GaussMarker: Robust Dual-Domain Watermark for Diffusion Models
Authors: Kecen Li
Zhicong Huang
Xinwen Hou
Cheng Hong
Venue: ICML 2025 poster (2025)
Keywords: Diffusion Models
Watermark
Primary area: social_aspects->security
TL;DR: We propose the first dual-domain watermark for diffusion models and achieve state-of-the-art watermark detection performance.

Abstract: As Diffusion Models (DM) generate increasingly realistic images, related issues such as copyright and misuse have become a growing concern. Watermarking is one of the promising solutions. Existing methods inject the watermark into the *single-domain* of initial Gaussian noise for generation, which suffers from unsatisfactory robustness. 
This paper presents the first *dual-domain* DM watermarking approach using a pipelined injector to consistently embed watermarks in both the spatial and frequency domains. To further boost robustness against certain image manipulations and advanced attacks, we introduce a model-independent learnable Gaussian Noise Restorer (GNR) to refine Gaussian noise extracted from manipulated images and enhance detection robustness by integrating the detection scores of both watermarks.
GaussMarker efficiently achieves state-of-the-art performance under eight image distortions and four advanced attacks across three versions of Stable Diffusion with better recall and lower false positive rates, as preferred in real applications.

GaussMarker: Robust Dual-Domain Watermark for Diffusion Models
Kecen Li"
Zhicong Huang 3
Xinwen Hou' Cheng Hong 3
Abstract
promising solution, and governments are starting to exert pressure on companies to adopt watermarks (Biden 2023
As Diffusion Models (DM) generate increasingly realistic images, related issues such as copyright and misuse have become a growing concern. Wa- termarking is one of the promising solutions. Existing methods inject the watermark into the single-domain of initial Gaussian noise for gen- cration, which suffers from unsatisfactory robust- ness. This paper presents the first dual-domane DM watermarking approach using pipelined in- jector consistently embed watermarks in both the spatial and firquency domains. To further boost robustness against certain image manipula- tions and advanced attacks, we introduce a model- independent learnable Gaussian Noise Restorer (GNR) to refine Gaussian noise extracted from manipulated images and enhance detection robust- ness by integrating the detection scores of both watermarks. GaussMarker efficiently achieves state-of-the-art performance under eight image distortions and four advanced attacks across three versions of Stable Diffusion with better recall and lower false positive rates, as preferred in real ap- plications.
California State Legislature 2024 European Union 2024
A watermarking method usually consists of two modules: watermark injector and watermark detector. The injector embeds a watermark into our target (e.g., a synthetic image), while the detector is capable of extracting the corresponding watermark from the watermarked target. To watermark a diffusion model, a naive approach is to apply classical image watermarking techniques (Cox al. 2007) to the contents generated by the diffusion model. These traditional water- marks are easy to remove without compromising content quality and lack adequate robustness for detection in real applications (Ren et al. 2024). Therefore, some researchers propose to inject the watermark into the parameters of diffu- sion model (Fernandez et al. 2023 Cui et al. 2023 Xiong
al. 2023 Zhao et al. 2023 Rezaei et al. 2024] Feng et al. 2024
With the parameters watermarked, the images gener- ated by the diffusion model also contain some information for the detector to extract the watermark. However, these approaches need to fine-tune the diffusion model, inevitably introducing additional computational overhead.
Recent research delves into designing tuning-free water-
marking approaches (Gunn et al. 2024 Yang et al. 2024 Ci
et al. 2024 Wen al. 2023 Wang al. 2024). Since the diffusion model generates images through denoising a Gaus- sian noise iteratively, they use a carefully designed injector to embed the watermark into the initial Gaussian noise. For detection, they leverage the Denoising Diffusion Implicit Model (DDIM) inversion (Song et al. 202T) to estimate the initial noise from the input image and detect whether the watermark exists in the estimated Gaussian noise. Although these auning-free approaches can resist some attack algo- rithms by leveraging the inherent generalization of diffusion models, they still suffer from detection performance degrad- ing under some easy image editing. For example, when the watermarked image is rotated by just 39, the watermark detection aceuracy of Gaussian Shading (Yang et al., 2024) (the SOTA tuning-free method) decreases from 100% to 64%, making this method extremely vulnerable in practical application scenarios.
1. Introduction
Diffusion models (Ho et al. 2020 Song et al. 2021 Rom- bach et al. 2022) have marked a significant advancement in image generation, empowering individuals from vari- ous backgrounds effortlessly create high-quality images. However, these highly realistic images can be misused in several ways, such as faking synthetic images as human- created ones, generating fake news, and copyright infringe- ment Humphreys et al. 2024).
To mitigate these concerns, watermarking has become a
'Work done during an internship at Ant Group. 'Istitutee of Automation, Chinese Academy of Sciences "School of Ar- tificial Intelligence, University of Chinese Academy of Sci- ences 'Ant Group. Correspondence to: Zhicong Huang <zhicong .rroonn.hce@eee antgroup.com>>
This paper proposes GaussMarker, a more robust tuning- free method to watermark diffusson models. Compared to existing methods which can only watermark the Gaus-
Proceedings of the 4nnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

GaussMarker: Robust Dual-Domain Watermarks for Diffusion Models
sian noise a single time (in the spatial domain or frequency domain), we design pipelined injector consistently em- bed watermarks across both the spatial and frequency do- mains, thereby implementing a dual-domain watermarking approach. The inspiration comes from the success of dual- domain watermark in traditional image watermarking (Shih & Wu 2003). We discover that while this strategy results in better performance compared to single-domain approaches, its robustness is still inadequate, particularly in the face of rotation, cropping, and several more advanced attacks. To address this limitation, we propose a learnable Gaus- sian Noise Restorer (GNR), which is capable of restoring Gaussian noise to its original state even after significant ma- nipulations of the watermarked image. The GNR model- independent and does not rely on the diffusion models being watermarked. Ultimately, we enhance detection robustness by fusing the detection scores of both watermarks.
encoder & compressing the high-resolution images into latent space 2 = Rexwxh, L.DM trains DM in the latent space. During inference, LDM first samples an initial noise map 2T E Rex from a standard Gaussian distribution N (0, I), where T is the time step of DM. After obtaining the clean latent vector 20 through the denoising process of DM, LDM uses the decoder 'D to decode the latent vector 2n into the clean image z0. In this paper, we focus on wa- termarking LDM due to its powerful generative capabilities and broad applications.
2.2. Watermark Diffusion Models
Existing watermarking methods can be categorized into two types: post-processing and in-processing schemes (An) et al. 2024). Post- fost-processing methods directly embed the watermark into the generated image, while in- mn-processing methods embed the watermark through modifying the gener- ation process or parameters of diffusion models. Compared to post-processing methods, which have been developed for decades, in-processing methods exhibit more promising capability for undetectable watermark (An et al. 2024 Wan et al. 2022). According to whether the model's ' parameters are fine-tuned, existing in-processing watermarks can be mainly divided into two types: tuning-based watermarks and tuning-free watermarks. Since GaussMarker belongs to tuning-free watermarks, we put the introduction of tuning- based watermarks into Appendix A
We summarize the contributions of this work as follows:
1. We design the first dual-domain watermarking, Gauss- Marker, for diffusion models. GaussMarker does not need to fine-tune the diffusion models, while exhibiting strong robustness.
2. We propose a learnable Gaussian Noise Restorer (GNR). GNR does not rely on some diffusion model for training, while significantly enhancing the robustness of watermarking under rotation and cropping attack.
Tuning-free Watermarks. Most existing tuning-free water- marks inject the watermark into the initial Gaussian noise or during the generation. For detection, they leverage the De- noising Diffusion Implicit Model (DDIM) inversion (Song ct al. 202T) to estimate 2T from the input image, and detect whether the watermark exists. Inspired by that a number of classical watermarking strategies rely on watermarking images in Fourier space (Cox et al. 2007), Tree-Ring (Wen) et al. 2023) proposes to inject the watermark into the initial Gaussian noise in the frequency domain. Later, RingID CC al. 2024) enhances Tree-Ring with a novel multi-channel heterogeneous watermarking approach for multi-key identi- fication. Benefiting from the invariances of Fourier space, these methods exhibit strong robustness under many image distortions. However, they restrict the generation random- ness of LDM and compromise model performance to in- ject watermarks. To mitigate this, Gaussian Shading (Yang) et al.] 2024) proposes a performance-loss/e lossless watermark. Compared to Tree-Ring, Gaussian Shading injects water- marks into the spatial domain. Specifically, they select a fixed quadrant of latent space as the watermarking key and only generate images from Gaussian noise in that quadrant. Based on Gaussian Shading, PRC (Gunn et al. 2024) in- troduces a pseudorandom code (Christ & Gunn 2024) to enhance the variability of generated images. Recently, La- Tencer (Wang et al. 2024) find that images generated
3. Thorough experiments show that, on three stable diffu- sion models and eight image distortions, the average true positive rate and bit accuracy of GaussMarker sur- passes existing methods, validating the superiority of GaussMarker in watermarking diffusion models.
2. Related Works
2.1. Diffusion Models
Diffusion Models (DM) (Ho et al.] 2020, Song Ermon 2019) are a class of score-based generative models that learn to reverse a process that gradually degrades the training data structure. For generation, diffusion models sample new images by iteratively denoising an initial noise map into a clean image. DM is the currently strongest model for image generation (Dhariwal& & Nichol, 2021), but usually needs much more time for generation compared to the classical generative model GAN, especially for high-resolution image generation.
In order to accelerate the practical usage, Latent Diffusion Models (LDM) (Rombach et al., (022) is proposed. LDM first trains a Variational AutoEncoder (VAE) (Kingma & Welling 2014), consisting of an encoder E and a decoder D, on the high-resolution images E CxHH With the
2

---

GaussMarker: Robust Dual-Domain Watermarks for Diffusion Models
by LDM are naturally watermarked by the decoder. They trace the generated images by checking if the images can be well-reconstruuted with an inverted latent vector. How- ever, Latent Tracer is not robust to many image distortions, limiting its practical applications.
3.1.2. FREQUENCY-DOMAN INJECTION
GaussMarker implements frequency-domain injection through further modifying the spatial- watermared Gaus- sian noise map 24. In order to ensure the detectability of apatial-domain watermark, frequency-domaii injection is expected to preserve the signal of Gaussian noise map. Intu- itively, injecting a watermark of more bits usually requires a larger scale of editing, Therefore, GaussMarker injects a zero-bit bit watermark into the frequency domain of 27.
3. Method
Compared to tuning-based watermarks, existing tuning-free watermarks exhibit certain gap in the robustness of water- mark detection, limiting their practical applications. This paper proposes GaussMarker, a robust dual-domain water- mark with two significant improvements. (1) GaussMarker injects the watermark into the spatial domain and frequency domain of the Gaussian noise simultaneously. During de- tection, the detection scores from two domains are fused to achieve more robust detection. (2) GaussMarker introduces Gaussian Noise Restorer (GNR) to enhance its robustness especially under the rotation and cropping attacks. Fig. gives an overview of our methodology.
We first obtain the frequency feature of zi by performing Fourier transformation 27-
29 F2
(3)
where F denotes the Fourier transform, and a7- Rex is the Fourier feature of 27. We pre-define a mask M {0, 1Jexwxh, representing the location of 27 to be edited. The dual-domain watermarked Gaussian noise can be for- malized as
(4) where F-1 denotes inverse Fourier transform, and wf E Rex is a Fourier feature map which contains zero- bit watermark. To enhance the robustness of this zero-bit watermark, we construct a ring-like Fourier feature map as (Wen et al.) (023) and adopt a circle mask for M to preserve the ring shape of w. Please refer to Appendix B.2 for more details. In general, a ring with a small radius introduces minimal edits to the space features 2 according to Parseval's s theorem, essentially preserving the signals s. We also explore the effects of mask radius in Appendix D.5
( (1 M) + wl M), =
3.1. Watermark Injection
Given a randomly sampled Gaussian noise map žг E Rexwxh and a (-bit watermark w E 1), (1 < x w x h),
GaussMarker injects w into 2T in the spatial and frequency space sequentially.
3.1.1. SPATIAL-DOMAIN INJECTION
GaussMarker performs spatial-domain injection through using w to change the signal of 27. To achieve this, we first rescale w into a signal map s E {0, 10]1 which has the same dimension with 27. The rescale rule is expected to have two characteristics: (I) invertible so that we can recover w from & during detection, and (2) the rescale result is sufficiently chaotic to ensure the independence of each dimension in 2r. In GaussMarker, the rescaling has two processes. First, wi is up-sampled into the target dimension with the nearest sampling. Second, we use deterministic code (Bernstein et al., 2008) to perform shuffling. Formally, s is obtained as
After obtaining the two-domain watermarked Gaussian noise map 25. the subsequent generation process is the same as the regular one of LDM. Specifically, we can use the UNet 2/ to iteratively denoise z,. = (with a prompt e) into the clean 2f with a sampler (Lu et al. 2022 Song et al. 2021 The finial watermarked image is x D)
3.2. Watermark Detection
s = Shuffle (Up-Sample (w, c x w x k),
(L)
Given image GaussMarker can detect whether our watermark w exists in this image by outputting a detection score r. The higher the r, the higher the likelihood that w exists in æ.
where a key of the code used for shuffling. With k; we can decode the code input from s. Then, the spatial- watermarked Gaussian noise can be formalized as
Similar to existing tuning free methods, GaussMarker uses DDIM inversion (Song et al.) 2021 estimate a possible original Gaussian noise map ěा of the input image Specif- ically, GaussMarker uses the LDM encoder & to obtain the clean latent 20 = E (x). Then, the original Gaussian noise map ěτ can be estimated with 2p, 2, and an empty prompt through DDIM inversion. The following sections will in- troduce how Gause extracts the detection score r.
abs (2T) (2s - 1);
where abs (2r) denotes taking the absolute value of 27. In essence, randomized is used to instruct the signs of Gaus- sian noise: 27, analogous to the strategy used by PRC-based watermark (Gunn et al., 2024). Since the whole watermark w is injected into 27, the watermark capacity in the spatial domain is bits.
3

---

Gause: Robust Dual-Domain Watermarks for Diffusion Models
Watermark Injection
Signal Change
Fourier Transform
Inv. Fourier Transform
Generation
z7
2f
"A photo an astronaut riding horse on mars"
Up-Sample
[10101...] [01000...]
0-bit Ring
[00101...]
Unknown
Attack
Shuffle
wf
Detection Score
Fourier Transform
Inversion
Fuser
Spatial Score
Freq. Score
åy
(no prompt)
Shufile
[10101...] [01000...]
[00100...]
[00101...]
Down-Samplc
[1
Froq. Detection
Spatial Detection
GNR
Scores Fusion
Watermark Detection
Figure 1. Overview of GaussMarker. The I-bits watermark is up-sampled and shuffled into signal map for I-bits -pomial-domann watermark. is used to sample Fourier map wf for zero-bi bit frequency-domain watermark. Both and wf are fixed during the injection and detection. (1) Watermark Injection. We inject multi-bit watermark and zero-bit watermark into the spatial domain and frequency domain of Gaussian noise map žy respectively. (2) Watermark Detection. We extract the frequency and spatial detection scores simultaneously with GNR enhancing the robustness, and fuse two scores make more robust detection.
and ry from the spatial and frequency domains of žr re-
frequency-domate injection. We first obtain its frequency feature through inverse Fourier transform as
spectively and enhances robustness through GNR and score fusion.
Σ = F FBr).
3.2.1. SINGLE-DOMAIE DETECTION SCORE
With pre-defined mask M, the detection score is formalized as
Spatial-Domain. GaussMarker extracts the watermark w from दτ through the reverse process of spatial-domain in- jection. Specifically, we first obtain its signal map E (0. 1) exxwx by associating with a negative noise and with a positive noise. Then, can obtained through a reverse process of Eq
ry - 10(1((2 wl) M
(8)
GaussMarker fuses the two detection scores r, and ry to make more robust detection. According to ensemble the- ory (Wood al. 2023), the effectiveness of score fusing relies each score having relatively good detection per- formance. However, our findings indicate that both scores perform inadequately when subjected to rotation and crop- ping attacks, particularly when aiming to maintain a low expected false positive rate. This suggests that GaussMarker is unable derive meaningful detection score, even when employing advanced fusion strategy. To solve this, introduce a learnable Gaussian Noise Restorer (GNR) to enhance the robustness of GaussMarker.
Dawple (Shuffle (5, ()),
(5)
where Down-Sample() uses average pooling. Since Up-Sample()
[q. uses nearest sampling, Down-Sampled in (5 acts like voting strategy. For example, if we inject a 1-bit {0]. we up-sample w into s = (0,0, 0, 0} using nearest sampling. During detec- tion, if the signal map is estimated as ă = {0, 1, we down-sample into the estimated watermark / = {0.25). The detection score of spatial-domain can be formalized as
3.2.2. GAUSSIAN NOISE RESTORER (GNR)
T -| - 3
Our GNR aims to improve the invariance of estimating 2T when the watermarked image undergoes rotation and cropping attacks. Formally, given the function space of
Frequency-Done -Domenn. Similarly, GaussMarker extracts the detection score ry from غx through the reverse process of

---

GauseMarker: Robust Dual-Domain Watermarks for Diffusion Models
2023). Therefore, the objective of GNR on the signal map is formalized as
0.5
Minimize GNREG
GNN (T
(T(ST") 2. (ST
$.5
0.0
where si is the signal map of the watermarked Gaussian noise map. We make two further improvements to this ob- jective. First, since the target si belongs to {0, (0,1)exxr fxxxxx, we replace Mean Square Error loss with Binary Cross En- tropy loss. Second, GNR learned from this objective will have high false positive rate. This is because shorteut for this objective is always outputting sy even when the watermark does not exist. Therefore, we introduce nega- tive sample learning to the objective. The final objective is formalized as
2
12
80 72 94
fotation Argle (')
Croppinng Ratlo
(a) Rotation attack.
(b) Cropping attack.
The Mean Square Error between the signal maps esti- mated from the clean image and image which edited with rotation (s+) or cropping (s2). Sor and are obtained through performing an inverse edition on 8y and 8e respectively. For example, if s, is estimated from image that has been rotated by 12", we rotate 8, by - 12 to obtain Sor.
Figure 2.
GNR G, the objective of GNR can be formalized as
(1 - 547) (1 GNR (T (st))))
|GNR [Inversion (T (((x))) 2
Minimize GNRE9
oy 1og (GNR (T (0g ))
Maximize GNRES
(11)
(1 - T (sr)) log (1 GNR (T (sr))) +
where Inversion() is the process of estimating the Gaussian noise map from an image, = is generated from the wa- termarked Gaussian noise map 2T >*.J and T is some image transformation, e.g. rotating 75 However, directly opti- mizing (9) is infeasible for two reasons. First, it needs LDM to generate training data, which time-consuming. For example, if the number of steps during both the genera- tion and inversion is 50, to generate each training data for (9.. we need the LDM to forward 100 times. Second, GNR from Eq. is related to the LDM used in training. If we have multiple LDMs to watermark, we need to train multiple GNRs, which brings more time cost. To mitigate this, we can approximate the objective as
T (#T) (GNR (T (+r)))
where 8T denotes the signal map of Gaussian noise without a watermark. [I. means that, for the signal map s with a watermark, GNR will output s even under some transformation T. While for the signal map ST without a watermark, GNR will just output the input. With GNR, estimating the watermark @ can be formalized as
W Down-SSmple (Shuffle (GNR (8), k)) (12)
A limitation of Eq. is that GNR only learns the invari- ance on the signal map, and can only benefit r.. However, since GaussMarker will fuse two scores to make detection, GNR also benefits the final detection score of GaussMarker.
Minimize GNRE@
GNR
(10)
In our experiments, GNR is implemented with UNet and the last layer of GNR is the Sigmoid activation function, which ensures the output belongs to (0, 1). During the inference, we 0.5 as the threshold to discretize the output of GNR to ensure the restored signal map belongs to (0. }}.
Compared to (q. I0) replaces Inversion (T(x*.))
with T==):/) ), and its optimization does not need any LDM.
We just need to randomly generate a watermarked Gaus-
sian noise map 2 and edit it with T. The assumption on which Eq. [0) works is that Inversion(Tin (x)* ss T This means that if an image is rotated by 75,, its estimated Gaussian noise map will also be rotated by approximately 75% This relationship hardly exists for many convolution layers in the encoder and UNet. However, a similar relation- ship exists in their signal maps. As shown in Fig. [ when the input image is rotated or cropped, the MSE between the original noise signal and new noise signal s, se changes dramatically. However, when we perform an inverse trans- formation on the new signal map, c.g. rotating by the same angle but in the opposite direction, the MSE decreases. This invariant property between the image and Gaussian noise map in the DDIM inversion is also verified by (Wen et al.
3.2.3. SCORE FUSION
Given the detection score r, and ry from spatial domain and frequency domain respectively, GaussMarker fuses two scores into one score, which can be used to make more robust detection. This objective can be formalized
Maximize (1 Fusere.
((1 - v) log (1 - Fuser (rs,ry) ()) +
(13)
y log (Fuser (r,,
where Fu is the function space of Fuser(), and E {0. indicates whether the input image has our watermark. In GaussMarker, we implement Fuser() as a two-layer
5

---

MauseM Robust Dual-Domain Watermarks for Diffusion Models
Table I. Comparison results of TPR @
1&FPR//////
Bit Accuracy under various image distortions.
Methods
DM
Clean
Rotate
JPRG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
Average
DweDetSed
0.000/ /0.99
0,000/ 0.915
0.000/0.88
0.000/
0.000/0.973
0.028 0.122
0.614/0.759
0.000/0.766
0,071 00.707
Stuble Signature
1,000/ / /0.992
0,957/ 0.859
0.926 00.802
1,00/0 70.98
0.963/
00.752
0.918/6812
0,948/0880
0.921 /0.61
0.956/0.87 0.882
Tree- Ring
1.000//
0.518/-
0,998/-
0.048/-
0.991/-
1,000/-
0
0.913/-
0.927 /-
0.823
RinglD
1,000/
1,000/ /-
1.000/
0.078 /-
1,000/-
1,000/-
1,000 /-
0.944/-
0.928 /-
0 /-
Gaussian Shading
1.000/ / 1.000
0.018/0.511
0,999/0,986
0.081/ /0,510
1.000/ 0.964
1.0000030 0.999
0..95 0.923
0.996/ 00944
0,998 0999/00990
0.788 / 00.874
PRC
1.000/ /.000
1..10/0.500
0.926 / 0.962
0.020/0.300 /0.501
0.957
0,993 70.996
0.392/0.699
0.836/ /0.917
0.606/0.88 00.800
0.638 00881
Latcn/Tracer
0,990 /-
0.017/-
0.010/-
0.013/-
0.058
0.012/-
0.010/-
0.012/-
0.059/ /-
0.135
Garsea
1.000/ / 1.000
0.997/ 0,998
0.996 / 0.997
1,000/ 1,000
0.966
1,000 00000/1.00
0.999/ 0.991
0.989/ 00.96
0.993 /09989
0.997 / 0.990
Dw:DetSed
0.000/ / 0.990
0.000/0.00
0.902
0.000/ 0.610
0.000/0.811
0.000 0.000/
0.000/0.977
0.035 00.41
0.574 0.724
0.000 0.741
0.068 /0.797
Stable Signature
1.000/ / /0.911
0,940/ 0.860
0.907/0 00.809
1.00/0 /09978
0.9914
0.949 00755
0.815
0.915 0.8667
0.938 0228/00 /0867
0.950/0.870
Tree- Ring
1.000/-
0.552/-
1.000/-
0.051
0.997 J-
1.000 7-
0.981 /-
0.897 /-
0.948 /-
0.822/
RingID
1.000/
1,000/ /-
1,000/ /-00/--0
0.116/-
1,000/ 7-
1,000 1-
1,000/
0.953/-
0.995
0.896
Gaussian Shading
SD
1.000/ / 110000
0.001 /05514
0.998/030 0.988
0.171 /0,543
1.000/ 0.996
1.000 0.999
0.999 0.933
0.998 0.994
0,999/ 0.976
0.796 / 0.887
PRC
1,000/ /1.000
0.016/10 0.502
0.826/000 /09112
0.009 /0.5/00500
0.802/0.9000 70,900
0,980/ 0.989
0.257 0.664
0.363 0.666
0.720 00855
0.552/ 0.773
LatentTreeer
0.994/ /-
0.014/-
0.011/- /-
0.00F /-
0.022// /-
0.016
0.119/- /-
0.029 /-
0.008 /-
0.124/
GauseMarker
1.000/ 11000
0.997/ 0.999
0.998 / 0.998
1.00/1.000
1,000/ 1.000/0.9000 0.966
1.000/10000
0.996 0.992
0,993 0.970
0.998 0.9993
0.998 / 0.991
DwiDetSed
0,000/ / /0.999
0,000/ 0.915
0.000
0.048/0.832
0.090
0.000/0.977
0.041 (04L/0M 004118
0,738/ 0.745
/ 0,743
0.092 / 0.8804
Stable Signature
0.909/ 0.999
0,957
0.952/00 805
0.98/00990 /0.984
0.977 70.925
/0.749
0.912/0.829
0,940
0.931 /D879
0,950 /0.883
Troc-Ring
1,000/ /-
0,565 /-
0,999/ /-
0.031 /-
L.00/--
1,000 /-
0.981 1-
0.930/-
0,942 /-
0 /-
V
RinglD
0.950/-
0,950/-
0.950/-
0.116/-
D.548/
0.500/-
0.568/
0.634/-
0.945
0.779
Goussian Shuding
1,000/ / 1.000
0 0.516
0,999 / /0,989
0.096 0096/0.5442
1,00/00 0,971
1.000/ 0.999
1,000 / 0.923
0,998 / 0.944
0,998 0.9979
0.789 / 00887
PMC
0.509/ /D.999
0.004/0.5000
0.851 /0.915
0.012/0.500
0.86570.95 70,932
(1.245 0.6621
0.374/ 0.668
0.735 /08667
0.559 /0.778
Taten
0.000/ /-
0.000/
0.000/
0.000/ /-
0.000/-
0.000 /-
0.000/- /-
0.000/- /-
0,000/ /-
0.000 /-
GaussMarker
1.000/ 1.000
0,998/ 0.999
0.998/0.998
10,90
1.000
0.991
0.988 0.965
0.996 0.994
0.998 /0.911
watermarked images are generated by SD V2.1. All these baselines are implemented with their source code.
Table Comparison results of CLIP Score and FID across three
Stable Diffussio V1.4 / V2.0/ V2.1.
Methods
CLIP Score
Ave.
FID
Ave.
GaussMarker. For DDIM inversion, we use a guidance scale of 0, 50 inversion steps and, an empty prompt. For spatial watermark, we use a random 256-bit watermark and take a secure stream cipher, ChaCha20 (Bernstein et al. 2008). as the Shuffle. We implement GNR as a 30M UNet and train it with learning rate of 0.0001, batch size of
Watermark
0.3488 0. 353500 0,3633
0.3567
25.05
25:22
24.89
DwIDetSvd
0,3424/0.351/1 0.3580
0,3507
24.47/23.74
24.21
24.14
Stable Signature
0,3466/ 0. 003545/1 (0,3611
0.3541
24.23/24.55
/
24.60
Tree-Ring
0,3168 / 0,3586 00.644
0,3566
24.86/24.94/
25.59
25.13
RingID
0.3282 / 0.3534 0,3603
0.3473
27.27/25.04 0..5044/6..11 26.17
26.16
Gaussian Staading
0,3467 0,3591 0033646
0.3568
21.64
23/67 / 24.77
24.36
PRC
0.3466 0.3576 0,3482
0.3508
24.19/
/4.80
24.43
LaientTraeer
0,3488 0,3580 0.3633
0,3567
25.05/
/4.40/ 25.22
24.89
GausMMrrer
0.3427/0.3578/ 003333
0.3545
2..00/24..4//
24.85
32, and training steps of 50,000. The image transformation
T includes the random rotation between- -80 and 180 de- grees, the random cropping between 70% and 100% and the random sign flipping (p = 0.35). We train the Fuser with a learning rate of 0.001, batch size of 200, and training steps of 1,000. More implementation details can be found in Appendix B
MLP and generate 100 watermarked images and 100 un- watermarked images for training. During inference, the final detection score of GaussMarker is r = Fuser(rs,, ry)))
4. Experiments
Diffusion Models. We focus on text-to-image latent diffu- sion model. Following previous works (Gunn et al.. 2024 Yang et al.) 2024), we evaluate our method and other base- lines on Stable Diffusion (SD) V2.1, SD V2.0, and SD V1.4. All these models generate 512x512 images with 4x64x60 64 latent space. For generation, we use the prompts from Ballee-Difusion-Pronn and 50 sampling steps"
4.1. Experimental Setup
Baselines. We mainly compare our GaussMarker with tuning-free methods, including Tree-Ring (Wen et al. 2023). RinglD (Ci et al.) 2024). Gaussian Shading (Yang et al.
with a guidance scale of 7.5
2024). PRC (Gunn et al., 2024). and Laten'Tracer (Wang et al. 2024). Additionally, we also select a uuning-based method, Stable Signature (Fernandez et al. (003) and a clas- sic image watermarking method, DwiDetSvv (Cox et al.] 2007). which is officially used by Stable diffusion. Each baseline generates 1,000 watermarked images and 1,000 un- un-watermarked images for evaluation. Since LatentTracen detects synthetic images without artificial watermark, the un un-watermarked images are generated by a LDM different from the LDM to be watermarked. For example, if the watermarked images are generated by SD V1.4, the un-
Datasets and Metrics. We use two metrics to evaluate the detection performance. We calculate the true positive rate (TPR) corresponding to the fixed false positive rate (FPR) 0.01, named TPR @ I 1%FPR We also calculate the bit ac- curacy for those multi-bit watermarking methods, For the visual metrics, we compute the FID HHeusll et al.
2017
httpp:///agginngsee.cc//assssste Suttavootta//Saalll--11ftoooooo.
6

---

GaussMarker: Robust Dual-Domain Watermarks for Diffusion Models
and CLIP-Score (Radford al. 2021). The FID is cal- culated using 5000 prompt and image pairs sampled from MS-COCO (Ln et al. 2014).
Table 3. Comparison results of @ /&FR// Bit Accuracy under
four advanced attacks.
Mothods
DM
VAE-1
VAE-2
Diffusion
UnMarker
Stable Signature
0.312/0.687
0.22200682
0.006/0.535
1.00/0.955
4.2. Comparison Results
Trox-Ring Ring
V2.
0.955 /-
0.981/-
0.125/-
0.011/-
RinglD
1.000/-
1.000/-
0,1947-
0.044/-
Gaussian Shuding
0.994/0.90
1.000/
0.066/0.530
0.081 70,544
Robustness. We compare GaussMarker with seven base- lines under eight image distortions across SD v2.1, SD v2.0 and SD v v1.4. The examples of distortions are present in Fig. 4 As shown in Tab. [ GaussMarker exhibits strong robustness on both TPRI% and bit accuracy. Specifi- cally, GaussMarker surpasses the best-perforning baseline, Stable Signature, by 4.6% and 11.5% in terms of the av- erage 1FR and bit accuracy respectively. These improvements are achieved despite Stable Signature being extensively trained. Among all the tuming- free baselines, RingID obtains the best TPR1%FPR on SD 12.1, but its performance is not consistent on other SDs and is much worse than ours. Surprisingly, on SD V1.4, LatentTracer can not obtain useful TPRI %FPR even when the water- marked image is not edited. We consider the reason is that since LatentTracer uses the reconstruction loss to detect whether an LDM generates the given image, if the image is generated by a less strong LDM (SD V1.4), it can still obtain a small reconstruction loss on a stronger LDM (SD 12.1). Therefore, LatentTracer easily thinks that this image is also generated by this powerful LDM, which causes a high FPR. Among all the methods evaluated, GaussMarker is the sole approach that consistently achieves average TPR1 1 FPPR and bit accuracy exceeding 0.99, significantly outperforming the other methods.
GaussMarer
1.,00/
1,000/ 1,000
0.667 /0.865
1,000/09900
Stable Signature
0.510/0.697
0.011 0.527/0.697
1.000/
True- Ring
0.981/- /-
0.992/-
0.136/ /-
0.021 /-
RingID
1.000/-
1.000/-
0.247 /-
0.025 /-
Gaussian Shading
0.991 /0,963
0.991/0,965
0.075 /0.534
0,151 /0.515
GauseMarker
1,800/ 0.999
1.000/0,998
0,853 70.872
1,000/0990
Stable Signature
0.295 / 7..689
0,365 706678
0,00000.55
/0.97
Rine-Ring
0,933
0.990/-
0.130/-
0.016/-
RingID
1,000/ /-
0.924 /-
0.131
0.022 /-
Gaussian Shading
1.000 0.9662
0.052/0.526
0.210/0.543
GaussMarker
1,000/ / 1.000
1.000/ /.999
0,744/00 0.845
1,000/ 0 1.000
Table 4. Ablation study different modules of GaussMarker acToss three SD V1.4/ /2.0/V22
Spatial Frequency
GNR
TPRISFPR
Bit Ace.
0,786 / 0,794 / 0.799
0,871 /0.87/ 0.868
0.777 0,794/ / 00770
0.943 0,956 0.946
0,871 / 0.87// 0.868
0.996 0,9884 0.875
0,991 0.991 0,990
0.998 0,998 0.997
0.991 0.991 0.990
Regeneration Attack. Following a recent benchmark (An) et al. 2024), we utilize a diffusion model (Dhariwal & Nichol 2021) pre-trained on ImageNet to perform regen- eration attack. Specifically, the watermarked image will undergo multiple cycles of noising and be denoised through this pre-trained diffusion model for regeneration.
Visually-Aware Attack. Recently, Kassis et al. proposed the first practical universal attack, UnMarker (Kassis & Hengartner] 2024). They introduce a visually-aware fil- ter to attack semantic watermarks, such as Tree- Ring and Gaussian Shading. Semantic watermarks only preserve the semantics of images, without regard for changes at the pixel level. GaussMarker also belongs to semantic watermarks.
Fidelity. Tab. 2 presents the CLIP score and FID compari- son results. For both two metrics, GaussMarker outperforms Stable Signature, the best- fest-performing baseline in robustness comparison. Although Gaussian Shading obtains the best CLIP score, GaussMarker is only 0.6% behind while obtain- ing 11.7% higher average bit accuracy and 20.7% higher TPR1 1 6FPR, which means that GaussMarker achieves a bet- ter trade-off between the model utility and the robustness of detection. For FID, the post-procet post-processing method DwiDetSvd performs the best, but it can not obtain useful detection accuracy as shown in Tab.
As shown in Tab. GaussMarker still exhibits the best ro- bustness under such four advanced attacks. Although Stable Signature outperforms all tuning-free baselines under vari- ous image distortions (Tab. [ it loses its superiority under advanced compression attacks. All tuning- free methods successfully resist this compression attack, but fail to work under the regeneration attack and UnMarker. Among all these advanced attacks, the regeneration attack using diffu- sion models degrades the performance of all methods a lot, including Gauss Marker, which is consistent with the results other baselines a lot.
4.3. Advanced Attacks
This section evaluates the robustness of Marker under more advanced attacks. According to the comparison results
in (An et al., 2024). However, GaussMarker still surpasses
in Sec. 4.2 select the top-4 methods as the baselines in terms of the average TPRI%FPR. We consider three types of attacks as follows.
4.4. Ablation Studies
Compression Attack. Following previous works Yangg ct al. 2024), we utilize two pre-trained VAE compressors, termed as VAE-1 (Cheng et al. 2020) and VAE-2 (Ballé
Dual-Doman and GNR. Tab. and 5 present the detec- tion and fidelity performance respectively of five different versions of GaussMarker: (I) only injecting spatial-domani watermark, (2) only injecting frequency-done domain watermark,
et al. 2018 respectively, for image compression.
7

---

GauseMarker: Robust Dual-Domaie Watermarks for Diffusion Models
Table 5. Fidelity results on different modules of Garker across three SD 4 414/ V2.0 V 2.1.
1.0
3,00
ECcME of Sieee Roani
0.9
60.99
Spatial
Frequency
CLIP Score f
Ave.
FID
Ave.
0,348K 7 3580 0.3633
0.3567
25.05 /2440/
25.222
JP55
CAA
pr5n
0.3467 1 3591 / 0.3666
053568
24.64/23.77
24.77
24.36
0,3470 0595 0.3639
0.3568
24.64/4473/ 24.88
24.78
0.7
10.77
0.3427 70.3//////006006 0.3631
0.3545
14.10/344///.11
24.85
0.96
Table 6, Rffects of transformation T on the bit accuracy of Gauss-
10t
122
1.2
104
Number Uses
Marker against Rotate/ C&S attacks using SD V2.1.
(a) Watermark Capacity.
(b) Number of Users.
Rotation Angle
Crop Ratio
w/o
(-43", 43")
(-90".90') ,9'")
(-180', 1180))
Figure 3. (a) Bit accuracy of GaussMarker when injecting water- mark of different bits. (2) Identification accuracy of GaussMarker when allocating watermarks to different numbers users.
w/o
00.52/
0.513/0.961
1.000
0.999/ / 70.988
185%, 100%)
0.512/0.996
/
1.000/0.990 00.999
0.998 / 10.999
(70%. 100%)
0.512/ 1,000
0.514/ 1.000
0.998/ 0006/11.00 1,000
0,998 / /1000
(55%, 100%)
0,512/ 1.000
0,514/ 1.004/1000
0.998/ 1,000
0,998/ / 1,000
(3) injecting dual-domain watermark without GNR, (4) only injecting spatial-domain watermark and use GNR for detec- tion, and (5) GaussMarker.
of GaussMarker when the watermark has different numbers of bits. Since GaussMarker needs the number of bits to be smaller than the latent size e x w x h, it can inject a watermark of up 4 64 x 64 = 22 bits. The results show that, the bit accuracy remains nearly 100% when the number of watermark bits is less than 2 under all image distortions. As the number of bits increases, the bit accuracy starts to decline especially for the Random Drop. This is because each bit in the watermark w will be repeated exarxh times to perform the nearest up-sampling. During detection, we use average down-sampling to let exwxh estimated signal values vote for bit prediction. When exweh is small (1 is close to ex w x h), the benefit of voting naturally diminishes.
For detection, the results show that fusing the detection scores from dual-domain watermarks significantly improves the detection performance. Although GNR can effectively improve the bit accuracy, without score fusion, it could re- store some signal maps that do not contain our watermark, increasing the FPR. With both score fusion and GNR, Gauss- Marker obtains the best TPRI %FPR and bit accuracy. Tab. presents Tab. under various image distortions. We find that spatial-domain watermarks exhibit better robustness due to injecting a watermark of more bits, except for some affine transformations. Fusing integrates the respective ad- vantages of both watermarks, and GNR further enhances the robustness, especially under rotation and cropping.
Number of Users. When we have multiple users using one LDM, the multi-bit watermark is capable of allocat- ing a unique watermark for each user. Given an image, we extract the watermark to identify which user it belongs to. In GaussMarker, we first determine whether the image contains a watermark. If does, the user with the high- est detection score is considered the one who generated the image. In such case, each LDM only has one unique wader-wattrmarkk w E {0, 1)' (or signal map) with its cor- responding G Each user will be assigned a unique key h E {0, and a unique ustr-watermark w. E {0, 13' with w. = XOR(2z (w, k). We use the estimated w to estimate the uste-watermark w. = XOR( k) for calculating the bit accuracy.
For fidelity, both spatial and frequency watermarks help preserve the original CLIP Score. For FID, the spatial wa- termark performs better than the frequency one. Combining both methods often requires more editing, leading to slightly worse CLIP Scores and FID for the dual- watermark compared to single-domain approaches. Improving the vi- sual quality of watermarked images using GaussMarker could be a direction for future work.
Transformation of GNR. Tab. 6 presents the bit accuracy of GauseMarker under rotation and cropping attacks when training GNR using different scales of rotation and cropping as the transformation T. Note that these two attacks use rotating 75 and cropping 75% respectively. When T does not include rotating 75,, the bit accuracy under rotation attack is only 51%. When 75th is included, the bit accuracy significantly increases. Surprisingly, even when does also obtain
Fig. 3(b) presents the identification accuracy of Gauss- Marker under different numbers of users. Following pre- vious works (Yang et al., 2024 Rezaei et al., 2024). we adopt a more effective approach to calculate the identifi- cation accuracy, which is detailed in Appendix C Even when the number of users is 10", GaussMarker still exhibits almost perfect identification in five cases. Although the identification accuracy for Gaussian Noise is only 97.6%, if user generates two images, the probability of successfully
not include cropping 75%, Gauss high bit accuracy, which means that the invariance of crop- ping can be learned more easily even just through rotation. However, if GNR is trained without any T, the bit accuracy under both attacks is very low.
Therefore, we only need train one GNR even when we have multiple users.
Watermark Capacity. Fig. M(a) presents the bit accuracy
8

---

Gaus.Marker: Robust Dual-Domain Watermarks for Diffusion Models
benchmarking the robustness of im- age watermarks. In /CML., 2024.
Huang, F. WAVES:
Table The time cost of three modules of Gauss during training and detection phase under SD V 2.1.
Phase
Inversion
GNR
Fuser
Ballé, J., Minnen, D., Singh, S., Hwang, S. J., and Johnston, N. Variational image compression with scale hyperprior. arXiv preprint arXiv: 2018.
Training
5.9 10""; 122 x
72 min
Disection
6.5%
1.0 x 10 %
Bernstein, D. J. et al. Chacha, a variant of salsa20. In Workshop record of SASC, 2008.
identifying him is still no less than 99%.
Time Cost. Although Marker needs additional train- ing, but the cost is minimal and the training is model- agnostic. As presented in Table 7 the training of GNR only needs 72 minutes on V100 32G GPU. Moreover, the time overhead incurred by GNR and Fuser during the detection phase is almost negligible.
Biden, J. R. Executive order on the safe, secure, and trust- worthy development and use of artificial intelligence, 2023.
California State Legislature. California Assembly Bill AB-3211 California Digital Content Provenance Stan- dards, February 2024. URL htttp::///eiicsaet
5. Limitations
http:///c/eeet//2211/////// 2024-09-24.
Accessed:
Similar to existing tuning-free DM watermarks, Gauss- Marker also relies on DDIM inversion (Song et al. 202T) to estimate the initial Gaussian map for watermark detection. Therefore, we need use continuous-time samplers based on ODE solvers (Song et al., (021). Besides, since the pa- rameters of DM are not watermarked, GaussMarker does not support releasing the model with its parameters.
Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramèr, F., Balle, B., Ippolito, D., and Wallace, Extracting training data from diffusion models. In 32nd USENIX Security Symposium, USENIX, 2023.
Carlini, N., Paleka, D., Dvijotham, K. D., Steinke, T.
Hayase, J., Cooper, A. F., Lee, K., Jagielski, M., Nasr, M., Conmy, A., Wallace, E., Rolnick, D., and Tramèr, F. Stealing part of production language model. In ICML, 2024.
6. Conclusion
This paper proposes GaussMarker, the first dual-domain wa- termark for diffusion models. Compared to existing single- domain watermarks, we inject the watermark into the spatial and frequency domain of the initial Gaussian noise simulta- neously. The detection scores from dual-domain watermarks are fused to achieve a more robust detection. Besides, we introduce GNR which does not rely on any diffusion models for training, while significantly enhancing the robustness under rotation and cropping attacks. Extensive experiments show that GaussMarker exhibits strong robustness and pre- serves the utility of diffusion models.
Cheng. Z., Sun, H., Takeuchi, M., and Katto, J. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In CVPR, 2020.
Christ, M. and Gunn, S. Pseudorandom error-correcting codes. In Advances in Cryptology CRYPTO, 2024.
Ci, H., Yang, P., Song, Y., and Shou, M. Z. Ringid: Re- thinking tree-ring watermarking for enhanced multi-key identification. In ECCV, 2024.
Cox, I., Miller, M., Bloom, J., Fridrich, J., and Kalker, T. Digital watermarking and steganography. Morgan kaufmann, 2007.
Impact Statement
Studying the security and privacy aspects of the generative models has become a growing concern (Carlini al.) [2023] 2024). This paper proposes robust DM watermark, which can be used to detect whether an image is generated by given DM. We believe that our approach can mitigate issues such as copyright infringement and misuse associated with DM, thereby promoting the development of trustworthy generative AI.
Cui, Y., Ren, J., Xu, H., He. P., Liu, H., Sun, L., and Tang, J. Diffusionshield: A watermark for copyright protection against generative diffusion models. CoRR, 2023.
Dhariwal, P. and Nichol, A. Q. Diffusion models beat gans on image synthesis. In NeurIPS, 2021.
European Union Artificial Intelligence Act: Regu- lation (EU) 2024/1689 of the European Parliament and of the Council, June 2024. URL https
References
An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y., Deng, C., Zhu, S., Mohamed, A., Wen, Y., Goldstein, T., and
EN/ /t//:X///ouri00gLexx3222222 2024-09-24.
Accessed:
9

---

GauseMarker: Robust Dual-Domain Watermarks for Diffusion Models
Feng, W., Zhou, W., He, J., Zhang, Wei, T., Li, G., Zhang, T., Zhang, W., and Yu, N. Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora. In ICML, 2024.
Shih, F. Y. and Wu, S. Y. T. Combinational image water- marking in the spatial and frequeney domains. Pattern Recognit, 2003.
Song, J., Meng. C., and Ermon, Denoising diffusion implicit models. In ICLR, 2021.
Fernandez, P. Couairon, G., Jégou, H., Douze, M., and Furon, T. The stable signature: Rooting watermarks in latent diffusion models. In ICCV, 2023.
Song, Y. and Ermon, S. Generative modeling by estimating gradients of the data distribution. In NeurlPS, 2019.
Gunn, S., Zhao, X., and Song, D. An undetectable water- mark for generative image models. CoRR, 2024.
Wan, W., Wang, J., Zhang, Y., Li, J., Yu, H., and Sun, J. A comprehensive survey on robust image watermarking. Neurocomputing: 2022.
Heusel, M., Ramsauer, H., Unterthiner, T., Nessler, B., and Hochreiter, S. Gans trained by two time-scale update rule converge to a local nash equilibrium. In NeurlPS, 2017.
Wang, 7., Sehwag, V., Chen, C., Lyu, I.., Metaxas, D. N., and Ma. S. How to trace latent generative model gen- erated images without artificial watermark? In ICML, 2024.
Ho, J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. In NeurIPS, 2020.
Wen, Y., Kirchenbauer, J., Geiping, J., and Goldstein, T. Tree-rings watermarks: Invisible fingerprints for diffusion images. In NeurlPS, 2023.
Humphreys, D., Koay, A. M. Y., Desmond, D., and Mealy, E. Al hype as a cyber security risk: the moral responsibility of implementing generative Al in business. Al Ethics, 2024.
Wood, D., Mu, T., Webb, A. M., Reeve, H. W. J., Luján, M., and Brown, G. A unified theory of diversity in ensemble learning. Journal of Machine Learning Research, 2023.
Kassis, A. and Hengartner, U. Unmarker: A universal at- tack on defensive watermarking. CoRR, abs/2405.08363, 2024.
Xiong, C., Qin, C., Feng, G., and Zhang, X. Flexible and secure watermarking for latent diffusion model. MM, 2023.
Kingma, D. and Welling, M. Auto-encoding variational bayes. In ICLR, 2014.
Yang, Z., Zeng, K., Chen, K., Fang, H., Zhang, W., and Yu, N. Gaussian shading: Provable performance-losste image watermarking for diffusion models. In CVPR, 2024.
Lin, T., Maire, M., Belongie, J., Hays, J., Perona, P., Ramanan, D., Dollár, P., and Zitnick, C. L. Microsoft COCO: common objects in context. In ECCV, 2014.
Liu, Y., Li, Z., Backes, M., Shen, Y., and Zhang, Water- marking diffusion model. CoRR, abs/2305. 12502, 2023.
Yu, N., Skripniuk, V., Abdelnabi, S., and Fritz, M. Artificial fingerprinting for generative models: Rooting deepfake attribution training data. In ICCV, 2021.
Lu, C., Zhou, Y., Bao, F., Chen, J., Li, C., and Zhu, J. Dpm- solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. NeurIPS, 2022.
Zhao, Y., Pang, T., Du C., Yang, X., Cheung, N., and Lin, M. A recipe for watermarking diffusion models. CoRR, 2023.
Radford, A., Kim, J. W., Hallacy. C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, Learning transferable visual models from natural language supervision. In ICML,, 2021.
Ren, K., Yang, Z., Lu, L., Liu, J., Li, Y., Wan, J., Zhao, X., Feng, X., and Shao, S. Sok: On the role and future of AIGC watermarking in the era of gen-ai. CoRR, 2024.
Rezaei, A., Akbari, M., Alvar, S. R., Fatemi, A., and Zhang,
Y. Lawa: Using latent space for in in-generation image watermarking. ECCV, 2024.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer. High-resolution image synthesis with latent diffusion models. CVPR, 2022.
10

---

GaussMarker: Robust Dual-Domain Watermarks for Diffusion Models
A. Tuning-Based Watermarks
B.2. GaussMarker
(Liu et al., )023) proposes the first tuning-based method. They construct a dataset containing the pair of watermarked prompts and the watermarked images, as well as the clean prompts and the clean images for tine-tuning LDM. How- ever, they do not provide clear method to detect whether the watermark exists in an image, and require powerful hardware to fine-tune the models. To solve these problems, Stable Signature proposed to only fine-tune the decoder of L.D (Fernandez et al. 2023). To achieve this, they first train a watermark extractor that can recover the hidden signature from any generated image. Then, they fine-tune the LDM decoder, such that all generated images yield given signature through the pre-trained extractor. Compared to directly fine-tuning the original decoder, LaWa (Rezaei jet al. 2024) proposes to add some intermediate layers into the decoder, and only fine-tune these new layers with other modules frozen. Compared to Stable Signature, LaWa is more robust to image modifications and can handle mul- tiple users for one image generation service. In order to defend against white-box box attacks, AquaLoRA proposes to fine-tune the UNet, which contains essential knowledge of LDM (Feng et al. 2024). These methods inevitably intro- duce additional computational overhead especially when LDM gets large, and their robustness heavily relies on tak- ing sufficient image augmentations during the training.
Up-sample and Down-sample. Given an (-bits watermark w E {0, 1)', GaussMarker up-samples it into signal map {0, 1jexuxh with nearest sampling. During detection, GaussMarker down-sample the estimated signal map & with average pooling to estimate w. The mapping relationship of elements in ua-sampling and down-sampling needs to be consistent. For example, given w = {0, 13 and c x w x h 7, if s = {w[0) [w]]). [0]]. [1]]]] [[]] w[]]. [[]]] and ş {0, 1, 1), the estimated watermark is w = { { 8 (w()) w (0), w (0 (() , wl [1]] [1], and = (1.0.0.0,0.1,11 D.. the estimated watermark is w -11 +|4++1|s--500 3 } = G 3) This mapping relationship can also be treated as a key and saved into in the Shuffle.
[[3] [[]++
= () If
3
4
Frequency Watermark. To enhance the robustness of this zero-bit watermark, construct ring-like Fourier feature map as (Wen et al.] 2023). We first obtain a Gaussian noise map "T = abs (e) (2s 1), where e ~ (N I). Then, we calculate its Fourier feature as wd = F(z{) and flatten it into one-dimensional vector. Formally, the feature map can be defined as
w/ [1,i,]]
Σ
a [1,55 (14)
Nis
osi Seifew. s ch.
?. 1
B. Implementation Details
where i E (0,............ .0, 1), E (0 (0..... 2
13. r2. = li
B.1. Baselines
1 and N.. is + \ .. = | - w 15
h
2
the number of summed elements. Eq. 14 14implies that, taking
Stable Signature (Fernandez et al. 2023). We fine-tune the decoder of SD using the watermark extractor provided in their re Fl This extractor model has been trained with more image augmentations, such as blur and rotations, and has better robustness to that kind of attacks, the cost of slightly lower image quality. We fine-tune the encoder subset of COCO (Lin et al. 2014), which contains 2,000 images, with batch size 4, training steps 100, and leaning rate 5 x 10-4.
the center of w/ as the center of a circle, elements at similar radius will have the same value, thereby forming a ring- like feature map. The value is defined as the average of elements in uf that have the same radius. This characteristic can enhance the robustness through leveraging many properties of the Fourier transform (Wen et al.) [202] Ci et al.) (2024). To preserve the ring shape of watermark in 2 we adopt a circle mask for M as
1, if <r
<9
LatentTracer (Wang et al.) 2024). LatentTraacer considers that the images generated by LDM contain a natural wa- termark, and does not inject any artificial watermark into the generated image. When detecting the watermark from SD 1 and SD V2.0, the un-watermarked images are gen- erated by SD V1.4. When detecting the watermark from SD V1.4, the un- untwarrrmd images are generated by SD in their repo to obtain the latent construction loss.
Mf. 2. =
(15)
0.
ifr
where ry is the radius of circle mask. In our experiments, we set ry 4, and we explore the effects of ry in Ap-
pendix D.5
B.3. Image Distortions
12.1. We use the default
As shown in Fig. 4 we adopt eight image distortions to evaluate the robustness of GaussMarker and baselines as follows:
stable ftable_signale signature
hhttps://gtthb> cww http://gthhu.cooooo/letttaaaaag htwm///hhnningggggg////
(b) Rotate. Rotate the image by 75 degrees and fill the extra areas with black pixels.
LatontTracer

---

GauseMarker: Robust Dual-Domain Watermarks for Diffusion Models
(a) Clean
(b) Rotate
(c) JPEG
(d) C&S
(c) R. Drop
(f) Blur
(g) S. Noise
(h) G. Noise
(i) Bright
(j) VAE
(k) Diffusion
(I) UnMarker
Figure Examples of attacks used our experiments.
(c) JPEG. Compress the image using JPEG and set the quality factor to 25.
as Tree-Ring and Gaussian Shading. Semantic watermarks only preserve the semantics images, without regard for changes the pixel level. GaussMarker also belongs to semantic watermarks.
(d) C&S. Randomly crop 75% area of the image and scale it into the original resolution.
(e) R. Drop. Randomly mask 80% area of the image with black pixels.
C. Metries Details
Bit Accuracy. Assuming an [-bit binary watermark w e {0, 1)' injected into the LDM, and the bit extracted from the generated image is w, the bit accuracy Aco(w; W) (0, 1) defined as the ratio of the number of matching bits between and to
(f) Blur. Apply median filter with a kernel size 7 to the image.
(g) S. Noise, Add salt-and-pepper noise to the image with probability of 0.05.
(h) G. Noise. Add Gaussian noise with standard deviation of 0.05 to the image.
TPR with Fixed FPR. We need to predefine threshold value E R. If the detection score meets or exceeds the threshold т, it is concluded that the image indeed contains the watermark. To calculate the TPR with fixed FPR, e.g. TPRI& natural way finding satisfying the given FPR, which can be used obtain the TPR. However, if the controlled FPR is too low the expected number of test samples is too large, need to use LDM to generate many images, which increases the cost of evaluation. Previous research (Yu et al. 2021) proposes more efficient approach to calculating this metric. They assumee that each bit W, of the watermark extracted from un-watermarked images is uniformly distributed, e.g. W; Bernoulli(0.5) where (emm represents the Bernoulli distribution with success probability of 0.5. Then, the FPR is defined
(i) Bright. Perform a brightness transformation on the im-
age with a factor of
B.4. Advanced Attacks
Compression Attack. Following previous works Yang et al., 2024), we utilize two pre-trained VAE compressors, termed as VAE-1 (Cheng et al. 2020) and VAE-2 (Ballè
al. 2018 respectively, for image compression.
Regeneration Attack. Following recent benchmark (An
et al.) 2024), we utilize diffusion model Dhhriiwll & Nichol 2021 pre-trained on ImageNet to perform regen-
eration attack. Specifically, the watermarked image will undergo multiple cycles of noising and be denoised through this pre-trained diffusion model for regeneration.
( ( -E-B((+++11-p) (16)
FPR(7) - Σ
Tisually-Aware Attack. Recently, Kassis et al. proposed the first practical universal attack, UnMarker (Kassis & Hen- gartner 2024), on defensive watermarking. They introduce a visually-aware filter to attack semantic watermarks, such
where B, (T 1,1- is the regularized incomplete beta function. For N-users identification task, we multiply it by N to obtain the expected FPR.
12

---

MauseM Robust Dual-Domain Watermarks for Diffusion Models
0.3
0.5
0.6
0.5
AccumaCy
0.5
0.5
accucroyy
36
72
308 Angle
144
103
20
70
30
70
02
70
64
10
0.2
0.3
0.3
0.7
0.2
Quality Tactor
Crep
Drop Patto
(a) Rotate.
(b) JPEG.
(c) C&S.
(d) R. Drop.
1.0
3.0
1.0
1.0
0.2
0.3
0.6
0.4
19:77
152
178915//11
0.4
87. ULAMEaCy
50 accrray
0.2
15
52
0.05
0.10
6.15
0.20
0.25
0.25
6.10
0.35
0.20
0.2
SemelS2ee
Ictos Frebstilty
Nohe Starcaed Dav aE
Dogstraes Tactor
(e) Blur.
(f) S. Noise.
(g) G. Noise.
(h) Bright.
Figure 5. Detection performance of GaussMarker under eight image distortions of different intensities.
D. More results
V2
50 V2.
D.1. Robustness
0.395
50 VL4
0.394
0.592
To further test the robustness, we conduct experiments using different intensities of noises for image distortions. Except for Gaussian Noise, TPRI %FPR and bit accuracy of Gauss- Marker remains above 90% and 80% respectively. Although the detection performance declines significantly with higher intensities of Gaussian noise, the quality of images is de- graded too much (the second-to ccond-to-llsst row of Fig.
V2.V
0.941
0.390
92.95
V2.0
50 V1.4
0.00
15
30
0
25
30
Size (FONM 190
5ic of GNS (H)
Figure 6. TPR 1 F&PP and bit accuracy of GaussMarker with dif- ferent sizes of GNR across three versions of SD.
D.2. Dual- -nal-Domain and GNR
D.3. Model Size of GNR
Tab. presents the performance of five different versions of GaussMarker under various image distortions. The re- sults show that each of the dual-domain watermarks has advantages terms of robustness. For example, the spatial- domain watermark obtain 19% and 56% higher TPRI FPPR than frequency-domai watermarks under JPEG and Ran- dom Drop respectively, while fremuency-domain water- marks achieve 68% and 87% higher TPRI & FPR than -oatial-domain watermarks under Rotate and C&S respec- tively. Injecting two types of watermarks simultaneously and fusing two detection scores leverages their respective strengths. However, the detection performance under Ro- tate and C&S is still not satisfactory, especially for the bit accuracy. Incorporating GNR significantly enhances the robustness against such two attacks, validating the design purpose of GNR.
We test five different sizes of GNR (0.5M, 1.9M, 7.7M, 17.3M, and 30.8M), implementing each through setting the base feature dimension of the UNet to 16, 32, 64, 96, and 128 respectively. Fig. 6 shows the results. GaussMarker with a larger GNR can obtain better TPR 1FRI..... Because larger GNR can learn the invariance better to restore the Gaussian noise. However, GaussMarker with a smaller GNR can obtain higher bit accuracy. We consider the reason is that, when GNR can not learn the invariance perfectly, it is more likely for GNR to output the watermarked signal map more often, even if the input signal map does not contain our watermark. Therefore, small GNR can obtain higher bit accuracy but a little lower TPR1 TPRI%FPR. %FPR.
D.4. Types of Fuser
In our main experiments, we implement the Fuser as a 2- layer MLP. We further test five other classifiers, 5-Nearest Neighborhood classifier with (KNN-5), SVM with linear
13

---

Gause Robust Dual-Domaie Watermarks for Diffusion Models
Table 8. Ablation study on different modules of Marker across three SD V1.4 / V2.0/ V 2.1 under various image distortions.
Spatial
Freq.
CNR
DM
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
Average
1.000/
0.028/0.512
0.9961
0.101 /0,540
1,0000
1,900/0,50 0.999
0.999/0.912
0.998 70934
0.996/0.968
0.791 70866
1'2A GS
1.000/-
0,701 /-
0.806/
0.978 /-
0.442/-
0.989/ /-
0.922/-
0,460/-
0.633 /-
0.770 /-
1,00/1.000
0.652/0.512
0.996/0.981
0 /0.540
0.98/0.900
1.000/
1.000/0.912
0.924/0.934
2966/00998
0.946 / 0,868
1.000/
0.996/0.996
0,989/0.999
1.000/10000
1.000
1,000/ 1.000
0,000 /0.99
0.899 70966
0.991/0.989
0.875 /0,950
/
1,000110000
0.997/0.998
0.996 0
1.000/1000 1.000
00.96
1.000/1.000
10.991
0,989 / /0.96
0,98//0 /0.999
0.997 /0,900
1.000/10000 1.000
0.009 70.515
B.9W 0.5885
0.140/0.541
1.000/0.969
/0.999
0000000923
0.998 70.930
0.909/0:977
0.794
1.000--
0,768/ 7-
0.838 /-
0.974/-
0.397 /-
0.989 /-
0.943 /-
0,517 /-
0,658 /-
0.794 /-
1.000110000
0.997 7
0.98470.541
(U.96)
(000//09000
0:907 /0.923
0.960/0.930
0.983 70,977
0,956 /08822
1.000/10000
0.991 /..999
0.996/0 0.998
0.909/ / 11000
1.000/0.9900
1.000/ / 1,000
0.962/ / 70.992
0.907 70.970
0.997/0.99
70.993
0.984 00,991
1.000/10000
0.997/0.999
0.998 0.999
1,000/1 11:00
1.000/0.900 00966
1.000/1.000
0.996/0.90 0.9922
0.993/ 70.970
0.996 009993
0.998 0.9991
1.000/1.000 1.000
0.0066/0.511
0.998/ 0
0.078 0 70.538
/0000/09970
1 1,000 70.999
1,000 70.915
03996700.95
0.998 0.9979
0.786 /0.871
SD V1
1.000/-
0.586 /-
0.866 /-
0.977 /-
0.458 /-
0.989 /-
0.896 /-
0:438 /-
0.783 /-
0.777 /-
/
1,000/1
0.576/0.517
0.998/ 0.966
0.983 /0.538
1.000/ /0.970
1.000
0.997 0.997/0.915 00.915
0.944/0.937
0.987 70.979
0.943 0.871
1.000/
1.000
0.997/ 0.999
0.997 / 0.999
0.999 00.999
1.000/ /0.970
1.300 L.000
0.997 0007/00000 /0.991
0.980/ / 0.966
0.996 0.9994
0.996 / 0.99
1.000/1
1.000
0.998 0.999
0.998 0.999
0.999/ 0:999
1.000/ 00.970
1.000 /1000
/.000/ 00.991
0.988 70.965
0.996 0.9994
0.998 / 0.991
Table Results of different Fusers across three SD V1.4/ /2.0/
V 2.1.
Fuser Type
&PRI
ROC-AUC
KNN-5
0.997 /0,99/ / 0.999
0,998/ / 0.997 / 0,996
T/ 2
ry 4
Ty 6
Ty 8
ry 10
Linear SVM
0.998 /09991 / /0.995
0.999 / 0.999/ / 0,999
RBF SVM
0.998 /0.99/ 0.999
0.999 / 0.999/ / 0.999
Figure 7. Visualization of the masks with different ry for trequency-domall watermarks.
Random Forest
0.998/ 0,993 / 0.994
0.999/ / 0.999/ / 0,999
Decision Tree
0.661 0.647 0.875
0.988/ / 0.982/ / 0,988
MLP
0.998 0.998 0.997
0.999 / 0.999 / 0.999
1.00
V2
0.962
V2.0
VL.
0.560
kernel (Linear SVM). SVM with a radial basis function kernel (RBF SVM), Random Forest with 100 trees, and
0.94
0.02
0.358
Decision Tree with Gini impurity. Since the Fuser does not affect the bit accuracy, we report another detection metric, ROC-AUC, following previous works (Wen et al., 2023 Ci
0.90
5D V2.1
50.42.
50 V1.
Rad of
Aadiua of Mack
cet al. 2024). As shown in Tab. 9 except for Decision Tree, all types of Fuser achieve over 99% TPR1 RFRR and ROC- AUC, and MLP obtains the highest average TPR1 IFFRR.
Figure 8. /PRI%FPE and bit accuracy of GaussMarker when us- ing masks with different radius ry for frequency-domain water- mark. ry 0 means GaussMarker does not inject the frequency- domain watermark.
D.5. Effects of the Mask Radius
In our main experiments, the mask radius ry is set 4. We further test five other values, O, 2, 6, 8, and 10. Fig. 7
Table 10. Effects of sampling steps on TPRI%FPR/ / bit accuracy of Gauss using SD V
is the visualization of the masks with different ry- Fig. 8 presents the detection performance of GaussMarker with different ry. When r = O, e.g. no frequency watermark, the TPRI &FPR of Marker falls below 90%, indicating the importance of injecting frequency-domee However, when r'y gets too large, the TPRI 1%FP starts to decrease. This is because that, too large ry will change the signal map of 27- lot. Since changing the signal map of z means changing the injected watermark, the detection score of spatial-domain watermark will get inaccurate, as shown in the right part of Fig.
Inv. Steps
Gen. Steps
100
10
0.993 0,980
0.994/ 0.983
/0.983
0.995 0.984
25
0.996 0..86
0.996 0.989
0.998 0.990
0.998 0,990
50
0.996/ 00.977 0.987
(1.997 0.989
0.997
/0.990
0.998 0,990
watermarks.
100
0.996/ 0.987
0.996/ 0.989
0.997 0.99
0.997 / 0,990
pling steps during generation and inversion improve the TPRI RFRP and bit accuracy of GaussMarker. However, even when both generation steps and inversion steps are only 10, the TPRI&FPR and bit accuracy of GaussMarker still remain above 99% and 98% respectively.
D.6. Sampling Steps
We explore how the number of sampling steps during gener- ation and DDIM inversion affects the detection performance of Gauser As present in Tab. 10, both larger sam-
14


Reviews:
[{"review_id": "QF1bp1gwaA", "reviewer": "Reviewer_YNzZ", "summary": "The paper introduces GaussMarker, a novel semantic watermark technique based on diffusion models. Different from previous works, GaussMarker adds watermarks in both the pixel and frequency domain of images. During detection, GaussMarker trains two additional components: 1. Gaussian noise restorer (GNR) for restoring the geometric attacks and 2. Fuser for fusing the detection score between pixel space and frequency space detection. Experiment results demonstrate the superiority of GaussMarker towards geometric attacks (Rotate, Crop&Scale).", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1:** About \"tunning-free\".\n\n**A1:** We consider GaussMarker to be a tuning-free method. The term \"tuning-free\" implies that SDs cannot be fine-tuned due to computational costs and the watermarking method can be attached to the model in a plug-and-play manner without touching the model weights. GaussMarker avoids fine-tuning SDs and instead trains only two small modules, which require minimal computational resources, as elaborated in Response 7.\n\n**Q2:** Generalizability of these two components.\n\n**A2:** We train a GNR for all SDs due to its model-independent characteristics. We train a Fuser for each SD, as the training data for the Fuser is generated from the corresponding SD.\n\n**Q3:** Some problems in Figure 3.\n\n**A3:** Some curves overlap at y=1. We will improve the illustration.\n\n**Q4:** Why does frequency watermark only matter for V2.1?\n\n**A4:** The frequency watermark matters more for stronger SDs **when using GNR**. In our experiments, we find that GNR occasionally extracts a high bit accuracy from unwatermarked images, especially on stronger SDs. This results in the need for a higher threshold to maintain the expected 1\\% FPR, which in turn lowers the TPR@1%FPR. \n\nFor instance, in Table 6, GNR+Spatial demonstrates better bit accuracy but worse TPR@1%FPR compared to Spatial under Gaussian Noise and Salt-and-Pepper Noise on SD V2.1. This significant drop does not occur with SD V1.4 and V2.0. Given the stable FPR of the frequency watermark [a], the frequency score becomes crucial for achieving a lower FPR through score fusion, especially on SD V2.1.\n\n[a] https://arxiv.org/pdf/2305.20030\n\n**Q5:** The relation between watermark capacity and the number of users in Figure 3.\n\n**A5:** The watermark capacity and number of users in Figure 3 are not directly related. The watermark capacity, denoted by \n$l$, refers to the number of bits available for watermarking. The number of users that can be assigned unique watermarks must be much less than $2^l$, and a larger $l$ usually supports more users. In Figure 3(b), with $l=256$, we assess how accurately GaussMarker can identify the correct user as the number of users grows.\n\n**Q6:** In Figure 3, why increasing the watermark capacity will make the watermark less vulnerable to Random Drop? why increasing the number of users will make the watermark less vulnerable to Gaussian noise?\n\n**A6.1:** Maybe you want to use 'more' instead of 'less'. As shown in Equation 5, we use a voting strategy (average pooling) to estimate each bit in the watermark $\\tilde{\\omega} \\in$ {0,1}$^l$ based on $cwh/l$ signs in the signal map $\\tilde{s} \\in$ {0,1}$^{cwh}$.  When $l$  increases, fewer signs can be used for voting, which means that sign estimation needs to be more accurate for estimating the $\\tilde{\\omega}$. Random Drop masks 80% of the image with black pixels, significantly impacting sign accuracy. Therefore, the bit accuracy under this attack is most affected by the watermark capacity.\n\n**A6.2:** When the number of users increases, higher bit accuracy is required in extracting watermarks from images to ensure high identification accuracy. For example, consider injecting a 3-bit watermark (ignoring unwatermarked images for simplicity). With two users assigned watermarks {0,0,0} and {1,1,1}, an estimated watermark $\\tilde{w}$={0,0,1} allows us to correctly identify the first user with just 66.7% bit accuracy.\n\nAs presented in Table 1, the bit accuracy under Gaussian Noise is the most unstable. Therefore, it is affected by the number of users most. Note that we set the watermark capacity to $l=256$ in this experiment, thus, the performance under Random Drop is great with its 1.000 TPR@1%FPR. However, under Gaussian Noise attack, GaussMarker only obtains 0.989 TPR@1%FPR, which means that nearly 11 watermarked images don't get high bit accuracy.\n\n**Q7:** Computation cost.\n\n**A7:** The cost is minimal, as presented in the table below. These experiments are conducted on 1 V100 32G GPU.\n\n| Phase     | Inversion | GNR         | Fuser          |\n|-----------|-----------|-------------|----------------|\n| Training  | -         | 72 min      | 1.4×10⁻¹ s     |\n| Detection | 6.5 s     | 1.2×10⁻³ s  | 1.0×10⁻⁴ s     |\n\n**Q8:** Ablation study on fidelity.\n\n**A8:** The ablation results are shown in the table below. Both spatial and frequency watermarks help preserve the original CLIP Score. For FID, the spatial watermark performs better than the frequency one. Combining both methods often requires more editing, leading to slightly worse CLIP Scores and FID for the dual-domain watermark compared to single-domain approaches. Improving the visual quality of watermarked images using GaussMarker could be a direction for future work.\n\n| Spatial | Frequency | Ave. CLIP Score↑  | Ave. FID ↓   |\n|---------|-----------|--------|--------|\n|         |           | 0.3567 | 24.89 |\n| ✓       |           | 0.3568 | 24.36 |\n|         | ✓         | 0.3568 | 24.78 |\n| ✓       | ✓         | 0.3545 | 24.85 |", "claims_and_evidence": "The claim \"GaussMarker is tunning-free watermarks\" is improper. Although GaussMarker doesn't need to tune the diffusion model, it still needs to train the Gaussian noise restorer and Fuser. Thus it is unfair to categorize GaussMarker as tunning-free watermarks.", "methods_and_evaluation_criteria": "Yes, the proposed method is make sense for the problem.", "theoretical_claims": "There are no theoretical claims in this paper.", "experimental_designs_or_analyses": "The paper experiments with the robustness and generation fidelity of their proposed method on three different versions of Stable Diffusion and various attacks. Furthermore, it contains ablation studies as well as experiments on multiple user cases. The experiments are thorough.", "relation_to_broader_scientific_literature": "The key contribution of this paper, watermark, is related to AI safety, and copyright protection problems.", "essential_references_not_discussed": "The paper has a thorough discussion of previous works.", "other_strengths_and_weaknesses": "## Strength \n1. By incorporating the two additional components (GNR and fuser) and adding watermarks in dual domains, GaussMarker achieves much better robustness. This contribution could be clearly illustrated in Table 4.\n\n## Weakness\n1. The introduction of additional components caused more concerns:\n\n    a. More computation expensive: How much is the additional computation cost introduced by the GNR and the fuser for both training and detection?\n\n    b. Effect on generation fidelity. As shown in Table 2, compared with the most direct baseline Tree-Ring, GaussMarker achieves slightly better FID and slightly worse CLIP Score. But what is the effect of spatial watermark and frequency watermark on the fidelity is still unclear.  Similar to Table 4, the paper should have an ablation study related to this.\n\n    c. Generalizability of these two components: does the paper train three GNRs and users for three stable diffusions or one for all of them?", "other_comments_or_suggestions": "1. Some problems in Figure 3, we couldn't visualize the results such as rotate, and C&S. The author needs a better illustration.", "questions_for_authors": "1. For Table 4, compare with the 4th and 5th rows, including the frequency significantly improve TPR1%FPR for V2.1. But this frequency watermark is not important for V1.4 and V2.0. Could the author discuss the difference between different versions of stable diffusion and why the frequency watermark only matters for V2.1?\n2. What's the relation between watermark capacity and the number of users in Figure 3? If the watermark capacity is 2^10, is the number of users 2^(2^10)?\n3. In Figure 3, why increasing the watermark capacity will make the watermark less vulnerable to Random Drop? why increasing the number of users will make the watermark less vulnerable to Gaussian noise? Is there any discussion?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MYsgDiZRxn", "reviewer": "Reviewer_u9TC", "summary": "This paper proposed **GaussMarker**, which embeds watermarks into the noise vector of diffusion models within both the spatial and frequency domains. To enhance the detection robustness of watermarks, the authors propose a learnable Gaussian Noise Restorer (GNR) that is capable of restoring from the distorted noise vector, especially under the rotation and cropping attacks. Experiments show that **GaussMarker** is robust against most common image transformations and four advanced watermarking removal attacks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1:** Why does GaussMarker largely outperform other methods when evaluated against the regeneration attack?\n\n**A1:** This advantage stems from GNR, as shown in the SD V2.1 results presented in the table below. Regeneration using diffusion models mainly involves semantic editing, which may also include spatial-like transformations. Notably, since GNR is trained using the composition of rotation and cropping with random sign flipping (p=0.35) for preventing overfitting, it can learn the invariance to various spatial-like transformations. Therefore, GNR enhances GaussMarker's ability to resist spatial-like transformations introduced by regeneration attacks.\n\n| Spatial | Frequency | GNR | TPR@1%FPR | Bit Acc. |\n|---------|-----------|-----|-----------|----------|\n| ✓       |           |     | 0.008     | 0.524    |\n|         | ✓         |     | 0.295     | -        |\n| ✓       | ✓         |     | 0.345     | 0.524    |\n| ✓       |           | ✓   | 0.660     | 0.865    |\n| ✓       | ✓         | ✓   | 0.667     | 0.865    |\n\n**Q2:** How do you evaluate the identification accuracy with multiple users?\n\n**A2:** We adopt an approximate algorithm as detailed in Appendix C, following Gaussian Shading. Specifically, we first compute a theoretical threshold $\\tau$ based on the predetermined number of users, $N$ and expected FPR. Given a watermarked image, if its bit accuracy exceeds this threshold, we consider the user generating it will be correctly identified among the $N$ users. A practical multi-user identification extension of GaussMarker is provided in Response A5.\n\n**Q3:** For rotation attacks, is the GNR capable of generalizing to other useen rotation degrees (angles not used during training the GNR)? My concern is that since the CNN-based networks face challenges in handling the image rotations, how does GNR overcome this?\n\n**A3:** GNR is trained with dense rotation angles randomly sampled from (-180$^{\\circ}$, 180$^{\\circ}$), and can converge easily. Therefore, even with unseen rotation degrees, they are likely to be approximated with minor errors by nearby angles.\n\n**Q4:** The formulation and method description of this paper needs further proofreading and justification.\n\n**A4:** We will improve the formulation and method description.\n\n**Q5:** It is confusing whether GNR requires retraining for each signal map. If so, the scalability of GNR is reduced, and how to select which GNR to use when multiple users generate images from the same LDM?\n\n**A5:** When we have multiple users, we also only need to train one GNR. Each LDM only has one unique model-watermark $w \\in$ {0,1}$^l$ (or signal map) with its corresponding GNR. Each user will be assigned a unique key $k \\in$ {0,1}$^l$ and a unique user-watermark $w_u \\in$ {0,1}$^l$ with $w_u = \\text{XOR}(w,k)$. We use the estimated $\\tilde{w}$ to estimate the user-watermark $\\tilde{w}_u = \\text{XOR}(\\tilde{w},k)$ for calculating the bit accuracy. This easy extension is similar to Gaussian shading, so we omit that detail from the paper. We can add it if needed.\n\n**Q6:** The idea of GNR is similar to the robustly trained watermark decoder (in Stable Signature) and is only designed to enhance the robustness of rotation and cropping.\n\n**A6:** The core ideas are similar, but training GNR is much more efficient. GNR does not require additional datasets for training, while Stable Signature needs to train its watermark decoder and VAE on the COCO dataset. Besides, in addition to rotation and cropping, GNR also includes random sign flipping and is robust to many spatial-like transformations in the pixel space, as detailed in Response A1.\n\n**Q7:** How do you derive the Equation in lines 222-224 (needs index) from Equation 10?\n\n**A7:** In Equation 10, GNR takes Gaussian noise as input and outputs its restored version. However, as shown in Figure 2, we find that the approximate invariance exists only in the signal space. Therefore, we redefine GNR to take the signal map of Gaussian noise as input and output the restored signal map, as formalized in the Equation in lines 222-224.\n\n**Q8:** In table 4, why does SD V 2.1's TPR performance get a significant drop compared to SD V 2.0 in the last two rows (from 0.997 $\\rightarrow$ 0.875), while the bit ACC remains the same? It seems that Spatial + GNR is sufficient to get a robust watermarking performance.\n\n**A8:** This is because the Spatial+GNR sometimes extracts high bit accuracy from unwatermarked images, which lowers the FPR and TPR@1%FPR, especially on stronger models (SD V2.1 is a further fine-tuned version of SD V2.0). Note that bit accuracy is only calculated from watermarked images, so it is less affected. The frequency score helps to reduce the FPR through score fusion.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "This paper compares several updated watermarking strategies, using standard metrics for detection (TPR and Bit Accuracy) and quality evaluation (FID and CLIP-score) and widely used prompt sets from MS-COCO for image generation. All of them make sense.", "theoretical_claims": "No theoretical claims in this paper.", "experimental_designs_or_analyses": "Yes, most of the experimental designs are valid and make sense. Below, I draw several questions and confusion from the paper.\n\n1. Why does **GaussMarker** largely outperform other methods when evaluated against the regeneration attack? Can you explain the underlying mechanism?\n2. How do you evaluate the identification accuracy with multiple users? Can you explain the experimental details?\n3. For rotation attacks, is the GNR capable of generalizing to other useen rotation degrees (angles not used during training the GNR)? My concern is that since the CNN-based networks face challenges in handling the image rotations, how does GNR overcome this?", "relation_to_broader_scientific_literature": "**GaussMarker** can be used to protect the intellectual property of diffusion-based generative models and safeguard their generated images from potential misuse.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "**Strengths**:\n1. The proposed **GaussMarker** is robust than most advanced baselines, making it an effective training-free watermarking strategy.\n2. The motivation is clear and straightforward.\n\n**Weaknesses**:\n1. The formulation and method description of this paper needs further proofreading and justification. For instance, $s$ is used to represent both signal map and spatial space, and sometimes they are mixed $s^{s,f}$; $s^{s,f}$ is less rigorously defined as signal map is only introduced in the **s**patial space but not in the **f**requency space (please point out my mistakes if I misunderstand the method).\n2. It is confusing whether GNR requires retraining for each signal map. If so, the scalability of GNR is reduced, and how to select which GNR to use when multiple users generate images from the same LDM? \n3. The idea of GNR is similar to the robustly trained watermark decoder (in Stable Signature) and is only designed to enhance the robustness of rotation and cropping.", "other_comments_or_suggestions": "The method description needs further proofreading to make the paper more fluent and easy to follow.", "questions_for_authors": "1. How do you derive the Equation in lines 222-224 (needs index) from Equation 10?\n2. In table 4, why does SD V 2.1's TPR performance get a significant drop compared to SD V 2.0 in the last two rows (from 0.997 -> 0.875), while the bit ACC remains the same? It seems that Spatial + GNR is sufficient to get a robust watermarking performance.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XJ359NwIZ2", "reviewer": "Reviewer_4dSB", "summary": "This paper presents **GaussMarker**, a novel watermarking method for diffusion models, with the following key contributions:\n1. **Dual-Domain Watermarking**: Embeds watermarks in both the spatial and frequency domains of Gaussian noise to enhance robustness.\n2. **Gaussian Noise Restorer (GNR)**: A model-independent learnable module that improves watermark detection robustness, especially against geometric attacks like rotation and cropping.\n3. **Score Fusion**: Combines detection signals from spatial and frequency domains to improve extraction accuracy.\n\nExperimental results demonstrate that **GaussMarker** outperforms existing methods across three versions of Stable Diffusion (V1.4, V2.0, V2.1) under eight common distortions (e.g., rotation, blur, noise, JPEG compression) and four advanced attacks (e.g., VAE compression, diffusion model regeneration, UnMarker attack).", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1:** Scope of Equation 10: Equation 10 is designed to improve robustness against rotation and cropping. Does it also apply to non-geometric transformations like JPEG compression and blurring? If so, can you provide a formal explanation or additional experiments? If not, can you clarify its limitations?\n\n**A1:** Equation 10 does not apply to common non-geometric transformations in our experiments. We will add this limitation. However, during detection, GNR takes the signal map of Gaussian noise that is estimated by LDM as input. Therefore, GNR can inherit the robustness of LDM (the 1st row of Table 6).\n\n**Q2:** Generalization of GNR: In Table 6, GNR consistently improves detection across all distortions, despite being trained only on rotation and cropping. Given that deep-learning models often overfit to specific noise patterns, how do you explain this unexpected gain?\n\n**A2:** Since the objective of GNR is approximate, as present in Figure 2 (nearly 30%-42%), we use random sign flipping (p=0.35) for GNR training. This prevents GNR from overfitting and ensures its good generalization. Therefore, GNR also enhances the robustness of GaussMarker under other attacks to some extent. \n\nWe provide additional ablation results ( TPR@1%FPR / bit acc. on SD V2.1) in the table below to verify this. With random sign flipping, the average TPR@1%FPR and bit accuracy of GaussMarker increases by 5.7% and 12.1%, respectively. Although GaussMarker gains the main improvement under Rotate and C\\&S attacks, the improvement under S. Noise, G. Noise, and Bright is also significant, especially on the bit accuracy. \n\n| Methods            | Clean       | Rotate      | JPEG        | C\\&S        | R. Drop     | Blur        | S. Noise    | G. Noise    | Bright      | Average     |\n|--------------------|-------------|-------------|-------------|-------------|-------------|-------------|-------------|-------------|-------------|-------------|\n| GaussMarker w/o flipping | 1.000 / 1.000 | 0.587 / 0.513 | 0.990 / 0.982 | 0.980 / 0.540 | 1.000 / 0.963 | 1.000 / 0.999 | 0.999 / 0.912 | 0.988 / 0.934 | 0.916 / 0.967 | 0.940 / 0.868 |\n| GaussMarker w/ flipping  | 1.000 / 1.000 | 0.997 / 0.998 | 0.996 / 0.997 | 1.000 / 1.000 | 1.000 / 0.963 | 1.000 / 1.000 | 0.999 / 0.991 | 0.989 / 0.968 | 0.993 / 0.989 | 0.997 / 0.990 |\n\n**Q3:** Complementarity of spatial and frequency-domain watermarks: The paper claims that dual-domain embedding improves robustness. Can you provide an analysis or empirical study to justify why spatial and frequency-domain watermarks are complementary?\n\n**A3:** We believe that the effectiveness of combining is built on the theoretical foundation of ensemble learning [a]. When both frequency-domain watermarking and spatial-domain watermarking can achieve precise and diverse detection results, as present in Table 6, fusing them may lead to more robust detection performance. This has been fully demonstrated by our experimental results.\n\n[a] https://jmlr.org/papers/v24/23-0041.html", "claims_and_evidence": "The paper makes the following main claims:\n1. Existing single-domain watermarking methods lack robustness against geometric attacks (e.g., rotation and cropping), while dual-domain watermarking significantly improves detection performance.\n2. **GNR** enhances watermark robustness by restoring corrupted watermark information.\n3. Score fusion improves watermark detection accuracy compared to using single-domain detection alone.\n\nWhile the paper provides experimental support for these claims, several issues remain:\n- **Effectiveness of dual-domain watermarking**: The paper shows that combining spatial and frequency-domain watermarks improves detection accuracy (Table 4), but lacks theoretical analysis explaining why these two approaches complement each other.\n- **Role of GNR**: The study (Figure 2) demonstrates that GNR improves robustness against rotation and cropping, and Table 4 shows increased detection accuracy. However, the learning objective of GNR (Equations 9 and 10) is based on noise signal recovery, without considering more complex image transformations, which might limit its generalization. Additionally, GNR is only optimized for rotation and cropping but its effectiveness against other attacks (e.g., Gaussian noise, blurring) remains unclear.", "methods_and_evaluation_criteria": "The paper employs reasonable evaluation methods:\n- **Baselines**: Compares against various state-of-the-art watermarking methods, including **Tree-Ring, Gaussian Shading, PRC, LatentTracer** (all tuning-free) and **Stable Signature** (a tuning-based method).\n- **Datasets**: Evaluates on **Stable Diffusion V1.4, V2.0, V2.1** using **MS-COCO** to generate 512×512 watermarked images.\n- **Metrics**:\n  - **TPR@1%FPR**: True positive rate at 1% false positive rate, measuring detection performance.\n  - **Bit Accuracy**: Measures the correctness of extracted watermark information.\n  - **FID** and **CLIP-Score**: Assess image quality.", "theoretical_claims": "The paper’s main theoretical contribution is the introduction of **GNR** for watermark restoration. However, several theoretical gaps remain:\n\n**Validity of GNR’s Learning Objective:**\nThe paper assumes that the Gaussian Noise Restorer (GNR) can effectively restore watermarked noise under transformations like rotation and cropping (Equation 10). However, it does not provide formal proof of this claim. Furthermore, while **Tree-Ring** mentions that watermark signals exhibit invariance under geometric transformations, it does not extensively discuss robustness against **non-linear transformations** such as **JPEG compression and blurring**.\n\nThis raises several critical questions:\n1. **Scope of Equation 10**: What specific types of transformations are covered by Equation 10? Does it include JPEG compression and blurring?\n   - If **JPEG and blurring** are included, can the authors provide more rigorous theoretical justification or additional experiments to support this claim?\n   - If **JPEG and blurring** are not included, the authors should explicitly state the limitations of Equation 10 and clarify the scope of transformations where GNR is applicable.\n\n2. **Effectiveness of GNR beyond rotation and cropping**:  \n   - In **Table 6**, the ablation study suggests that GNR improves watermark robustness across **all distortions**, not just rotation and cropping.\n   - However, the training transformation **T** only includes **rotation and cropping**, which raises concerns about potential overfitting to these specific noise layers.\n   - Typically, deep learning models trained on a limited set of distortions **tend to overfit** to those distortions while exhibiting **weaker generalization** to unseen noise types.\n   - If GNR was only trained on **rotation and cropping**, why does it still improve robustness against **other distortions** (e.g., JPEG compression, blurring)?\n   - Can the authors provide a **rational explanation** for this unexpected gain?", "experimental_designs_or_analyses": "The experimental design is generally solid, but there are areas for improvement:\n1. **Limitations of GNR**:\n   - As mentioned in **Theoretical Claims**\n\n2. **Effectiveness of score fusion**:\n   - The correlation between spatial and frequency-domain scores is not studied.", "relation_to_broader_scientific_literature": "The paper situates itself well within the watermarking literature, comparing tuning-free and tuning-based methods.", "essential_references_not_discussed": "Most of the essential references are discussed.", "other_strengths_and_weaknesses": "**Strengths**\n\n- **Innovative dual-domain watermarking**: The proposed *GaussMarker* introduces a novel approach by embedding watermarks in both the spatial and frequency domains. This idea is well-motivated and aligns with the intuition that leveraging multiple domains can enhance robustness.\n- **No fine-tuning required**: Unlike tuning-based watermarking methods, *GaussMarker* does not require modifying diffusion model parameters, making it computationally efficient and more practical for real-world deployment.\n- **Comprehensive experiments**: The paper evaluates *GaussMarker* on multiple versions of Stable Diffusion (V1.4, V2.0, V2.1) and benchmarks against various state-of-the-art watermarking techniques. It tests robustness under eight image distortions and four advanced attacks, demonstrating superior performance.\n- **Gaussian Noise Restorer (GNR) for improved robustness**: The introduction of GNR helps mitigate the impact of geometric transformations (rotation, cropping), significantly improving detection accuracy in such cases.\n \n**Weaknesses**\n\n- **Validity of GNR’s Learning Objective:**\nThe paper assumes that the Gaussian Noise Restorer (GNR) can effectively restore watermarked noise under transformations like rotation and cropping (Equation 10). However, it does not provide formal proof of this claim. Furthermore, while **Tree-Ring** mentions that watermark signals exhibit invariance under geometric transformations, it does not extensively discuss robustness against **non-linear transformations** such as **JPEG compression and blurring**.\n\nThis raises several critical questions:\n1. **Scope of Equation 10**: What specific types of transformations are covered by Equation 10? Does it include JPEG compression and blurring?\n   - If **JPEG and blurring** are included, can the authors provide more rigorous theoretical justification or additional experiments to support this claim?\n   - If **JPEG and blurring** are not included, the authors should explicitly state the limitations of Equation 10 and clarify the scope of transformations where GNR is applicable.\n\n2. **Effectiveness of GNR beyond rotation and cropping**:  \n   - In **Table 6**, the ablation study suggests that GNR improves watermark robustness across **all distortions**, not just rotation and cropping.\n   - However, the training transformation **T** only includes **rotation and cropping**, which raises concerns about potential overfitting to these specific noise layers.\n   - Typically, deep learning models trained on a limited set of distortions **tend to overfit** to those distortions while exhibiting **weaker generalization** to unseen noise types.\n   - If GNR was only trained on **rotation and cropping**, why does it still improve robustness against **other distortions** (e.g., JPEG compression, blurring)?\n   - Can the authors provide a **rational explanation** for this unexpected gain?", "other_comments_or_suggestions": "See Weaknesses.", "questions_for_authors": "1. **Scope of Equation 10**: Equation 10 is designed to improve robustness against rotation and cropping. Does it also apply to **non-geometric transformations** like JPEG compression and blurring? If so, can you provide a formal explanation or additional experiments? If not, can you clarify its limitations?\n2. **Generalization of GNR**: In Table 6, GNR consistently improves detection across all distortions, despite being trained only on rotation and cropping. Given that deep-learning models often overfit to specific noise patterns, how do you explain this unexpected gain?\n3. **Complementarity of spatial and frequency-domain watermarks**: The paper claims that dual-domain embedding improves robustness. Can you provide an analysis or empirical study to justify why spatial and frequency-domain watermarks are complementary?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KWgXa0WWit", "reviewer": "Reviewer_52ML", "summary": "This paper introduces GaussMarker, the first dual-domain watermarking technique tailored for diffusion models. The authors preoposed a\nNovel Dual-Domain Watermarking taht is designed for diffusion models without requiring any fine-tuning, while still achieving strong robustness. The authors also develop GNR, which is trained independently from the diffusion models. This component notably enhances the watermark's resilience against rotation and cropping attacks. Extensive experiments across three stable diffusion models and eight types of image distortions demonstrate that GaussMarker outperforms existing methods in terms of true positive rate and bit accuracy.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1:** However, in table 1, it seems that the propsoed method are more rebust than other watermarking method only under rotaion and C\\&S attack. Any comments? Moreover, as the GNR is trained in latent space, does it mean that it would be reobust on image space attack like JPEG and Brightness.\n\n**A1.1:** GaussMarker also achieves better detection performance than Stable Signature, TreeRing and PRC under S. Noise, G. Noise, and Bright attacks, as present in Table 1. A major shortcoming of existing methods is that they do not perform well across different image distortions, whereas GaussMarker exhibits relatively consistent robustness across various image distortions. \n\n**A1.2:** Yes, GNR can inherit the robustness of LDM, as present in the 1st and 4th rows of Table 6. However, since GNR uses an approximate objective, it may extract a little high detection score from an unwatermarked image sometimes (low TPR@1%FPR but high bit accuracy in the 4th row and S. Noise line of Table 6). Therefore, it is necessary to fuse the frequency score for a lower FPR.\n\n**Q2:** Even though the proposed method does not achieve state-of-the-art performance under all attack, it achieves competitive results. However, comparing with other methods with similiar performance (RingID, TreeRing, etc), the proposed method needs additonal training.\n\n**A2:** GaussMarker does need additional training, but the cost is minimal and the training is model-agnostic. As presented in the table below, the training of GNR only needs 72 minutes on 1 V100 32G GPU. Moreover, the time overhead incurred by GNR and Fuser during the detection phase is almost negligible.\n\n| Phase     | Inversion | GNR         | Fuser          |\n|-----------|-----------|-------------|----------------|\n| Training  | -         | 72 min      | 1.4×10⁻¹ s     |\n| Detection | 6.5 s     | 1.2×10⁻³ s  | 1.0×10⁻⁴ s     |\n\n**Q3:** Comparing other attacks, why applying Gaussian Noise attack in a multiple user applicaiton would grealty downgrade the accuracy is not clear, could the author provide some comment on this?\n\n**A3:** When the number of users increases, higher bit accuracy is required in extracting watermarks from images to ensure high identification accuracy. For example, consider injecting a 3-bit watermark (ignoring unwatermarked images for simplicity). With two users assigned watermarks \\{0,0,0\\} and \\{1,1,1\\}, an estimated watermark $\\tilde{w}$=\\{0,0,1\\} allows us to correctly identify the first user with just 66.7\\% bit accuracy.\n\nAs presented in Table 1, the bit accuracy under Gaussian Noise is the most unstable. Under Gaussian Noise attack, GaussMarker only obtains 0.989 TPR\\@1\\%FPR, which means that nearly 11 watermarked images don't get high bit accuracy. Therefore, it is affected by the number of users greatly.", "claims_and_evidence": "The claims are supported by experiemnts", "methods_and_evaluation_criteria": "The method includes two part: the first is a dual-domain watermark encoder and the second is a GNR for watermark robustness improvement. However, the assumptions that $\\left(\\mathcal{T}\\left(x^{s, f}\\right)\\right) \\approx \\mathcal{T}\\left(z_T^{s, f}\\right)$ might not stand in some cases where the watermarked images have some differences with the source image.", "theoretical_claims": "The theoretical claims are correct", "experimental_designs_or_analyses": "Ablation experiments are conducted, various attacking method are considered when evaluating the method. \n\nHowever, in table 1, it seems that the propsoed method are more rebust than other watermarking method only under rotaion and C&S attack. Any comments?\nMoreover, as the GNR is trained in latent space, does it mean that it would be reobust on image space attack like JPEG and Brightness.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Strengths:\n\nThe dual domain design and score fusing is novel and can improve the robustness for watermark detection.\n\nWeaknesses:\n\nEven though the proposed method does not achieve state-of-the-art performance under all attack, it achieves competitive results.\nHowever, comparing with other methods with similiar performance (RingID, TreeRing, etc), the proposed method needs additonal training.", "other_comments_or_suggestions": "Comparing other attacks, why applying Gaussian Noise attack in a multiple user applicaiton would grealty downgrade the accuracy is not clear, could the author provide some comment on this?", "questions_for_authors": "N/A", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper has received all weak acceptances in the final recommendations. This paper proposed GaussMarker, which embeds watermarks into the noise vector of diffusion models within both the spatial and frequency domains. Although the reviewers expressed concerns about the unclear justification and insufficient experimental analysis, the authors' rebuttal effectively addressed several of these issues. This led to a consensus among the reviewers in favor of acceptance. Consequently, the Area Chair has decided to accept this paper.
Decision: Accept (poster)