ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
Authors: Huayang Huang
Yu Wu
Qian Wang
Venue: NeurIPS 2024 poster (2024)
Keywords: Diffusion models
Image watermarking
Primary area: diffusion_based_models

Abstract: Watermarking generative content serves as a vital tool for authentication, ownership protection, and mitigation of potential misuse. Existing watermarking methods face the challenge of balancing robustness and concealment. They empirically inject a watermark that is both invisible and robust and passively achieve concealment by limiting the strength of the watermark, thus reducing the robustness. In this paper, we propose to explicitly introduce a watermark hiding process to actively achieve concealment, thus allowing the embedding of stronger watermarks. To be specific, we implant a robust watermark in an intermediate diffusion state and then guide the model to hide the watermark in the final generated image. We employ an adversarial optimization algorithm to produce the optimal hiding prompt guiding signal for each watermark. The prompt embedding is optimized to minimize artifacts in the generated image, while the watermark is optimized to achieve maximum strength. The watermark can be verified by reversing the generation process. Experiments on various diffusion models demonstrate the watermark remains verifiable even under significant image tampering and shows superior invisibility compared to other state-of-the-art robust watermarking methods.

ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
Huayang Huang', Yu Wu Qian Wang²
School of Computer Science, Wuhan University
2Schoo of Cyber Science and Engineering, Wuhan University (hyhuang, wuyuca, qianwang) @whu. edu.
Abstract
Watermarking generative content serves vital tool for authentication, ownership protection, and mitigation of potential misuse. Existing watermarking methods face the challenge of balancing robustness and concealment. They empirically inject a watermark that is both invisible and robust and passively achieve concealment by limiting the strength of the watermark, thus reducing the robustmess. In this paper, we propose to explicitly introduce watermark hiding process to actively achieve concealment, thus allowing the embedding of stronger watermarks. To be specific, we implant robust watermark in an intermediate diffusion state and then guide the model to hide the watermark the final generated image. We employ an adversarial optimization algorithm to produce the optimal hiding prompt guiding signal for each watermark. The prompt embedding optimized minimize artifacts in the generated image, while the watermark is optimized to achieve maximum strength. The watermark can verified by reversing the generation process. Experiments various diffusion models demonstrate the watermark remains verifiable even under significant image tampering and shows superior invisibility compared to other oftte-of-hhe-rt robust watermarking methods.
Introduction
Diffusion models (DMs) are revolutionizing content creation and generating stunningly realistic imagery across diverse domains [17 33 60). The advent of exx-tto-image diffusion models [3]] B0
58 . coupled with personalized generation techniques
[53
enables the creation of
highly specific content by virtually anyone. However, it has raised concerns about authenticity and ownership, including the risk of plagiarism [34 22 and the potential misuse of images of public
figures [39 [5) Consequently, governments and businesses are increasingly advocating for robust
mechanisms to verify the origins of generative content [9]45).
Watermarking offers proactive approach to authenticate the source of generated content. This technique embeds imperceptible secret messages within the generated content. These messages serve as unique identifiers, confirming the image's 's origin while remaining invisible to the human eye. They also need be robust enough to withstand potential distortions encountered during online sharing.
Existing watermarking techniques face a significant challenge in striking a balance between conceal- ment and robustness. Traditional post-processing methods [46] 9 employ empirical approach to identify an invisible and robust watermark and embed it within the generated image. They passively achieve concealment by limiting the watermark strength, consequently compromising robustness. Conversely, stronger watermarks, while enhancing robustness, can introduce visible artifacts into the generated image. Recent advancements in in-processing watermarking for diffusion models expect
"Corresponing author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

the generative model to learn this balance and directly produce watermarked content. However, these or can lead to unintended semantic
methods often require expensive model retraining [55 48 alterations within the generated images 44
Our ROBIN scheme introduces explieit watermark hiding process actively achieve concealment. This approach reduces the invisibility limitation of the watermark itself and thus enables the embed- ding of more robust watermarks. Specifically, we implant robust watermark within an intermediate diffusion state, and then directionally guide the model to gradually conceal the implanted watermark, thus achieving invisibility in the final generated image. In this way, robust watermarks can be secretly implanted in the generated content without model retraining.
We focus the rext-to-image diffusion models, which support additional prompt signal to guide the generation process. We employ an adversarial optimization algorithm to design an optimal prompt guidance signal specifically tailored for each watermark. The prompt embedding is optimized to minimize artifacts in the generated image, and the watermark is optimized to achieve maximum strength. The optimized watermark and prompt signal are universally applicable to all images. During the generation process, the watermark is implanted within an intermediate state following the semantic formation stage. Subsequently, the optimized prompt guidance signal is introduced throughout the remaining diffusion steps. After image generation, following previous works [4] 49), we reverse the diffusion process to the watermark embedding point to verify the existence of the watermark. This innovative approach offers a promising way to overcome the trade-of off between watermark strength and stealth by explicitly introducing an additional watermark hiding process.
In summary, our key contributions are as follows:
We propose a novel watermarking method for diffusion models that embed a robust water- mark and subsequently employ active hiding process to achieve imperceptibility.
We develop adversarial optimization algorithm to generate a prompt signal for watermark hiding and a strong watermark that can be hidden and strategically select the watermarking point within the diffusion trajectory.
Evaluations on both latent and image diffusion models demonstrate that our scheme exhibits superior robustness against various image manipulations while preserving semantic content.
Related work
Diffusion generation and inversion. Diffusion models [17
36 37 operate by iteratively
transforming pure noise xr ~ ~N, I) into increasingly realistic images xp ((x) through 7 steps of denoising. The learning process involves stochastic Markov chain in directions. The forward process diffuses the sample To by adding random noise:
(()aaae1) = NV
where {B,)T= the scheduled variance. 24 can also be generated from 2g as:
34. -a +VT Oje,
where a; = II (1- 3)) and e ~ ~ 1). Then a network is learned to predict the noise in each step, following the objective:
min minnEny.-ooumtrrom(............
||c ea (2..,,, t.
where F. is the noise latent at timesteps / and (p() is the embedding of the text prompt
introduces the ODE solver for deterministic sampling by constructing the original one as a non-Markov process. computes the x;-1 from 2; by predicting the estimation of zo and the direction pointing to 2t:
DDIM (Denoising Diffusion Implicit Model) K5
Ft
V Onco 1 vb(p))
2/1
(4)
Vau

---

- 1 + /1 Va-vlpa-aa 0 (pp)).
(5)
The deterministic generation properties of DDIM allow reconstruct the noise latent é, from the final image Zo as
Se -v +V1 - -rce( --
(6)
This unique characteristic allows us to selectively mark and recover an inner noise representation within the diffusion process, which serves powerful tool for our watermarking approach.
Watermarking generative models. The content watermark of generative models can be introduced either after the generation (post-processing) during the sampling process (in-processing). Post- processing methods can adopt traditional digital image watermarking technology. Popular methods include frequency domain watermarking, which modifies the image representation in domains like Discrete Wavelet Transform (DWT) [47] or Discrete Cosine Transform (DCT) [8] DwtDet watermarking 3 is applied in open sourced model Stable Diffusion. Frequency domain watermarks can be designed to be robust against common image manipulations like cropping, scaling, and even compression 388. HiDDeN (57) pioneered the end-to-end approach, utilizing encoder-decoder
architecture to directly generate watermarked images. RivaGAN [52] leverages adversarial training incorporate perturbations and image processing during model training for increased robustness.
In-processing methods make the watermark become part of the generated image by interfering with generation process. Early approaches explored adding watermarks to training data [50] [5] [0] [3] 48
essentially building watermark encoder into the model. Stable Signature [14] simplified this process by fine-tuning only the external decoder of latent diffusion models. However, these methods all treated watermarking as a separate goal from the generation task, limiting their flexibility. The recent Tree-Ring watermarking (44) shares similarities with approach, modifying the initial noise to encode information semantically within the image. However, the semantic modifications induced by Tree-Ring watermarks are random and may compromise the faithfulness of the original model. Therefore, we aim to preserve the original semantics exactly to guarantee a similar level of text alignment compared to the original generation. Our work shows that embedding the watermark within the intermediate diffusion state and guiding the model to hide it can achieve the secret embedding of strong watermarks without model retraining.
3 Methodology
3.1 Overview of ROBIN
Task definition. Diffusion model watermarking aims to embed an invisible and verifiable watermark w; within the generated image Tp, using a watermark implantation function I. During Internet transmission, the generated content may be subjected to various image transformation operations T. The model owner aims to leverage watermark extraction algorithm E to verify the presence of w; within the distorted sample T(x)), thereby establishing image ownership.
Pipeline of ROBIN.
Watermark generation. We first generate hiding prompt guidance signal wp for each watermark using the adversarial optimization algorithm, which is detailed in [Section 3.2
Watermark implantation. ROBIN implants w, into an intermediate generation state 2e after the semantics have been formed as
x. = I Wi, M),,
(7)
where injects wi into the frequency domain of x; and M the coverage area of the watermark. During the remaining DDIM generation, ROBIN incorporates the optimized prompt guidance signal Wp to direct the model towards hiding the watermark w; to maintain the similarity between the generated image zū and its unwatermarked counterpart 20. Let linjection be the watermark injection point, the generation of the watermarked image is as follows:
(0) P6 (11-1/11)) Var-120 + vI 10 to0,,
if 2
Enjection
(
Vā VI- 160 (
if Enjecttio 2
3

---

Image generation Xy
DDIM sampling
Xg
T-t steps
steps
Semantic formation
Detail formation
Maximize strength
A dversarial optimization
Minimize artifacts
Watermark optimization
Watermark
Generation with watermark hidden
Watermarked generation
Optimized prompt guidance
Figure 1: The watermark optimization and implantation ROBIN. robust watermark is added at an intermediate state of generation, and an additional prompt guiding signal is optimized to direct the model towards hiding embedded watermark the generated image. The image watermark and guiding signal are optimized adversarially to improve robustness and invisibility.
After embedding the watermark, the model is guided by both the original input text prompt p and the optimized prompt embedding wpp achieve reliable generation with the watermark hidden. The predicted noise then becomes
co (p)), wp)= mn co(x; xb()) + m2 to(
(9)
+ 72) cs t, (0)).
(10)
where 1/1 7/2 the guidance scale parameters weight the guidance of the original text prompt and the optimized prompt signal.
Watermark verification. To verify the watermark, reverse the transformed watermarked image T(xī) to step Iunjection and retrieve the intermediate state क7. The watermark information w/ E(s7, M)) is extracted from the frequency space of 27. L1 distance D is used to measure the similarity between w and w'. When the distance falls below a threshold as
D(w, w')
Σ ww - w/ll ST. iEM
(11)
M
the presence of the watermark within the image confirmed. generation and implantation process of ROBIN.
Figure
presents the watermark
3.2 Adversarial optimization algorithm
We employ adversarial optimization algorithm generate the watermark and the corresponding hiding prompt guidance signal. The prompt signal is optimized in the embedding space and guides the model conceal the embedded image watermark. while the watermark tries to be strong as possible while allowing for its targeted hiding by the prompt signal.
The objective of the prompt guiding signal is to minimize the impact of the watermark the final generated image. We define the image retaining loss lyet, which penalizes excessive deviations from the original images:
Cret MSE( - ID),
(12)
VI areo anco (p),
(13)
Val

---

Full
Uncondion
Condition
Guidanze
Full
Uncondition
Condition
Guidance
0.85
0.025
Fail & Uncond & Cond noise
0.14
0.8
Noise changes (mxan)
0.12
0.75
0.7
0.08
0.65
0.06
0.6
0.55
0.02
0.5
1000
800
600
400
200
1000
800
600
400
2001
Timestops
Timesteps
(a) Predicted noise during normal generation.
(b) Predicted noise changes under perturbations.
Figure 2: The impact of introducing frequency domain disturbances at different diffusion steps on the predicted noise. Timestep 1000 signifies the Gaussian noise state and step 0 represents the final generated image. The Uncondition curve (orange) and the Condition curve (gray) nearly overlap in both figures. Guidance the amplified difference of Uncondition and Condition. Full is the addition of Uncondition and Guidance.
26 is the final image predicted from the watermarked noisy latent 27 through Equation (4) with an additional guidance up. MSE denotes the mean squared error.
Furthermore, the loss incurred during DDIM inversion increases proportionally with the guidance strength [23]. we introduce a constraint term Loons to prevent excessive prompt guidance:
conns = ( t, wp) - co (0)))
(14)
To achieve robustness, we embed the watermark in the frequency domain of the image [44]. Frequency domain signals more resistant to spatial operations compared to spatial domain signals [3]. Similar to we set the watermark as multiple concentric rings, but we further optimize its value to the maximum within the aforementioned constraints for greater strength and better robustness. The optimization losses Wp and w; become
Lw, = alret + Bloonss
(15)
Lw, = alrec + Be X |/
(16)
Since the watermark and the prompt guiding signal are interdependent, we employ an alternating optimization method, in which we iteratively optimize one while fixing the other. More details about the watermark design and optimization algorithm are presented in Appendix
3.3 Finding keypoints for implantation
The selection of the optimal stage for watermark embedding within the diffusion process is crucial for achieving both high image fidelity and semantic consistency with the input text prompt. We delve into the sensitivity of the predicted noise to frequency domain disturbances in different diffusion steps. According to classifier-free guidance method (27), the predicted noise each step can be depicted as Full Uncondition + s (Comdilion & - U Uncondilion). Condition and Uncondition are predicted noise with and without text conditions. Parameter is the scaling factor and the second term of the addition is called Guidance. Full noise is the final noise to be removed in the current step.
Figure 2(a) shows the evolution of mean values of various predicted noise terms throughout the generation process. We can find that after step 300, the slowdown in guidance rise indicates the completion of basic semantic formation and diminishing guidance influence. Additionally, |Figure 2(b) presents how the predicted noise changes when perturbations are added at different timesteps. When the timestep is greater than 200, the frequency domain noise interferes with the generation process mainly by disrupting the guidance term. After 200 steps, the intrinsic unconditional term more affected. We can conclude that early generation stages establish the foundation for image semantics and excessive intervention at this point can disrupt the intended image content. Conversely,
5

---

manipulating the final stages, dedicated to refining image details, may impede the model's 's capacity to recover from watermark-induced noise, ultimately compromising the final image quality.
Therefore, we strategically choose the watermark insertion point between steps 300 and 200. This stage offers the sweet spot: frequency perturbations have minimal impact the mean of the predicted noise, allowing for watermark integration without sacrificing image quality and disruption to the core semantics.
3.4 Watermark validation
In the watermark verification phase, we reverse the diffusion process to get the state 27 at the watermark injection step. We extract the M region of i Fourier space and calculate its L1 distance from the implanted watermark wi. However, the original prompt used for image generation is unknown during verification of online images. Similar to [44], we use the null-text prompt as the condition text embedding and set the guidance scale to 1.0. We also found unexpectedly that introducing the optimized prompt signal during inversion hinders the watermark recovery, which we aim to explore in future work. Our watermark verification requires a reversible generation process, making it compatible with any reversible samplers such as DPM-Solver [23), +PM--olver++ (24). PNDM 21] and AMED-Solver [56].
4 Experiments
4.1
Experimental setting
Model and dataset. We conducted experiments on two distinct diffusion models operating in latent and image domains. For the latent diffusion model, we utilize the widely available Stable Diffusion-v2 v2 (3I] and the stable-diffusion cenfffusioo-rommptss dataset from Gustavosta []]. We also test on guided diffusion model [2] trained on the ImageNet [[2), which operates directly on the pixel domain and can generate images of size 256 x 256 based on the category provided.
Evaluation metrics. To assess the effectiveness of ROBIN, we compute the Area Under the ROC Curve (AUC-ROC) based on the I.1 distance to measure the effectiveness of watermark verification. Specifically, we compute AUC using 1,000 watermarked and 1,000 clean images. For the quality of watermarked images, we employ a suite of diverse metrics. We utilize classic measures like PSNR (Peak Signal-to-Noise Ratio), SSIM (Structural Similarity Index), and MSSIM (Multiscale SSIM) 44 to quantify the pixel-level differences between watermarked and original images. We employ the Fréchet Inception Distance (FID) []6] to evaluate the fidelity of the watermarked image distribution. We also leverage the CLIP score 22) to measure the alignment between generated images and their corresponding text prompts. More details are provided in Appendix B.I
Implementation details. We utilize 50 steps of deterministic sampling for both models. Stable Diffusion employs the second-order multistep PPo-Solver algorithm [23] with a default guidance scale of 7.5. ImageNet diffusion model leverages the DDIM sampling algorithm [35. We optimize the watermark and the hiding prompt using 50 generated images. The learning rates for the image watermark and prompt guidance 0.8 and 5e-04, respectively, with total of 1,000 optimization rounds. The default image watermark covers 70% of the image frequency domain. All experiments conducted NVIDIA GeForce RTX 3090 GPU.
4.2 Effectiveness and robustness
We compare our method with five baselines: DwtDet 4. DwiDetSvd (26), RivaGAN [2 Stable Signature [14], and Tree-Ring watermarks 44 To ensure the watermark's 's resilience in real-woor worldd scenarios, we delve into its robustness under various image transformations. These include Gaussian blur with radius 4, Gaussian noise with intensity 10%, jpeg compression with quality 25, color jitter with brightness 6, random rotation 75 degrees, and random cropping of 75% and rescaling. These settings are strict for watermark verification because the image has been significantly altered. ROBIN also evaluated under a combination of attacks where we randomly selected various combination of the six transformations. The processed samples are shown in Figure 6 in the Appendix.

---

Table 1: Comparison of AUC under different attacks and verification time for Stable Diffusion Bi Clean represents the watermark verification on unmanipulated images. Avg is the average AUC across all attack cases. Time is the time required to validate the watermark for single image.
Method
Clean
Blur
Noise
JPFG
Bright
Rotation
Crop
Avg
Time
DwtDet
4
0.974
0.503
0.293
0.492
0.519
0.596
0.640
0.574
0.056s
Post-
DwdDetSvd 26
1.000
0.979
0.706
0.753
0.517
0.431
0,511
0.702
0.233s
processing
RivaGAN [2]
0.999
0.974
0,888
0.981
0,963
0.173
0.999
0.854
0.437s
StableSig [4
1,000
0.565
0.731
0.989
0.976
0.658
1.000
0.845
0.112s
Tree-Ring [4
1.000
0.999
0,944
0.999
0.983
0.935
0.961
0.975
2.599s
processing
ROBIN
1.000
0.999
0.954
0.999
0.975
0.957
0.994
0.983
0.53
Table 2: Comparison of AUC under different attacks and verification time for Imagenet Diffusion [2 Stable Signature is specifically designed for latent diffusion models and are incompatible with pixel-level ImageNet diffusion models
Method
Clean
Blur
Noise
JPEG
Bright
Rotation
Crop
Avg
Time
DwtDet 4
0.899
0.512
0.365
0.522
0.538
0.478
0.433
0.536
0.012s
Post- processing
DwtDetSvd 26
1.000
0.947
0.656
0.568
0.535
0.669
0.614
0.713
0.058s
RivaGAN 52
1.000
0.988
0.962
0.978
0.924
0.321
0.999
0.882
0.109s
In- processing
Tree-Ring ROBIN
0.999
0.975
0.979
0.940
0.861
0,975
0,994
0.966
3. 3.963s
1.000
0,999
0.994
0.969
0.959
0.998
1.000
0.988
0.986s
Table 3: AUC on different number of random attacks applied the same time.
Method
2
3
4
5
6
Tree-Ring 0,969
0.809
0.699
0.520
0.546
0,509
ROBIN 0.973
0.814
0.759
0.579
0.558
0,556
Robustness. The comprehensive results of AUC comparison with baselines are presented in Table I and Table 2 While most methods (except DwtDct) perform well for watermark verification in the absence of attacks, their accuracy degrades with strong image manipulations. Traditional frequency- domain methods show significant vulnerability. RivaGAN falters with image rotations, and Stable Signature exhibits sensitivity to blur, noise, and rotation. The Tree-Ring watermark displays better robustness due to its pattern design but remains less resilient than ROBIN.
The performance of watermark verification for Stable Diffusion under different numbers of simultane- ous attacks shown in Table 3, Note that due to the inherent potency of the individual attacks, their combination leads to significant image quality deterioration. The resulting images are presented in Figure 7 But ROBIN still demonstrates superior robustness compared to the state-of-the-ar method Tree-Ring in such challenging scenarios.
The robustness of ROBIN on the one hand comes from the introduction of an explicit hiding process, we can implant stronger watermark. Furthermore, fewer inversion steps during verification compared Tree-Ring watermarks also mitigate the accumulation of DDIM inversion errors, further enhancing accuracy. The evaluation of ROBIN under more attacks is presented in Appendix C.2
Time cost. The time cost of watermark verification associated with different watermarking schemes presented in the last column of Table I]add TTble 2] The simple DwtDet method demonstrates the fastest performance, achieving a validation time of less than 1s DwtDetSvd exhibits a 4x slowdown compared to DwtDet, while RivaGAN is 10x slower. StableSig decodes the watermark directly from the image, but it requires fine-tuning the model. The verification of Tree-Ring watermarks necessitates reversing the entire generation process, resulting in significant time costs. ROBIN requires reversing only a limited number of generation steps, resulting in consumption times of 0.531s and 0.986s for the two models, which are considerably lower compared to the Free-Ring watermark. More experimental results are presented in Appendix C.I
4.3 Quality of watermarked image
Traditional post-hoe watermarking methods introduce subtle visual distortions into the generated images. In contrast, the objective of ROBIN aligns with the Free-Ring in constructing "content
7

---

Table 4: Quality of generated images. PSNR, SSIM and MSSIM measure the similarity between the watermarked and unwatermarked images. CLIP evaluates how well the watermarked image aligns with the user-pon previpdo textual description. FID measures the distribution similarity between the watermarked dataset and a random dataset of real images. The subscripts indicate the standard deviation of five independent experimental runs, each initialized with a different random seed.
Model
Method
PSNR
SSIM ?
MSSIM f
CLIP
0
W/o watermark
0C
1,000
1.000
0.403
25.53
Stable Diffusion
Tree-Ring 44
15.37 .7
0.568. 003
0.626 oos
0.364.o0
25.93. 18
ROBIN
24.03,04 04
0.768.000 000
0.881 0011
0.396.00
26.86.09
W/o watermark
00
1,000
1.000
0.271
16.25
ImageNet Diffusion
Tree-Ring 44
15.68 24.98
0.663 .002
0.607
0.267
17.68.1e 16
ROBIN
0.875.000
0.872.001
0.275.00
18.26.
W/o Watermark
Tree-Ring
ROBIN
"Young, curly haired redhead girl a dark medieval inn"
"Full body portrait of white haired girl spider man suit"
"Cloudscape, nebula gasses in the background, fantasy magic angel"
Figure 3: The generated images with Tree-Ring and ROBIN watermarks.
watermark":: seamlessly embedding the watermark within the image content without altering its semantics. Due to this fundamental shift in watermarking philosophy, we only compare the image quality with Ring watermarks.
The Line-Ring&o approach aims to find another watermarked image that aligns with the text prompt, even if it differs from the original image. However, it is more akin random semantic modifications and does not guarantee the same level of text alignment as the original generation. Figuree 3howws that the Tree-Ring approach significantly alters the generated image's 's semantics, sometimes even failing to fulfiil the text prompt's 's intent. This occurs because it disrupts the essential Gaussian characteristics of the initial noise, hindering the generation process. In contrast, ROBIN excels preserving the overall image content and semantic structure, providing better lower bound for faithfulness by preserving the original semanties. Table 4 provides the quantitative results. ROBIN demonstrates significant improvements in PSNR, SSIM, MSSSIM, and CLIP score, while slight increase in FID observed. This is because the position of the watermark implanted in our scheme at a later stage of generation, resulting in a slightly greater influence on the overall generation distribution. This implies a negligible trade-off for achieving a strong watermark with minimal degradation the overall quality of the generated image.
8

---

Table 5: Watermark accuracy and image quality under different settings. (1) random watermarks Wt. (2) random watermarks with prompt signal up for hiding, (3)-(5) different loss functions for optimizing wi and upp (6) full loss function for optimizing both w; and dpp.
Watermark
Loss function
AUCT
Image quality
ID
Image wa
Prompt up
Exet
Roons
[|w,1]
Clean
Adversarial
PSNR
SSIM
CLIP
FID,
Random
None
1.00
0.903
20.11
0.68
0.39
29.21
(2)
Random
Optimized
1.00
0,901
21.70
0,70
0.39
27.77
(3)
Optimized
Optimized
/
<
1.00
0,988
18.95
0.48
0.30
32.18
(4)
Optimized
Optimized
1.00
0,970
23,91
0.76
0.40
26.68
Optimized
Optimized
/
1.00
0.966
24.19
0.77
0.40
26.93
Optimized
Optimized
/
< 1.00
0.983
24.03
0.77
0.40
26.86
4.4
Ablation study
To gain further insights into the effectiveness of ROBIN, we conduct an ablation study, exploring the influence of different design choices. We additionally introduce the Mean Squared Error of Watermark (MSE) to represent the verification accuracy in some settings where the AUC always equal to 1. It is calculated as the mean of LI distance between the extracted and original watermark.
Setting variations. To explore the individual contributions of various components in our scheme, we conduct a series of experiments presented in Table 5 Experiments in Settings I and 2 demonstrate that the introduction of prompt-basee based watermark hiding signals improves image quality, as evidenced by 1.6 increase in PSNR and 1 1.44 decrease in FID score compared to Setting 1. Setting 3 emphasizes the importance of the fret in controlling watermark strength. Without Eret, ROBIN prioritizes creating a highly robust watermark, leading to significant image distortion (PSNR: 18.95, SSIM: 0.48). Setting presents that removing Eoons allows for stronger prompt guidance, but this results in increased DDIM inversion loss and decrease of 0.13 in adversarial AUC. Setting 5 prioritizes minimal impact on the generated image by weakening the watermark. This approach leads to poorer watermark robustness and a decrease of 0.017 in adversarial AUC. Experiments under Settings and demonstrate that the presence of the hiding prompt signal, the image watermark can be optimized to achieve stronger robustness while maintaining invisibility.
Point of implantation. We evaluate the impact of implanting the watermark at different stages in the diffusion process. The results are presented in Figure 4) Watermark verification accuracy improves with later implantation due to fewer DDIM inversion steps and reduced information loss. Early implantation, while initially maintaining image quality (low FID), can significantly change the image content (low SSIM/PSNR) by disrupting semantic formation. Conversely, late implantation may leave the watermark visible due to insufficient space for hiding, leading high FID and deviation from the original image (low SSIM). This empowers us to pinpoint the optimal embedding stage (steps 15-10) for balancing visual quality and semantic preservation.
Watermark strength. We also verify the influence of different watermarking strengths and the results are shown in Figure 4 Higher watermark strength (proportional coverage in the frequency domain) generally benefits verification accuracy, as the watermark becomes more prominent. The CLIP score and FID remain stable due to strategic embedding and guided hiding. Traditional metrics (SSIM, PSNR) decrease with stronger watermarks due to increased content modification. The watermarked images under different strengths are shown in Figure 5 Compared Tree-Ring, the quality of generated images with ROBIN watermarks is less sensitive to watermark strength. More qualitative results are presented in Appendix C.5
5 Conclusion & Discussion
This paper proposes a novel watermarking method for the diffusion model, which embeds watermark in the intermediate diffusion state and guides the model to conceal the watermark. By explicitly introducing the active hiding process, we can implant stronger watermarks without compromising image quality. We believe this method holds promise for expanding the possibilities of reliable watermarking in diffusion models.

---

AUC MSE
SSIM CLIP PSNR FID
1,0002
0.7
0,9998
0.6
36
0.9996
0.5
MSE
0.9992
23
0.999
20
0.9088
15
0.9984
50
30
10
Embodding Point
Embedding Point
(a) Watermark Accuracy.
Image Quality.
AUC MSE
SSIM + CLIP PSNR FID
1,0002
0,9998
0.9996
0.9994
MSE
0.9992
0.4
20
0.999
0,993
0.9966
0.9984
0.45
0.75
Watermark Strength
Watermark Stronggth
(c) Watermark Accuracy.
Image Quality.
Figure 4: Ablation experiments embedding point and watermark strength.
Watermark
Tree-Ring
ROBIN
Figure 5: Generated images under different watermark strengths. The top row is the result of the Fine-Ring& scheme and the bottom row the result ROBIN.
The verification of ROBIN watermarks relies on the reversible generation process, future advancements enabling reversibility of other sampling algorithms would broaden application of our method. Additionally, the inherent information loss during DDIM inversion can be
Limitations.
reduced by exploring generative trajectories that can be reversed exactly [28 40 5T).
Social impact. Our ROBIN scheme, as watermarking method, can help creators establish ownership and discourage unauthorized use. Furthermore, ROBIN watermarks can be implanted in one-shot manner without retraining the whole model, making it applicable to different diffusion- text-to-image models.
Acknowledgment
This work was partially supported by the National Natural Science Foundation of China under grants 62372341, U20B2049, and U21B2018.
10

---

References
[1] CuttarottaSSahe--iffuiio---oppp
Datasets
at Hugging
Face.
http://wwgnnaaaeeaaaaaccctssssss Prompts, March 2023.
[2] Openaifguidee--difusiiio https://ggihbbbccooooooo//////cs -infuuuiinn,,,,i May 2024.
[3] Ali Al-Haj Combined dwt-dct digital image watermarking. Journal of computer science, 3()): 740-746, 2007.
[4] Kuanchin Chen. Digital Watermarking and Steganography, page 402-409. Jan 2009, doi: 10.4018/978. 1-60566-014- 4-1.c0044.
[5] Ruoxi Chen, Haibo Jin, Jinyin Chen, and Lichao Sun. Editshield: Protecting unauthorized image editing by instruction-guide -uidedd diffusion models. arXiv preprint arXiv:2311.12066 2023.
[6] Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-iman learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2818-2829, 2023.
[7] Guillaume Couairon, Jakob Verbeek, Holger Schwenk, and Matthieu Cord. Diffedit: Diffusion- based semantic image editing with mask guidance. arXiv preprini arXiv:2210.1 /427, 2022.
[8] Cox. Digital watermarking and steganography. Morgan Kaufmann google schola, 2:893-914, 2007.
[9] Ingemar J Cox, Joe Kilian, Tom Leighton, and Talal Shamoon. Secure spread spectrum watermarking for images, audio and video. In Proceedings of IEEE International Conference on Image Processing, volume 3, pages 243-246. IEEE, 1996.
[10] Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, and Jiliang Tang. Diffu- sionshield: watermark for copyright protection against generative diffusion models. arXiv preprint arXiv:2306. 234442306..4442,,, 2023.
[11) Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: large-scale hierarchical image datahase. In Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition, pages 248-255, 2009.
[12] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances Neural Information Processing Systems, 14:8770-8794 2021.
[13] Luke Ditria and Tom Drummond, Hey that's mine imperceptible watermarks are preserved in diffusion generated outputs. arXiv preprint arXiv:2308.11 11123, 2023.
[14] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In IEEF/CVF International Conference on Computer Vision, pages 22409-22420, IEEE, 2023.
[15] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. In International Conference Learning Representations. OpenReview.net, 2023.
[16] Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in Neural Information Processing Systems, 30, 2017.
[17] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-68517 2020.
[18] Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. exact inversion of dom-solvers. arXiv preprint arXiv:2311.1888) 2023.

---

[19] Makena Kelly.
White
house rolls out plan to promote ethical
ai.
http://ee...omoo222//////////3// google 1o-miionn wwwicrooootttoo http::/wwwa......oooooooooooeear
2023.
URL https://wwns theverge
[20] Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European Conference on Computer Vision, pages 740-755. springer, 2014.
[21] Luping Liu, Yi Ren, Zhijje Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. In International Conference on Learning Representations, 2022.
[22] Xiao Liu, Xiaoliu Guan, Yu Wu, and Jiaxu Miao. Iterative ensemble training with anti-gradient control for mitigating memorization in diffusion models. In European Conference Computer Vision, 2024.
[23] Cheng Lu, Yuhao Zhou, Fan Bao. Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-5787, 2022.
[24] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm- solver++: Fast solver for guided sampling diffusion probabilistic models. arXiv preprint 2XXi:2211.000995 2022.
[25] Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen Or. Null-text inversion for editing real images using guided diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 6038-6047, 2023.
[26] KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt- dct-svd based watermarking. In International Conference on Communication Systems Software and Middleware and Workshops. pages 271-274. IEEE, 2008
[27] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text- rext-guided diffusion models. In International Conference on Machine Learning, volume 162, pages 16784-16804. PMLR, 2022.
[28] Zhihong Pan, Riccardo Gherardi, Xiufeng Xie, and Stephen Huang. Effective real image editing with accelerated iterative diffusion inversion. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 15912-15921, 2023.
[29] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pages 8748-8763. PMLR, 2021.
[30] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hicrarchical text-conditional image generation with clip latents. arXiv e-prints, pages arXiv-2204, 2022.
[31] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[32] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22500-22510, 2023.
[33] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in Neural Information Processing Systems, 35:36479-336666 2022.
12

---

[34] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by -ex-ae models. In USENIX Security Symposium, pages 2187-2204. USENIX Association, 2023.
[35] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations. OpenReview.net, 2021.
[36] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in Neural Information Processing Systems, 32, 2019.
[37] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations. OpenReview.net, 2021.
[38] Matthieu Urvoy, Dalila Goudia, and Florent Autrusseau. Perceptual dft watermarking with improved detection and robustness to geometrical distortions. JEEE Transactions on Information Forensics and Security, 9(7): 101-110911111 2014.
[39] Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 21 2116-2127, 2023.
[40] Bram Wallace, Akash Gokul, and Nikhil Naik. Edict: Exact diffusion inversion via coupled transformations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22522-22541, 2023.
[41] Ruoyu Wang, Yongqi Yang, Zhihao Qian, Ye Zhu, and Yu Wu. Diffusion in diffusion: Cyclic one-way diffusion for text-vision- conditncod generation. In International Conference Learning Representations, 2024.
[42] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4); 600-612, 2004.
[43] Ping Wei, Qing Zhou, Zichi Wang, Zhenxing Qian, Xinpeng Zhang, and Sheng Li. Generative steganography diffusion. arXiv preprint arXiv:2305.0347. 2023.
[44] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. In Advances in Neural Information Processing Systems 36, 2023.
[45] Kyle Wiggers. ages and videos. 2023.
Microsoft
pledges to watermark ai-generated im-
URL https://techcruncch. wttp:/ccccccomm2/////////22
microsoft-pledgee to to- www.wwrwaa........o.o.oom......e ai ai-generated-
viddovdees/
[46] Raymond B Wolfgang and Edward J Delp. A watermark for digital images, In Proceedings of
IEEE International Conference on Image Processing, volume pages 219-222. IEEE, 1996.
[47] Xiang-Ger Xia, Charles G Boncelet, and Gonzalo R Arce. Wavelet transform based watermark for digital images. Optics Express, 3 3(12):497-511, 1998.
[48] Cheng Xiong, Chuan Qin, Guorui Feng. and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proceedings of ACM International Conference Multimedia, pages 1668-1676, 2023.
[49] Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang. Cross: trollable, robust and secure image steganography. Advances in Neural Information Processing Systems, 36, 2024.
Diffussonn model makes con-
[50] Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 14448-14457, 2021.
[51] Guoqiang Zhang, Jonathan Lewis, and W Bastiaan Kleijn. Exact diffusion inversion via bi-directional integration approximation. arXiv preprint arXiv: 2rX.v:2307.10824 2023.
13

---

[52] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infanee and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint 1Xiv:1909.01285, 2019.
[53] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 3836-3847, 2023.
[54] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks provably removable using generative ai. Aug 2023.
[55] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang. Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137 2023.
[56) Zhenyu Zhou, Defang Chen, Can Wang, and Chun Chen, Fast ode-based sampling for diffusion models in around 5 steps. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7777-7786, 2024.
[57] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference computer vision, pages 657-672, 2018.
[58] Ye Zhu, Yu Wu, Kyle Olszewski, Jian Ren, Sergey Tulyakov, and Yan Yan. Discrete contrastive diffusion for cross-modal music and image generation. In International Conference Learning Representations (ICLR), 2023.
[59] Ye Zhu, Yu Wu, Zhiwei Deng, Olga Russakovsky, and Yan Yan. Boundary guided learning free semantic control with diffusion models. Advances Neural Information Processing Systems, 36, 2024.
[60] Ye Zhu, Yu Wu, Nicu Sebe, and Yan Yan. Vision+ x: A survey multimodal learning in the light data, IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024.
14

---

Appendix
A
Scheme details
A.1 Image watermark design
To make the watermark less visible and more resistant to alterations, embed the watermark into the frequency domain of the selected diffusion latent. Frequency domain watermarks are proven be robust against common manipulations like cropping and compression and resilient against geometric distortions, such as scaling and rotation. Draw inspiration from Tree-Ring watermarks, we use radiating watermark pattern, where the watermark information within each frequency band holds equal values. This design choice enhances the watermark's 's robustness against image rotations. Specifically, after each optimization round of the image watermark. the values within specific frequency band are averaged. This averaged pattern is then used for further prompt signal optimization and another round of adversarial optimization.
A.2 Prompt signal design
Our scheme is based on the classifier-free guidance technique, where the generation relies on both unconditional and conditional predictions. The predicted noise of xı at step / is defined as:
Eo( 1, (p))))))))))))))))) = co(,, (b()) (1-1)) to (0)),
(17)
where 1) is the guidance scale parameter and is the input text condition. In this way, the model can maintain its original ability to remove noise and the new function of generating specific content.
A.3 Optimization algorithm design
The details of the adversarial optimization algorithm are presented Algorithm Initially, the image watermark w; is randomly sampled, and guidance wp is set to NULL (representing text prompt). In each round, we randomly select a generated sample xo and obtain the noise representation z at the watermark embedding point. Then both wy and wp optimized alternatively in an adversarial manner. We experimentally set the hyperparameters a as 1.0, 3 as 1.0, and as 0.005.
Algorithm 1 Adversarial Optimization Algorithm
Input: Dataset X, P; max epoch N; hyper-parameters a, 8, A; watermark mask M Output: Optimized watermark pair wo Wpi
Initialization
wh + rand_ (ondd_int(ww)))
w p + (NULL);
k: < 0:
2: while not converted yet do
3: // get sample
Zo. X,P
4: ligee xt from T0
Zt +aroo +-I-- - NO I),
Uniforr(200,3000 300)
5: I/ image watermark optimization
wi k+1
arg arggmin(ale. + Bloone A ||ut()
6: // prompt guidance optimization w arg min( min(erreet Bloons)
up
1: 6 ++
7: end while
8: return (wf, w
15

---

Table 6: Comparision of time cost (s) of different watermarking methods.
Stable Diffusion 31 Generation
(512x512)
Imagenet Diffusion (266
Method
Validation
Generation
Validation
W/o Watermark
2.614
3.479
DwtDet 4
2.681
0.056
3,492
0.012
Post-
DwiDetSvd
26
2.749
0.233
3.511
0.058
processing
RivaGAN
52
3.342
0.437
3.661
0.109
StableSig
[4
2.614
0.112
In- processing
Tree-Ring
2.617
2.599
3,482
3.963
ROBIN
2.682
0.531
3.592
0.986
B Implementation details
B.1 Details about evaluation metric
Setting for AUC computing. The AUC-ROC (Area Under the ROC Cure) metric is statistical measure used to evaluate the performance binary classification problem, which is watermarked or not here. The ROC Curve is created by plotting the fraction of true positive results against the fraction of false positive results at various threshold settings. The AUC summarizes the overall performance across all possible thresholds. A higher AUC value means the test is more accurate in making this distinction. And an AUC of 1.0 represents perfect discrimination. For both our method and Free-Ring watermarking, compare the extracted image watermarks using the L1 distance. For the other three ateganography-basee methods, we utilize the Hamming distance between the implanted and decoded binary sequences, these methods typically operate binary data representations.
Setting for FID computing. For Stable Diffusion, we generate 5,000 watermarked images and calculate FID against the MS-COCO-2017 dataset [20]. For the ImageNet Diffusion model, we calculate FID using 10,000 watermarked images against the ImageNet- IK training dataset [I1].
Setting for CLIP computing. For both models, we test 1,000 images using the OpenCLIP-ViT model (6) For Stable Diffusion, we work with the ground-truth text prompts, while for the ImageNet model, we construct prompts like photo x", where "x" is the category the generated image.
About pixel-level metrics. The content watermarking scheme of ROBIN doesn't aim for exact replication of the original image. Instead, strives for a visually similar "alternative generation" that maintains both image quality and semantic integrity. While traditional watermarking schemes utilized metrics like PSNR/SSIM to assess image distortion introduced by the watermark (treated additional signal), utilize them in this research as supplementary indicators to reflect the degree of semantic preservation within the watermarked image. Essentially, the higher the similarity between the watermarked and original image, the less semantic impact the watermark has introduced.
C
More experimental results
C.1 Time overhead
We evaluate the time cost associated with different watermarking schemes. The results are presented in Table 6) Traditional post-procsssing methods exhibit similar time requirements for watermark addition and verification. The simple DwtDet method demonstrates the fastest performance, achieving both addition and validation times less than 0.1s. DwtDetSvd exhibits 3x slowdown compared to DwtDet, while RivaGAN is 10x slower. Notably. the runtime of these methods is heavily influenced by the input image size. For in nn-processing watermarking, StableSig directly fine-tunes the model, incurring no additional time overhead during the generation process. The Tree-Ring method introduces minimal impact (0.003s) on generation time by solely modifying the initial random vector. However, verification necessitates reversing the entire generation process, resulting in significant time consumption (2.6s for Stable Diffusion and 3.9s for Imagenet Diffusion). ROBIN employs one-shot approach for watermark embedding during the intermediate diffusion stage. The impact
16

---

Table 7: Watermark verification (AUC) under reconstruction attack.
Method
VAB-Bmshj2018
VAE-Cheng2020
Diffusion model
Tree-Ring ROBIN 0.998
0.992
0.993
0.996 0.997
0.999
Table 8: Watermark verification (AUC) on noise-to-image generation.
Diffusion Type
Clean
Blur
Noise
JPEG
Bright
Rotation
Crop
Avg
Noise-to-Image
1.0
0.996
0.997
1.0
0.963
0.999
1.0
0.993
Table Watermark verification (AUC) different optimization settings.
Alignment
Clean
Blur
Noise
JPEG
Bright
Rotation
Crop
Avg
Latent-level 1.000
0.999
0.940
0.999
0.974
0.927
0.994
0.972
Pixel-Ievel (ROBIN) 1.000
0.999
0.954
0.999
0.975
0.957
0.994
0.983
on generation time arises from the introduction of additional guidance calculations, resulting in minimal overhead of 0.068s and 0.1,3s, which is negligible compared to the generation time of 2.614s and 3.479s for the two models. Verification of ROBIN watermarks requires reversing only limited number of generation steps, resulting in consumption times 0.531s and 0.986s for the two models, which are considerably lower compared to the Tree-Ring watermark.
C.2 Reconstruction attacks
We evaluate the performance of ROBIN under different variants of reconstruction attacks [54]. As shown in Table ROBIN consistently exhibits stronger robustness under these adversarial conditions.
C.3 Application to noise-to-image models
ROBIN can also be applied to noise-to-image generation models, as it does not rely on the original text prompt input. Given that large-scale pretrained diffusion models typically conditional generative models, we chose to use the unconditional capability of Stable Diffusion to simulate the noise-to-image generation process for this evaluation.
We evaluate ROBIN on the unconditional generation of Stable Diffusion, where the original text is set to NULL (representing no text prompt). In this setup, the image is generated unconditionally before the watermark injection point. After that, we still utilize our watermarking hiding prompt embedding to guide the generation process and actively erase the watermark. The results in Table indicate that ROBIN can still function well in noise-to-imags to-image generation.
C.4 Pixel-level optimization
In our scheme, the watermark is embedded in the latent space while the loss function is calculated the pixel level. We believe that this approach, which combines pixel-level alignment with latent space optimization, is beneficial for improving robustness.
This is because different latent representations us to find a latent code that maps to visually the same image but also contains robust watermarks. This provides more opportunities to embed strong and robust watermark signals without introducing noticeable visual artifacts. The benefits of this optimization method are evident when we actively aim for concealment, feature not supported by other watermarking methods.
map to similar pixel-level expressions, allowing
To further validate our approach, we also test a variant the ROBIN scheme where the loss function is computed at the latent level rather than the pixel level. The results presented in Table demonstrate that letent-level alignment slightly decreases the robustness of the watermark, thereby underscoring the effectiveness of our pixel-level alignment strategy.
17

---

Original
Blurring
Noise
JPEG
Brighiness
Rolation
Cropping
Figure 6: Samples under different attacks.
2
3
Original
5
Figure 7: Samples under different number of attacks applied the same time. The sequence of attacks performed on the above images is Gaussian blur with radius 4, JEPG compression with quality 25, color jitter with brightnsss 6, random cropping of 75%, and random rotation of 75 degrees.
C.5 More qualitative results
18

---

W/o Watermark
Tree-Ring
ROBIN
"Glowing cracks, elven princess, meditating, lotus pose, blossoming"
"Full samurai ninja armor, spiderman, fantastic details full face"
"Anime as Margot Robbie cute-fine-face, surprised realistic shaded face"
"Oil painting portrait of a young black woman with long hair in white dress"
"A knitted Capybara wearing stylish sunglasses and dressed in a beanie cap"
"Dark fantasy, evil magician portrait, dark surrealist
Figure 8: More qualitative comparison results with Tree-Ring watermarks for Stable Diffusion.
19

---

W/o Watermark
Tree-Ring
ROBIN
"Malamute, malemute, Alaskan malamute" "
"Hyena, hyaena"
"Lakeside, lakeshore"
"Screen, CRT screen"
"Indri, Indris, Indri indri, Indri brevicaudatus"
"Siamese cat, Siamese"
Figure More qualitative comparison results with Tree-Ring watermarks for the ImageNet Diffusion model.
20

---

Embedding point
Clean
XT
Figure 10: Generated images with the watermark embedded at different diffusion stages. Clean represents the images that are generated without watermarking. Xy means the watermark is embedded into the initial noise, and X, means the watermark implanted in the final generated image.
21

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Please Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
22

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
The codes will be available hhtttp::/githuu.com//iiitt
ROBBN
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
23

---

Answer: [Yes]
Justification: The codes will be available at wtlttpss//ggihhie ctw/ homm/Hanaah111////0 and we use open source model and data, which are cited correctly the main paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c ec/
for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https i
//nips //nips.cc/pil wccppublicgguuuiecceeee
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Please SSection 4.1 Appendix A and Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: Please see Table 4
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please see Section 4.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
The research conducted in the paper conform with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please see Section 5
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
25

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: All datasets we used are public and cited properly.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
26

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
The codes and data will be available at httpps///github.commiiiiioe/ee
ROBIN
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
27


Reviews:
[{"review_id": "SyZJRmwocD", "reviewer": "Reviewer_Axd1", "summary": "This paper aims to balance robustness and concealment for image watermarking generated by diffusion models. The authors propose a novel method that actively hides stronger watermarks while ensuring their imperceptibility. They introduce a two-step process: first, embedding a robust watermark in intermediate diffusion time-steps, then using an adversarial optimization algorithm to generate a \"hiding prompt\" that guides the model to conceal the watermark in the final image. This approach aims to maximize watermark strength while minimizing visual artifacts. The proposed method has been evaluated on both latent and image diffusion models.", "questions": "Please refer to the weakness section.", "limitations": "yes", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Originality: The work builds upon the existing tree-ring watermarks for diffusion models [39]. The idea of simultaneously optimizing the prompt for stealthiness and the watermark for robustness is particularly innovative in an adversarial manner is interesting. This method also does not require training diffusion model parameters, unlike previous techniques, and it is shown to be more robust than the tree-ring-based baseline. Furthermore, the authors claim that their approach preserves the semantics of the original stable diffusion model, unlike the tree-ring-based method.\n\nQuality: The authors clearly explain their methodology, particularly the introduction of a watermark hiding process and the use of an adversarial optimization algorithm. The study includes a thorough comparative analysis with five baselines, including those based on diffusion models, demonstrating the robustness of the proposed method against various image transformations.\n\nClarity: The paper is generally well-organized and clearly written.\n\nSignificance: By addressing the crucial balance between robustness and concealment, the paper tackles a major challenge in digital watermarking of diffusion models. The method's ability to embed stronger watermarks while maintaining imperceptibility could have far-reaching implications for content protection. Moreover, the approach's compatibility with existing diffusion models without requiring retraining enhances its practical significance and potential for widespread adoption.\n\n\n[39] Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. In Advances in Neural Information Processing Systems, 2023.", "weaknesses": "1 - Motivation for Preserving Semantics (Line 37): The author states that the tree-ring watermark baseline [39] leads to semantic changes that their method does not. However, the motivation behind this is unclear. Although the tree-ring watermark approach results in slight semantic alterations compared to the original stable diffusion model, the changes remain faithful to the original text prompt with a negligible drop in the FID score. This implies that the user experience is not significantly affected. Therefore, it would be beneficial to clarify the rationale behind the emphasis on preserving the semantics of the original image and how it contributes to the overall goal of the watermarking method.\n\n2 - Attribution for frequency domain embedding: On line 133, the statement \"To achieve robustness, we embed the watermark in the frequency domain of the image\" should properly credit the tree-ring watermark baseline [39]. \n\n3 - Watermark validation threshold: In section 3.4, the authors do not explain how they selected the L1 distance threshold for watermark verification. The authors should explicitly describe the methodology for determining this threshold, including any empirical studies.\n\n4 - Fairness of comparison metrics: Table 3's comparison using PSNR, SSIM, and MSSIM may not be entirely fair when comparing to the tree-ring watermark baseline, which doesn't aim to preserve semantics relative to the original diffusion model, although still faithful to the text prompt. For example, given a prompt \"a white dog\", the tree-ring method will generate a white dog, but it may differ from the output of the original diffusion model (just like changing random seed). Instead, using the FID score, which assesses the similarity of generated images to real images, would be a more appropriate metric. The proposed method shows relatively poor performance in terms of FID, and this should be addressed to provide a more balanced and accurate evaluation of the method's effectiveness.\n\n[39] - Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. NeurIPS, 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1. Clarify the motivation for preserving semantic, given that the sematic alterations caused by Tree-Ring remain faithful to the original text prompt, as evidenced by a negligible drop in FID.\n\n(1) FID cannot evaluate the semantic faithfulness of the generated images to the orignal textual prompt. FID only measures the distributional distance between two unordered sets of images at the pixel level, regardless of the semantic content. So, a minor decrease in FID does not ensure that the generated images remain semantically consistent with the text.\n\n(2) Semantic modifications induced by Tree-Ring watermarks are random and may result in images that deviate from the original textual prompts. This is evidenced by the decline in the CLIP score by 10\\% (from 0.403 to 0.364) on Stable Diffusion, which quantifies the correspondence between generated images and the given text. Figure 3 in the original manuscript presents examples of such generation failures. \n\n(3) Therefore, we aim to exactly preserve the original semantics to achieve a better lower bound for faithfulness. We also improve the CLIP score by 8.8\\% compared to Tree-Ring. By generating a watermarked image semantically aligned with the original one, we minimize its impact on user experience (image-text alignment).\n\n(4) In addition, we potentially support the scenario when users may expect watermarked and original Stable Diffusion to produce the same outputs to verify that they are using the correct version, which necessitates semantic preservation.\n\n\n> Q2. Attribution for frequency domain embedding.\n\nIn the original manuscript, we have credited Tree-Ring watermarks for the frequency domain embedding in lines 134 and 135. But for clarity, we will move it to line 133 in the revised version. \n\n\n> Q3. How to select the L1 distance threshold for watermark verification. \n\n(1) In practical application scenarios, a fixed threshold is required for per-image watermark detection. We empirically set this threshold as the median L1 distance between 250 watermarked and 250 non-watermarked images. Using the calculated threshold (31.45), we achieve 100\\% detection accuracy on a separate 1000-image dataset.\n\n\n(2) For research comparisions, we aim for a thorough evaluation under various thresholds to ensure a larger effective threshold interval. Therefore, we follow Tree-Ring [a] and use the Area Under the Curve (AUC) metric. AUC represents the area under the Receiver Operating Characteristic (ROC) curve, which plots the fraction of true positive results against the fraction of false positive results at various threshold settings. A higher AUC indicates a broader range of effective thresholds for real-world applications, reflecting a higher tolerance for errors.\n\n[a] Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. NeurIPS, 2023.\n\n\n> Q4. Metrics like SSIM may not be entirely fair when comparing with Tree-Ring which doesn't aim to preserve semantic but keep faithfulness. Instead, FID would be a more appropriate metric.\n\n\n\n(1) We acknowledge that in generative watermarking, it is not necessary for the watermarked image to exactly match the original image. Ideally, we may find another watermarked image that aligns with the text prompt, even if it differs from the original image. However, achieving this is challenging. Tree-Ring watermarks, as noted in response to Q1, are more akin to random semantic modifications and do not guarantee the same level of text alignment as the original generation (10\\% reduction in CLIP score).\n\n(2) Instead, we make the simplest assumption that \\textbf{preserving the original semantics provides a better lower bound for faithfulness}. Thus, we used PSNR, SSIM, and MSSIM to evaluate the similarity between the images before and after adding watermarks. Our improvement lies in achieving stronger robustness than Tree-Ring watermarks while producing outputs nearly identical to the original image.\n\n(3) Additionally, our method potentially supports adding watermarks to a given image as we can maintain almost identical outputs. In contrast, Tree-Ring watermarks are limited to the generation phase.\n\n(4) As we mentioned in the response for Q1, FID cannot evaluate the semantic faithfulness of the generated images to the original textual description but CLIP score does. \n\nIn addition, FID is only calculated on pixel level and is a less reliable metric for semantic integrity, which is crucial in generative watermarking. \nThe table below illustrates the impact of various pixel-level image transformations on FID, including random erasing with ratio 7\\%, center cropping of 80\\%, JPEG compression with quality 45 and random rotation of 30 degree. The processed image samples are provided in Figure 1 in the rebuttal pdf. \n\nThe results show that JPEG compression, causing negligible visual changes for huamn eyes, significantly affects FID. In contrast, randomly erasing 10\\% of the image, which substantially alters image semantics, has limited influence on FID.\n\nTable 1. FID under different image transformations.\n|  | Original | Erase | Crop | JPEG | Rotate  |\n| :---- | :---- | :---- | :---- | :---- | :---- |\n| FID | 25.53 | 25.88 | 26.96 | 27.42 | 29.90 |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "w9uM78jxcy", "reviewer": "Reviewer_kSaH", "summary": "This paper addresses watermarking in text-to-image diffusion models. Its main contributions are: 1) Embedding the watermark in the later stages of the diffusion process; 2) Introducing a text prompt guidance signal. These components collectively achieve better watermark robustness and image quality.", "questions": "See above.", "limitations": "See above.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "* Addresses a significant issue.\n* Achieves a better trade-off between robustness and image quality compared to existing baselines.", "weaknesses": "* The robustness improvement over Tree-Ring is minor, only about 1% (see Table 1).\n* Stable Signature is not compared in Table 2.\n* Applicable only to diffusion models with DDIM sampler.\n* Unclear how the proposed method resists frequency domain attacks.\n* The rationale behind maximizing the watermark signal value to increase robustness is not explained.\n* The initialization and optimization process for the text prompt w_p is unclear, especially when text prompt optimization is a discrete optimization problem.\n* Why the original prompt used for image generation is unknown during verification?\n* No noticeable improvement in the quality of generated images in terms of Clip score.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1. The robustness improvement over Tree-Ring is minor.  \n\n(1) Compared to Tree-Ring watermarks, ROBIN improves the robustness from 0.975 to 0.983 on Stable Diffusion, effectively reducing the error rate by 32\\% (from 0.025 to 0.017). Achieving further improvements on an already high AUC of 0.975 is inherently challenging.\n\n(2) Additionally, our robustness evaluations were conducted under severe attacks that significantly compromised image quality, making watermark verification much more difficult. Thus, we believe our improvement is significant.\n\n(3) Moreover, ROBIN offers substantial advantages in verification speed (80\\% improvement in verification time) and image quality (35\\% improvement in SSIM), compared to Tree-Ring watermarks. These enhancements underscore the substantial benefits of our approach.\n\n> Q2. Stable Signature is not compared in Table 2.\n\nAs mentioned in Line 198 of the original manuscript, Stable Signatures are specifically designed for latent diffusion models and are therefore incompatible with pixel-level ImageNet diffusion models (Table 2). This limitation is also mentioned in the Introduction section of the original paper of Stable Signatures [a].\n\n[a] The stable signature: Rooting watermarks in latent diffusion models. ICCV, 2023.\n\n> Q3. Applicable only to diffusion models with DDIM sampler.\n\nThe applicability of ROBIN is not limited to DDIM samplers. Our watermark verification requires a reversible generation process, making it compatible with any reversible samplers such as DPM-Solver [a], DPM-Solver++ [b], PNDM [c], and AMED-Solver [d]. Our experiments employed both DPM-Solver and DDIM, and we anticipate ROBIN's adaptability to future reversible generation algorithms.\n\n[a] Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. NeurIPS, 2022.  \n\n[b] Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv:2211.01095 (2022).\n\n[c] Pseudo Numerical Methods for Diffusion Models on Manifolds.\" ICLR, 2022.\n\n[d] Fast ode-based sampling for diffusion models in around 5 steps. CVPR, 2024.\n\n> Q4. Unclear how the proposed method resists frequency domain attacks.  \n\nFollowing your suggestions, to further assess robustness, we evaluated ROBIN under various low-pass filtering frequency attacks, which interfere with the frequency domain of the image without destroying the main content. The accompanying table presents AUC values on Stable Diffusion under different attack methods, demonstrating the superior robustness of our approach to frequency domain attacks. \n\n\nTable 1. Performance evaluation under frequency-domain attacks.\n| Method | Ideal Low-pass | Butterworth Low-pass | Gaussian Low-pass |\n| :---- | :---- | :---- | :---- |\n| StableSig | 0.879 | 0.932 | 0.933 |\n| Tree-Ring | 0.975 | 0.999 | 0.996 |\n| ROBIN | **0.987** | **0.999** | **0.999** |\n\n> Q5. The rationale behind maximizing the watermark signal value to increase robustness.\n\n(1) Our approach adheres to the fundamental principle that stronger signals exhibit greater resilience to noise and interference. Existing attacks typically add small noise signals to the original image to disrupt the watermark without damaging the image. A stronger watermark signal has more \"power\" to overpower the noise signal, as demonstrated in [a].\n\n(2) In the context of frequency domain watermarking that we use, the strength of the watermark signal is positively correlated with its numerical value. By maximizing the value of the watermark, we increase the watermark strength, thereby improving robustness.\n\n\n[a] Digital watermarking and steganography. Morgan kaufmann, 2007.\n\n\n> Q6. The initialization and optimization process for the text prompt $w_p$ is unclear, especially when text prompt optimization is a discrete optimization problem.  \n\n\n(1) As stated in line 438 of the original manuscript, we initialized $w_p$ as empty strings to minimize its interference with the generation process.\n\n\n(2) In our approach, we optimize a continuous prompt embedding rather than the discrete text prompt, which allows it to be optimized via gradient descent.\n\nModel owners can introduce $w_p$ into the generation process as another guidance term independent of the original text for watermarking. \nWe will clarify it in the revised version and replace the words ''prompt $w_p$'' with ''prompt embedding $w_p$'' for clarity.\n\n> Q7. Why the original prompt used for image generation is unknown during verification?  \n\nWe target a more general watermark verification scenario where users might generate images using diffusion models and publish them online. Our goal is to determine whether these published images are authentic, even when users do not provide their diffusion prompts (likely they won't). \n\n\n> Q8. No noticeable improvement in the quality of generated images in terms of Clip score.  \n\n(1) In our paper, the image quality is assessed by PSNR, SSIM, and MSSIM metrics rather than CLIP score. And we achieve an improvement of 35\\% in SSIM over Tree-Ring watermarks. \n\n(2) CLIP score evaluates the alignment between the generated image and its corresponding text prompt and is constrained by the base model's generative capacity. We achieved a relative 8.8\\% improvement in CLIP score (from 0.364 to 0.396) on Stable Diffusion (SD) compared to the optimal Tree-Ring watermarks, nearing the upper bound of the base model (SD) with a CLIP score of 0.403.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "C5Ikvg5UeU", "reviewer": "Reviewer_duRp", "summary": "This paper discuss ROBIN, robust and invisible watermarks. The method proposes to embed the watermark during intermediate steps of the sampling process of diffusion model, by optimized prompt guidance signal w_p, the model was able to embed the invisible watermark into the generated content without losing the image quality while maintaining high robustness. The watermarked image can later be decoded through DDIM inversion.", "questions": "Most questions have been asked in the weakness section, here are some general questions for the author:\n1. In Tables 1 and 2, ROBIN method achieves better verification time compared to Tree-ring. However, I'm wondering about the watermarking embedding time since adversarial optimization has been used. Does the optimization create a big bottleneck?\n2. The watermarking capacity is not mentioned in the empirical section, in line 135, the author mentions that \"we set the watermark as multiple concentric rings\" but I didn't find how many concentric rings are exactly used.\n\n-------------------------------------Post rebuttal Edition---------------------------------------\n\nI appreciate the author's clarification. Most of my concerns have been addressed. With the potential readability enhancement in mind, I have changed my rating accordingly.", "limitations": "Limitations are adequately addressed. I think it's good research but the presentation may need heavy reformating to meet the standards of NeurIPS.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper discusses a significant problem of improving the trade off between image quality and watermarking robustness. The idea of optimizing the guiding prompt in at a later stage of the diffusion steps is interesting and novel.", "weaknesses": "The main issue of this paper is the presentation of methodology and empirical results. Several key aspects are unclear.\n1. From the main context, it is unclear how w_p and w_i are optimized, although equations 13 and 14 do provide a loss function to w_p and w_i, line 5 and line 6 in algorithm 1 provide different formulations than simply minimizing equations 13 and 14. Additionally, in equations 8 and 11, the author mentioned $\\epsilon_\\theta(x_t^*,t,\\psi(p), w_p)$, which is not defined until Appendix A. I personally suggest the author to move the important part of Appendix A to the main text of the paper to enhance readability and reduce confusion since they are pivotal to understanding the methodology. \n 2. Another layer of confusion comes from the empirical results, for example, in caption of figure 2, it mentions that \"Guidance is the guide signal calculated from the Condition and Uncondition\". I personally cannot understand how the author calculated the guidance, so I unfortunately fail to understand the meaning of this figure. Additionally for figure 2a, the red \"Uncondition\" curve is not visible in the figure, if the curve completely overlaps with another curve, it will be helpful if the author could indicate that in the text, or change the way of presentation for figure 2a. \n3. In table 3, the author did not explicitly explain the meaning of subscript for FID and Clip score, I can only assume it's standard deviation, but FID measures the distance between two distributions so it's not supposed to have a standard deviation in it's natural form, but the paper didn't seems to explain that, additionally if the subscript serves as standard deviation, why the PSNR and SSIM do not have the standard deviation info. \n4. Typos that affect the readability a lot. in line 110, it mentioned $w_t$. Since it has no meaning, I had to assume it's a typo and suppose it should be $x_t$ then continue reading, however in algorithm 1, in the Output line, $w_t$ appears again, now I'm not so certain if it's a typo or not.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1. The optimization of $w_p$ and $w_i$ in lines 13 and 14 seems not to be consistent with Algorithm 1. The definition of $\\epsilon_\\theta(x_t^*,t,\\psi(p),w_p)$ should be moved to the main text.\n\n(1) In the original manuscript, Lines 5 and 6 in Algorithm 1 indeed correspond to the minimization of the loss functions described in Equations 13 and 14. We recognize that the inclusion of additional inputs for the loss calculation in Algorithm 1 may have caused some confusion. Therefore, we will revise the expressions in Algorithm 1 to enhance clarity in the revised version.\n\n(2) We acknowledge the reviewer's suggestion and will move the definition of $\\epsilon_\\theta(x_t^*,t,\\psi(p),w_p)$ from Appendix A.2 to the Methodology section for improved understanding. \n\n\n\n\n> Q2. Confusion for the caption and content of Figure 2. An illustration of the overlapped curve in Figure 2a.\n\n(1) The caption of Figure 2 in the original manuscript provides a simplified overview of the commonly used classifier-free guidance method [a], which has become a fundamental part of large-scale text-to-image diffusion models. A detailed explanation of this method has been presented in Appendix A.2 of the original manuscript. \nFor better understanding, we include the definition from the original paper as follows. *For classifier-free guidance, the label $y$ in a class-conditional diffusion model $\\theta(x_t|y)$ is replaced with a null label $\\emptyset$ with a fixed probability during training. During sampling, the output of the model is extrapolated further in the direction of $\\theta(x_t|y)$ (Condition) and away from $\\theta(x_t|\\emptyset)$ (Uncondition)as follows:* $Full=Uncondition + s\\cdot (Condition - Uncondition)$. The second term of the addition is Guidance.\n\n\n\nFigure 2 (in the original manuscript) illustrates how the above components (Full, Uncondition, Condition and Guidance) change during the generation process (Figure 2a) and the impact of frequency domain perturbations on these components (Figure 2b). To enhance clarity, we will incorporate the relevant reference [a] within the Figure 2 caption and include the formula above in the revised version for better understanding.   \n\n(2) We appreciate the reviewer's suggestion regarding Figure 2a. According to the above formula, the mean values of Uncondition and Condition are very close, resulting in their almost overlapping curves in Figure 2. We will incorporate a detailed explanation of the overlapped curves in the caption of the figure in the revised version. \n\n[a] GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models. ICML, 2022.\n\n> Q3. Explanation about the subscript in Table 3 and the results for other metrics.\n\n\n\n(1) The subscripts in the original manuscript (Table 3) indicate the standard deviation of five independent experimental runs, each initialized with a different random seed. FID measures the difference between the five independently generated image sets and the ground-truth real image sets, so it has a standard deviation. \n\n(2) Due to space constraints, we have omitted the standard deviations for other metrics such as PSNR and SSIM. These values are provided in the table below.\nWe will clarify the meaning of subscripts and include the standard deviations for all metrics in the revised version.\n\nTable 1. Image quality of five repeated experiments. Subscripts indicate standard deviation.\n| Model | Method | PSNR | SSIM | MSSIM |\n| :---- | :---- | :---- | :---- | :---- |\n| Stable Diffusion | Tree-Ring | ${15.37_{.07}}$ | $0.568_{.003}$ | $0.626_{.005}$ |\n|  | ROBIN | $24.03_{.04}$ | $0.768_{.000}$ | $0.881_{.001}$ |\n| Imagenet Diffusion | Tree-Ring | $15.68_{.03}$ | $0.663_{.002}$ | $0.607_{.001}$ |\n|  | ROBIN | $24.98_{.02}$ | $0.875_{.000}$ | $0.872_{.000}$ |\n\n> Q4. Some typographical errors.\n\n\n\nWe thank the reviewer for identifying the typos. The variable $w_t$ in line 110 should be $x_t$. And $w_t$ in the output line and initializaion of Algorithm 1 should be $w_p$. These errors will be corrected in the revised manuscript. We will also conduct a thorough proofreading of the original manuscript to avoid any other typographical errors.\n\n> Q5. Does the optimization create a big bottleneck?\n\n\n(1) We do not believe watermark optimization to be a big bottleneck. \nFirst, the watermark optimization only needs to be done once. The optimized prompt embedding can then be applied universally to all images and text prompts without requiring further optimization. Second, the optimization process can be carried out offline, and the online watermark embedding incurs negligible overhead during image generation.\n\n(2) The table below presents the time costs per image for watermark optimization, watermarked image generation, and watermark verification using Stable Diffusion. The watermark optimization of ROBIN only incurs an average time overhead of 0.112 seconds per image. The time overhead for watermark embedding during image generation is 0.068 seconds, which is negligible compared to the average image generation time of 2.614s using Stable Diffusion. The verification of ROBIN watermarks is 80\\% faster than Tree-Ring watermarks.\n\nTable 2. Time cost (s) of the watermark operation on each image.\n| Method | Optimization (Offline) | Generation (Online) | Validation |\n| :---- | :---- | :---- | :---- | \n| Stable Diffusion | - | 2.614 | - |\n| Tree-Ring | 0.000 | 2.617 | 2.599|\n|ROBIN | 0.112 | 2.682 | 0.531| \n\n\n> Q6. The watermarking capacity is not mentioned in the empirical section.\n\nAs mentioned in Line 187 in the original manuscript, the watermark capacity is 70\\% of the image frequency domain, corresponding to 30 and 120 concentric rings for Stable Diffusion and ImageNet diffusion model, respectively.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qiGojFnli5", "reviewer": "Reviewer_4gSJ", "summary": "This paper presents a novel watermarking technique for diffusion models that is robust against input transformations and invisible to the human eye. Unlike existing methods that rely on post-processing or perturbing the initial noise, this technique actively injects the watermark signal during the intermediate diffusion process. The method employs adversarial optimization to maximize watermark strength while minimizing the difference between the watermarked and original outputs. It also identifies optimal keypoints for embedding watermarks without compromising image quality.\nDuring verification, the technique measures the distance between the holdout watermark and the reconstructed watermark from the intermediate stage; a small distance confirms the presence of the injected watermark.\nThe evaluation part considers six types of attacks on watermarking, with results showing that the proposed method outperforms existing baselines in terms of robustness. Additionally, numerical and perceptual assessments indicate that the proposed method introduces less distortion in image quality compared to baselines. Several ablation studies validate the design choices of the proposed method.", "questions": "(1) While the robustness demonstrated in Table 1 is commendable, could the method maintain its efficacy against a combination of attacks, such as Blur, Rotation, and Crop? Additionally, considering [1] highlights the effectiveness of reconstruction attacks, a discussion on these would be insightful.\n\n(2) Is the proposed watermarking technique applicable to noise-to-image diffusion models? Further discussion on this application would be valuable.\n\n(3) Equation (10) suggests that the watermarking operates at a pixel level; how does this contribute to its robustness against numerous attacks? It would be beneficial for the readers if the authors could provide deeper insights into the mechanisms that ensure robustness, beyond just presenting successful outcomes.\n\n(4) The abstract mentions that existing watermarking methods are passive, whereas the proposed method is active. Could the authors clarify this distinction? The current explanation within the manuscript does not fully convey the implications of this difference.\n\nReference:\n[1] Zhao, Xuandong, et al. Invisible Image Watermarks Are Provably Removable Using Generative AI. ArXiv:2306.01953 (2023).", "limitations": "This paper has included the potential limitation.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The design incorporates an intriguing adversarial optimization and prompt embedding optimization strategy.\n2. Well-written and easy to follow.\n3. Results are promising, validated through thorough testing.", "weaknesses": "1. The evaluation could be enhanced by including more strong attack scenarios.\n2. Certain sections of the manuscript would benefit from further detailed explanations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> Q1. Could the method maintain its efficacy against a combination of attacks and reconstruction attacks?\n\n\nAs suggested by the reviewer, we have evaluated ROBIN under both conbination attacks and reconstruction attacks. \n\n(1) We randomly selected various combinations of the six attacks outlined in this paper. The performance of watermark verification under different numbers of simultaneous attacks is shown in the table below. \n\nNote that due to the inherent potency of the individual attacks, their combination leads to significant image quality deterioration. The resulting images are included in the attached rebuttal pdf. These images are no longer suitable for watermark detection as their integrity has been severely compromised. But ROBIN still demonstrates superior robustness compared to the state-of-the-art method Tree-Ring in such challenging scenarios. \n\nTable 1. Watermark verification (AUC) on different number of random attacks applied at the same time.\n| Method | 1 | 2 | 3 | 4 | 5 | 6 |\n| :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n| Tree-Ring | 0.969 | 0.809 | 0.699 | 0.520 | 0.546 | 0.509 |\n| ROBIN | **0.973** | **0.814**| **0.759**| **0.579** | **0.558** | **0.556** |\n\n(2) We evaluate the performance of ROBIN under different variants of reconstruction attacks [a]. As shown in the table below, ROBIN consistently exhibits stronger robustness under these adversarial conditions.\n\nTable 2. Watermark verification (AUC) under reconstruction attack.\n| Method | VAE-Bmshj2018 | VAE-Cheng2020 | Diffusion model |\n| :---- | :---- | :---- | :---- |\n| Tree-Ring | 0.992 | 0.993 | 0.996 |\n| ROBIN | **0.998** | **0.999** | **0.997** |\n\n[a] Invisible Image Watermarks Are Provably Removable Using Generative AI. ArXiv:2306.01953 (2023).\n\n> Q2. Is the proposed watermarking technique applicable to noise-to-image diffusion models? \n\nROBIN can indeed be applied to noise-to-image generation models, as our scheme does not rely on the original text prompt input. Given that large-scale pretrained diffusion models are typically conditional generative models, we chose to use the unconditional capability of Stable Diffusion to simulate the noise-to-image generation process for this evaluation.\n\nWe evaluate ROBIN on the unconditional generation of Stable Diffusion, where the original text is set to NULL (representing no text prompt).\nIn this setup, the image is generated unconditionally before the watermark injection point. After that, we still utilize our watermarking hiding prompt embedding $w_p$ to guide the generation process and actively erase the watermark.\nThe results in the table below indicate that ROBIN can still function well in noise-to-image generation. \n\nTable 3. Watermark verification (AUC) on noise-to-image generation.\n| Diffusion Type | Clean | Blur | Noise | JPEG | Bright | Rotation | Crop | Avg |\n| :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n| Noise-to-Image | 1.0 | 0.996 | 0.997 | 1.0 | 0.963 | 0.999 | 1.0 | 0.993 |\n\n> Q3. Provide more insights about how the watermarking at a pixel level contributes to the robustness.\n\n(1) In our scheme, the watermark is embedded in the latent space while the loss function is calculated at the pixel level (Equation 10 in the original manuscript).\nWe believe that this approach, which combines pixel-level alignment with latent space optimization, is beneficial for improving robustness. \n\n(2) This is because different latent representations can map to similar pixel-level expressions, **allowing us to find a latent code that maps to visually the same image but also contains robust watermarks**. \nThis provides more opportunities to embed strong and robust watermark signals without introducing noticeable visual artifacts. \nThe benefits of this optimization method are evident when we actively aim for concealment, a feature not supported by other watermarking methods.\n\n(3) To further validate our approach, we also tested a variant of the ROBIN scheme where the loss function is computed at the latent level rather than the pixel level. The results presented in the table below demonstrate that latent-level alignment slightly decreases the robustness of the watermark, thereby underscoring the effectiveness of our pixel-level alignment strategy.\n\nTable 4. Watermark verification (AUC) on different optimization settings. \n| Alignment | Clean | Blur | Noise | JPEG | Bright | Rotation | Crop | Avg |\n| :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- | :---- |\n| Latent-level | 1.000 | 0.999 | 0.940 | 0.999 | 0.974 | 0.927 | 0.994 | 0.972 |\n| Pixel-level (ROBIN) | 1.000 | 0.999 | 0.954 | 0.999 | 0.975 | 0.957 | 0.994 | 0.983 |\n\n> Q4. Clarify more about the distinction between the passive nature of existing methods and the active nature of the proposed method. \n\n\nWe appreciate the reviewers' comments and would like to clarify this point in more detail. \n\n(1) Existing methods achieve concealment passively because they don't take invisibility into consideration during watermark implantation and don't take actions to achieve this goal actively. Users are thus compelled to manually and empirically reduce the watermark strength to achieve stealthiness, often leading to a weak watermark signal and decreased robustness. \n\n\n(2) In our method, we prioritize invisibility as a goal for watermark embedding and design our approach specifically to achieve this goal.\nWe design a prompt embedding guidance to achieve invisibility, and our optimization of prompt embeddings guides the model to visually conceal the watermark. Consequently, our method can maximize watermark strength while minimizing visual artifacts.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We sincerely thank the anonymous reviewers for their valuable and constructive comments and suggestions. And some figures are contained in the attached pdf.

Meta-review: The paper initially received largely positive reviews: 2 BA, 1 WA, and 1 BR. The major concerns raised were:

1) unclear motivation and descriptions (Axd1, kSaH)
2) fairness to compare with tree-ring method (Axd1)
3) incremental improvement over tree-ring method (kSaH)
4) no noticeable improvement of CLIP score (kSaH)
5) limited to DDIM samplers? (kSaH, 4gSJ)
6) Readability problems (duRp, 4gSj)
7) include stronger attacks (4gSJ)

The authors wrote a response, and afterwards all reviewers were satisfied and increased their ratings. In the end, all reviewers were positive. The paper should be updated according to the reviews and discussion.
Decision: Accept (poster)