RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees
Authors: Xun Xian
Ganghua Wang
Xuan Bi
Jayanth Srinivasa
Ashish Kundu
Mingyi Hong
Jie Ding
Venue: NeurIPS 2024 poster (2024)
Keywords: Copyright Protection
Privacy
Primary area: privacy

Abstract: Safeguarding intellectual property and preventing potential misuse of AI-generated images are of paramount importance. This paper introduces a robust and agile plug-and-play watermark detection framework, referred to as RAW.
As a departure from existing encoder-decoder methods, which incorporate fixed binary codes as watermarks within latent representations, our approach introduces learnable watermarks directly into the original image data. Subsequently, we employ a classifier that is jointly trained with the watermark to detect the presence of the watermark.
The proposed framework is compatible with various generative architectures and supports on-the-fly watermark injection after training. By incorporating state-of-the-art smoothing techniques, we show that the framework also provides provable guarantees regarding the false positive rate for misclassifying a watermarked image, even in the presence of adversarial attacks targeting watermark removal. 
Experiments on a diverse range of images generated by state-of-the-art diffusion models demonstrate substantially improved watermark encoding speed and watermark detection performance, under adversarial attacks, while maintaining image quality. Our code is publicly available [here](https://github.com/jeremyxianx/RAWatermark).

RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees
Xun Xian Department of ECE
Ganghua Wang School of Statisties University of Minnesota wang9019@umn edu
University of Minnesota xi xian00440umn, edu
Xuan Bi
Jayanth Srinivasa
Ashish Kundu Cisco Research
Carlson School of Management University Minnesota xbi feii.mnn.om edu
Cisco Research
jasrinivecisco. com
ashkundu@cisco.c com
Mingyi Hong Department of ECE University of Minnesota mhong@umn. edu
Jie Ding
School of Statistics
University of Minnesota dingj @umn edu
Abstract
Safeguarding intellectual property and preventing potential misuse of Al Al-generated images are of paramount importance. This paper introduces a robust and agile -lagay watermark detection framework, referred as RAW. As departure from existing encoder-decoder methods, which incorporate fixed binary codes as watermarks within latent representations, our approach introduces learnable water- marks directly into the original image data. Subsequently, we employ a classifier that is jointly trained with the watermark to detect the presence of the watermark. The proposed framework is compatible with various generative architectures and supports on-the-fly watermark injection after training. By incorporating state-of- the-art smoothing techniques, we show that the framework also provides provable guarantees regarding the false positive rate for misclassifying a watermarked image, even in the presence of ad attacks targeting watermark removal. Experi- ments on a diverse range of images generated by statc-of-the-as art diffusion models demonstrate substantially improved watermark encoding speed and watermark detection performance, under adversarial attacks, while maintaining image quality. Our code is publicly available here.
Introduction
In recent years, Generative Artificial Intelligence, notably in computer vision, has made significant strides. The adoption of diffusion models (DM) applications like Stable Diffusion [1] and DALLE- 2 [2] has greatly improved image generation quality. However, these advancements also raise concerns about potential misuse, seen in instances such as DeepFake [3] and copyright infringement [4].
To mitigate the potential misuse of diffusion models, the incorporation of watermarks emerges as promising solution. Watermarked images, tagged with crafted signals, act markers to identify their machine- bechine-generated origin. Watermarking techniques designed for generative models can be generally
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

classified into two categories: model-specific [5, 6, 7, 8] and model-agnoste [9, 10, 11], as outlined in Table Model-specific methods refer to those tailored for particular generative models, often offering a better tradeoff between watermarked image quality and watermark detection performance. However, this characteristic may potentially restrict their applicability across diverse use cases. For instance, the Tree-Ring watermark [8] is tailored for specific samplers, e.g., DDIM [12], used for image generation within diffusion models. The feasibility of adapting this method to other commonly used samplers remains open to discussion.
Table 1: Summary of features of several representative watermark techniques. The second column denotes the method's suitability for real-time on-the-ffy fly implementation. denotes cases where the watermark is embedded during the generative process. The third column evaluates whether the watermarking method provides provable guarantees on false-positive rates (FPRs) under adversarial attacks in a distribution-free manner.
Method
Model agnostic
On-the-fly deployment
Provable FPRs under adversurial attacks
DwtDetSvd [13]
RivaGan [10]
StegaStamp [11]
X
Stable Signature [5]
Tree Ring [8]
X
X
RAW (Our method)
In contrast, model-agnostic approaches directly watermark generated content without modifying the generative models. These approaches can be categorized into two types. The first, from traditional signal processing, c.g., DwTDcTSvd [13], embeds watermarks in specific parts of images' frequency domains. However, they be vulnerable to strong image manipulations and adversarial attacks for removing watermarks [14]. The second type employs deep learning techniques, utilizing encoder- decoder structures to embed watermarks, such as binary codes, in latent spaces. For instance, RivaGan [10] trains the watermark and watermark decoder jointly as learned models, enhancing transmission and robustness. However, these methods demand greater computational resources for watermark injection, limiting real-time on-the-fly deployment. For example, when injecting watermarks into images, the RivaGan requires over 15x the time needed by the DwtDet methods [15].
Additionally, there has been a sustained emphasis on precisely evaluating false-positive rates (FPRs) and/or the Area Under the Receiver Operating Characteristic curve (AUROC) for each utilized watermarking strategy [16], given the potential economic implications associated with watermark implementation. To establish an explicit theoretical formulation for FPRs, many studies have assumed that the binary watermark code extracted from unwatermarked images exhibits a pattern where each digit is an independent and identically distributed (IID) Bernoulli random variable with equal probabilities. This assumption enables the explicit derivation of the FPRs when comparing the extracted binary code with the predefined actual binary watermark code. However, such an assumption may not hold as empirically observed in [17], and thus the corresponding formulation for FPRs might be incorrect.
1.1 Contributions
In this paper, we introduce Robust, Agile plug-and-play Watermark framework, abbreviated as RAW. RAW designed for both adaptability and computational efficiency, providing a model- agnostic approach for real-time, on-the-fly deployment of image watermarking (which can be straight- forwardly extended to video watermarking as outlined in Section 4.5). This dedication to adaptability is to ensure the accessibility for third- -arty users, e.g., artists and generative model providers. More- over, this adaptability is fortified by the integration of state-of-the-art smoothing techniques for achieving provable guarantees on the FPRs for detection, even under adversarial attacks.
new framework for robust and agile alug-and-play image watermark learning In contrast to incoder-decoder techniques that insert fixed binary watermarks into latent spaces, we propose to embed learnable watermarks, matching the image dimensions, into both the frequency and spatial domains of the original images. To differentiate between watermarked and unwatermarked samples, we utilize a classifier, e.g., a convolutional neural network (CNN), and perform joint training for both the watermarks and the classifier. The proposed framework offers several benefits, including enhanced computational efficiency achieved through batch processing for watermark injection post joint training. For instance, experimental results demonstrate time efficiency enhancements, approximately 30x

---

(200x) faster than the frequency- baseedde--eddddee -ecooder-decoder based) method, respectively. Moreover, can be readily integrated with other state-of-the theh-htrtt techniques to further enhance robustmess and generalizability, such as adversarial training [18, 19], and contrastive learning [20, 21J.
Provable guarantees on FPRs even under adversarial attacks without distributional assumptions By integrating methods from the conformal prediction literature [22, 23] into our RAW framework, we showcase its ability offer rigorous, distribution-ffee assurances regarding the FPRs. Additionally, we develop a novel technique, inspired by the randomized smoothing [24, 25]. to further enhance our provable guarantees. This technique ensures certified guarantees on FPRs under arbitrary perturbations, including those adversarial with bounded norms. That is, as long as any transformations on test images stay within predefined range. our guarantee on FPRs remains valid.
Extensive empirical studies on various datasets & extension to video watermark We evaluate the effectiveness of our proposed method across various generative data scenarios, such as the DBDiffusion [26] and MS-COCO [27]. Additionally, we discuss how to extend the proposed framework for video watermarking and provide empirical results to demonstrate its effectiveness. Our assessment includes detection performance, robustness against image manipulations/attacks the computational efficiency of watermark injection, and the quality of generated images. Experimental results consistently affirm the excellent performance of our approach, as evidenced by significantly improved watermark encoding speed and notable enhancements in detection performance against state-of-ther -iie------hh-rtttt adversarial attacks aimed at removing watermarks.
1.2 Related Work
Classical watermarking techniques for images Image watermarking has long been a fundamental problem in both signal processing and computer vision literature [9, 28]. Methods for image-based watermarking typically operate within either the spatial or frequency domains [9, 29]. Within the spatial domain, methodologies span from basic approaches, such as the manipulation of the least significant bit of individual pixels, to more complex strategies like Spread Spectrum Modulation [30, 31]. In the frequency domain, watermark embedding [9. 32] involves modifying coefficients generated by transformations such the Discrete Cosine Transform [33].
Image watermarking using deep learning & Watermark for diffusion models The advent of advanced deep learning techniques has opened up new avenues for watermarking. Many of these methods [34, 35, 36, 10, 17, 11], are based on the encoder-decoder architecture. In this model, the encoder embeds binary code into images in latent representations, while the decoder takes image as input and generates a binary code for comparison with the binary code injected for watermark verification. For example, the HiDDeN technique [36] involves the simultaneous training of encoder and decoder networks, incorporating noise layers specifically crafted to simulate image perturbations. While these methods improve robustness over traditional watermarking, they might not be suitable for real-time watermark injection due to the lengthy feed-forward process in the encoder, especially with larger architectures. Most recently, there has been line of work focusing on designing watermarks specifically for diffusion models [5, 8, 37]. These methods benefit from improved robustness due to their model-specific design, but the applicability other types of models is not yet well established.
Watermarks for protecting model intellectual property
Deep neural networks represent valuable intellectual assets, given the significant resources invested in their training and data collection processes [1]. For example, training stable diffusion models consumes approximately 150,000 GPU hours, amounting to roughly $600,000 in costs [38]. Given their broad applications in real- world scenarios, ensuring copyright protection and facilitating their identification is crucial in both normal and adversarial contexts [39, 40J. Some approaches embed watermarks directly into model parameters [41], necessitating white-box access for inspection. Others [42, 43] rely on backdoor attacks [44, 45, 46, 47], injecting triggers into training data to enable targeted predictions during testing. These methods primarily focus on safeguarding model intellectual property rather than the generated outputs.
2 Preliminary
Notations. We consider the problem of embedding watermarks into images and then detecting the watermarks as a binary classification problem. Let X' = [0, _| xH be the input space, with C, W. and H being the channel, width and height of images, respectively. We denote y = (0, to be the label space, with label 0 indicating unwatermarked and indicating watermarked versions, respectively. For vector v we use ||a|| to denote its normm
3

---

Threat Model. We consider the following use scenario of watermarks between third-party user Alice, e.g., an artist, a generative model provider Bob, e.g.. DALLE-2 from OPENAL, and an adversary Cathy. (1) Alice selects a diffusion model (DM) from Bob's s API interface and sends an input (e.g., prompt for text-to-image diffusion models) to Bob for generating images. (2) Upon receiving Bob generated images X E X, Alice embeds watermark into X, denoted as X' E X, and releases it to the public. (3) Adversary Cathy applies (adversarial) image transformation(s)) e.g., rotating and cropping, on X' to obtain a modified version (' X).. (4) Alice decides if X' was generated by herself not.
Problem Formulation. From the above, the watermark problem for Alice essentially boils down to a binary classification hypothesis testing problem:
Ho X' was generated by Alice (Watermarked);
H X' was NOT generated by Alice (Unwatermarked)
To address this problem, Alice will build detector given by
1(Watermarked)
if VxX) 2 T, if (X() < <,
x(V( = { (((Unwatermarkee)
where T E R is a threshold value and Va (to be defined later) is a scoring function which takes the image input and output value in [0, 1] to indicate its chance of being sample generated by Alice.
Alice's Goals. Alice's ' objective is to design watermarking algorithms that fulfill the following objectives: (1) Quality: the quality of watermarked images should closely match that of the original, unwatermarked images; (2) Identifiability: both watermarked and unwatermarked content should be accurately distinguishable; (3) Robustness: the watermark should be resilient against various image manipulations.
Cathy's 's (Adversary) Goals. Cathy aims to design attack algorithms to meet the following objectives: (1) Watermark Removal: the watermarks embedded by Alice can effectively eliminated after the attacks; (2) Quality: the attacks cannot significantly alter the images.
3 RAW
In this section, we formally introduce our RAW framework. At a high level, the RAW framework comprises two consecutive stages: a training stage and an inference stage, as outlined in Figure in Appendix. In the following subsection, we first provide an in-depth description of the training stage.
3.1 Training stage
Suppose Alice obtains batch of diffusion model-generated images. The unwatermarked data denoted as Duwn & (X,) for images to protect intellectual property.
I,...,n. Alice will need to embed watermarks into these
Definition 3.1 (Watermarking Module). A watermarking module (-) maps X to itself, with parameters w E Rd.
The watermarking module can take the form of an encoder with attention mechanism, as seen in the RivaGan [10], or can involve Fast Fourier Transformation (FFT) followed by frequency adjustments and an inverse FFT, as employed in DwiDet.
In our RAW framework, we propose add two distinct watermarks into both frequency and spatial domains:
En
+ tq x v) + x u,
where u, X' are watermarks, C1, 02 > O determine the visibility of these watermarks, and F(F-1) represents the Fast Fourier Transformation (FFT) (inverse FFT), respectively. For simplicity of notation, in the rest of this paper, we will denote w - [u, v). For implementation, we clip the watermarked image (X) to be within the range [0, 1]. making & (X) non-linear function of X.
The rationale for adopting the above approach is to simultaneously enjoy the distinct advantages offered by watermarks in both domains. In particular, the incorporation of watermark patterns

---

in the frequency domain has been widely recognized for its effectiveness against certain image manipulations such as translations and resizing. Moreover, our empirical validation corroborates the improved robustness of spatial domain watermarking in the presence of noise perturbations.
We denote the watermarked dataset E to be Dum - {E (xx)) for = 1,..., n. Alice now wishes to distinguish the combined dataset 'D _ Duwm U with verification module, which is binary classifier.
Definition 3.2 (Verification Module). A verification module is mapping Vo(-) X' + [0.1] parameterized by E TR
The score generated by the verification module for input image can be understood the chance of this image being generated by Alice.
To fulfill Alice's first two goals, Alice will consider jointly training the watermarking and verification modules parameterized by and 0, with the following loss function:
BCE(D) A
Σ
Y Eogg(V((X))
+ (1 Y) log(1 Vo
XED
where is the training image and Y E {0,1) the label indicting X watermarked or not.
Recall that Alice also aims to enhance the robustness of the watermark algorithms. As a result, we consider transforming the combined datasets with different data augmentations MI....,M,, ob- tain D & Mi (D)...., .., Dm & Mm (D), respectively. Here, the data augmentations MI..... Mn are defined as follow.
Definition 3.3 (Modification Module). An image modification module map M X' X.
To sum up, the overall loss function for our RAW framework is specified as:
Lraw BCE(D) Σ BCE(D"),
where BCE(-) denotes the binary cross entropy loss as specified in Equation (3). The loss function above is composed of two terms: BCE(D), which corresponds to the cross-entropy on the original combined datasets D, and Ex= BCE(D*), signifying the cross-entropy on the augmented datasets D1 D In our experiments, inspired by contrastive learning such as those presented in [20, 21 I], we adopt two-view data augmentation approach by setting m 2.
3.1.1 Overall Training Algorithm
We describe the overall training algorithm below. For completeness, we provide the full podudo-code summarized in Algorithm 3 in the appendix. We consider conducting the following steps alternatively.
Optimize the verification module Vo based on the overall loss Lraw by stochastic gradient descent (SGD):
Gs+1 + 02 (e Vo Crww (0,, w))
where 14 O is the step size at each step
Optimize the watermark w based on Ly. defined as the first term on the right-hand side of Equation (4), with sign-based stochastic gradient descent (SignSGD):
Wr+1 w. V sign Co w:))
(5)
where sign(-) outputs the sign of each component, and 14 > 0 is the step size.
We provide two remarks on the optimization procedure for the watermark update, as outlined in Eq. (5). First, we choose signSGD over conventional SGD, based on empirical findings suggesting that (sign-based) first-order methods can improve both training and test performance data-level optimization tasks [19, 48, 49]. In our context, this refers to cases where the optimized variable the watermark rather than the model parameters. Second, we focus the watermark optimization solely on the first term because the other terms, BCE(Dk) for & = 1,2..... m, may contain nonddifferentiable elements with respect to the watermark. These non-differentiable parts make gradient-basse based optimization impractical.
5

---

3.2 Inference Stage
We present a generic approach for Alice to obtain provable guarantees on the FPRs when using the previously trained Vi on test images, even amidst adversarial perturbations.
To begin with, we first examine a scenario where the future test data X E X' adheres to an IID pattern with the watermarked data Dwm generated by Alice, without undergoing any image modifications. In this case, Alice can employ conformal prediction to establish provable guarantees on the FPRs. The main idea is that, by utilizing the trained Va as a scoring mechanism, the empirical quantile of the watermarked data's distribution will converge to the population counterpart. This convergence is guaranteed by the uniform convergence of cumulative distribution functions (CDFs). To be more specific, we set the threshold T defined in Equation (1) to be the a-quanilee (with finite- sample corrections) of the predicted scores for watermarked data, Ve (D - (V {X,)) Following [23, 46], can be shown that, with high probability, the probability of the resulting detector g misclassifying a watermarked image Xtest is upper-bounded by a, given that X is IID with Dwn. For completeness, rigorous statement and its proof are provided in Appendix A.2.
The above argument assumes that the future test image X follows an IID pattern with the original watermarked data Dmmm, However, if the test image Xest undergoes manipulation attack, denoted by A(Xiea), with A : X' + X' being an adversarial image manipulation, then it can deviate from the distribution of "Dwm_ This deviation from III will render the previous argument invalid. Moreover, in practice, Alice is unaware of the adversarial transformation A employed by the attacker, thus making even more challenging to control the FPRs.
To address this problem, we propose to consider a robust version of the originally trained Va. denoted as V. such that X and A(X) stay close under V. namely
(5(X) - ((A(X)) S 17,
for all X and small 17 > 0. The reason for finding such V is because we can relate ((x() back to (XXest which is IID with ((DWm) (accessible to Alice) to establish the FPRs with previous arguments.
To develop the robust version from the base Vo, we will build upon the following result from the randomized smoothing literature. Denote N(, Σ) to be the normal distribution with mean μ and covariance Σ respectively, and & 1--1 --) to be the inverse of the cumulative distribution function of standard normal distribution.
Lemma 3.4 ([50, 51]) Let h R R [0. 1] be a continuous function. Let > O, and H(X)
E
[h(X + Z)). Then the function & (H(() is - with respect to l norm.
0~))(0,021)
The above result suggests that for any (continuous) base verification module (classifier) Vo. we can obtain a smoothed version with
E Vo(X + +211
=-1==-11-
Z~~N00021)
and it is guaranteed that [V(X) v(r) I 20-11 - Y11, for any X,Y Y E X'. Suppose the attacker employs adversarial attack A such that |X A(X)l S 7. We have
((x)))()(X)]1
(8)
Remark 3.5 (A can not be excessively adversarial). We emphasize that the transformation A should not be excessively adversarial. In other words, the parameter ry should be very low value for both theoretical and practical reasons. From a theoretical perspective, an overly adversarial transformation AA can result in trivial TPRs/FPRs. For instance, if watermarked images are transformed into a completely uniform all-white or all-black state, it becomes impossible to detect the watermark. From practical standpoint, an excessively adversarial transformation A tends to overwrite the original content within the images. This directly contradicts the intentions of attackers and may not achieve the desired stealthy modifications.

---

3.2.1 Overall Inference Algorithm
Given pair of (Ew. Vo), desired robust range > 0, and a smoothing parameter or > 0, Alice now will set the thresholding value 7, as introduced in Equation (1), to satisfy:
F +)+ (log(2/0)/(2n))
=
(9)
where 8 (0, 1) is violation rate describing the probability that the FPRs exceeds and F is the empirical cumulative distribution function of (V((Ew (X:)) where
(E (X.)) 2 x 20-1
E 2~~N(0,021) (Xo + +11
The next result shows that if a future test input comes from the same distribution as the watermarked data Dwn,, the above procedure can be configured to achieve any pre-specified false positive rate a with high probability.
Theorem 3.6 (Certified FPRs of g based on threshold in Equation (9)). Given any watermarked dataset Dom and its associated verification module Vo. suppose that the test data X IID drawn from the distribution of D'mm Given any E (0, 1), y > O and a > O, for any (adversarial) image transformations A such that [|A(()) - X < 7 for all X E X, the robust verification module V specified in Eq. (7) and its corresponding hard-labe detector g(-) introduced in Eq. (1), with the threshold I as specified in Eg. (9) satisfy
(( (o( (A(((sA))))))) (exssss))) 0 (Unwatermarked) P
|
Dun
S a,
with probability at lease 6 for any a (0, 1) such that a > v /log(2/8)/(22))
Due to space constraints, the proof is provided in Appendix A. The above result shows that by using the decision rule as specified in Equation (9), Alice can obtain provable guarantee on the Type error rate in terms of detecting future test input Xiest even Xiesı is adversarially perturbed within "-range (as measured by 22-norm), under the condition that the future test input Xiea is independently and identically distributed as the D namely watermarked samples generated by the artist Moreover, the result above only addresses the detector's s performance in terms of FPRs and does not account for True Positive Rates (TPRs). To achieve high TPRs, careful selection of y and is essential. For instance, an excessively large a will cause the smoothed classifier V to lose its detection capability.
Experiments
In this section, we conduct a comprehensive evaluation of our proposed RAW, including (1) detection performance, (2) robustness, (3) watermarking speed, (4) the quality of watermarked images, and (5) the provable FPRs guarantees under adversarial attacks. Our findings reveal significantly enhanced robustness in RAW while preserving the quality of generated images. Furthermore, substantial reduction in watermark injection time, indicates the suitability of RAW for on-the-fly deployment. All the experiments were conducted machines equipped with Nvidia Tesla A100s.
4.1 Experimental setups
Datasets (1) In line with the previous work [8], we employ Stable Diffusion-v2-11 [1], open-source text-to-image diffusion model, with DDIM sampler, to generate images. All the prompts used for image generation are sourced from the MS-COCO dataset [27]. (2) We further evaluate our RAW utilizing DBdiffusion [26], a dataset consisting of 14 million images generated by Stable Diffusion. This dataset encompasses a wide array of images produced under various prompts, samplers, and user- defined hyperparameters. Ablation studies examining various generative models, such as SDXL-1.0,
are detailed in Appendix D.
Verification Mlasles/Classifeess In terms of verification modules, for all the results reported in the main text, we utilize ResNet 18 [52]. For training the verification modules, 500 images are randomly selected for training for each dataset. Subsequently, we evaluate the trained watermarks and associated models on 1000 new, unwatermarked images and their watermarked versions. Ablation studies on using different models, such as VGG [53] as verification modules, and different number of training data are provided in Section 4.4 and Appendix D.
7

---

Table 2: Summary of main results. 'N-ROC' denotes the AUROC performance without image manipulations or adversarial attacks. 'Ad-ROC" represents the average performance across nine distinct image manipulations and attacks. The 'Encoding Speed' column denotes the efficiency of injecting watermarks into images post-training, measured in seconds (CPU time) per image.
Dataset
Method
Encoding Speed
N-ROC
Ad-ROC
FID
CLIP
DwTDeT DwTDeTSvd
0.048
0.83
0.54
25.10
0.359
MS-Coco
0.122
0.98
0.75
25.21
0.361
FID: 24.12
RivaGan
1.16
0.99
0.81
24.87
0.359
CLIP: 0.382
StegaStamp RAW (Ours)
1.45
0.99
0.93
42.31
0.291
0.0051
0.98
0.92
24.75
0.360
DwTDeT
0.048
0.81
0.55
3.12
0.427
DwTDeTSvv
0.110
0.99
0.78
10.24
0.421
DBdiffusion
RivaGan
1.87
0.99
0.82
19.75
0.424
StegaStamp
1.90
0.99
0.92
40.59
0.386
RAW (Ours)
0.0078
0.98
0.90
23.48
0.425
Table 3: AUROC performance of state-of-the-ard methods under 9 (adversarial) image manipulations: Rotation 90", Cropping and resizing 70%, Gaussian Blur with a kernel size of (7, 9) and bandwidth of 4, Noise with IID mean Gaussian 0.05, Jitter with brightness factor 0.6, JPEG compression with quality 50, and 3 attacks (VAE Att1, VAE Att,, Diff Att).
Datasets
MS-COCO
DBDiffusion
DwtDet
DwtDetSvd
RivaGan
Ours
DwtDet
DwtDetSvd
RivaGan
Ours
JPEG
0.61
0.99
0.99
0.91
0.50
0.95
0.99
0.99
Rotation 90
0.51
0.55
0.39
0.96
0.47
0.54
0.38
0.84
Cropping 70%
0.64
0.52
0.99
0.95
0.65
0.61
0.99
0.84
Gaussian Blur
0.52
0.92
0.99
0.93
0.53
0.99
0.99
0.98
Gaussian Noise
0.47
0.76
0.99
0.90
0.84
0.99
0.99
0.98
Jittering
0.65
0.78
0.98
0.96
0.17
0.68
0.98
0.99
VAE Attl
0.50
0.73
0.62
0.89
0.49
0.75
0.80
VAE A122
0.48
0.78
0.67
0.90
0.49
0.73
0.63
0.81
Diff Att
0.49
0.71
0.69
0.83
0.51
0.73
0.70
0.82
Average
0.54
0.75
0.82
0.92
0.56
0.78
0.82
0.90
Watermark Parameters In Equation (2) of RAW, two parameters and 0o control the invisibilityy of the watermark, thereby influencing the quality of watermarked images. the main text results, we set C1 = 2 0.05 to align with the image quality of watermarked images produced by other state- of-the-art methods (refer to the 'FID' and 'CLIP' columns Table 2). We conduct an ablation study exploring different values of and C2 Section 4.4 and Appendix D. For all other watermarking techniques, we implement them using the open-source package employed by the Official Stable Diffusion Model.
Evaluation Metrics (1) To assess the detection performance, we adhere to the convention of reporting
the area under the curve of the receiver operating characteristic (AUROC) [17, 5]. (2) For evaluating the quality of the watermarked images, we adopt both the Frechet Inception Distance (FID) [54] and the CLIP score [55], following the methodology outlined in [8]. Additionally, we also evaluate the quality watermarked images using metrics such as PSNR and SSIM, and include the results in the appendix. For our watermark scheme, each independent run (including training and testing) corresponds to a unique watermark. All metrics are averaged across independent runs, with standard deviation of 0.03 for all detection performances (AUROC) and 0.7 for image quality metrics.
4.2 Main Results
Detection performance and image generation quality To ensure fair comparison, we primarily evaluate our proposed RAW against other model-agnostic approaches, presenting the summarized results Table along with visual examples illustrated in Appendix D.4. Additionally, for complete- methods and provide the results in the
ness, compare proposed RAW against

---

appendix. Our RAW exhibits comparable performance to mcoder-deccoerr-baeee approaches, e.g.. RivaGAN, while concurrently achieving similar FID and CLIP scores, which underscores superior image quality compared to alternatives. We report the PSNR and SSIM of the watermarked images in the Table in the appendix. Our method outperforms StegaStamp PSNR and SSIM but falls behind DwtDetSvd and RivaGAN, as expected. StegaStamp prioritizes robust detection by injecting significant noise, reducing image quality. In contrast, DwtDetSvd and RivaGAN maintain better image quality at the cost of reduced robustness to image perturbations, a point further detailed in the next paragraph.
Robust detection performance We assess the robustness of our proposed RAW against six common data augmentations and three adversarial attacks in this subsection. The data augmentation set comprises: color jitter with brightness factor of 0.5, JPEG compression with quality 50, rotation by 90", addition of Gaussian noise with O mean and standard deviation 0.05, Gaussian blur with kernel size of (7,9) and bandwidth 4, and 70% random cropping and resizing. For adversarial attacks, we select three otate-of-the-art methods for removing watermarks, with two VAE-based attacks Bmshj201 j018 18 [14] (VAE Attl) and Cheng2020 [56] (VAE Att2) from Compress [57] with compression factors are set to 3 for both models, and one diffusion-model attack with noise steps of 60 following [58].
The averaged results are the 'AUROC (Adv)' column of Table 2 and the detailed results are summarized in Table 3. Our approach demonstrates superior performance compared with alternative methods. Specifically, across both datasets, the average AUROC for our RAW increased by 70% and 13% for nine image manipulationss/ttaall methods. We note that Stegastamp demonstrates similar averaged robust detection performance compared to ours. However, this comes at the expense of reduced image quality, as evidenced by markedly increased FID scores and/or lowered SSIM/PSNR scores.
surpassing frequency- and mncoder-deecoer-banee
Watermark injection speed We in- vestigate the time costs needed to em- bed watermarks into images. We note that the watermark injection process occurs post- tost-training. Therefore, our watermark injections only necessitate one FFT, two additions, and another inverse FFT. Table 4, we present CPU time (in seconds) elapsed for in- jecting watermarks into different im- age quantities. Notably, our method achieves substantial time efficiency improvements, approximately 30x (200x) faster than the frequency-basee based (encoder-decoder based) method, respectively. This is attributed to streamlined batch operations in our RAW. This highlights the suitability of our approach for on- on-the-fly deployment.
Table 4: CPU time (seconds) elapsed for injecting water- marks into images. Lower values are preferred.
Batch Size +
images
100
images
500 images
DwtDet
0.27
4.8
24.5
DwtDetSvd
0.64
12.2
60.1
RivaGAN
5.52
116
> -000
StegaStamp
7.34
134
> 500
RAW (Ours)
0.35
0.51
0.76
4.3 Certified FPRs
We assess the certified FPRs performance of our proposed RAW by varying the FPRs rate pre- specified by Alice. We set the adversaril radius 7 = 0.001 and the smoothing parameter a = 0.05. We summarize the results of five independent runs in Figure ((a) and report the mean (with standard error < 0.002). The results show that the FPRs of RAW consistently matches the theoretical upper bounds (i.e., a), supporting the result presented in Theorem 3.6.
4.4 Ablation Studies
Effect of training sample size on prediction performance We manipulate the sample size of the watermarked training dataset Dwm to assess its impact on detection performance. These findings are illustrated in Figure 1(b), where we note that satisfactory detection performance can be achieved with reasonably small training dataset, e.g., 100 images.
Trade-off between robustness and image quality We explore the trade-off between robustness and image quality by adjusting the watermark strength parameters e₁ (= o2). as illustrated in Figure I (c) & (d) below. We note that with increasing values of e and 02, the average AUROC, under (adversarial) images manipulations, also increases, while the image quality only exhibits slight

---

degradation, as indicated by the slightly increased FID value. These findings also highlight the stability of the watermark hyperparameters e and c2 our proposed RAW, a desirable characteristic for real-world deployments, as preferred by practitioners.
0.05
Theery Upper Bound
MS-30CO
0.04
RAW
Averaged AUNOC
D3:CW9uslon
0.7
0.02
0.01
MS-COCO
CD-0PTEET
0.00
0.02
0.04
830
(Training Samp Size)
(d)
Figure 1: (a) FPRs of our proposed RAW. (b) Impact of training sample size on detection performance. (c) & (d) The tradeoff between the quality of watermarked images, assessed using FID (lower values are preferable), and the detection robustness.
4.5 Extension Video Watermark
We discuss how to extend the proposed watermark framework from Al generated images to videos. The main idea is to embed the same pre-trained watermark either every frame or intervals, such every three frames, of the video. The corresponding verification module, i.e., the watermark classifier, is then used detect the watermark in each frame where was embedded. The overall presence of the watermark in the video is determined by the detection results from these frames.
We evaluate the pre-trained (on the MS-COCO dataset) watermark and its corresponding classifier using short videos created by the stable- srable-video cif-ddiifiooooooo img22id-xx -tt model, which generates videos from images. The images used produce the videos are sourced from the DiffusionDB dataset. This guarantees that the testing vidcos were not exposed to either the watermark or the classifier during the training process. The results are summarized Table below, where we observed that our proposed method achieves a similar detection rate compared to RivaGan, while providing significantly faster watermark encoding speed (x60 times faster).
Table 5: Encoding Speed (CPU Only) and AUROC (over fresh 500 test samples) for video watermark with the proposed RAW
Method
Video Resolution
Number of Frames
Time Elapsed
AUROC
RAW (Ours)
512 x 512
24
0.2 - 0.5s
0.96
RivaGan
512 x 512
24
8 12s
0.97
Conclusion
In this study, we introduce the RAW framework a versatile watermarking approach essential for protecting intellectual property and mitigating potential misuse of Al-generated images. The proposed RAW framework offers several notable features, including significantly enhanced watermark encoding speed and/or detection performance, along with the assurance of provable guarantees on false positive rates even under adversarial perturbations in test images. Experimental findings across various datasets validate its advantages.
Linitation & Future Work One potential limitation of the proposed method is that when applied to large-scale systems with millions users, the associated training loss will be high. One interesting direction is to study how to efficiently fine-tune from one pair of watermark and its corresponding verification module to a new pair. Other directions include investigating the maximum number of concurrent watermarks learnable in single training session and optimal smoothing strategies for wider certified radii.
Broader Impact This paper aims contribute the advancement of trustworthy machine learning, particularly in ensuring the safe and legitimate use of contemporary generative artificial intelligence. Our efforts could have several positive societal implications, such protecting intellectual property and preventing potential misuse Al-generated images.
The Appendix contains proofs, experimental details, and ablation studies.
10

---

Acknowledgment
The work of Xun Xian, Xuan Bi, and Mingyi Hong was supported in part by a sponsored research award by Cisco Research. The work of Ganghua Wang and Jie Ding was supported in part by the Army Research Office Early Career Program Award under grant number W911NF2310315.
References
[1] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, "High-resolutio image synthesis with latent diffusion models," in Proceedings of the IEEE/CVF conference computer vision and pattern recognition, 2022, pp. 10 684-11 695.
[2] A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen, "Hierarchical text-conditional image generation with clip latents, 2022," URL https://arxiv. wgg/abs/204.06122, vol. 2022.
[3] L. Verdoliva, "Media forensics and deepfakes: an overview," IEEE Journal of Selected Topics in Signal Processing, vol. 14, no. 5, pp. 910-932, 2020.
[4] M. Sag, "Copyright safety for generative ai," Forthcoming in the Houston Law Review, 2023.
[5] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, "The stable signature: Root- ing watermarks in latent diffusion models," in Proceedings of the IEEE/CVF International Conference Computer Vision, 2023, pp. 22466-22477.
[6] G. Nie, C. Kim, Y. Yang, and Y. Ren, "Attributing image generative models using latent fingerprints," arXiv preprint arXiv:2304. 09750999, 2023.
[7] C. Kim, K. Min, M. Patel, S. Cheng, and Y. Yang, "Wouaf: Weight modulation for user attribu- tion and fingerprinting in text-to-image diffusion models," arXiv preprint (XXi:2336.04744: 2023.
[8] Y. Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, "Tree-rings watermarks: Invisible fingerprints for diffusion images." in Thirty-sevnnth Conference Neural Information Processing Systems, 2023. [Online]. Available:
[9] I. J. Cox, J. Kilian, T. Leighton, and T. Shamoon, "Secure spread spectrum watermarking for images, audio and video," in Proceedings of 3rd IEEE international conference on image processing, vol. 3. IEEE, 1996, pp. 243-246.
[10] K. A. Zhang, L. Xu, A. Cuesta- watermarking with attention." " arXiv preprint arXiv:1909.01280 01205, 2019.
and K. Veeramachaneni, "Robust invisible video
[11] M. Taneik, B. Mildenhall, and R. Ng, "Stegastamp: Invisible hyperlinks in physical photographs," in Proceedings of the IEEF/CVF conference on computer vision and paltern recognition, 2020, pp. 2117-2126.
[12] Song, C. Meng, and Ermon, "Denoising diffusion implicit models," arXiv preprint arXiv:2010.02502, 2020.
[13] I. Cox, M. Miller, J. Bloom, J. Fridrich, and T. Kalker, Digital watermarking and steganography. Morgan kaufmann, 2007.
[14] J. Ballé, D. Minnen, S. Singh, S. J. Hwang, and N. Johnston, "Variational image compression with scale hyperprior," arXiv preprint arXiv: arXiv: (at:::00200444 2018.
[15] Q. Wang, "Invisible watermark," https:/ggthbb..ommShhhtdddnn/nit wataaa//iiiiisbbleewtttraaa,, 2022.
[16] I. Pitas, "A method for watermark casting on digital image." IEEE Transactions on Circuits and Systems for Video Technology, vol. 8, no. 6, pp. 775-780, 1998.
[17] P. Fernandez, A. Sablayrolles. T. Furon, H. Jégou, and M. Douze, "Watermarking images in self-supervised latent spaces," " in ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 2022, pp. 3054-3058.
[18] I. J. Goodfellow, J. Shlens, and C. Szegedy, "Explaining and harnessing adversarial examples." arXiv preprint arXiv: 1412.6572 2014.
[19] A. Madry, A. Makelov, Schmidt, Tsipras, and A. Vladu, "Towards deep learning models resistant to adversarial attacks," arXiv preprint arXiv:1706.06 06083, 2017.
11

---

[20] T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, "A simple framework for contrastive learning of visual representations," in International conference on machine learning. PMLR, 2020, pp. 1597-1607.
[21] P. Khosla, P. Teterwak, C. Wang, A. Sarna, Y. Tian, P. Isola, A. Maschinot, C. Liu,, and D. Krishnan, "Supervised contrastive learning," Advances in neural information processing systems, vol. 33, pp. 18 661-18 673, 2020.
[22] V. Vovk, A. Gammerman, and Shafer, Algorithmic learning in a random world. Springer, 2005, vol. 29.
[23] J. Lei and L. Wasserman, "Distribution-fiee prediction bands for non-parametric regression," Journal of the Royal Statistical Society Series B: Statistical Methodology, vol. 76, no. 1, pp.
71-96, 2014.
[24] C. Duchi, P. L. Bartlett, and M. Wainwright, "Randomized smoothing for stochastic optimization." SIAM Journal on Optimization, vol. 22, no. 2. pp. 674-701, 2012.
[25] J. Cohen, E. Rosenfeld, and Z. Kolter, "Certified adversarial robustness via randomized smooth-
ing." in international conference on machine learning. PMLR, 2019, pp. 1310-1320.
[26] Z. J. Wang, E. Montoya, D. Munechika, H. Yang, B. Hoover, and D. H. Chau, "Diffusiondb:
A large-scale prompt gallery dataset for text-to-image generative models," arXiv preprint arXiv:2210. 14896, 2022.
[27] T.-.. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. Zitnick, "Microsoft coco: Common objects in context," in Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13. Springer,
2014, pp. 740-755.
[28] Pereira, J. O. Ruanaidh, F. Deguillaume, G. Csurka, and T. Pun, "Template hased recovery of fourier-based watermarks using log-polar and log-log maps," in Proceedings IEEE international conference on multimedia computing and systems, vol. 1. IEEE, 1999, pp. 870-874.
[29] G. Gupta, V. Gupta, and M. Chandra, "Review on video watermarking techniques in spatial and transform domain," " in Information Systems Design and Intelligent Applications: Proceedings of Third International Conference INDIA 2016, Volume 2. Springer, 2016, pp. 683-691.
[30] H. O. Altun, A. Orsdemir, G. Sharma, and M. F. Bocko, "Optimal spread spectrum watermark embedding via a multistep feasibility formulation," " IEEE transactions on image processing, vol. 18, no. 2, pp. 371-387, 2009.
[31] Hartung and B. Girod, "Watermarking of uncompressed and compressed video," Signal processing, vol. 66, no. 3, pp- 283-301, 1998.
[32] J. J. O'Ruanaidh and T. Pun, "Rotation, scale and translation invariant digital image watermark- ing," in Proceedings of International Conference on Image Processing, vol. 1. IEEE, 1997, pp. 536-539.
[33] R. Hernandez, M. Amado, and F. Perez- Gonzalez, "Det-domain watermarking techniques for still images: Detector performance analysis and new structure," IEEE transactions on image processing, vol. 9, no. 1, pp. 55 55-68,22 2000.
[34] H. Kandi, D. Mishra, and S. R. S. Gorthi, "Exploring the learning capabilities of convolutional neural networks for robust image watermarking." Computers & Security, vol. 65, pp. 247-268. 2017.
[35] J. Hayes and G. Danezis, "Generating steganographic images via adversarial training," Advances in neural information processing systems, vol. 30, 2017.
[36] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, "Hidden: Hiding data with deep networks," in Proceedings of the European conference on computer vision (ECCV), 2018, pp. 657-672.
[37] Z. Yang. K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu, "Gaussian shading: Prov- able perfornance-losiees image watermarking for diffusion models." in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 12 162-12 171.
[38] Wikipedia contributors. (2023) Stable diffusion, [Online]. Available: wttp://en.wikkpeei..rgg// SetiStable_Diffusshe
12

---

[39] F. Tramër, F. Zhang. A. Juels, M. K. Reiter, and T. Ristenpart, "Stealing machine learning models via prediction [APIs), " in 25th USENIX security symposium (USENIX Security 16), 2016, pp. 601-618.
[40] X. Xian, M. Hong, and J. Ding, "Understanding model extraction games," in 2022 IEEE 4th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA). IEEE, 2022, pp. 285-294.
[41] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, "Embedding watermarks into deep neural networks." in Proceedings of the 2017 ACM on international conference on multimedia retrieval, 2017, pp. 269-277.
[42] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and Keshet, "Turning your weakness into a strength: Watermarking deep neural networks by backdooring," in 27th USENIX Security Symposium (USENIX Security 18), 2018, pp. 1615-1631.
[43] Y. Zhao, T. Pang, C. Du, X. Yang. N.-M. Cheung, and M. Lin, "A recipe for watermarking diffusion models," arXiv preprint arXiv:2303.101
2023.
[44] T. Gu, B. Dolan-Gavitt, and S. Garg, "Badnets: Identifying vulnerabilitics in the machine learning model supply chain," arXiv preprint arXiv: arXiv:1708.066 067333 2017.
[45] X. Xian, G. Wang, J. Srinivasa, A. Kundu, X. Bi, M. Hong, and J. Ding, "Understanding backdoor attacks through the adaptability hypothesis," International Conference on Machine Learning. PMLR, 2023, pp. 37 952-37 976.
[46] X. Xian, G. Wang, J. Srinivasa, A. Kundu, X. Bi, M. Hong, and J. Ding, "A unified detec- tion framework for inference-stage backdoor defenses," in Advances in Neural Information Processing Systems, vol. 36, 2023, pp. 7867-7894.
[47] G. Wang, X. Xian, J. Srinivasa, A. Kundu, X. Bi, M. Hong, and J. Ding, "Demystifying poisoning backdoor attacks from statistical perspective," in International Conference on Learning Representations (ICLR), 2024.
[48] Liu, B. Han, T. Liu, C. Gong, G. Niu, M. Zhou, M. Sugiyama et al., "Probabilistic margins for instance reweighting in adversarial training," Advances in Neural Information Processing Systems, vol. 34, pp. 23 258-23 269, 2021.
[49] Q. Wang, F. Liu, Y. Zhang, Zhang, C. Gong, T. Liu, and B. Han, "Watermarking for out- of-distribution detection," Advances in Neural Information Processing Systems, vol. 35, pp. 15 545-15 557, 2022.
[50] H. Salman, J. Li, I. Razenshteyn, P. Zhang, H. Zhang, S. Bubeck, and G. Yang, "Provably robust deep learning via adversarially trained smoothed classifiers," Advances in Neural Information Processing Systems, vol. 32, 2019.
[51] A. Levine, S. Singla, and S. Feizi, "Certifiably robust interpretation in deep learning," arXiv preprint arXiv: /2105, 2019.
[52] K. He, X. Zhang, S. Ren, and J. Sun, "Deep residual learning for image recognition," in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770-778.
[53] K. Simonyan and A. Zisserman, "Very deep convolutional networks for large-scale image recognition," arXiv preprint arXiv: 1556, 2014.
[54] M. Heusel, H. Ramsauer, T. Unterthiner, Nessler, and Hochreiter, "Gans trained by a two time-scale update rule converge to local nash equilibrium," Advances in neural information processing systems, vol. 30, 2017.
[55] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., "Learning transferable visual models from natural language supervi- sion," " in International conference on machine learning. PMLR, 2021. pp. 8748-8766 8763.
[56] Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, "Leared image compression with discretized gaus- sian mixture likelihoods and attention modules," " in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 7939-7948.
[57] J. Bégaint, F. Racapé, S. Feltman, and A. Pushparaja, "Compressai: a pytorch library and evaluation platform for end-to-end compression research," arXiv preprint arXiv:201 1.03029, 2020.
13

---

[58] X. Zhao, K. Zhang, Z. Su, S. Vasan, I. Grishchenko, C. Kruegel, G. Vigna, Y.-X. Wang, and L. Li, "Invisible image watermarks are provably removable using generative ai," arXiv preprint WwXiv:2306.01990 2023.
[59] V. N. Vapnik, "An overview of statistical learning theory," IEEE transactions on neural networks, vol. 10, no. 5, pp. 988-999, 1999.
[60] P.-Y. Y. Chen, "Model reprogramming: Resource-efficien cross-domain machine learning," arXiv preprint arXiv:2202.10622 2022.
[61] A. Dosovitskiy, L. Beyer, Kolesnikov, D. Weissenborn, Zhai, Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly el al., "An image is worth 16x 16 words: Transformers for image recognition scale," arXiv preprint arXiv:2010. 1929, 2020.
14

---

Appendix for RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees
In Section A, we outline the formal proofs supporting the theoretical findings introduced in the main text. In Section B, we present omitted details, encompassing pscudocode and additional deliberations regarding the construction of RAW. In Section C, offer implementation details of our experiments. In Section D, we present additional ablation studies on different hyperparameters.
A Proof of theoretical results
In this section, we provide the proof for Theorem 3.6. To begin with, we first revisit the overall inference procedure employed by our RAW and provide several detailed discussions. For the reader's s convenience, we include the pseudo-code outlining the inference stage protocol of RAW in Algorithm below.
Algorithm Conformal (Inference) Watermark Detection
Input:
querying input X Wes watermarked dataset D (X,((X)) ) verification module Vo. desired false positive rate E (0, 1). violation rate 5 E (0, 1), desired adversarial robust range > 0, smoothing parameter > 0, and smoothed/robust verification module Vi() - + (Bx
2)))
1: Receiving future query sample X
2: for to do
3: Calculate 8; & (E X, D2m
5:
Select the decision threshold 7 according to Equation (10). Determine X watermarked if (XEee))))) 2
Output: The decision the sample Nes is watermarked sample or not
The overall inference process for the proposed RAW mainly involves determining a decision threshold value т. This threshold is calculated based the provided watermarked dataset Dw and the corresponding (smoothed) verification module V, and it should satisfy the following condition:
In 3
+ + 2) -a- 2
(10)
2n
where (0, 1) is the violation rate describing the probability that the (FPRs) exceeds a, and / the empirical cumulative distribution function the watermarked dataset under V i.e., (X,,)) In the case where /llog(2/))/C (2n)) > a, we set the thresholding value to be the maximum of We note that under such cases there will be no theoretical guarantees in term of
FPRs.
A.1 Proof of Main Results
The proof of Theorem 3.6 built upon the techniques established in our previous work [46]. [46]. we developed similar provable guarantees under the IID assumption of future test data. However, in our case of Theorem 3.6, such an IID assumption is no longer valid and hence raise up new technical challenges. To prove Theorem 3.6, we will use the following result concerning the convergence properties empirical cumulative distribution functions (ECDFs).
Lemma A.1 "Dvoretzy-KKifferr- -WlffowitZ inequality). Given natural number n, let X1, X2,..., Xx, be real-valued independent and identically distributed random variables with cumulative distribution fanction F()). Let F(-)) denote the associated empirical distribution function.
The interval that contains the true CDE F(x), with probability 1 - 8 is specified as
In 2
F(x) - F(x) s F(x) + where = =
V
2n
15

---

Proof of Theorem 3.6. Note that Xust is IID drawn from the watermarked data distribution and we have
P(g(A(X(ss) = 0 (Unwatermarked) | (Dmm)
=P(Y(A(Xee))) S )
(11)
< <P(((X - 7 S )
(12)
TEx,:1VV(X1os S ? Dwwn
(Fx,,( S F(( ") D
(13)
-P(F(((XIes) S F(T 2) D
In 3
S <P(F(((X(O)) - F(T 2) + E Dum)
(E=
V
(14)
2n
=a
(15)
a,
holds with probability at least 1 - 8. The equation (11) is because of the decision rule specified in Algorithm 1, and the inequality (12) is due to the lipschitz condition of V with parameter o namely
(V()- D(Y) S - - YlI.
for any X,y E X. Additionally, the F in equation (13) represents the CDF of the watermarked data under V(-), i.e., ((E while F in (14) denotes the empirical CDF obtained from Dwn i.e., (V(E (X:)(()))) [x))]=== under V.)). The inequality in (14) arises from the DKW inequality specified in Lemma A. Furthermore, the Equation (15) based on the fact that the CDF follows a uniform distribution (a result of the probability integral transformation) and the selection of the thresholding value specified Equation (10).
A.2 Provable FPRs without adversarial attacks
In this section, we present the omitted results of the provable FPRs concerning the watermark detection performance of our RAW in the absence of adversarial attacks, elaborated in Line 225 of the main text. All the techniques used in this section are based on our previous work [46]. as discussed earlier.
As there are no anticipated adversarial attacks on test images, there is consequently no requirement to apply mmoothing/rouustffcction the trained verification model V.. The corresponding pseudo-code outlined in Algorithm below. Similarly, the updated thresholding value r selected to satisfy the
Algorithm 2 Conformal (Inference) Watermark Detection under adversarial attacks
Input: querying input Xus. watermarked dataset Dmm ((E.. (X.))) verification module Ve. desired false positive rate (0, 1), violation rate d (0, 1)
1: Receiving future query sample X1es
2: for = to do
3: Calculate s; & VowEww X; nm
4: end for
Select the decision threshold 7 according to Equation (10).
6: Determine if Xast is watermarked if (E (Nea)) 2
Output: The decision the sample Xuse is watermarked sample not
condition.
In 2
F(7) = a -
(16)
2n
16

---

where 8 E () is the violation rate describing the probability that the (FPRs) exceeds a, and F is the empirical cumulative distribution function of the watermarked dataset under Va. i... (V (X,)) Contrasting the selection of T under adversarial attacks in Equation (10), we note that the term y/a is omitted because of the absence of adversarial attacks. In the case where (llog(/00) (2n)) > o, set the thresholding value be the maximum of (Vo(Ew (X:)) Theorem A.2 (Certified FPRs under adversarial attacks). For any watermarked dataset Dunn and its associated verification module Vg. suppose that the test data (Xrest Yua) are IID drawn from the distribution of Dumm, Given ô (0, 1). the detectorg(-) (defined in Line 231 in the main text) with the threshold I as specified in Equation (16) satisfies
P(g(X
(Unwatermarked) (D"m)
with probability at least 1 - ò for any a E (0, such that a v
Proof. The proof follows the same approach as the proof for Theorem 1, with the exclusion of the 7/0 term.
17

---

B Omitted Details and Further Discussions
In this section, initially present the omitted pseudo-code for the training algorithm, followed by further discussions regarding the design of RAW.
B.1 Overall flow of the proposed RAW
Figure 2 below demonstrates the overall flow of our RAW framework and its differences from ponoddr-decoder-baaee methods. In RAW, watermarks are directly introduced and injected into images and are jointly trained with the watermark classifier.
Frequency Wafermark
Joint Learning
Classifier
>>>>
>>
Spatial Watermark
(a) RAW
>>>>
Ground-truth Watermark
L
<<<
Decoder
(b) Encoder-Decoder
Extracted Watermark
Figure The overall flow of the proposed RAW framework.
B.2 Pseudocode for training algorithms
The pseudocode for the overall training pipeline RAW is outlined in Algorithm
Algorithm 3 Training Algorithms for RAW
Input: (I) Image sets generated from diffusion model (X, (II) watermark visibility parameter eı, 02: (III) learning rates [p=))=1. {u:)T= y
Initialize: (1) a verification module V4 :' + [0, 1]. (2) a watermarking module: E., ( =X) +
x v) + 02 x w with each entries in u, E X' initialized as IID uniform random variables.
I: for to T do
Clipping the watermarked to be within the range [0. 1];
3: Given Vs, optimizing w based on Law with SignSGD;
4: Given the watermark w, updating 0 based on Luw. with SGD;
5:
end for
Output: (1) The verification module Vo: (2) Watermarking method E...
B.3 Additional metrics on image quality
We report the PSNR and SSIM of the watermarked images in the Table below. For PSNR and SSIM, our method outperforms the StegaStamp method but is behind DwtDetSvd and RivaGAN, These results are consistent with our expectations. The StegaStamp method achieves more robust detection by sacrificing image quality through injecting a large amount of noise into the image, while Dwt and RivaGAN maintain image quality slightly better at the cost of reduced robustness against (adversarial) image perturbations.
18

---

Dataset
MS-COCO
DBdiffusion
Method
PSNR 1
SSIM
PSNR f
SSIM
RAW (Ours)
29.1
0.94
29.0
0.93
StegaStamp
27.1
0.90
28.1
0.90
DwiDeiSvd
39.6
0.98
37.8
0.97
RivaGAN
36.4
0.96
38.5
0.97
Table 6: Additional metrics for image quality.
B.4 Further Discussions
We now elaborate on two pivotal aspects of our watermark designs and overarching training al- gorithms: (I) the joint training scheme for watermarking and verification modules, and (II) the integration of spatial-domain watermarks.
(I) The joint training scheme for watermarking and verification modules. Theoretically, using standard arguments from classical learning theory [59], it can be shown that training both the watermarking and the verification modules distinguish between watermarked and unwatermarked data will not lead to a test accuracy worse than when the watermark is fixed, and only the model is trained. From practical perspective, the initially randomly initialized watermarks may align well with specific training data, emphasizing the need to optimize watermarks for distinct data scenarios. Our empirical observations support this notion, evidenced Figure (left), where the joint training scheme leads to significantly higher test accuracy and lower training loss compared with the scenario where the watermark fixed.
(II) The inclusion of spatial domains. Classical methods for embedding watermarks primarily introduce them into the frequency domains of images [13]. However, it has been empirically observed that such watermarks are susceptible to manipulations, such as Gaussian noise [8]. To overcome this vulnerability, we draw inspiration from the model reprogramming literature [60], where watermarks are incorporated into the spatial domain to enhance accuracy in distinguishing in- and out-distribution
data [49]. Consequently, we explore the integration of watermarks into the spatial domain (in addition to the frequency domain), as outlined in Equation (2). We empirically observed that including spatial watermarks could significantly boost the accuracy of the trained verification module under Gaussian-noise manipulations on test data, depicted in Figure 5 (right).
Effects of optimizing watermarks
Effects spatial watermarks
1.0
Model Only
Freq only Watermark
Model Watermark
Freqe Watermark
966
0.4
0.2
-22
0.0
5.0
Test Accuracy (Lower the better)(Higher the better)
Training Loss
Training Loss (Lower the better) (Higher the better)
Tost Accuracy
Figure 3: Effects of (1) joint training and (2) spatial watermarks.
19

---

C
Implementation details
In this section, we first list the implementation details for the results presented the main text. Next, we present ablation studies on the performance of our RAW by using different hyper-parameters.
C.1 Implementation Details
Watermark setup Recall that the watermarking module in our RAW takes the form of
=
u) C2 x v,
where u, U E A' are two watermarks injected into spatial and frequency domains, respectively, For the results presented the main text, we set the watermark strength parameters 6₁ and 02 to be 0.05 each. To enhance invisibility further, we implement circular mask with radius of 150 for the frequency domain watermarks, inspired by the procedure outlined in [8].
Verification module setup In terms of the verification module Vs. throughout all the experiments in the main text, we adopt the pre-trained ResNet 18 [52] architecture.
Training data augmentation Two types data augmentations are employed during the training phase. (1) To enhance the robustness of the trained verification model V/ against Gaussian noise, ensuring its sustained predictive effectiveness post-smoothing, we introduce Gaussian noise into the training data. This augmentation entails the addition of noise with mean of zero and standard deviation of 0.5 during the training process. (2) Additionally, we employ standard image augmentations such as random cropping and flipping facilitate training.
D
Additional Ablation Studies
D.1 Verification module/model architectures.
In this section, we assess the watermark detection performance of our RAW using diverse model architectures: ResNet 9, ResNet 34, VGG 16 [53] and VIT [61]. The summarized results on both Direee-Dfffiooo-geeeee
MS MS-COCO and DBDiffusion dataset can be found in Table below. FID and CLIP scores are omitted, given that the watermark strength parameters and are consistent with those in the main text (i.e., both set to 0.5). Notably, we observed an improvement in both benign and adversarial detection performances with more complex model, ResNet 34, which is reasonable as complex models often possess greater learning capacity.
Table 7: Summary of detection results under different model architectures. AUROC (Ben) denotes the AUROC performance without image manipulations or adversarial attacks. AUROC (Adv) represents the average performance across nine distinct image manipulations and attacks.
Dataset
MS-COCO
DBDiffusion
AUROC (Ben) f
AUROC (Adv) f
AUROC (Ben) 1
AUROC (Adv)
ResNet
0.94
0.82
0.90
0.80
ResNet
0.99
0.93
0.99
0.94
VGG 16
0.99
0.93
0.99
0.90
ViT 0.95
0.88
0.97
0.81
D.2 Size of watermarked training data under fine-tuning scenario.
In this section, we shift focus more realistic scenario where fine-tune both the classifier and the watermarks using pre-trained models. We note that the new scenario differs from the one discussed in the main text, where the classifier is trained from seratch with randomly initialized weights.
To elaborate, we initially pretrain a set of watermarks along with their corresponding classifiers using a dataset such as MS-COCO. Subsequently, we fine-tune this pair using a new dataset. We present the results of this strategy by varying the number of new training data and summarize the outcomes in
20

---

Table 8 below. In contrast to the training from scratch scenario described in the main text, our RAW framework demonstrates significant improvement with reasonably small training dataset size.
Table 8: Summary of detection results under numbers of training data. AUROC (Ben) denotes the AUROC performance without image manipulations or adversarial attacks. AUROC (Adv) represents the average performance across nine distinct image manipulations and attacks.
Dataset
MS-COCO
DBDiffusion
AUROC (Ben) f
AUROC (Adv) t
AUROC (Ben) 1
AUROC (Adv)
10
0.74
0.68
0.70
0.68
50
0.85
0.71
0.86
0.72
" 100
0.99
0.85
0.99
0.81
500
0.99
0.91
0.99
0.93
D.3
Different diffusion models for generating images
In this section, we examine the watermark detection results of our RAW approach across various generative models, specifically utilizing two widely recognized architectures: SDXL and BriXL. We maintain consistent settings as detailed in the main text. The AUROC outcomes are consolidated Table Our findings indicate that our RAW method achieves high AUROC scores for both MS-COCO and DBDiffusion datasets, underscoring its broad applicability.
Table Summary of detection results under numbers of training data. AUROC (Ben) denotes the AUROC performance without image manipulations or adversarial attacks, AUROC (Adv) represents the average performance across distinct image manipulations and attacks.
Dataset
MS-COCO
DBDiffusion
AUROC (Ben)
AUROC (Adv) f
AUROC (Ben) 1
AUROC (Adv)
SDXL
0.98
0.89
0.99
0.87
BriXL
0.99
0.91
0.99
0.89
D.4
Additional Visual Examples
In this section, we present additional visual examples in Figure 5 and resulting from our proposed RAW method. Our observations reveal no notably discernible differences between the original and watermarked images, highlighting the effectiveness of our approach.
21

---

Original Image
PRANIC
PAAIN
PYNKE
Watermarked Image
PAANN
RYNKAD
Pixel Differences (5x)
Figure 4: Examples of RAW-watermarked images (middle row)
Original Image
Watermarked Image
Pixel Differences (4x)
Figure 5: Examples of RAW-watermarked images (middle row)
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The claims in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Discussions on the limitations of this work are provided in Section 5 in the main text.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model cell-speciiiiatinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g. if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
23

---

Answer: [Yes]
Justification: For all the theoretical results, we have clearly listed the full set of assumptions and provided complete proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We have detailed all the experimental setups in both the main text and the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
24

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: We have provided details, including GitHub links, on how to implement the results for our proposed methods.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips cc/
iesiisssssoooooo oneoonoooooooooo olycy) for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / //nips. cc/ mublic/guides SudeeS/mm Sunaisubbssssss wwsssssollll.o..oo onPolicy) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
All experiment details are listed.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Error bars are reported.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi-
dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
25

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The computation resources are listed in the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't I make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics httpp::://eeuippi wttpppppppcpppppppceppppppppppee httpppblic/tthhcsciiieeeee
Answer:
[Yes]
Justification:
We conformed with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- cration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Discussions on potential societal impacts are provided Section of the main text.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
26

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This paper poses such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We have properly cited all the datasets, models, and GitHub repositories (code) used in this work.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
27

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datastsss has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: This paper does not release any new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: This paper does involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
28

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
29


Reviews:
[{"review_id": "NoAEeWru75", "reviewer": "Reviewer_8Sds", "summary": "This paper proposes a post-processing watermarking strategy that embeds watermarks into images after generation. The strategy is designed to be computationally efficient and model-agnostic. It involves training a learnable watermark and embedding it into both the frequency and spatial domains of the original image. The embedded watermark is later verified by a classifier, which is trained jointly with the watermark.", "questions": "see above.", "limitations": "see above.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* Addresses an important problem.\n* The problem formulation is clear and easy to understand.\n* The paper is generally well-presented.\n* Experimental results show improvements in adversarial robustness and speed.", "weaknesses": "* The survey of existing works in the \"Related Works\" section is incomplete. Numerous works on watermark frameworks for diffusion models are not included.\n* It would be helpful if the authors provided a figure depicting an overview of the proposed method.\n* The authors should clarify why they did not use signSGD to optimize the verification model if it is better. What are the data-level optimization problems?\n* The reasoning for optimizing the watermark only based on $L_0$ instead of $L_{raw}$ needs to be explained.\n* The method is not plug-and-play; it requires training the watermark and the verifier for each target generative model.\n* Experimental evaluation:\n  * For the SDXL model, no comparison with baselines is made.\n  * Metrics for image quality comparison are limited. The authors should also include metrics like SSIM.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q: The survey of existing works in the \"Related Works\" section is incomplete. Numerous works on watermark frameworks for diffusion models are not included.\n\n**R**: Thank you for your questions regarding the related works section. We will include more works on watermark frameworks for diffusion models in the revision.\n\n> Q: It would be helpful if the authors provided a figure depicting an overview of the proposed method.\n\n**R**: Thank you for your suggestion regarding the presentation of the proposed method. We have included a figure depicting an overview of the proposed method in the revision.\n\n> Q: The authors should clarify why they did not use signSGD to optimize the verification model if it is better. What are the data-level optimization problems?\n\n**R**: Thank you for your insightful question regarding the optimizer and the data-level optimization problems. \n\nThe data-level optimization problem refers to problems where the variables to be optimized are the data themselves instead of typical model parameters. For instance, the problem of finding an adversarial example is a data-level optimization problem ($x$ is an input to a machine learning model $f$, and $y$ is the correct label for $x$):\n$ min_{x'}  \\| x - x' \\|_\\infty \\text{;   subject to } f(x') \\neq y .$ Data-level optimization problem can be difficult to solve, e.g., the results may get stuck at suboptimal points [A]. A common approach is to use the signum of first-order gradients [B,C].\n\nThe reason for not using signSGD to optimize the verification model is that the verification model is a typical model parameter optimization problem, and signSGD may potentially lead to several optimization issues such as slow convergence speed. We will make this clear in the revision.\n\nRefs:\n[A] Wang et al., \"Probabilistic margins for instance reweighting in adversarial training\". In\nNeurIPS, 2021.\n\n[B] Madry et al., \"Towards deep learning models resistant to adversarial attacks\". In ICLR, 2018. \n\n[C] Wang et al., \"Watermarking for Out-of-distribution Detection\". In NeurIPS, 2022.\n\n\n\n\n\n\n> Q: The method is not plug-and-play; it requires training the watermark and the verifier for each target generative model.\n\n**R**: Thank you for your question regarding the plug-and-play nature of the proposed method. When referring to the method as plug-and-play, we mean that the watermarking method can be applied to any generative model without modification, regardless of its architecture. This is in sharp contrast to previous works that are designed for specific generative models, such as [8] for stable diffusion with the DDIM sampler only. In addition, we believe that additional training by individual users, e.g., artists, is actually beneficial since the watermark and verifier are tailored to them and possibly would bring better robustness. We will make this clear in the revision.\n\n> Q: The reasoning for optimizing the watermark only based on instead of needs to be explained.\n\n**R**: Thank you for your question regarding the optimization procedure.\n\nThe main reason for optimizing the watermark based only on $L_0$ instead of $L_\\text{raw}$ is because $L_\\text{raw}$ involves non-differentiable terms with respect to the watermark, which makes gradient-based optimization infeasible. In detail, recall that $L_\\text{raw}$ contains cross-entropy losses calculated on perturbed images, which can involve non-differentiable operations such as JPEG compression.\n\n> Q: Metrics for image quality comparison are limited. The authors should also include metrics like SSIM.\n\n**R:** Thank you for your suggestion regarding the image quality comparison metrics. \n\nWe report the PSNR and SSIM of the watermarked images in the Table below. For PSNR and SSIM, our method outperforms the StegaStamp method but is slightly behind DwtDctSvd and RivaGAN. These results are consistent with our expectations. The StegaStamp method achieves more robust detection by sacrificing image quality through injecting a large amount of noise into the image, while DwtDctSvd and RivaGAN maintain image quality slightly better at the cost of reduced robustness against (adversarial) image perturbations.\n\n| Method       | FID (Lower is preferred) | PSNR (Higher is preferred) | SSIM (Higher is preferred) |\n|--------------|---------------------------|----------------------------|----------------------------|\n| RAW          | 24.75                     | 31.9                       | 0.91                      |\n| StegaStamp   | 42.31                     | 27.8                       | 0.88                       |\n| DwtDctSvd    | 25.12                     | 37.6                       | 0.98                       |\n| RivaGAN      | 25.03                     | 35.2                       | 0.95 \n\n> Q:  For the SDXL model, no comparison with baselines is made.\n\n**R**: Thank you for your question regarding the baseline comparison for the SDXL model. We report the results in the following table. We observe that our proposed method outperforms RivaGAN and DwtDctSvd while being slightly behind StegaStamp. This is reasonable and consistent with our expectations, as explained previously.\n\nTable: Comparison between RAW and baselines on images generated by SDXL.\n| Method       | Average normal AUROC | Average Adversarial AUROC |FID (Lower is preferred) |\n|--------------|-------------------------------------|-----------------------------------------|-------------------------|\n| RAW          | 0.99                                | 0.90                                    | 15.3                   |\n| DwtDctSvd    | 0.99                                | 0.76                                    | 15.2                   |\n| RivaGAN      | 0.99                                | 0.80                                    | 15.6                 |\n| StegaStamp   | 0.99                                | 0.92                                    | 23.4                  |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "j5SJ1T9EFT", "reviewer": "Reviewer_h31G", "summary": "This paper proposes a Robust, Agile plug-and-play Watermarking (RAW) framework, which adds learnable watermarks directly on the original image and employs a classifier to detect the presence of the watermark. This design enhances both adaptability and computation efficiency, providing an model-agnostic for real-time applications. This paper show that RAW achieves provable guarantees on the false positive rate (FPR) for detection, even under adversarial attacks.", "questions": "N/A", "limitations": "N/A", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The proposed RAW provides provable guarantees on FPR for watermarking under signal processing and adversarial attacks.\n2. RAW shows improved watermarking speed and robustness performance, while maintaining image quality.", "weaknesses": "1. In Equation (5), the watermark is also optimized, which indicates that this method can only add the same watermark. This limits the application.\n2. The proposed method still embeds the watermark into the carrier image and is not specifically designed for AI-generated images.\n3. In Table 2, some columns lack bolded data, and some bolded entries are not the best results.\n4. The compared methods are outdated, failing to highlight the robustness and quality of this approach.\n5. Since the carrier is involved in the method, PSNR should be evaluated.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for devoting their valuable time to reviewing our paper and offering insightful suggestions for improving it.\n\n> Q: The proposed method still embeds the watermark into the carrier image and is not specifically designed for AI-generated images.\n\n**R**: Thank you for your questions regarding the watermark design. \n\nThe design of our proposed work aims to be usable by anyone, regardless of how the image is generated, whether by state-of-the-art diffusion models or drawn by an artist. Despite the general-purpose design, empirical evidence has verified the effectiveness of our method on AI-generated images. That being said, we will explore how to tailor the current methods to better fit AI-generated images in future work.\n\n> Q: In Table 2, some columns lack bolded data, and some bolded entries are not the best results.\n\n**R**: Thank you for your questions regarding the Table 2.\n\nWe will bold all the best results for each column in the revision. In Table 2,there are a total of three performance metrics and two metrics regarding the quality of the watermarked images. For the performance of encoding speed, our method outperforms other methods by significant margins. For the normal AUROC, all methods are close to each other, and the differences are not significant. For the adversarial AUROC, our method achieved the second-highest AUROC of 0.92 for MS-COCO, slightly behind the StegaStamp method. This is reasonable and consistent with our expectations, as StegaStamp significantly degrades image quality to achieve robustness against image perturbations, as indicated by significantly higher FID and lower PSNR and SSIM values. We will make this clear in the revision.\n\nTable: Comparasion between StegaStamp and RAW (our method) on MS-COCO.\n\n| Method       | Adversarial AUROC |FID (Lower is preferred) | PSNR (Higher is preferred) | SSIM (Higher is preferred) |\n|--------------|---------------------------|---------------------------|----------------------------|----------------------------|\nOur method     | 0.92             | 24.75                     | 31.9                       | 0.91                      \nStegaStemp    | 0.93            | 42.31                     | 27.8                       | 0.88                      |\n\n\n> Q: Since the carrier is involved in the method, PSNR should be evaluated.\n\n**R:** Thank you for your suggestion regarding the image quality comparison metrics. \n\nWe report the PSNR and SSIM of the watermarked images in the Table below. For PSNR and SSIM, our method outperforms the StegaStamp method but is slightly behind DwtDctSvd and RivaGAN. These results are consistent with our expectations. The StegaStamp method achieves more robust detection by sacrificing image quality through injecting a large amount of noise into the image, while DwtDctSvd and RivaGAN maintain image quality slightly better at the cost of reduced robustness against (adversarial) image perturbations.\n\n| Method       | FID (Lower is preferred) | PSNR (Higher is preferred) | SSIM (Higher is preferred) |\n|--------------|---------------------------|----------------------------|----------------------------|\n| RAW          | 24.75                     | 31.9                       | 0.91                      |\n| StegaStamp   | 42.31                     | 27.8                       | 0.88                       |\n| DwtDctSvd    | 25.12                     | 37.6                       | 0.98                       |\n| RivaGAN      | 25.03                     | 35.2                       | 0.95", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7oMrluxzGs", "reviewer": "Reviewer_FV9y", "summary": "This paper introduces a novel image watermarking technique that injects signals into both the frequency and pixel domains of images. The watermark is specifically designed for the detection of AI-generated images and incorporates smoothing techniques to provide provable error guarantees against attacks under certain conditions. Additionally, the method's simplicity leads to faster watermarking speeds compared to existing techniques.", "questions": "- Based on Table 3, RAW achieves a comparably low FID and high CLIP score, suggesting it applies an imperceptible and low-budget watermark signal to the images in the current evaluations. However, a more detailed evaluation of RAW's robustness against provable diffusion attacks [1][2] that claim to break imperceptible watermarks would be valuable. I am curious to know the authors' opinion on how their method might perform against such attacks.\n\n[1] Saberi, M., Sadasivan, V. S., Rezaei, K., Kumar, A., Chegini, A., Wang, W., and Feizi, S. Robustness of ai-image detectors: Fundamental limits and practical attacks, 2023.\n\n[2] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai, 2023.", "limitations": "- As noted in the limitations section, this technique is designed for use with a single watermark key (w) rather than multiple values, which is a disadvantage compared to existing methods. However, given the importance of the task of detecting AI-generated images, this focus on a single key value is justified and does not limit the value of this work.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Unlike most watermarking techniques in the literature which train an encoder decoder model without theoretical guarantees, this paper provides certified error guarantees against a certain range of attacks. This is a novel and valuable addition to the watermarking literature, since reliability is of great importance in this domain.\n\n- While having a fast inference time, the watermark achieves high robustness against some common attacks.", "weaknesses": "- A comparison against more recent watermarking techniques is needed. In Table 4, the paper does not provide performance results (i.e., AUROC) against attacks compared to recent methods such as TreeRing [1], Trustmark [2], and RoSteLAS [3]. The included watermarking techniques (i.e., DwtDCT, RivaGAN) are known to be weaker against attacks compared to state-of-the-art watermarks.\n\n- The paper lacks a comprehensive analysis of performance against image manipulations. While Table 4 illustrates performance on various attacks, it is unclear whether the hyper-parameters for these attacks have been set to their full strength. For instance, what hyper-parameters are being used for the VAE and Diff attacks? It is recommended that the authors include image quality metrics for the attacks (e.g., PSNR, SSIM) to demonstrate that their method maintains acceptable performance even under strong attacks that preserve image quality. Additionally, including a wider variety of diffusion attacks (e.g., pixel space and latent space) and potentially adversarial attacks (e.g., model substitution attacks), as discussed in the literature [4][5], would provide a more comprehensive evaluation.\n\n\n\n[1] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust, 2023.\n\n[2] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images, 2023.\n\n[3] Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. Rosteals: Robust steganography using autoencoder latent space, 2023.\n\n[4] Saberi, M., Sadasivan, V. S., Rezaei, K., Kumar, A., Chegini, A., Wang, W., and Feizi, S. Robustness of ai-image detectors: Fundamental limits and practical attacks, 2023.\n\n[5] An, B., Ding, M., Rabbani, T., Agrawal, A., Xu, Y., Deng, C., Zhu, S., Mohamed, A., Wen, Y., Goldstein, T., et al.: Benchmarking the robustness of image watermarks, 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for devoting their valuable time to reviewing our paper and offering insightful suggestions for improving it.\n\n> Q: The paper lacks a comprehensive analysis of performance against image manipulations. While Table 4 illustrates performance on various attacks, it is unclear whether the hyper-parameters for these attacks have been set to their full strength. For instance, what hyper-parameters are being used for the VAE and Diff attacks? \n\n**R**: Thank you for your questions regarding the hyperparameters for the attacks. For all the attacks, we followed the public implementation in this GitHub repository (https://github.com/XuandongZhao/WatermarkAttacker) for watermark attacks without any modifications. We will include the hyperparameters for the attacks in the revision.\n\n\n> Q: It is recommended that the authors include image quality metrics for the attacks (e.g., PSNR, SSIM) to demonstrate that their method maintains acceptable performance even under strong attacks that preserve image quality. \n\n**R**: Thank you for your questions regarding the evaluation metrics.\n\nWe report the PSNR and SSIM of the watermarked images in the Table below. For PSNR and SSIM, our method outperforms the StegaStamp method but is slightly behind DwtDctSvd and RivaGAN. These results are consistent with our expectations. The StegaStamp method achieves more robust detection by sacrificing image quality through injecting a large amount of noise into the image, while DwtDctSvd and RivaGAN maintain image quality slightly better at the cost of reduced robustness against (adversarial) image perturbations.\n\n| Method       | FID (Lower is preferred) | PSNR (Higher is preferred) | SSIM (Higher is preferred) |\n|--------------|---------------------------|----------------------------|----------------------------|\n| RAW          | 24.75                     | 31.9                       | 0.91                      |\n| StegaStamp   | 42.31                     | 27.8                       | 0.88                       |\n| DwtDctSvd    | 25.12                     | 37.6                       | 0.98                       |\n| RivaGAN      | 25.03                     | 35.2                       | 0.95                       |\n\n\n> Q: Additionally, including a wider variety of diffusion attacks (e.g., pixel space and latent space) and potentially adversarial attacks (e.g., model substitution attacks), as discussed in the literature [4][5], would provide a more comprehensive evaluation.\n\n**R**: Thank you for your suggestions regarding the evaluation of the proposed method. We will include more adversarial attacks, as you suggested, in the revision to provide a more comprehensive evaluation.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: 3x BA. This paper proposes to embed watermarks into images after generation by adding learnable watermarks directly on the original image and employing a classifier to detect the presence of the watermark. The reviewers agree on the (1) important topic, (2) novel method, and (3) clear improvements. Most of the concerns, such as the insufficient evaluation, insufficient recent baselines, and insufficient analysis against image manipulations, have been addressed by the rebuttal. Therefore, the AC leans to accept this submission.
Decision: Accept (poster)