numerical findings.", "weaknesses": "The definition of tau is not intuitive. How to select tau seems to be a tricky question -- an absolutely large tau may rule out the possibility of detecting the watermark, whereas a small tau may render multiple i's satisfying the TDR condition, making the selection of i as in the TAR stage sensitive to ties and run-ups. This becomes more challenging when the dimension of watermark is long (e.g., 64-bit, as mentioned by the authors). The results seem to show that when tau increases, both TDR and TAR decrease while FDR also decreases. This is not intuitive. It would be helpful if additional numerical experiments can be conducted to evaluate the robustness against the selection of tau in real data.)\n\nAs for post-processing, the authors consider limited non-adversarial settings. It would be helpful to also consider the robustness of the proposed procedure against flipping, rotation, and cropping.\n\nThe work claims to watermark and attribute AI-generated images. However, it is not clear to me where and how the proposed method takes advantage of the AI image-generating process. As demonstrated in the numerical experiments, the proposed method seems to work well even if the datasets are not AI generated.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)