Disentangled Style Domain for Implicit $z$-Watermark Towards Copyright Protection
Authors: Junqiang Huang
Zhaojun Guo
Ge Luo
Zhenxing Qian
Sheng Li
Xinpeng Zhang
Venue: NeurIPS 2024 poster (2024)
Keywords: Dataset Copyright Protection; Text-to-Image Model; Diffusion Model；Watermark
Primary area: privacy
TL;DR: We propose a novel implicit watermarking scheme that leverages a disentangled style domain to detect data unauthorized usage.

Abstract: Text-to-image models have shown surprising performance in high-quality image generation, while also raising intensified concerns about the unauthorized usage of personal dataset in training and personalized fine-tuning. Recent approaches, embedding watermarks, introducing perturbations, and inserting backdoors into datasets, rely on adding minor information vulnerable to adversarial training, limiting their ability to detect unauthorized data usage. In this paper, we introduce a novel implicit Zero-Watermarking scheme that first utilizes the disentangled style domain to detect unauthorized dataset usage in text-to-image models. Specifically, our approach generates the watermark from the disentangled style domain, enabling self-generalization and mutual exclusivity within the style domain anchored by protected units. The domain achieves the maximum concealed offset of probability distribution through both the injection of identifier $z$ and dynamic contrastive learning, facilitating the structured delineation of dataset copyright boundaries for multiple sources of styles and contents. Additionally, we introduce the concept of watermark distribution to establish a verification mechanism for copyright ownership of hybrid or partial infringements, addressing deficiencies in the traditional mechanism of dataset copyright ownership for AI mimicry. Notably, our method achieves one-sample verification for copyright ownership in AI mimic generations. The code is available at: [https://github.com/Hlufies/ZWatermarking](https://github.com/Hlufies/ZWatermarking)

Disentangled Style Domain for Implicit z- z-Watermark Towards Copyright Protection
Junqiang Huang
Zhaojun Guo Department of Computer Science
Department of Computer Science
Fudan University
Fudan University 221 02110240087700 @m. fudan. edu cn
23210240188am fudan edu.
Ge Luo Department of Computer Science
Zhenxing Qian Department of Computer Science
Fudan University gluo uo 18dfudnn edu. cn
Fudan University zxqi an@fudan. edu. cn
Sheng Li
Xinpeng Zhang"
Department of Computer Science
Department of Computer Science
Fudan University 1 sheng@fudann edu.
Fudan University zhangxinpengSfudan. edu, cn
Abstract
Text-to-image models have shown surprising performance in high-quality image generation, while also raising intensified concerns about the unauthorized usage of personal dataset in training and personalized fine-tuning. Recent approaches, embedding watermarks, introducing perturbations, and inserting backdoors into datasets, rely on adding minor information vulnerable adversarial training, limit- ing their ability to detect unauthorized data usage. In this paper, we introduce a novel implicit Zero-V Watermarking scheme that first utilizes the disentangled style domain to detect unauthorized dataset usage in text-to- image models. Specifically, our approach generates the watermark from the disentangled style domain, enabling self tuffgennrraizztion and mutual exclusivity within the style domain anchored by protected units. The domain achieves the maximum concealed offset of probability distribution through both the injection of identifier and dynamic contrastive learning, facilitating the structured delineation dataset copyright boundaries for multiple sources of styles and contents. Additionally, we introduce the concept of watermark distribution to establish a verification mechanism for copyright owner- ship of hybrid partial infringements, addressing deficiencies in the traditional mechanism of dataset copyright ownership for Al mimicry. Notably, our method achieves one-sample verification for copyright ownership in Al mimic generations. The code is available at: https: : //github. com/ of ies TWatermarking
Introduction
Recent advancements in text-to-image generation technologies [1, 2, 3] have revolutionized art creation by enabling users replicate the unique styles of artists and images through simple prompts. Simultaneously, text-to-iman personalization technologies [4. 5, 6, 7] make it easy to fine-tune generative models with minimal online personal portfolios, which may not be authorized.
"Corresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

However, question arises: are individual styles and contents entitled to copyright protection? Re- cent studies [8, 9, 10, 11] indicate sigmificant visual and stylistic similarities between Al- -l-generations and unauthorized datasets. For example, an Al-generated image of "a vast grassland in the style of Van Gogh's Starry Night" inherently associates with Van Gogh's 's artistic domain, even without direct replication of the original artwork. Therefore, a new paradigm is needed to emphasize ownership of styles and content for dataset copyright protection.
Several methods have been proposed for personal dataset copyright protection, including Glaze [12], DIAGNOSIS [13], and Luo et al. [14]. Glaze safeguards personal datasets by introducing calculated perturbations to prevent AI style mimicry during fine-tuning, but Bochuan et al. [15] demonstrate these perturbations are vulnerable to adversarial purification. Furthermore, Glaze's 's approach inher- ently restricts legitimate training uses. Besides, DIAGNOSIS, which constructs backdoors based on diffusion model memorization, is an approach to copyright protection. However, integrating backdoors into the datasets may introduce new harmful security risks [16]. Meanwhile, Luo et al. use digital watermarking to detect unauthorized usage, but it lacks robustness, as shown in [17].
To address the above problems, we introduce an implicit Ferr-Watermarking scheme that focuses on the distinct style and creative essence ingrained within datasets, rather than merely the digital carriers (e.g., digital images). Inspired by recent studies in disentangled representation learning [18, 19, 20, 21, 22] and IP customization [23, 24, 25]. we consider that image generation is conceptualized as a regularized entanglement of styles and contents, within the mutually exclusive contraction domains generalized from the anchor of the original samples. Unlike existing methods of embedding invisible information into protected datasets, our approach quantizes the domains representing protected style and content representations into implicit watermarks to delineate the copyright boundaries.
In this paper, we aim to generate implicit watermarks from the disentangled style domains of protected units, enabling self-generalizattoo and mutual exclusivity. Specifically, we initially employ the style domain encoder to disentangle each protected unit into its style representation. serving as the center anchor points for the contraction domain. Then, we generalize the contraction domain by the dynamic contrastive learning between central samples and boundary samples of the specific protected unit. Finally, the domain achieves the maximum concealed offset of probability distribution through both the injection of identifier 2 and dynamic contrastive learning, enabling copyright boundary delineation quantized as implicit watermarks. During the verification phase, to address the complex copyright boundaries in image generation with multiple sources of styles and contents, we propose a verification mechanism utilizing the style domain and watermark distribution to tackle hybrid or partial infringements. We highlight our main contributions as follows:
1. We propose a novel watermarking method for dataset copyright protection against unautho- rized Al mimicry. To the best of our knowledge, this work is the first study that facilitates the structured delineation of dataset copyright boundaries in the disentangled style domain. No- tably, experiments demonstrate that ours accomplish the one-sample verification challenge for copyright ownership of hybrid or partial infringements.
2. We utilize strategies for the self- gefereaeaaliinn and mutual exclusivity of 2-watermarking, breaking away from the traditional methods of embedding invisible information into datasets.
3. To tackle hybrid or partial infringements in image generation with multiple sources of styles and contents, we introduce the concept of watermark distribution establish verification mechanism for dataset copyright ownership by the disentangled style domain.
4. Extensive experiments on benchmark datasets demonstrate the effectiveness, robustness, and versatility of our method against various challenges, including adversarial fine-tuning methods (e.g.. Dreambooth), watermark removal (e.g.. Latent attack) and the usage detection of unauthorized data in black-box cross-APls and models (e.g., DALL-B-3).
2 Related Works
2.1 Text-to-Image Generation and Diffusion Models
Recently, the field of visual synthesis has experienced significant advancements, with various research [1, 26, 27, 28, 29, 30, 31, 32] achieving impressive outcomes. Notably, diffusion models [1, 30, 31, 32] have emerged as pioneers in image generation, surpassing carlier models based on adversarial

---

generative networks [26, 27] and autoregressive methods [28, 29]. Among these, Stable Diffusion [31] stands out for its noteworthy contributions to latent diffusion models. Besides, recent studies, such as
Lora [4], Dreambooth [5], Textual inversion [6], and ControlNet [7], have shifted towards personalized fine-tuning of pre-trained diffusion models. These advancements empower individuals to replicate specific styles and contents with just minimal shared unauthorized samples.
Mimic Fine-tune Phase
Generation Phase
Verification Phase
Unauthorized data
Verifying successfully
Styles and Contents
Mimic Model
Style Domain
Fine- tune
G
Generate
Watermark Extractor
Prompt
Attocker
Defender
Siilority Dissimilonty
Figure 1: The main pipeline of dataset copyright verification with our method. Notably, we use the watermark extractor (with specific K watermark mapping relationships) and identifier to detect protected datasets usage, instead of the traditional embedding and extraction pairing process.
2.2 Preventing Unauthorized Data Usage
There are several ways [12, 13, 14, 33, 34, 35, 36] prevent unauthorized data usage. Adversarial example-based methods (i.e., Glaze [12], AdvDM [33], and Anti-Dreambooth [34]) introduce perturbations induce mimic models to learn different image styles during training and tinettniigg Nevertheless, the added perturbations are dependent on and constrained by the surrogate model, resulting in weak generalization and transferability. Besides, backdoor-based dataset ownership verification [13, 35, 36] is conducted by defenders triggering whether suspicious models exhibit specific backdoor behaviors. However, the integration of backdoors into datasets could introduce new harmful security risks, as indicated in [16]. At the same time, Luo et al. [14] propose watermarking framework for detecting art theft mimicry based on digital watermarking techniques [37, 38, 39, 40]. However, the robustness of these is insufficient, as they are easily removable, as indicated in [17].
2.3 Disentangled Representation Learning
Disentangled representation learning [41] aims model the factors driving data variations [42]. Early works [43] used labeled data to factorize representations in a supervised manner. Recently, unsupervised method [44] has been largely explored, especially for disentangling style and content from the image [45, 42, 46, 47, 48]. Inspired by recent studies in disentangled representation learn- ing [18, 19, 20, 21, 22] and IP customization [23, 24, 25], we consider that the act of generating them from scratch requires a deep understanding of the underlying factors and complex generative processes, unlike mere analysis of text or images. In other words, image generation conceptualized as entangled combinations of styles and contents of the original samples. Taking this viewpoint, we redefine the concept of image beyond digital forms, viewing them as compositions multiple representations that serve as class-free guidance for diffusion models in seff-disentanglement Addi- tionally, since these disentangled representations are mutually exclusive high-dimensional space, they naturally demarcate copyright boundaries through mutual exclusivity.
3 Method
3.1 Threat Model
Attacker's Goal and Capability. Attackers could train or fine-tune on protected datasets (D) to replicate the styles and contents of personal portfolios, exploiting them for financial gain or involvement in criminal. The attacker's capabilities are follows:
3

---

Unauthorized access to proprietary datasets, such personal portfolios and photo albums.
Utilize data attacks like second-stage fine-tuning, mixed-cleat dilution, purification- latent attack, prompt attack, and data augmentations to remove potentially hidden information.
Just publicize the APIs and keep the mimicry details hidden, including fine-tuning ap- proaches and training parameters.
Defender's Goal and Capability. The defender aims to detect single or minimal instances of mimic images, i.e., publicly available online or offline, to track back copyright ownership. Before sharing data, defenders register the identifier and implicit watermarks W3 for protected units with a third party. The defender's capabilities are follows:
General Ability:
Defenders obtain stylized mimic images from known suspicious models or APIs verify copyright ownership in black-box setting.
Limited Ability: Defenders occasionally and randomly acquire minimal (even single) mimic images online or offline without any prior knowledge.
3.2 The overview of c-Watermarking
The overview of method is depicted in Figure 2. Our pipeline consists of three phases. Initially, all units within the protected dataset are disentangled, with the contraction domain embedded within the style domain. This is achieved by maximizing the offset via identifier z, ensuring non- overlap. Subsequently, self-generalization of each contraction occurs through dynamic contrastive learning between the central and boundary samples of the protected unit. Finally, the watermark is implicitly quantized based on the mutual exclusivity of contraction domains, leveraging their distinct representations of style and content.
Style
somples
DDPM
Deontanggg
dacoratnutice
9
9x
Sple Of
Style domoin
Controction domain
G
Aechor
Grewes Kinaga
M
sample
Boundory somple
GLIP
Discriinator
Normal sample
Mopping
GoneraRzation samples
2 [iontt "swz"]
Disentongled representaions
Contraction domatn
Disentangling Styles and Contents Phose
Mutual Exclusivity Phase
Self-Generolizattin Phase
Figure 2: Overview of z- w-watermarking, In this framework, acts the key unique bias of the disentangled style domain S₂ protected units, and Q denotes the dynamic historical negative queue.
3.3 Disentangled Style Domain for Watermarkin
The style domain encoder & (ResNet) and denoising decoder De (UNet with 2m + 1 activation layers) are formally defined by a pair of forward and backward Markov chains representing T-steps transformation from normal distribution 2T ~ (N(0, 1) into the learned distribution än ~ po (z()) We aim to achieve disentanglement of images the latent level. To this end, we regularize data æ into latent representations Zz, which follow a Gaussian distribution N, using a Variational Autoencoder (VAE) as follows.
(=<2=1 = NN (f (z))).
(I)
Eq.1 denotes the probability distribution gø (2z (a:) for 2g, which is the mean u(x:) and variance o² (x) of Zz (i.e., @ denotes the parameters of VAE). The style domain encoder is represented as follows:
(1 (xx, Φ), 2) = 8, where [ = [ (i.e., 81.m semantically or visually relates to xr). Identifier serves as the key special bias of the style domain S.. Identifier can be the spatial embedding
vector (e.g.. image, text, audio, model, etc.). this paper, we set the text 'swz' to be converted into
text feature embeddings by CLIP (i.e.. dx)) z. embedding it into E. Then, partition the vector

---

into m + 1 sections, which is half the number of layers in the decoder Dz. Each V E s is utilized to modulate the corresponding pair of layers (h,, fimm-i), thus fostering specialization among the latent sub-vectors. Moreover, we implement layer-wise guidance dropout by selectively zeroing out portions of $1:m, thereby diminishing the decoder's dependency on sub-vector correlations. The details and tricks are in the supplemental material, and we derive pre-trained style encoder trained in MS-COCO.
Based on the pre-trained style domain encoder, we design the parameters 0g of the discriminator and the fe of watermark extractor. Specifically, let D { that denotes the protected dataset, where K' is the number of the protection units (i.e., each sample or class with shared attributes). Let D. (=:")) ii=l,==1 denotes mimic samples that include K subsets of protected units generated by the surrogate model M trained on D, where N is the number of mimic samples for the k-th protected unit. The optimization objective is as follows:
E (())
(a((skk
$/ (( 2, : 0a) L (5k5 2, wki 0w))
s.t. 0" arg min D. Hal
Σ Σ SEND (H)
(Ja(sk (()) +b)
[Da
where c E C denotes the class of k-th protected unit, and wi denotes the mapping watermark relationship to k-th contraction domain. F. denotes the cosine similarity function, and L(-) is the loss function (e.g., H. is cross entropy loss, H2 is mse loss). Specifically, identifier 2 denotes the representation is shifted to the marginal distribution. Moreover, in Eq.2 represents the domain regularization term, aimed at achieving dynamic self- eeff-generalization and mutual exclusivity of the contraction domain according to the following constraints as Eq.3 and Eq.4.
1
Σ SDD
I(sk,
st)s
Σ SENDE
I(sk: $
(3)
IDK
D
Let 2y E D and {1
(m) } = D E D., where D.c denotes the similar mimic set of the k-th protected unit øg. Let D D D where n,t E Ditt is the central sample of the contraction domain of
Tki and x; E D is the boundary sample of the contraction domain. e denotes the boundary value of the contraction domain and II(-) denotes the distance function. We aim for the contraction domain to ensure self- eeff-genrallzzatonn in Eq.3, while evolving mutual exclusivity in Eq.4. Let x & D denote the complement of D serving as the negative samples, where D.* D3 - DD.
II
((88) > (c 3)IP"IXIP.*
(4)
where 33 is a positive hyper-parameter. To achieve the above constraint, let / = A + A23/2, where '₁, A2 are two hyper-parameters. t/1 aim to achieve self ceffageneralization and th ensures mutual exclusivity and maximum offset described in $3.4 and $3.5.
3.4 Self-Geenralization Module
As previously mentioned, we aim to explore the style boundaries of the contraction around the anchor sample Fę to establish the range we want to protect. ti1 aims to achieve self geff-generalizttion in Eq.5.
exp(sk st/7
11 log
(5)
N Σ exp(sk ① 8:/T)"
where sy ~ D, st D and 5 ~ D T the temperature parameter. We designate a subset the k-th protected unit as positive samples and the rest negative (normal). Notably, sş is disentangled by E,, while s; and st disentangled by E.. Representing the parameters of & as 0 and those of E as 0', we update 0' by momentum update: 0' +- mád + (1 - m)0. where m is a momentum coefficient. Only 0 are updated by back propppropagttion.
5

---

3.5 Mutual Exclusivity Module
Let Sy ~ D, s ~ D and s; ~ D. The contraction domain of the protected unit is quantized the predefined implicit watermark via &,. Formally, the regularization term the is defined in Eq.6.
exp(#2 @ 81/T)
2/2 log E LS exp(5k 8%: @ (s 9)//))
(6)
where Q denotes the dynamic historical negative queue. Q is initially populated with anomalous samples and anomaly identifiers, consistently serving as negative instances for contrastive learning. Here, we also employ momentum updates of Eg to encode negative examples.
Dataset Copyright Verification via 2- Watermarking
One-Sample Verification. We aim to verify copyright ownership using single or minimal mimic images. To achieve this, we propose leveraging the disentangled style domain to facilitate the structured delineation of dataset copyright boundaries. Experiments show that our method offers effective copyright verification, with the single-sample success rate far exceeding the baseline, in Table 2. The probability of the watermark guided by in the contraction domain of the protected unit denoted as Eq.7
qo. (Zembl 2)
Pz(2|0 ~ D) 24. K (c 3)KxXPX(K-II)
(7)
where lim (x(1)) - 1 indicates (mimic sample) originating from protected 'D is an extremely x>D
unlikely probability event (i.e., 7) denotes infinitesimal). The occurrence of extremely low-probability events ensures the credible mathematical basis for the ownership of sample copyrights. Meanwhile, in generative scenarios, the challenge of identifying the target carrier ( relying solely on manual similarity judgments) renders traditional one-to-one watermark verification mechanisms limited.
Extensive Statistical Verification. To further validate our method's 's effectiveness from multiple perspectives, we propose the concept of watermark distribution. Assuming the multi-styles and multi-contents of T' datasets are present in D T defenders utilize { = disentangle the image generations. Let &z, (x) = (ca, we), where e E {0, k2) and k2 E K2 (i.e., K, is the number of protected units of t-th dataset, and the corresponding watermark is wk,)) Watermark distribution is defined as Eq.8.
t@wd E
(Folwe, Wk. Ne.=k
()) $3 Pm
8
1Dml
Let 1ick@100%wwds = w@ arg mazk, (Fo(.) = 100%, Ct k that denotes the best distribution (i.e.. within Dm the number of samples of the type of t-th datasets is the largest) in the most accurate distribution (i.e., with bits accuracy reaching 100%). When assessing data copyright for single-party verification, two criteria must be fulfilled: Aug acc > a and 10kk100%wdd > 7, where Aeg acc represents Average Watermark Accuracy. In this paper, the threshold for is set to 0.99, and the threshold for y set to 0.80. For multi-party hybrid or partial infringements, copyright ownership is determined by comparing the maximum value of t0k@ 1100%100dw wd tested across T different style domain encoders D... attributing it to the k-th unit of the 1-th protected dataset.
Experiments
5.1 Experimental Setting
Datasets and Models. In this paper, we pre-train the style domain encoder [49] and decoder [50] on MS COCO [51]. We conduct experiments on three open-source benchmark datasets (i.e., CelebA [52].
Pokenmon [53], Dreambooth dataset [5]), 17 Artists (e.g. Van Gogh and Monet) and 10 AI' artworks (e.g., GhostMix and CatLora). The surrogate model is Stable diffusion v1.5 [32] fine-tuned (i.e.,
Lora [4] and Dreambooth [5]) on the benchmark datasets. Moreover, the attackers include Stable Diffusion v1 v1.00, and the APIs of DALL-B3 [3], Imagen2 [1], PG-v2.5 [54], PixArt-a [55].
We use CLIP to extract the Zemb of text-z in our setting. Specifically, we randomly select subset containing K protected units from each dataset for training (i.c., N mimic images per unit generated).

---

Baseline and Metrics. We compare our pipeline against existing digital watermarking methods (i.e.. DCT-DWT-SVD [39], RivaGan [37], SSL [40], Trustmark [56]), and RoSteALS [57]). We evaluate each method's performance using average watermark accuracy (Ang acc) and watermark distribution metrics (tWrd and (ak@100%0m as defined in $4). Additionally, we employ FID and CLIP Score to evaluate the quality of A Al-generation, and True Positive and True Negative to measure Discriminator performance.
100
90%
50
Bit accuracy
75%
60%
60%
-50
-100
40%
(a) The watermark distribution across generated sam- ples from 10 random protected units.
(h) The t-SNE of feature representations for mimic samples from random protected units in Artists.
Main results for our method. The left subfigure compares watermark distribution between mimic (Red) and no-mimic (Blue) models from 10 random protected datasets. The right subfigure illustrates the structured delineation of style domains' boundaries.
Figure 3:
5.2 Main Result
To benchmark the effectiveness of the watermark, we primarily report the watermark distribution across 1000 image generations from all units of each protected dataset the black-box validation scenario of Al mimicry, utilizing Aug ace and @ 100%wd (i.e., the proportion of samples where watermark bit accuracy hits 100%) for evaluation.
Table 1: Main results. We enumerate the sample count within each range of watermark distribution (128 bits) from 1000 mimic images of all protected units for both mimic and non-mimic models.
The sample counts within each range of watermark distribution
128-bit
w mimimirry
Aug aco(%)
t0k0100%% (%)
0-20%
20-40%
40-60%
60-80%
80-90%
90-100%
CelebA
0
272
495
231
0
$1.46
0
995
99.81
98.1
0
249
513
227
11
0
49.26
0 96.4
CUB
5
988
99.56
127
341
55.71
0 98.1
Dreambooth
/
0
0
996
99.97
Artists
x
124
455
419
0
55.83
0 97.9
/
0
1
993
99.87
Als
x
0
144
561
292
0
99.95
$2.20
98.0
0
Main experimental findings regarding watermark distribution validation on both mimic and no- mimic models across five datasets are detailed in Figure 3a and Table Our method outperforms the watermark distribution under random states, which are not exposed on the protected dataset. Specifically, our average accuracy exceeds 99%, significantly higher than the approximately 50% of the -onninfringement state model. Such a significant difference in watermark distribution is one of the key pieces of evidence for copyright authentication. Additionally, we compare our method with digital watermarking approaches in Table 2, where our method achieves an Aug ace of 99.83% surpassing others that reach only around 60%. Notably, cases of 100% watermark accuracy (f@k@100%wdl the proportion of samples using digital watermarking methods is deficient, whereas
7

---

our method reaches 97.7%. This indicates the failure of digital watermarking in attributing ownership in Al mimiery scenarios, contrasting with the effectiveness our proposed method.
Table 2: Main results. Comparison of results across different watermarking methods. The stark disparity in t@ 100%wo between our results and the bascline reveals that traditional invisible watermarks are prone be removed diluted during diffusion training.
Method Aug acc (%) t
t0k@0 (%)
DCT-DWT-SVD
57.76
S 0.1
RivaGan
61.34
$ 0.1
SSL
64.39
S 0.1
Trustmark
55.37
6.6
RoSteALS
66.50
7.9
Ours
99.83
97.7
5.3 Robustness Study
To benchmark the robustness of our watermark, we document its performance against various attack methods. These include identifier error, second-stage fine-tuning with 1:10 ratio between original and generated images, mixed clean fine-tuning with a blending rate of 0.1, watermark removal in latent attack [17], and prompt attack with different description in black-box scenarios. Additionally, we utilize data augmentations as attacks, consisting of 90" rotation, 50% JPEG compression, 60% center cropping and scaling, Gaussian blur with x filter size. color jitter with a hue factor of 100, along with adjustments to brightness by a factor of 1.5 and contrast by factor of 2.0.
Table 3: The results of the robustness study. We conduct robustness experiments from various attack perspectives, including identifier error, second-stage fine-tuning, mixed clean fine-tuning, watermark removal in latent attack, prompt attack, and image augmentations.
The sample counts within each ningo of wateomark distritution
128-bit
0-20%
20-40%
40-60%
60-80%
80-90%
90-100%
FID
CLIP
Ang acc (%)
181-3100% (9))
w/o mimkery w/o Attack
124
455
419
2
D
55,71
266.48
0.9491
Second-stage Fine-tune
7
975
271.54
0.9358
99.13
93.3
Mixed Clean Fine- tune
11
29
35
944
259.89
0.9337
99.04
92.2
Latent Attack
19
24
925
289.75
0.9094
95.81
87.2
Prompt Atiack
Contrast
11
972
318.39
0.8951
99.01
92.2
JPEG
10
14
968
307.41
0.8399
98.97
91.6
GausianBBur
11
17
15
957
341.04
0.9811
98.50
89.8
Brightness
0.8839
ConterCrop
379.10
0.8716
Hue
80
50
833
339.76
0.8362
94.44
68.6
Rotation
17 294
415
108
169
394.54
0.8124
83.66
14.8
In Table 2, baseline methods fall short in attributing copyright ownership due to their inability to extract the complete watermark, achieving a likelihood of less than 0.1. Conversely, our methods demonstrate heightened reliability. Table reveals that even under adversarial conditions, we can extract numerous samples with 100% bit accuracy, surpassing the performance of baseline models (i.e., @@k@ 100 less than 0. 0.). Notably, while attacks decrease LGk 100%av,, only a certain proportion of @@A@ 100%wd samples is required for verification in Al mimicry copyright attribution. This is attributed to the improbable occurrence of such events natural state, as outlined in Eq.7.
5.4 Generalization Study
To benchmark the generalization capability of our watermark, we document its performance in copyright verification within the landscape AI mimicry, considering an array of fine-tuning models and black-box APIs in Table 4. We set the surrogate model to Stable Diffusion v1.5. Our primary focus lies on examining generalization across Stable Diffusion v1.5 (i.e., Lora and Dreambooth) & v2.0, well the APIs of PixArt-a, PG-o2.5, DALL-E-3, and Imagen2. Each model and AP1 instructed to generate 20 images for inspection using the prompt "An art piece resembling the style of 'ttrryy Night",, aiming discern whether the attack model has been exposed to Van Gogh's

---

portfolios. In Table 4, our method achieves 100% Aug ace on most suspicious models, with an overall average 98.60%. The average level of 94.29%. Additionally, it achieves 100% accuracy in True Positive (TP) detection, as well as 100% Arg ace and / 100%dd.. As depicted Figure 4, our proposed method provides strong evidence of its ability to detect imitation behavior of commercial APIs like PixArt-o using few suspicious samples.
also reaches nearly 100% on most models, with an
(a) Van Gogh
(b) Dreambooth, v
Lora, V
(d) SD-v2.0,
(e) DALL-E-3,
(I) PixArt-a, v
(g) PGv2.5-a, v
(h) Imagen2.
Figure 4: The results of generalization study. Each API or model is instructed to generate the image for data copyright ownership using the prompt "An piece resembling the style of 'Starry Night". Among them, subfigure 4a represents the protected sample units, while subfigures 4b-4h, represent the suspicious mimic samples generated by various suspicious models.
Table 4: The results of generalization study. Utilizing the prompt "An art piece resembling the style of 'ttarry Night"", we generate 20 images by suspicious models and APIs of black-box.
Attacker models/APIs
FID
CLIP
TP
TN
Aug ace (%)
f@ w00%wd (%)
SD-v1.5 + Dreambooth
259.76
0.9484
20
0
100
100
SD-v1.5 Lora
265.21
0.9396
20
0
100
100
SD-v2.0
267.38
0.9163
20
0
100
100
PixArt-a
285.09
0.9011
20
0
100
100
PGv2.5
301.94
0.8836
19
1
98.98
95.0
DALL-E-3
318.13
0.8966
18
2
97.02
85.0
Imagen2
326.09
0.9368
17
3
94.35
80.0
Average
289.09
0.9175
98.60
94.29
5.5
Ablation Study
We hereby discuss the effects of several key hyperparameters. involved in z-watermarking, Please find more experiments regarding other parameters and detailed settings in the Appendix.
Model Component Study. We evaluate the effectiveness of our components: Disentangled Style Domain D, self-gemeralizattion module th, and mutual exclusivity module tiy. As shown in Figure 5a and 5d, we compare Ang acc and #@k 100%wdl across five datasets. demonstrates that omitting any proposed components leads decline in the model's performance. Notably, the Disentangled Style Domain enables the t 100%wd to rise from around 60% to over 90%, while the addition of 4/ and 2/2 further optimizes the model achieve performance exceeding 99%.
Data Scale Study. We next explore relationship between the training data scale and validation data scale in Figure 5b and 5e, which is crucial for real-world copyright protection scenarios. Experimental

---

evidence suggests that minimal set can propel our model to an above 99% Aug acc. Besides, high t@k@ 100%wd is observed on limited scale of validation dataset, reflecting the effectiveness of practical validation settings, where access to the APIS of suspicious black-box mimic models.
Bit Length Study. Watermark bit length serves as the bedrock of copyright verification reliability theory in Al mimicry scenarios. Figure 5c and 5f present experiments validating lengths from 32 512 bits across five datasets. Notably, experiments with a bit length of 512 demonstrated higher average accuracy and 10k@100%wd, highlighting the scalability and reliability of z- z-watermarking.
100.0
100.0
10000
98.0
99.8
Desset
98.0
Trankng
99.6-
Draie
94.0
CU
97.0
Aug
99.4
92.0
Aziaa
96.0-
99.2-
1300
90.0
Dee?
95.0-
10
100
500
1000
99.0-33
32
64
158
256
512
Ablation Configuration
Validing Scale
Bit Length
(a) Varieble-Model Component
(b) Sariable-Date Scale
(c) Variable- Bit Length
100.0-
100.0
100.0
köng kingg 100%ced (%)
90.0
97.0-
kgigg 1ongoo
96.0-
30.0
Donectt
94.0-
Truning Seale
Daract
91.0
60.0
88.0
130
84.0-
50.0
3
5
Degg
AV
85.0
100 500
1000
80.0
32
64
128
256
512
Ablation Configuration
Validing Scale
Bit Length
(d) Vodieble-Model Component
(e) Variable-Data Scale
(l) VariaalleBii Length
Figure 5: The results of Ablation study. We performed ablation experiments mainly model components (Distangled style domain D, self self-generalizatonn e'1 and mutual exclusivity th2), data scale (ranging from 10 to 1000), and watermark bit length (ranging from 32 to 512).
Discussion and Limitation
To enrich our experimental dataset, gathered a lot of contemporary authorized artworks, historical artworks, and Al-generated pieces. We at this moment affirm that this collected data is specifically for the experiments related to our method and is not for any other use.
Ethical Statement:
Limitation: Our proposed method focuses on the disentangled style domains of protected units. Consequently, modifications to the deep features of style domains using existing techniques (e.g.. style transfer or bias injection), are expected to influence our performance. Although our robustness study confirms our reliability against various attacks, the potential impact of specific targeted attacks (e.g., Glaze) on performance degradation could not be overlooked. To address this challenge, adding specific adversarial samples for adversarial optimization could guide our future research. Additionally, the fine- tuning performance of the surrogate model may slightly affect the experimental results, so is necessary to set the optimization parameters appropriately.
7 Conclusion
This paper presents the first study on the disentangled style domain for implicit watermarking to detect unauthorized data usage of Al mimicry, from the perspective of entity protection in styles and contents. Extensive experiments demonstrate the superiority of z-watermarking compared to the baseline. Notably, our method achieves one-sample verification for copyright ownership of hybrid or partial AI infringements. We aspire for our work advance the ethical evolution of future artificial intelligence, ensuring due respect for creators' copyrights.
Acknowledgements
This work was supported by the National Key R&D Program of China under Grant 8023YFF0905000
10

---

References
[1] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphacl Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, al. Photorcalistic text-to- image diffusion models with deep language understanding. Advances neural information processing systems, 35:36479-36444 2022.
[2] Yu Takagi and Shinji Nishimoto. Nigh-resolution image reconstruction with latent diffusion models from human brain activity. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattemn Recognition, pages 14453-14425 14463, 2023.
[3] James Betker, Gabriel Goh, Li Jing. Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, et al. Improving image generation with better captions. Computer Science. https://cdn. openai. com/papers/dall pdf. 2(3):8, 2023.
[4] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106. 09685. 2021.
[5] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dream- booth: Fine tuning text-to-image diffiusion models for subject-driven generation. Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22500-22510, 2023.
[6] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashník, Amit Bermano, Gal Chechik, and Daniel Cohen-Or, An image worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint XXiv:2208.00618, 2022.
[7] Lvmin Zhang, Anyi Rao, and Mancesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836-3847, 2023.
[8] Zhenting Wang, Chen Chen, Yi Zeng, Lingjuan Lyu, and Shiqing Ma. Alteration-frce and model-agnostic origin attribution of generated images. arXiv preprint arXiv:2305. 18439, 2023.
[9] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. In Proceedines of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 6048 0088660582200 2023.
[10] Inc. Getty Images (US). stability ai, inc. Last Updated: March 30, 2024, 6:25 a.m., 2023. Assigned To: Jennifer L. Hall.
[11] Anderson. Anderson v. stability ai, et al., Oct 2023. Citations: (N.D, Cal. 2023).
[12] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by feext-to-mmage models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2187-228722 2204, 2023.
[13] Zhenting Wang, Chen Chen, Lingjuan Lyu. Dimitris N Metaxas, and Shiqing Ma. Diagnosis: Detecting unauthorized data usages in text-to-image diffusion models. In The Twelfth International Conference on Learning Representations, 2023.
[14] Ge Luo, Junqiang Huang, Manman Zhang, Zhenxing Qian, Sheng Li, and Xinpeng Zhang. Steal my artworks for finc-tuning? a watermarking framework for detecting theft mimicry in text-to-image models. arXiv preprint arXiv:2311.13619, 2023.
[15] Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative ai. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 10657-10677, Curran Associates, Inc., 2023.
[16] Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking. JEEE Transactions on Information Forensics and Security, 2023.
[17] Xuandong Zhao, Kexun Zhang, Zihao Su. Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. arXiv preprint N..iv:23306019955 2023.
[18] Xinlei Chen, Zhuang Liu, Saining Xie, and Kaiming He. Deconstructing denoising diffusion models for self-superrised learning. arXiv preprint arXiv:2401. 114:2400..14444, 2024.
11

---

[19] Yingheng Wang, Yair Schiff, Aaron Gokaslan. Weishen Pan, Fei Wang, Christopher De Sa, and Volodymyr Kuleshov. Infodiffusion: Representation learning using information maximizing diffusion models. In International Conference on Machine Learning, pages 36336-36354, PMLR, 2023.
[20] Drew A Hudson, Daniel Zoran, Mateusz Malinowski, Andrew K Lampinen, Andrew Jaegle, James I. McClelland, Loic Matthey, Felix Hill, and Alexander Lerchner. Soda: Bottleneck diffusion models for representation learning. arXiv preprint arXiv:2311.1799 2023.
[21] Sarthak Mittal, Korbinian Abstreiter, Stefan Bauer, Bernhard Schölkopf, and Arash Mchrjou. Diffusion based representation learning. In International Conference on Machine Learning, pages PMLR, 2023.
[22] Zhizhong Wang, Lei Zhao, and Wei Xing. Stylediffusion: Controllable disentangled style transfer via diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 7677-7689, 2023.
[23] Zhen Li, Mingdeng Cao, Xintao Wang, Zhongang Qi. Ming- -Mng Cheng, and Ying Shan. Photomaker: Customizing realistic human photos via stacked id embedding. arXiv preprint arXiv:2312.04461, 2023.
[24] Hu Ye, Jun Zhang. Sibo Liu, Xiao Han, and Wei Yang. Ip-adapter: Text compatible image prompt adapter for text-to-image diffusion models. arXiv preprint #xXiv:2308.067211 2023.
[25] Qixun Wang. Xu Bai, Haofan Wang, Zekui Qin, and Anthony Chen. Instantid: Zero-shot eeeentty-preseeving generation in seconds. arXiv preprint arXiv:2401 107519, 2024.
[26] Bowen Li, Xiaojuan Qi. Thomas Lukasiewicz, and Philip Torr. Controllable text-to-image generation. Advances in Neural Information Processing Systems, 32, 2019.
[27] Yang Song and Stefano Ermon. Improved techniques for training score-based generative models. Advances in neural information processing systems, 33:1 1248-12448, 2020.
[28] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot texl-to-image generation. In Internatoonal Conference Machine Learning, pages 8821-8831. PMLR, 2021.
[29] Jiahui Yu, Yuanzhong Xu, Jing Yu Koh, Thang I Luong, Gunjan Baid, Zirui Wang, Vijay Vasudevan, Alexander Ku, Yinfei Yang, Burcu Karagol Ayan, et al. Scaling autoregressive models for content-rich text-to-image generation. Transactions on Machine Learning Research, 2022.
[30] Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Megrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In International Conference Machine Learning, pages 16784 16804. PMI.R, 2022.
[31] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[32] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06122 1(2)3, 2022.
[33] Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue. Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. arXiv preprint arXiv:2302.045 04578, 2023.
[34] Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti- dreambooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116-2127, 2023.
[35] Junfeng Guo, Yiming Li, Lixu Wang. Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed at hand. Advances in Neural Information Processing Systems. 36, 2024.
[36] Sheng- Yen Chou, Pin- Yu Chen, and Tsung- Yi Ho. How to backdoor diffuusion models? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015-4024, 2023.
[37] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv: 1909.0189. 2019.
12

---

[38] Ali Al-Haj. Combined dwt-det digital image watermarking, Journal of computer science, 3(9):740-746. 2007.
[39] Yuqi He and Yan Hu. A proposed digital image watermarking based on dwt-dct-svd. In 2018 8 2nd IEEE Advanced Information Management, Communicates. Electronic and Automation Control Conference (IMCEC), pages 1214-1218. TEEE, 2018.
[40] Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2022.
[41] Irina Higgins, David Amos, David Pfau, Sebastien Racaniere, Loic Matthey, Danilo Rezende, and Alexan- der Lerchner. Towards a definition of disentangled representations. arXiv preprint arXiv:1812.022300 2018.
[42] Hsin- Ying Lee. Hung- Yu Tseng, Jia-Bin Huang, Maneesh Singh, and Ming- -ssan Yang. Diverse image- to-image translation via disentangled representations. In Proceedings of the European conference on computer vision (ECCV), pages 35-51, 2018.
[43] Theofanis Karaletsos, Serge Belongie, and Gunnar Rätsch. Bayesian representation learning with oracle constraints. arXiv preprint arxiv: 150.:11500001111 2015.
[44] Hyunjik Kim and Andriy Mnih. Disentangling by factorising. International conference on machine learning, pages 2649-2658. PMLR, 2018.
[45] Yexun Zhang. Zhang, and Wenbin Cai. Separating style and content for generalized style transfer. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8447-8455, 2018.
[46] Hadi Kazemi, Seyed Mehdi Iranmanesh, and Nasser Nasrabadi. Style and content disentanglement in generative adversarial networks. In 2019 IEEE Winter Conference on Applications of Computer Vision (WACV), pages 848 856. IEEE, 2019.
[47] Dmytro Kotovenko, Artsiom Sanakoyeu, Sabine Lang, and Bjom Ommer. Content and style disentan- glement for artistic style transfer. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4422-4431, 2019.
[48] Gihyun Kwon and Jong Chul Yc. Diagonal attention and style-based gan for content-style disentangle- ment in image generation and translation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 13980-13989, 2021.
[49] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[50] Olaf Ronneberger, Philipp Fischer, and Thomas Brox, U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assisted intervention MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part 18, pages 234- 241. Springer, 2015.
[51] Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755 Springer, 2014.
[52] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pages 3730-3738, 2015.
[53] Justin N. M. Pinkney. Pokemon blip captions. pokemon- blip- captions/, 2022.
[54] Daiqing Li, Aleks Kamko, Ehsan Akhgari, Ali Sabet, Linmiao Xu, and Suhail Doshi. Playground v2. 5: Three insights towards enhancing aesthetic quality in text-to-image generation. arXiv preprint MxXiv:2402.1724, 2024.
[55] Junsong Chen, Jincheng Yu, Chongjian Ge, Lewei Yao, Enze Xie, Yue Wu, Zhongdao Wang, James Kwok, Ping Luo, Huchuan Lu, et al. Pixart-)allpha: Fast training of diffuusion transformer for photorealistic text-to-image synthesis. arXiv preprint 21Xiv:2310.00426 2023.
[56] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:231 2023.
13

---

[57] Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. Rosteals: Robust steganography using autoencoder latent space. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattem Recognition. pages 933-942, 2023.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: this paper, the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss the limitations of the work performed in this paper, and explore valuable research directions related the topic for the future.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sellsspeciiiationn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
15

---

Answer: [Yes]
Justification: The paper provides a complete set of assumptions and a thorough (and correct) proof for each theoretical result.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We have detailed the algorithm's specifics in both the paper and the appendix ensure the reproducibility of the experimental results presented in the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
16

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The code for reproducing main experiments is available at: https://giihe wat.luuiies/Naatrmrri......
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/
for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / /nips. cctpublic//eeeccccccccccccccecct cabbic/guiids///// /Coo//eoeeemeeeee sesssuummisioooi swiissosisiygoooooooo for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code permitted.
6. Experimental Setting/eetails
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We have provided training and testing details in the appendix (such as data splits, hyperparameters, selection methods, optimizer types, etc.).
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: In our experiments conducted across five datasets, each repeated five times under consistent settings, observed mean errors within 1%, leading to employ I-sigma error bars.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
17

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide sufficient information the computer resources required to reproduce each experiment in the appendix of the paper.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: https://neet /ttp::////ee...eeeeeeeeeeee wwwpurips.ccpppppleeeee cc/public/ httpppulcltihsseeeeeeepeppp csGuidelines"
Answer: [Yes]
Justification: Our research conduct in the paper adheres to the NeurIPS Code of Ethics in every respect.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss both the potential positive societal impacts and negative socictal impacts of our work in the paper.
Guidelines:
18

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploymentt of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper may poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cite and provide detailed descriptions of benchmark datasets and some related works the paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
19

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
If assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Our paper dose not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our work does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
Our paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
20

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
21


Reviews:
[{"review_id": "wShm7zNAmo", "reviewer": "Reviewer_z2Ei", "summary": "While text-to-image models excel in generating high-quality images, they also raise issues of unauthorized dataset copyright protection. This paper proposes a novel implicit watermarking scheme that detects and protects dataset copyrights by disentangling the style domain  to generate watermarks. The proposed method achieves One-Sample Verification, significantly improving existing copyright protection mechanisms.", "questions": "1. In line 150, “Moreover, we implement layer-wise guidance dropout by selectively zeroing out portions of  s_{1:m} , thereby diminishing the decoder’s dependency on sub-vector correlations.” Could you clarify the criteria used for this selection? Additionally, how does this approach effectively reduce the decoder’s dependency on sub-vector correlations? Is there existing literature that supports this conclusion, or can you provide a more detailed explanation?\n\n2. In the experimental section, line 216, the authors tested “17 artists (e.g., Van Gogh and Monet) and 10 AI artworks.” Given that copyright protection is an incremental task, as new artists or AI artworks are created, the number of protected entities will increase. This presents two potential challenges:\n\t1. How does the proposed method handle the increasing number of protected entities? Does it require retraining with each addition, or is there a more cost-effective solution?\n\t2. As the number of protected entities grows, will the styles of these entities influence each other, potentially reducing the model’s detection performance?", "limitations": "The authors have addressed the limitations.", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The authors are the first to utilize the disentangled style domain to detect unauthorized dataset usage in text-to-image models, and they have effectively implemented a method called z-watermarking to enhance copyright protection.\n\n2. The authors conducted comparative experiments with state-of-the-art protection methods and robust experiments under various conditions. They also performed comprehensive ablation studies, demonstrating the effectiveness and robustness of their method. The ablation studies verify the importance and effectiveness of each module proposed by the authors.", "weaknesses": "1. This paper involves many complex modules, and in Section 3 (Method), the authors use many symbols and subscripts. However, the annotations for these symbols and subscripts are not very clear. For instance, in line 144, $\\mathcal{E}_z(z_x|(x, ϕ), z) = s$. It is not clear what the input to the style domain encoder is. If ‘|’ denotes a probabilistic condition, then the style domain encoder only has one input, but Figure 2 appears to show two inputs, which is confusing. For the numerous symbols and labels, it is recommended that the authors provide a unified introduction in each section.\n\n2. The paper introduces the operational flow of the model in three parts. However, the authors seem to focus more on explaining each module rather than the connections between modules and the overall operational flow. As a result, after reading these parts, it remains difficult to grasp the overall process of the proposed method. The paper appears technically sound, but there is still significant room for improvement in introducing the technical flow.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer **z2Ei**, thank you very much for your careful review of our paper and your thoughtful comments. We hope that the following responses will help clarify any potential misunderstandings and alleviate your concerns.\n\n---\n\n**Q1:** Regarding “Moreover, we implement layer-wise guidance dropout by selectively zeroing out portions of $s_{1:m}$, thereby diminishing the decoder’s dependency on sub-vector correlations.” Is there existing literature that supports this conclusion? Could you provide a more detailed explanation?\n\n**R1:** Thank you for your comments and we do understand your concerns. To further alleviate your concerns, we provide more explanations.\n- Firstly, **our goal is to achieve a bidirectional mapping between images and disentangled variables $s_{1:m}$.** By reducing the co-adaptations between Unet layers, it enhances the model's generalization ability, meaning that neurons are less likely to rely too much on each other, thereby achieving decoupling. The dropout guided by zeroing out disentangled variables during training essentially aims to encourage the model to obtain linearly independent solutions for $s_{1:m}$.\n\n- Second, **the latest paper SODA[1]** (presented at _CVPR 2024_, a self-supervised diffusion model designed for representation learning) suggests that disentangled latent spaces can better represent the generated images. **In the conclusion of the reference[1]: To improve localization and reduce correlations among the sub-vectors, we present layer masking – a layer-wise generalization of classifier-free guidance [2].** The reference provides ample ablation experiments to validate it.\n\n- Third, we have also thoroughly validated the correctness of this conclusion in our experiments. The results presented in Table 1, Table 2, and Figure 3 of our main experiments in the paper demonstrate the rationale behind this conclusion.\n\n[1] Hudson D A, Zoran D, Malinowski M, et al. Soda: Bottleneck diffusion models for representation learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 23115-23127.\n\n[2] Ho J, Salimans T. Classifier-free diffusion guidance[J]. arXiv preprint arXiv:2207.12598, 2022.\n\n---\n\n**Q2:** How does the proposed method handle the increasing number of protected entities? Does it require retraining with each addition, or is there a more cost-effective solution?\n\n**R2:** We use the identifier $z$  with effectively infinite capacity to handle the increasing number of protected entities. This approach does not require retraining the style domain encoder and incurs only minimal additional cost. We will provide more explanations.\n\n- **First, one of the advantages of the paper is to use the _identifier $z$_ to address the issue of the increasing number of protected entities.** In this paper, unrestricted $z$ can represent any text, image, video, or audio, which is encoded into $z_{\\text{emb}}$ and injected into the style domain to ensure the boundary of the protected unit.\n\n- **Second, $z$ signifies the identifier that maximally shifts the contraction domain to the edge distribution** of the style representation space. After decoupling the style domain and negative samples and performing dynamic contrastive learning to increase the distance in the similarity space, $z$ is further shifted to the boundary space by injecting $z$.\n\n- **Third, we do not need to retrain the style domain encoder.** We only need to decouple the protected unit into the style domain, inject the corresponding identifier $z$ to shift it to the edge distribution, and store the mapping relationship in the watermark extractor (This only incurs a minimal cost).\n\n---\n\n**Q3:** As the number of protected entities grows, will the styles of these entities influence each other, potentially reducing the model’s detection performance?\n\n**R3:** Thank you for your comments and we do understand your concerns. In response to Question 2, **the advantages of our paper for addressing this issue are to decouple the style domain, utilize dynamic contrastive learning, and use the unique and  infinite identifier $z$.** To further alleviate your concerns, we provide more explanations.\n- First, we decouple the latent variables into sub-vectors that control image generation, thereby extracting linearly independent combinations of the image's essential features. Then, we utilize dynamic contrastive learning to set **_sample anchors, edge samples, central samples, and negative samples_** for the protected units, encouraging the style domain of the protected units to occupy mutually exclusive regions in the high-dimensional space.\n\n- Second, we propose the identifier $z$ to further enhance the reliability and security of the solution. $z$ represents **_the unique and critical identifier_** that maximally shifts the contraction domain to the edge distribution of the style representation space. Since $z$ is an arbitrary identifier (including any text, string, image, etc.), its capacity is effectively infinite, which is sufficient to differentiate the growing number of protected entities.\n\n- Third, we have thoroughly validated the feasibility of our approach through main and ablation experiments. **As the number of protected entities increases, the distinctiveness of the model remains robust, ensuring that the styles of these entities do not influence each protected unit.**\n\n|128bit| 0-20% | 20-40%|40-60%|60-80% | 80-90%|90-100% | TP|TN| Avg acc (%) | k@t@100%wd (%)  |\n|-----------|-------|--------|--------|--------|--------|---------|-----|-----|---------------|------------------|\n|**$z$ Error**| 0 |151|555|291| 3| 0 | 0 |1000|52.15|0|\n|**$z$-watermarking**|0| 0 |0 |1| 6| **993** | 1000|0| **99.87** | **97.9** |\n\n---\n\n**Q4:** The annotations for these symbols and subscripts are not clear, and there is still significant room for improvement in introducing the technical flow.\n\n**R4:** Thank you for pointing out the shortcomings in our writing. We will make revisions.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "g8ioUrpCw5", "reviewer": "Reviewer_jJoo", "summary": "This paper introduces an innovative implicit $z$-watermarking scheme using disentangled style domains to protect dataset copyrights in text-to-image models. It achieves structured delineation of copyright boundaries, self-generalization, mutual exclusivity, and effective verification for hybrid or partial infringements. The method demonstrates high robustness and reliability against various challenges, marking a significant advancement in protecting copyrighted content in AI-generated visual data.", "questions": "Please refer to the weakness.", "limitations": "The author has clearly presented its limitations.", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. This paper designs a novel implicit $z$-watermarking scheme via disentangled style and content domains to protect dataset copyrights. Meanwhile,  instead of embedding invisible information into images, the proposed self-generalization module and mutual exclusivity module are used to explore the style boundaries.\n\n2. This paper is very detailed and well-formulated, with precise wording, clear definitions, and easy to understand.\n\n3. Extensive experiments demonstrate the SOTA performance of the proposed method, such as DCT-DWT-SVD, RivaGan, and SSL. Obviously, the proposed $z$-watermarking is hard to be removed by some illegal mimic models.", "weaknesses": "1. In table I, it is suggested to compare with some recent and SOTA watermarking methods, such as Trustmark and RoSteALS.\n\n[1] TrustMark: Universal Watermarking for Arbitrary Resolution Images.\n\n[2] Rosteals: Robust steganography using autoencoder latent space. In CVPRW 2023.\n\n2. Can $z$-watermarking resist some watermark removal or attack methods, such as DDIM inversion or VAE. The authors could provide some results to improve the completeness of the experiment.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer **jJoo**, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n---\n\n**Q1:** In Table I, it is suggested to compare with some recent and SOTA watermarking methods, such as Trustmark and RoSteALS.\n\n**R1:** Thank you for your constructive suggestions! **We have added Trustmark[1] and RoSteALS[2]** as comparison baselines. Here are more details and discussions. We set up 100 images with different watermarks. Trustmark has a length of 64 bits, RoSteALS has a length of 56 bits, and ours is 128 bits. We evaluated whether the generated images contained watermarks using TP (True Positive) and TN (True Negative). For watermark extraction, we used Avg acc (%) and k@t@100%wd as evaluation metrics. The experimental results indicate that previous watermarking methods are diluted or erased easily during the generation process, which is detrimental to the traceability and ownership of the samples.\n\n| Method           | TP  | TN  | Avg acc (%) | k@t@100%wd(%) |\n|------------------|-----|-----|-------------|-------------------|\n| Trustmark | 93  | 907 | 55.37       | 6.6   |\n| RoSteALS  | -   | -   | 66.50       | 7.9 |\n| **Ours** | 1000| 0   | **99.83**   | **97.7**  |\n\n[1] TrustMark: Universal Watermarking for Arbitrary Resolution Images.\n\n[2] RoSteALS: Robust steganography using autoencoder latent space. In CVPRW 2023.\n\n---\n\n**Q2:** Can $z$-watermarking resist some watermark removal or attack methods, such as DDIM inversion or VAE? The authors could provide some results to improve the completeness of the experiment.\n\n**R2:** Thank you for your constructive suggestions! We agree that understanding the impact of watermark removal is also important. In our paper's robustness experiments, we conducted experiments on Latent Attacks. To further demonstrate the superiority of our approach, we have included the following additional experiments. We hereby provide more details.\n\n- First, **we use the watermark removal method [1]** to attack baseline watermarking schemes and ours. For attacks using variational autoencoders, we evaluate the pre-trained image compression models: Cheng2020 [2]. The compression factors are set to 3. For diffusion model attacks, we use stable diffusion 2.0 [3]. The number of noise steps is set to 60.\n- Second, we chose Avg acc (average watermark accuracy), Detect Acc (percentage of images where decoded bits exceed the detection threshold 0.65), and k@t@100%wd as the evaluation metrics for watermark robustness. The result is as follows.\n- Third, our method achieves an average accuracy of 97.93% and 95.81%, with a detection accuracy of 100% and k@t@100%wd of 91.5% and 87.2% under VAE and Diffusion attacks, respectively. In contrast, other methods like DCT-DWT-SVD, RivaGan, and SSL show significantly lower performance. From the results, our performance significantly surpasses other watermarking schemes after being subjected to watermark removal attacks [1].\n\n| Method | Removal Attack Instance | Avg acc (%) | Detect Acc (%) | k@t@100%wd (%) |\n|-----------|-------------------------|-------------|----------------|-------------------|\n|**DCT-DWT-SVD**|VAE attack|50.17| 2.0|0.0|\n|**DCT-DWT-SVD**|Diffusion attack| 54.41 | 2.8| 0.0|\n|**RivaGan**|VAE attack|60.71|6.2| 0.0|\n|**RivaGan**|Diffusion attack|58.23|1.8|0.0|\n|**SSL**|VAE attack|62.92|15.6|0.0|\n| **SSL**|Diffusion attack|63.21|16.3|0.0|\n|**Ours**|VAE attack|**97.93**|**100** |**91.5**|\n|**Ours**| Diffusion attack| 95.81|100|87.2|\n\n[1] Zhao X, Zhang K, Su Z, et al. Invisible image watermarks are provably removable using generative ai[J]. arXiv preprint arXiv:2306.01953, 2023.\n\n[2] Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Learned image compression with discretized gaussian mixture likelihoods and attention modules,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 7939–7948.\n\n[3] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 10 684–10 695.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fU7uoVPE2n", "reviewer": "Reviewer_d18z", "summary": "The paper introduces an implicit watermarking scheme that leverages disentangled style domains to detect unauthorized dataset usage in text-to-image models. The proposed method aims to address limitations in traditional watermarking techniques by using implicit z-watermarks for dataset copyright verification, achieving better robustness against various attacks.", "questions": "I have shown my concerns in the weakness part, Please address my concerns there.", "limitations": "I am uncertain about how practical it is to implement this method on a large scale. The experiments provided in this paper only cover limited data.", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The proposed framework is able to protect the dataset copyright. This is extremely important in an era of generative AI. Besides, rather than directly protecting the image, this work proposes to protect the styles. Such a thinking may bring some new insights into this area.", "weaknesses": "1. The writing of this paper has some problems. The description of its first section is totally in a chaos status. \n2. In some specific situations, I agree that the styles are necessary to be protected. However, in most situations, copyright law typically protects original works of authorship. An individual style, which may consist of a particular technique or aesthetic, is not considered a tangible, original creation. Styles are more akin to ideas or methods, which are generally not protected under copyright law. If the styles are not protected by the laws, why do we need such a method mentioned in this submission? \n3. Defining and enforcing copyrights for individual styles would be highly subjective and impractical. Styles evolve and are influenced by many sources, making it difficult to establish clear boundaries for what constitutes a protected style. \n4. Granting copyright protection to individual styles could stifle creativity and innovation. Artists and creators often build upon existing styles and techniques to develop new works. Restricting the use of styles could hinder the creative process and limit artistic freedom. For example, if the Cubist style were copyrighted, it could prevent new artists from experimenting with and developing this style further, thereby limiting artistic progress.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer **d18z**, thank you very much for your careful review of our paper and thoughtful comments. \n\n**Q1: Response on \"Why We Need to Protect Individual Creators' Styles and Content Copyrights in the AI Era\".**\n\n**R1:** To further alleviate your concerns, we provide more explanations.\n- First, **considering both style and content align better with judicial standards**. In copyright cases, judges assess ownership by comparing the style, brushstrokes, and content of the original and imitation works. \n\n- Second, **there have been numerous high-profile legal cases involving unauthorized imitation of artists' styles by AGI.** Notable Sarah Andersen [1] and Getty Images [2] have filed lawsuits against Stability AI, DeviantArt, Midjourney, and OpenAI over copyright and trademark infringement. The AI-generation 'Rock, Paper, Scissors'[3] has violated multiple laws, including the Digital Millennium Copyright Act. Greg Rutkowski’s art style has been used by AI without authorization for profit over 3 million times [4]. _In the AIGC era, safeguarding and tracing the styles and content of personal works is crucial_.\n- Third, **there are already some efforts dedicated to protecting the styles of artistic works,** such as **Glaze: _Protecting Artists from Style Mimicry by Text-to-Image Models_[5] (_Best Paper at USENIX Security 2023_).** Glaze's survey shows that 91% of 1,207 artists are concerned about AI using their works for training. **Artists expect AI mimicry to have a significant impact on the art community:** **97% of artists believe it will reduce job security for some artists; 88% think it will discourage new students from studying art; and 70% feel it will diminish creativity.** Many artists (**over 89%**) have already taken or plan to take action in response to AI mimicry. Additionally, **55%** think reducing their online presence will impact their careers, while **78%** of artists expect AI mimicry to affect job security, rising to **94%** for newer artists. The survey report indicates that without appropriate regulations, AI-style mimicry could undermine people’s motivation for creative freedom.\n- Fourth, **we aim to establish a positive and healthy cycle for the development of art between generative AI and human creation,** where human creators should retain the rights to authorize and trace their creative styles and content. We hope our work will guide the regulated development of generative AI. _In the AI era, we believe this step is urgent for ensuring intellectual property rights for human creativity._\n\n**Q2: Defining and enforcing copyrights for individual styles would be highly subjective and impractical. Styles evolve and are influenced by many sources, making it difficult to establish clear boundaries for what constitutes a protected style.**\n\n**R2: From a computational perspective, the abstract high-dimensional features of the style domain have distinctiveness.** In this paper,**to ensure the exclusivity of the style domain**, we use identifier $z$ to maximally shift the contraction domain to the edge distribution of the style representation space. _Specifically, We decouple the style domain and perform dynamic contrastive learning to increase the similarity distance._ **The Style Domain is shifted into the contraction domain of the edge distribution by $z$; $z$ and the watermark to be verified are held by the defender.** The copyright boundary of the protected unit, which is the edge space distribution, can only be correctly tracked and yield the correct watermark when using $z$.\n\n||TP|TN|Avg acc(%)|k@t@100%wd(%)|\n|-------------------|-----|-----|-----------------|--------------------|\n|$z$ Error|0|1000|52.15|0|\n|$z$-watermarking|1000|0|99.87|97.9|\n\n**Q3: Regarding the statement ‘Granting copyright protection to individual styles could hinder creativity and artistic progress by restricting the use and evolution of existing styles.’**\n\n**R3:** We do understand your concerns. Next, we will provide a more detailed explanation below.\n\n- **First,** **we should clarify our goal again: creators should have the right to authorize and trace their creative styles and content,** particularly in the context of unauthorized mimicry by generative AI. In the AI era, we believe this step may be urgent: ensuring intellectual property protection for human creativity.\n- **Second, current instances of AI mimicry may severely hinder their motivation and damage their enthusiasm, turning high-quality works into someone else’s benefit according to Glaze's survey [5].** The survey of **1,207 artists** shows **91%** are worried about AI training on their works. Concerns include job security (**97%**), deterring new students (**88%**), and reduced creativity (**70%**). **89%** are taking action, with **53%** considering reducing their online presence. **77%** believe AI mimics their styles well, but unauthorized use remains a major concern. _Glaze collaborates with **art-centric social networks**, advocacy groups like **CAA (US) and EGAIR(EU)**, governments, and companies to protect IP and advocate for artists' style copyrights._\n- **Third,** **our work continues to focus on the perspective of human creators, aiming to ensure the rights of original authors in the era of the generative AI explosion.** We aim to establish a healthy cycle for the development of art, where creators have the right to authorize and trace their creative styles and content.\n\n**Q4: The writing of this paper has some problems.**\n\n**R4:** Thank you for pointing out them. We will improve them to make the expression clearer.\n\n[1] AI art lawsuits: Stability AI, DeviantArt, and Midjourney face litigation.\n\n[2] Inc. Getty Images (US). v. stability ai, inc. Assigned To: Jennifer L. Hall.\n\n[3] Copyright Protection: Exploring Originality and Ownership in a Digital Landscape.\n\n[4] This artist is dominating AI-generated art. \n\n[5] Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models, USENIX Security 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CZtoOUbPDy", "reviewer": "Reviewer_NU2V", "summary": "The current watermarks applied to AI-generated images rely on adding additional information, limiting their ability to detect unauthorized use of data. This paper introduces a new implicit watermarking scheme, which first utilizes the disentangled style domain to detect unauthorized dataset usage in text-to-image models., so as to achieve self-generalization and mutual exclusivity within the style domain anchored by protected units. In addition, this paper introduces the concept of watermarking distribution and establishes a verification mechanism for copyright ownership of hybrid or partial infringements. It is worth noting that this paper implements One-Sample-Verification for dataset copyright verification in AI mimic generation. This paper also designed experiments to verify the robustness, generalization and ablation of multiple data sets.", "questions": "- The significant problem is the writing, too obscure.\n- There is a problem with the icon marking in Figure 2, the marked color of central sample is inconsistent with that in the figure.\n- There is an unclear sign in line 181. Should $s_k^+$ be $s_i^+$?\n- Can you explain the meaning of each symbol of formula 7 in detail, and supplement the rationality and significance of the indicators proposed?\n- In 5.2 Main result, can you give the value of the number of protected units (i.e., K) and how the 1000 images used were selected?\n- It is observed that the avg acc is higher with the longer the watermark length in the ablation experiment. Can you give the details of the mapping from the contraction domain to the watermark in the extractor?\n- The experiment is only compared with the digital watermarking method, can you add a comparison with other methods (such as backdoor-based)?", "limitations": "The authors addressed the limitations of this paper, which focuses only on the disentangled style domains of protected units, potentially making it difficult to resist attacks that modify deep features of style domains. Future research could incorporate specific adversarial samples.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The problem exploited in this paper is important and needs to be addressed.\n- The idea of disentangling the image into content and style seems effective.", "weaknesses": "- This paper is really hard to follow. The method's modules are not explained very well, and the input, output and training details of each module are not clear.\n- Too much mathematical description makes it difficult for readers to quickly understand the process and principle of the method, and the meaning of each mathematical symbol is not clearly described.\n- The model structure diagram is less relevant to subsequent descriptions. The paper also lacks simple examples of the data used in the experiment.\n-Only the watermark distribution concept is proposed, and the copyright ownership verification experiments of hybrid or partial infringements are lacking.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer NU2V, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can alleviate your concerns.\n\n---\n\n**Q1: The significant problem is the writing, this paper is tough to follow and not examples.**\n\n**R1:** Thank you for your constructive suggestions! We will reorganize and improve it to make the expression clearer and more understandable. **Regarding training details**, we have provided **model details and experiment details** in the supplementary materials. Meanwhile, **in Section 3.2 of the supplementary materials**, we show simple examples of the suspicious data generated from suspicious models and APIs, such as DALL·E·3.\n\n---\n\n**Q2: Can you explain the meaning of each symbol of Formula 7 in detail, and supplement the rationality and significance of the indicators proposed?**\n\n**R2:** Formula 7 is as follows:\n$P_{z}(x|\\phi \\backsimeq \\mathcal{D}) = \\frac{q_{\\phi_z}(z_{emb}|z)}{2^L \\cdot K \\cdot (c+\\beta)^{K \\times N^2 \\times (K-1)}}$\n- **On the left side of the equation:** $x$ denotes the suspicious sample, $\\phi$ represents the parameters of the VAE , $\\mathcal{D}$ denotes the protected dataset, $z$ signifies the identifier. And $p(\\cdot)$ represents the probability distribution of the copyright of $x$ belonging to $\\mathcal{D}$.\n- **On the right side of the equation:** $z_{emb}$ denotes the embedding representation, and $q_{\\phi_z}(z_{emb}|z)$ denotes the prior probability distribution. $L$ denotes the length of the watermark, $K$ denotes the number of protected units, $N$ denotes the number of generation of protected unit, $c$ denotes the marginal distance, and $\\beta$ denotes a positive hyper-parameter.\n\nHere, $/2^L$ denotes the probability of the watermark conforming to $L_{bit}$, $1/K$ denotes the probability that the sample to be detected belongs to $K$ datasets' class, and $1/(c+\\beta)^{K\\times N^2\\times(K-1)}$ denotes the reciprocal of the distance between samples with different styles and contents. Their product represents the probability that the sample to be detected originates from the protected dataset. In hypothesis testing, a low-probability event is almost unlikely to occur in a single random trial, and the probability of such an event is used as the significance level $\\alpha$ (i.e., $\\alpha$ $ \\leq P(\\cdot))$. Therefore, in the process of copyright ownership detection, the event that the sample is detected as belonging to the protected dataset can be expressed as $H_0: D \\leftarrow x$, with a confidence interval of $1 - \\alpha\\$, and can be expressed as $P(|X - \\mathcal{D}| \\leq c) = 1 - \\alpha$. Thus, we have a very high confidence in ensuring the ownership.\n\n---\n\n**Q3: Can you give the value of the number of protected units (i.e., K) and how the 1000 images used were selected?**\n**R3:** Thank you for your comments and we do understand your concerns.\n1. In 5.2 Main result, we set the value of $K$ to 50.\n2. In the process of selecting 1000 images of the protected unit, we first obtained the representation $z$ of each image through the style domain encoder. We randomly selected one as the $z_o$ anchor sample, and the others as $z_{go}$. Then, we ranked them based on their similarity and Euclidean distance and finally selected the images according to the ranking results.\n\n**Q4: Can you give the details of the mapping from the contraction domain to the watermark in the extractor?**\n\n**R4:** Thank you for your comments. The PyTorch code of the watermark extractor is as follows:\n\n```\nclass w_decoder(nn.Module):\n    def __init__(self, inc, outc):\n        super(w_decoder, self).__init__()\n        self.Conv_ = nn.Sequential(\n            nn.Conv2d(4*inc, 4*inc, 3, 2, 1),\n            nn.BatchNorm2d(4*inc),\n            nn.GELU(),\n            nn.Conv2d(4*inc, 4*inc, 3, 2, 1),\n            nn.BatchNorm2d(4*inc),\n            nn.GELU(),)\n        self.F_fusion = nn.Sequential(\n            nn.BatchNorm1d(6*inc),\n            nn.GELU(),\n            nn.Linear(6*inc, inc),\n            nn.BatchNorm1d(inc),\n            nn.GELU())\n        self.F_reduce = nn.Sequential(\n            nn.Linear(4*inc, 2*inc),\n            nn.BatchNorm1d(2*inc))\n        self.out = nn.Sequential(\n            nn.BatchNorm1d(inc),\n            nn.GELU(),\n            nn.Linear(inc, outc))\n        self.fc_d = nn.Linear(inc, inc)\n        self.fc_f = nn.Linear(inc, inc)\n        self.Adapt = nn.AdaptiveAvgPool2d(1)\n    def forward(self, data, domain, z=None):\n        f = self.Conv_(domain)\n        f = self.Adapt(f).view(f.shape[0], f.shape[1])\n        f_reduce = torch.cat((self.F_reduce(f), f), dim=-1)\n        f_fusion = self.F_fusion(torch.add(f_reduce, z))\n        out = self.fc_d(data) + self.fc_f(f_fusion) + data + f_fusion\n        out = self.out(out)\n        return out\nwm_logits = Z_Model.w_decoder(data, domain, z)\n```\n---\n**Q5: Can you add a comparison with other methods (such as backdoor-based)?**\n\n**R5:** To further alleviate your concerns, we compare ours and methods based on backdoor attacks.\n- We employ the current SOTA (DIAGNOSIS[1]) for dataset protection through backdoor. The evaluation metrics utilized are True Positive (TP), True Negative (TN), and Attack Success Rate (ASR), as implemented by DIAGNOSIS. \n- **Main result:** The experimental results are shown in the table below.\n\n|Method|TP|TN|ASR(%)|Avg acc(%)|k@t@100%wd(%)|\n|-----------|-----|-----|---------|-------------|-------------------|\n|DIAGNOSIS|993|7|99.3|-|-|\n|Ours|1000|0|100|99.72|98|\n\n- **Post-tracking ownership:** It refers to the process of claiming copyright ownership before litigation when owners discover suspicious models or images without having embedded backdoors immediately.\n\n|Method|TP|TN|ASR(%)|Avg acc(%)|k@t@100\\%wd(%)|\n|-----------|-----|-----|---------|-------------|-------------------|\n|DIAGNOSIS|2|998|0.2|-|-|\n|Ours|1000|0|100|99.69|94.7|\n\n[1] DIAGNOSIS: Detecting Unauthorized Data Usages in Text-to-image Diffusion Models. ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
## Global Response

We would like to express our gratitude to all reviewers for their thorough reading and constructive feedback. Since all reviewers have expressed several main concerns, we will try to address these issues in the global response.

**Rethinking Personal Data Copyright Ownership in the Era of Generative AI.** Due to the explosive growth of generative AI, an increasing number of creators' works, including creative entities, brushstrokes, and styles, are being used for unauthorized profit. In Glaze's survey, based on responses from 1,207 artists, the vast majority hope for fair legislation to protect the unique artistic styles and content of their works. However, unfortunately, there are currently no feasible solutions, and this issue is highly challenging. Currently, generative AI is being maliciously used by some to easily learn, imitate, and plagiarize unauthorized human works for profit. This severely undermines creators' motivation, damages their creative enthusiasm, and turns high-quality works into others' benefits. This step may be urgent for ensuring intellectual property rights for human creativity in the AI era. Therefore, we aim to establish a positive and healthy cycle for the development of art between generative AI and human creation.

**$z$ identifier causes exclusivity.** In this paper, $z$ is designed to ensure the exclusivity and uniqueness of the protected unit distribution within large datasets. $z$ signifies the identifier that maximally shifts the contraction domain to the edge distribution of the style representation space, after decoupling the style domain and performing dynamic contrastive learning to increase the distance in the similarity space. Since $z$ is an arbitrary identifier (such as text, strings, images, etc.), its capacity is effectively infinite, which further enhances the reliability and security of the solution. In machine learning, there are inherent differences in the high-dimensional feature distributions of protected units. Our approach, which utilizes the $z$ identifier, decouples the style domain and employs dynamic contrastive learning, aims to shift this distribution. In the paper, we provide hypothesis testing (Section 4) and experimental data (Section 5.3) to demonstrate the feasibility of our proposed solution.

|                    | 0-20% | 20-40% | 40-60% | 60-80% | 80-90% | 90-100% | TP | TN | Avg acc (%) | k@t@100\%wd (%)  |
|--------------------|-----------|------------|------------|------------|------------|-------------|--------|--------|----------------------------------|-----------------------------------|
| $z$ Error          | 0         | 151        | 555        | 291        | 3          | 0           | 0      | 1000   | 52.15                            | 0                                 |
| $z$-watermarking   | 0         | 0          | 0          | 1          | 6          | **993**     | 1000    | 0      | **99.87**                        | **97.9**                     |

**Regarding the baselines for watermarking and backdoor methods.** We compared digital watermarking methods such as DCT-DWT-SVD, RivaGan, SSL, Trustmark, and RoSteALS, as well as the backdoor-based method DIAGNOSIS. The experimental results indicate that previous watermarking methods are diluted or erased during the diffusion generation process, which is detrimental to the traceability and ownership of the sample. Additionally, we introduced watermark removal attacks (such as VAE and Diffusion Attack), where digital watermarking methods nearly fail, while our approach still demonstrates strong robustness.

---

### Comparison of Methods

| Method         | TP  | TN  | ASR | Avg acc (%) | $k@t@100\%wd$ (%) |
|----------------|-----|-----|-----|-------------|-------------------|
| DCT-DWT-SVD    | -   | -   | -   | 57.76       | 0.1               |
| RivaGan        | -   | -   | -   | 61.34       | 0.1               |
| SSL            | -   | -   | -   | 64.39       | 0.1               |
| Trustmark      | 93  | 907 | 9.3 | 55.37       | 6.6               |
| RoSteALS       | -   | -   | -   | 66.50       | 7.9               |
| DIAGNOSIS      | 993 | 7   | 99.3| -           | -                 |
| **Ours**       | **1000** | 0 | **100** | **99.83** | **97.7**         |

---

### Removal Attack Performance

| Method         | Removal Attack Instance | Avg acc (%) | Detect Acc (%) | k@t@100 %wd (%) |
|----------------|-------------------------|-------------|----------------|-------------------|
| DCT-DWT-SVD    | VAE attack              | 50.17       | 2.0            | 0.0               |
|                | Diffusion attack        | 54.41       | 2.8            | 0.0               |
| RivaGan        | VAE attack              | 60.71       | 6.2            | 0.0               |
|                | Diffusion attack        | 58.23       | 1.8            | 0.0               |
| SSL            | VAE attack              | 62.92       | 15.6           | 0.0               |
|                | Diffusion attack        | 63.21       | 16.3           | 0.0               |
| **Ours**       | VAE attack              | **97.93**   | **100**        | **91.5**         |
|                | Diffusion attack        | **95.81**   | **100**        | **87.2**         |

Meta-review: 1x A and 3x BR. This paper proposes an implicit watermarking scheme using disentangled style domains to protect dataset copyrights in text-to-image models. The reviewers agree on the (1) important topic, (2) novel method, and (3) comprehensive experiments. Most of the concerns, such as the efficiency analysis, have been addressed by the rebuttal. Therefore, the AC leans to accept this submission.
Decision: Accept (poster)